// Copyright Joyent, Inc. and other Node contributors.

//

// Permission is hereby granted, free of charge, to any person obtaining a

// copy of this software and associated documentation files (the

// "Software"), to deal in the Software without restriction, including

// without limitation the rights to use, copy, modify, merge, publish,

// distribute, sublicense, and/or sell copies of the Software, and to permit

// persons to whom the Software is furnished to do so, subject to the

// following conditions:

//

// The above copyright notice and this permission notice shall be included

// in all copies or substantial portions of the Software.

//

// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS

// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF

// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN

// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,

// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR

// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE

// USE OR OTHER DEALINGS IN THE SOFTWARE.

#include "node_crypto.h"

#include "node_buffer.h"

#include "node_crypto_bio.h"

#include "node_crypto_clienthello-inl.h"

#include "node_crypto_groups.h"

#include "node_errors.h"

#include "node_mutex.h"

#include "node_process.h"

#include "tls_wrap.h" // TLSWrap

#include "async_wrap-inl.h"

#include "base_object-inl.h"

#include "env-inl.h"

#include "string_bytes.h"

#include "util-inl.h"

#include "v8.h"

#include <openssl/ec.h>

#include <openssl/ecdh.h>

#ifndef OPENSSL_NO_ENGINE

# include <openssl/engine.h>

#endif // !OPENSSL_NO_ENGINE

#include <openssl/evp.h>

#include <openssl/pem.h>

#include <openssl/x509v3.h>

#include <openssl/hmac.h>

#include <openssl/rand.h>

#include <openssl/pkcs12.h>

#include <cerrno>

#include <climits> // INT_MAX

#include <cstring>

#include <algorithm>

#include <memory>

#include <utility>

#include <vector>

static const int X509_NAME_FLAGS = ASN1_STRFLGS_ESC_CTRL

| ASN1_STRFLGS_UTF8_CONVERT

| XN_FLAG_SEP_MULTILINE

| XN_FLAG_FN_SN;

namespace node {

namespace crypto {

using node::THROW_ERR_TLS_INVALID_PROTOCOL_METHOD;

using v8::Array;

using v8::ArrayBufferView;

using v8::Boolean;

using v8::ConstructorBehavior;

using v8::Context;

using v8::DontDelete;

using v8::EscapableHandleScope;

using v8::Exception;

using v8::External;

using v8::False;

using v8::Function;

using v8::FunctionCallback;

using v8::FunctionCallbackInfo;

using v8::FunctionTemplate;

using v8::HandleScope;

using v8::Int32;

using v8::Integer;

using v8::Isolate;

using v8::Just;

using v8::Local;

using v8::Maybe;

using v8::MaybeLocal;

using v8::NewStringType;

using v8::Nothing;

using v8::Null;

using v8::Object;

using v8::PropertyAttribute;

using v8::ReadOnly;

using v8::SideEffectType;

using v8::Signature;

using v8::String;

using v8::Uint32;

using v8::Undefined;

using v8::Value;

#ifdef OPENSSL_NO_OCB

# define IS_OCB_MODE(mode) false

#else

# define IS_OCB_MODE(mode) ((mode) == EVP_CIPH_OCB_MODE)

#endif

struct StackOfX509Deleter {

void operator()(STACK_OF(X509)* p) const { sk_X509_pop_free(p, X509_free); }

};

using StackOfX509 = std::unique_ptr<STACK_OF(X509), StackOfX509Deleter>;

struct StackOfXASN1Deleter {

void operator()(STACK_OF(ASN1_OBJECT)* p) const {

sk_ASN1_OBJECT_pop_free(p, ASN1_OBJECT_free);

}

};

using StackOfASN1 = std::unique_ptr<STACK_OF(ASN1_OBJECT), StackOfXASN1Deleter>;

// OPENSSL_free is a macro, so we need a wrapper function.

struct OpenSSLBufferDeleter {

void operator()(char* pointer) const { OPENSSL_free(pointer); }

};

using OpenSSLBuffer = std::unique_ptr<char[], OpenSSLBufferDeleter>;

static const char* const root_certs[] = {

#include "node_root_certs.h" // NOLINT(build/include_order)

};

static const char system_cert_path[] = NODE_OPENSSL_SYSTEM_CERT_PATH;

static X509_STORE* root_cert_store;

static bool extra_root_certs_loaded = false;

// Just to generate static methods

template void SSLWrap<TLSWrap>::AddMethods(Environment* env,

Local<FunctionTemplate> t);

template void SSLWrap<TLSWrap>::ConfigureSecureContext(SecureContext* sc);

template void SSLWrap<TLSWrap>::SetSNIContext(SecureContext* sc);

template int SSLWrap<TLSWrap>::SetCACerts(SecureContext* sc);

template SSL_SESSION* SSLWrap<TLSWrap>::GetSessionCallback(

SSL* s,

const unsigned char* key,

int len,

int* copy);

template int SSLWrap<TLSWrap>::NewSessionCallback(SSL* s,

SSL_SESSION* sess);

template void SSLWrap<TLSWrap>::OnClientHello(

void* arg,

const ClientHelloParser::ClientHello& hello);

template int SSLWrap<TLSWrap>::TLSExtStatusCallback(SSL* s, void* arg);

template void SSLWrap<TLSWrap>::DestroySSL();

template int SSLWrap<TLSWrap>::SSLCertCallback(SSL* s, void* arg);

template void SSLWrap<TLSWrap>::WaitForCertCb(CertCb cb, void* arg);

template int SSLWrap<TLSWrap>::SelectALPNCallback(

SSL* s,

const unsigned char** out,

unsigned char* outlen,

const unsigned char* in,

unsigned int inlen,

void* arg);

static int PasswordCallback(char* buf, int size, int rwflag, void* u) {

const char* passphrase = static_cast<char*>(u);

if (passphrase != nullptr) {

size_t buflen = static_cast<size_t>(size);

size_t len = strlen(passphrase);

if (buflen < len)

return -1;

memcpy(buf, passphrase, len);

return len;

}

return -1;

}

// Loads OpenSSL engine by engine id and returns it. The loaded engine

// gets a reference so remember the corresponding call to ENGINE_free.

// In case of error the appropriate js exception is scheduled

// and nullptr is returned.

#ifndef OPENSSL_NO_ENGINE

static ENGINE* LoadEngineById(const char* engine_id, char (*errmsg)[1024]) {

MarkPopErrorOnReturn mark_pop_error_on_return;

ENGINE* engine = ENGINE_by_id(engine_id);

if (engine == nullptr) {

// Engine not found, try loading dynamically.

engine = ENGINE_by_id("dynamic");

if (engine != nullptr) {

if (!ENGINE_ctrl_cmd_string(engine, "SO_PATH", engine_id, 0) ||

!ENGINE_ctrl_cmd_string(engine, "LOAD", nullptr, 0)) {

ENGINE_free(engine);

engine = nullptr;

}

}

}

if (engine == nullptr) {

int err = ERR_get_error();

if (err != 0) {

ERR_error_string_n(err, *errmsg, sizeof(*errmsg));

} else {

snprintf(*errmsg, sizeof(*errmsg),

"Engine \"%s\" was not found", engine_id);

}

}

return engine;

}

#endif // !OPENSSL_NO_ENGINE

// This callback is used to avoid the default passphrase callback in OpenSSL

// which will typically prompt for the passphrase. The prompting is designed

// for the OpenSSL CLI, but works poorly for Node.js because it involves

// synchronous interaction with the controlling terminal, something we never

// want, and use this function to avoid it.

static int NoPasswordCallback(char* buf, int size, int rwflag, void* u) {

return 0;

}

// namespace node::crypto::error

namespace error {

Maybe<bool> Decorate(Environment* env, Local<Object> obj,

unsigned long err) { // NOLINT(runtime/int)

if (err == 0) return Just(true); // No decoration necessary.

const char* ls = ERR_lib_error_string(err);

const char* fs = ERR_func_error_string(err);

const char* rs = ERR_reason_error_string(err);

Isolate* isolate = env->isolate();

Local<Context> context = isolate->GetCurrentContext();

if (ls != nullptr) {

if (obj->Set(context, env->library_string(),

OneByteString(isolate, ls)).IsNothing()) {

return Nothing<bool>();

}

}

if (fs != nullptr) {

if (obj->Set(context, env->function_string(),

OneByteString(isolate, fs)).IsNothing()) {

return Nothing<bool>();

}

}

if (rs != nullptr) {

if (obj->Set(context, env->reason_string(),

OneByteString(isolate, rs)).IsNothing()) {

return Nothing<bool>();

}

// SSL has no API to recover the error name from the number, so we

// transform reason strings like "this error" to "ERR_SSL_THIS_ERROR",

// which ends up being close to the original error macro name.

std::string reason(rs);

for (auto& c : reason) {

if (c == ' ')

c = '_';

else

c = ToUpper(c);

}

#define OSSL_ERROR_CODES_MAP(V) \

V(SYS) \

V(BN) \

V(RSA) \

V(DH) \

V(EVP) \

V(BUF) \

V(OBJ) \

V(PEM) \

V(DSA) \

V(X509) \

V(ASN1) \

V(CONF) \

V(CRYPTO) \

V(EC) \

V(SSL) \

V(BIO) \

V(PKCS7) \

V(X509V3) \

V(PKCS12) \

V(RAND) \

V(DSO) \

V(ENGINE) \

V(OCSP) \

V(UI) \

V(COMP) \

V(ECDSA) \

V(ECDH) \

V(OSSL_STORE) \

V(FIPS) \

V(CMS) \

V(TS) \

V(HMAC) \

V(CT) \

V(ASYNC) \

V(KDF) \

V(SM2) \

V(USER) \

#define V(name) case ERR_LIB_##name: lib = #name "_"; break;

const char* lib = "";

const char* prefix = "OSSL_";

switch (ERR_GET_LIB(err)) { OSSL_ERROR_CODES_MAP(V) }

#undef V

#undef OSSL_ERROR_CODES_MAP

// Don't generate codes like "ERR_OSSL_SSL_".

if (lib && strcmp(lib, "SSL_") == 0)

prefix = "";

// All OpenSSL reason strings fit in a single 80-column macro definition,

// all prefix lengths are <= 10, and ERR_OSSL_ is 9, so 128 is more than

// sufficient.

char code[128];

snprintf(code, sizeof(code), "ERR_%s%s%s", prefix, lib, reason.c_str());

if (obj->Set(env->isolate()->GetCurrentContext(),

env->code_string(),

OneByteString(env->isolate(), code)).IsNothing())

return Nothing<bool>();

}

return Just(true);

}

} // namespace error

struct CryptoErrorVector : public std::vector<std::string> {

inline void Capture() {

clear();

while (auto err = ERR_get_error()) {

char buf[256];

ERR_error_string_n(err, buf, sizeof(buf));

push_back(buf);

}

std::reverse(begin(), end());

}

inline MaybeLocal<Value> ToException(

Environment* env,

Local<String> exception_string = Local<String>()) const {

if (exception_string.IsEmpty()) {

CryptoErrorVector copy(*this);

if (copy.empty()) copy.push_back("no error"); // But possibly a bug...

// Use last element as the error message, everything else goes

// into the .opensslErrorStack property on the exception object.

auto exception_string =

String::NewFromUtf8(env->isolate(), copy.back().data(),

NewStringType::kNormal, copy.back().size())

.ToLocalChecked();

copy.pop_back();

return copy.ToException(env, exception_string);

}

Local<Value> exception_v = Exception::Error(exception_string);

CHECK(!exception_v.IsEmpty());

if (!empty()) {

CHECK(exception_v->IsObject());

Local<Object> exception = exception_v.As<Object>();

Maybe<bool> ok = exception->Set(env->context(),

env->openssl_error_stack(),

ToV8Value(env->context(), *this).ToLocalChecked());

if (ok.IsNothing())

return MaybeLocal<Value>();

}

return exception_v;

}

};

void ThrowCryptoError(Environment* env,

unsigned long err, // NOLINT(runtime/int)

// Default, only used if there is no SSL `err` which can

// be used to create a long-style message string.

const char* message = nullptr) {

char message_buffer[128] = {0};

if (err != 0 || message == nullptr) {

ERR_error_string_n(err, message_buffer, sizeof(message_buffer));

message = message_buffer;

}

HandleScope scope(env->isolate());

Local<String> exception_string =

String::NewFromUtf8(env->isolate(), message, NewStringType::kNormal)

.ToLocalChecked();

CryptoErrorVector errors;

errors.Capture();

Local<Value> exception;

if (!errors.ToException(env, exception_string).ToLocal(&exception))

return;

Local<Object> obj;

if (!exception->ToObject(env->context()).ToLocal(&obj))

return;

if (error::Decorate(env, obj, err).IsNothing())

return;

env->isolate()->ThrowException(exception);

}

// Ensure that OpenSSL has enough entropy (at least 256 bits) for its PRNG.

// The entropy pool starts out empty and needs to fill up before the PRNG

// can be used securely. Once the pool is filled, it never dries up again;

// its contents is stirred and reused when necessary.

//

// OpenSSL normally fills the pool automatically but not when someone starts

// generating random numbers before the pool is full: in that case OpenSSL

// keeps lowering the entropy estimate to thwart attackers trying to guess

// the initial state of the PRNG.

//

// When that happens, we will have to wait until enough entropy is available.

// That should normally never take longer than a few milliseconds.

//

// OpenSSL draws from /dev/random and /dev/urandom. While /dev/random may

// block pending "true" randomness, /dev/urandom is a CSPRNG that doesn't

// block under normal circumstances.

//

// The only time when /dev/urandom may conceivably block is right after boot,

// when the whole system is still low on entropy. That's not something we can

// do anything about.

inline void CheckEntropy() {

for (;;) {

int status = RAND_status();

CHECK_GE(status, 0); // Cannot fail.

if (status != 0)

break;

// Give up, RAND_poll() not supported.

if (RAND_poll() == 0)

break;

}

}

bool EntropySource(unsigned char* buffer, size_t length) {

// Ensure that OpenSSL's PRNG is properly seeded.

CheckEntropy();

// RAND_bytes() can return 0 to indicate that the entropy data is not truly

// random. That's okay, it's still better than V8's stock source of entropy,

// which is /dev/urandom on UNIX platforms and the current time on Windows.

return RAND_bytes(buffer, length) != -1;

}

template <typename T>

static T* MallocOpenSSL(size_t count) {

void* mem = OPENSSL_malloc(MultiplyWithOverflowCheck(count, sizeof(T)));

CHECK_IMPLIES(mem == nullptr, count == 0);

return static_cast<T*>(mem);

}

void SecureContext::Initialize(Environment* env, Local<Object> target) {

Local<FunctionTemplate> t = env->NewFunctionTemplate(New);

t->InstanceTemplate()->SetInternalFieldCount(1);

Local<String> secureContextString =

FIXED_ONE_BYTE_STRING(env->isolate(), "SecureContext");

t->SetClassName(secureContextString);

env->SetProtoMethod(t, "init", Init);

env->SetProtoMethod(t, "setKey", SetKey);

env->SetProtoMethod(t, "setCert", SetCert);

env->SetProtoMethod(t, "addCACert", AddCACert);

env->SetProtoMethod(t, "addCRL", AddCRL);

env->SetProtoMethod(t, "addRootCerts", AddRootCerts);

env->SetProtoMethod(t, "setCipherSuites", SetCipherSuites);

env->SetProtoMethod(t, "setCiphers", SetCiphers);

env->SetProtoMethod(t, "setECDHCurve", SetECDHCurve);

env->SetProtoMethod(t, "setDHParam", SetDHParam);

env->SetProtoMethod(t, "setMaxProto", SetMaxProto);

env->SetProtoMethod(t, "setMinProto", SetMinProto);

env->SetProtoMethod(t, "getMaxProto", GetMaxProto);

env->SetProtoMethod(t, "getMinProto", GetMinProto);

env->SetProtoMethod(t, "setOptions", SetOptions);

env->SetProtoMethod(t, "setSessionIdContext", SetSessionIdContext);

env->SetProtoMethod(t, "setSessionTimeout", SetSessionTimeout);

env->SetProtoMethod(t, "close", Close);

env->SetProtoMethod(t, "loadPKCS12", LoadPKCS12);

#ifndef OPENSSL_NO_ENGINE

env->SetProtoMethod(t, "setClientCertEngine", SetClientCertEngine);

#endif // !OPENSSL_NO_ENGINE

env->SetProtoMethodNoSideEffect(t, "getTicketKeys", GetTicketKeys);

env->SetProtoMethod(t, "setTicketKeys", SetTicketKeys);

env->SetProtoMethod(t, "setFreeListLength", SetFreeListLength);

env->SetProtoMethod(t, "enableTicketKeyCallback", EnableTicketKeyCallback);

env->SetProtoMethodNoSideEffect(t, "getCertificate", GetCertificate<true>);

env->SetProtoMethodNoSideEffect(t, "getIssuer", GetCertificate<false>);

#define SET_INTEGER_CONSTANTS(name, value) \

t->Set(FIXED_ONE_BYTE_STRING(env->isolate(), name), \

Integer::NewFromUnsigned(env->isolate(), value));

SET_INTEGER_CONSTANTS("kTicketKeyReturnIndex", kTicketKeyReturnIndex);

SET_INTEGER_CONSTANTS("kTicketKeyHMACIndex", kTicketKeyHMACIndex);

SET_INTEGER_CONSTANTS("kTicketKeyAESIndex", kTicketKeyAESIndex);

SET_INTEGER_CONSTANTS("kTicketKeyNameIndex", kTicketKeyNameIndex);

SET_INTEGER_CONSTANTS("kTicketKeyIVIndex", kTicketKeyIVIndex);

#undef SET_INTEGER_CONSTANTS

Local<FunctionTemplate> ctx_getter_templ =

FunctionTemplate::New(env->isolate(),

CtxGetter,

env->as_callback_data(),

Signature::New(env->isolate(), t));

t->PrototypeTemplate()->SetAccessorProperty(

FIXED_ONE_BYTE_STRING(env->isolate(), "_external"),

ctx_getter_templ,

Local<FunctionTemplate>(),

static_cast<PropertyAttribute>(ReadOnly | DontDelete));

target->Set(env->context(), secureContextString,

t->GetFunction(env->context()).ToLocalChecked()).Check();

env->set_secure_context_constructor_template(t);

}

void SecureContext::New(const FunctionCallbackInfo<Value>& args) {

Environment* env = Environment::GetCurrent(args);

new SecureContext(env, args.This());

}

// A maxVersion of 0 means "any", but OpenSSL may support TLS versions that

// Node.js doesn't, so pin the max to what we do support.

const int MAX_SUPPORTED_VERSION = TLS1_3_VERSION;

void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {

SecureContext* sc;

ASSIGN_OR_RETURN_UNWRAP(&sc, args.Holder());

Environment* env = sc->env();

CHECK_EQ(args.Length(), 3);

CHECK(args[1]->IsInt32());

CHECK(args[2]->IsInt32());

int min_version = args[1].As<Int32>()->Value();

int max_version = args[2].As<Int32>()->Value();

const SSL_METHOD* method = TLS_method();

if (max_version == 0)

max_version = MAX_SUPPORTED_VERSION;

if (args[0]->IsString()) {

const node::Utf8Value sslmethod(env->isolate(), args[0]);

// Note that SSLv2 and SSLv3 are disallowed but SSLv23_method and friends

// are still accepted. They are OpenSSL's way of saying that all known

// protocols below TLS 1.3 are supported unless explicitly disabled (which

// we do below for SSLv2 and SSLv3.)

if (strcmp(*sslmethod, "SSLv2_method") == 0) {

THROW_ERR_TLS_INVALID_PROTOCOL_METHOD(env, "SSLv2 methods disabled");

return;

} else if (strcmp(*sslmethod, "SSLv2_server_method") == 0) {

THROW_ERR_TLS_INVALID_PROTOCOL_METHOD(env, "SSLv2 methods disabled");

return;

} else if (strcmp(*sslmethod, "SSLv2_client_method") == 0) {

THROW_ERR_TLS_INVALID_PROTOCOL_METHOD(env, "SSLv2 methods disabled");

return;

} else if (strcmp(*sslmethod, "SSLv3_method") == 0) {

THROW_ERR_TLS_INVALID_PROTOCOL_METHOD(env, "SSLv3 methods disabled");

return;

} else if (strcmp(*sslmethod, "SSLv3_server_method") == 0) {

THROW_ERR_TLS_INVALID_PROTOCOL_METHOD(env, "SSLv3 methods disabled");

return;

} else if (strcmp(*sslmethod, "SSLv3_client_method") == 0) {

THROW_ERR_TLS_INVALID_PROTOCOL_METHOD(env, "SSLv3 methods disabled");

return;

} else if (strcmp(*sslmethod, "SSLv23_method") == 0) {

max_version = TLS1_2_VERSION;

} else if (strcmp(*sslmethod, "SSLv23_server_method") == 0) {

max_version = TLS1_2_VERSION;

method = TLS_server_method();

} else if (strcmp(*sslmethod, "SSLv23_client_method") == 0) {

max_version = TLS1_2_VERSION;

method = TLS_client_method();

} else if (strcmp(*sslmethod, "TLS_method") == 0) {

min_version = 0;

max_version = MAX_SUPPORTED_VERSION;

} else if (strcmp(*sslmethod, "TLS_server_method") == 0) {

min_version = 0;

max_version = MAX_SUPPORTED_VERSION;

method = TLS_server_method();

} else if (strcmp(*sslmethod, "TLS_client_method") == 0) {

min_version = 0;

max_version = MAX_SUPPORTED_VERSION;

method = TLS_client_method();

} else if (strcmp(*sslmethod, "TLSv1_method") == 0) {

min_version = TLS1_VERSION;

max_version = TLS1_VERSION;

} else if (strcmp(*sslmethod, "TLSv1_server_method") == 0) {

min_version = TLS1_VERSION;

max_version = TLS1_VERSION;

method = TLS_server_method();

} else if (strcmp(*sslmethod, "TLSv1_client_method") == 0) {

min_version = TLS1_VERSION;

max_version = TLS1_VERSION;

method = TLS_client_method();

} else if (strcmp(*sslmethod, "TLSv1_1_method") == 0) {

min_version = TLS1_1_VERSION;

max_version = TLS1_1_VERSION;

} else if (strcmp(*sslmethod, "TLSv1_1_server_method") == 0) {

min_version = TLS1_1_VERSION;

max_version = TLS1_1_VERSION;

method = TLS_server_method();

} else if (strcmp(*sslmethod, "TLSv1_1_client_method") == 0) {

min_version = TLS1_1_VERSION;

max_version = TLS1_1_VERSION;

method = TLS_client_method();

} else if (strcmp(*sslmethod, "TLSv1_2_method") == 0) {

min_version = TLS1_2_VERSION;

max_version = TLS1_2_VERSION;

} else if (strcmp(*sslmethod, "TLSv1_2_server_method") == 0) {

min_version = TLS1_2_VERSION;

max_version = TLS1_2_VERSION;

method = TLS_server_method();

} else if (strcmp(*sslmethod, "TLSv1_2_client_method") == 0) {

min_version = TLS1_2_VERSION;

max_version = TLS1_2_VERSION;

method = TLS_client_method();

} else {

THROW_ERR_TLS_INVALID_PROTOCOL_METHOD(env, "Unknown method");

return;

}

}

sc->ctx_.reset(SSL_CTX_new(method));

SSL_CTX_set_app_data(sc->ctx_.get(), sc);

// Disable SSLv2 in the case when method == TLS_method() and the

// cipher list contains SSLv2 ciphers (not the default, should be rare.)

// The bundled OpenSSL doesn't have SSLv2 support but the system OpenSSL may.

// SSLv3 is disabled because it's susceptible to downgrade attacks (POODLE.)

SSL_CTX_set_options(sc->ctx_.get(), SSL_OP_NO_SSLv2);

SSL_CTX_set_options(sc->ctx_.get(), SSL_OP_NO_SSLv3);

// Enable automatic cert chaining. This is enabled by default in OpenSSL, but

// disabled by default in BoringSSL. Enable it explicitly to make the

// behavior match when Node is built with BoringSSL.

SSL_CTX_clear_mode(sc->ctx_.get(), SSL_MODE_NO_AUTO_CHAIN);

// SSL session cache configuration

SSL_CTX_set_session_cache_mode(sc->ctx_.get(),

SSL_SESS_CACHE_CLIENT |

SSL_SESS_CACHE_SERVER |

SSL_SESS_CACHE_NO_INTERNAL |

SSL_SESS_CACHE_NO_AUTO_CLEAR);

SSL_CTX_set_min_proto_version(sc->ctx_.get(), min_version);

SSL_CTX_set_max_proto_version(sc->ctx_.get(), max_version);

// OpenSSL 1.1.0 changed the ticket key size, but the OpenSSL 1.0.x size was

// exposed in the public API. To retain compatibility, install a callback

// which restores the old algorithm.

if (RAND_bytes(sc->ticket_key_name_, sizeof(sc->ticket_key_name_)) <= 0 ||

RAND_bytes(sc->ticket_key_hmac_, sizeof(sc->ticket_key_hmac_)) <= 0 ||

RAND_bytes(sc->ticket_key_aes_, sizeof(sc->ticket_key_aes_)) <= 0) {

return env->ThrowError("Error generating ticket keys");

}

SSL_CTX_set_tlsext_ticket_key_cb(sc->ctx_.get(), TicketCompatibilityCallback);

}

// Takes a string or buffer and loads it into a BIO.

// Caller responsible for BIO_free_all-ing the returned object.

static BIOPointer LoadBIO(Environment* env, Local<Value> v) {

HandleScope scope(env->isolate());

if (v->IsString()) {

const node::Utf8Value s(env->isolate(), v);

return NodeBIO::NewFixed(*s, s.length());

}

if (v->IsArrayBufferView()) {

ArrayBufferViewContents<char> buf(v.As<ArrayBufferView>());

return NodeBIO::NewFixed(buf.data(), buf.length());

}

return nullptr;

}

void SecureContext::SetKey(const FunctionCallbackInfo<Value>& args) {

Environment* env = Environment::GetCurrent(args);

SecureContext* sc;

ASSIGN_OR_RETURN_UNWRAP(&sc, args.Holder());

unsigned int len = args.Length();

if (len < 1) {

return THROW_ERR_MISSING_ARGS(env, "Private key argument is mandatory");

}

if (len > 2) {

return env->ThrowError("Only private key and pass phrase are expected");

}

if (len == 2) {

if (args[1]->IsUndefined() || args[1]->IsNull())

len = 1;

else

THROW_AND_RETURN_IF_NOT_STRING(env, args[1], "Pass phrase");

}

BIOPointer bio(LoadBIO(env, args[0]));

if (!bio)

return;

node::Utf8Value passphrase(env->isolate(), args[1]);

EVPKeyPointer key(

PEM_read_bio_PrivateKey(bio.get(),

nullptr,

PasswordCallback,

*passphrase));

if (!key) {

unsigned long err = ERR_get_error(); // NOLINT(runtime/int)

if (!err) {

return env->ThrowError("PEM_read_bio_PrivateKey");

}

return ThrowCryptoError(env, err);

}

int rv = SSL_CTX_use_PrivateKey(sc->ctx_.get(), key.get());

if (!rv) {

unsigned long err = ERR_get_error(); // NOLINT(runtime/int)

if (!err)

return env->ThrowError("SSL_CTX_use_PrivateKey");

return ThrowCryptoError(env, err);

}

}

int SSL_CTX_get_issuer(SSL_CTX* ctx, X509* cert, X509** issuer) {

X509_STORE* store = SSL_CTX_get_cert_store(ctx);

DeleteFnPtr<X509_STORE_CTX, X509_STORE_CTX_free> store_ctx(

X509_STORE_CTX_new());

return store_ctx.get() != nullptr &&

X509_STORE_CTX_init(store_ctx.get(), store, nullptr, nullptr) == 1 &&

X509_STORE_CTX_get1_issuer(issuer, store_ctx.get(), cert) == 1;

}

int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,

X509Pointer&& x,

STACK_OF(X509)* extra_certs,

X509Pointer* cert,

X509Pointer* issuer_) {

CHECK(!*issuer_);

CHECK(!*cert);

X509* issuer = nullptr;

int ret = SSL_CTX_use_certificate(ctx, x.get());

if (ret) {

// If we could set up our certificate, now proceed to

// the CA certificates.

SSL_CTX_clear_extra_chain_certs(ctx);

for (int i = 0; i < sk_X509_num(extra_certs); i++) {

X509* ca = sk_X509_value(extra_certs, i);

// NOTE: Increments reference count on `ca`

if (!SSL_CTX_add1_chain_cert(ctx, ca)) {

ret = 0;

issuer = nullptr;

break;

}

// Note that we must not free r if it was successfully

// added to the chain (while we must free the main

// certificate, since its reference count is increased

// by SSL_CTX_use_certificate).

// Find issuer

if (issuer != nullptr || X509_check_issued(ca, x.get()) != X509_V_OK)

continue;

issuer = ca;

}

}

// Try getting issuer from a cert store

if (ret) {

if (issuer == nullptr) {

ret = SSL_CTX_get_issuer(ctx, x.get(), &issuer);

ret = ret < 0 ? 0 : 1;

// NOTE: get_cert_store doesn't increment reference count,

// no need to free `store`

} else {

// Increment issuer reference count

issuer = X509_dup(issuer);

if (issuer == nullptr) {

ret = 0;

}

}

}

issuer_->reset(issuer);

if (ret && x != nullptr) {

cert->reset(X509_dup(x.get()));

if (!*cert)

ret = 0;

}

return ret;

}

// Read a file that contains our certificate in "PEM" format,

// possibly followed by a sequence of CA certificates that should be

// sent to the peer in the Certificate message.

//

// Taken from OpenSSL - edited for style.

int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,

BIOPointer&& in,

X509Pointer* cert,

X509Pointer* issuer) {

// Just to ensure that `ERR_peek_last_error` below will return only errors

// that we are interested in

ERR_clear_error();

X509Pointer x(

PEM_read_bio_X509_AUX(in.get(), nullptr, NoPasswordCallback, nullptr));

if (!x)

return 0;

unsigned long err = 0; // NOLINT(runtime/int)

StackOfX509 extra_certs(sk_X509_new_null());

if (!extra_certs)

return 0;

while (X509Pointer extra {PEM_read_bio_X509(in.get(),

nullptr,

NoPasswordCallback,

nullptr)}) {

if (sk_X509_push(extra_certs.get(), extra.get())) {

extra.release();

continue;

}

return 0;

}

// When the while loop ends, it's usually just EOF.

err = ERR_peek_last_error();

if (ERR_GET_LIB(err) == ERR_LIB_PEM &&

ERR_GET_REASON(err) == PEM_R_NO_START_LINE) {

ERR_clear_error();

} else {

// some real error

return 0;

}

return SSL_CTX_use_certificate_chain(ctx,

std::move(x),

extra_certs.get(),

cert,

issuer);

}

void SecureContext::SetCert(const FunctionCallbackInfo<Value>& args) {

Environment* env = Environment::GetCurrent(args);

SecureContext* sc;

ASSIGN_OR_RETURN_UNWRAP(&sc, args.Holder());

if (args.Length() != 1) {

return THROW_ERR_MISSING_ARGS(env, "Certificate argument is mandatory");

}

BIOPointer bio(LoadBIO(env, args[0]));

if (!bio)

return;

sc->cert_.reset();

sc->issuer_.reset();

int rv = SSL_CTX_use_certificate_chain(sc->ctx_.get(),

std::move(bio),

&sc->cert_,

&sc->issuer_);

if (!rv) {

unsigned long err = ERR_get_error(); // NOLINT(runtime/int)

if (!err) {

return env->ThrowError("SSL_CTX_use_certificate_chain");

}

return ThrowCryptoError(env, err);

}

}

static X509_STORE* NewRootCertStore() {

static std::vector<X509*> root_certs_vector;

static Mutex root_certs_vector_mutex;

Mutex::ScopedLock lock(root_certs_vector_mutex);

if (root_certs_vector.empty()) {

for (size_t i = 0; i < arraysize(root_certs); i++) {

X509* x509 =

PEM_read_bio_X509(NodeBIO::NewFixed(root_certs[i],

strlen(root_certs[i])).get(),

nullptr, // no re-use of X509 structure

NoPasswordCallback,

nullptr); // no callback data

// Parse errors from the built-in roots are fatal.

CHECK_NOT_NULL(x509);

root_certs_vector.push_back(x509);

}

}

X509_STORE* store = X509_STORE_new();

if (*system_cert_path != '\0') {

X509_STORE_load_locations(store, system_cert_path, nullptr);

}

if (per_process::cli_options->ssl_openssl_cert_store) {

X509_STORE_set_default_paths(store);

} else {

for (X509* cert : root_certs_vector) {

X509_up_ref(cert);

X509_STORE_add_cert(store, cert);

}

}

return store;

}

void SecureContext::AddCACert(const FunctionCallbackInfo<Value>& args) {

Environment* env = Environment::GetCurrent(args);

SecureContext* sc;

ASSIGN_OR_RETURN_UNWRAP(&sc, args.Holder());

ClearErrorOnReturn clear_error_on_return;

if (args.Length() != 1) {

return THROW_ERR_MISSING_ARGS(env, "CA certificate argument is mandatory");

}

BIOPointer bio(LoadBIO(env, args[0]));

if (!bio)

return;

X509_STORE* cert_store = SSL_CTX_get_cert_store(sc->ctx_.get());

while (X509* x509 = PEM_read_bio_X509_AUX(

bio.get(), nullptr, NoPasswordCallback, nullptr)) {

if (cert_store == root_cert_store) {

cert_store = NewRootCertStore();

SSL_CTX_set_cert_store(sc->ctx_.get(), cert_store);

}

X509_STORE_add_cert(cert_store, x509);

SSL_CTX_add_client_CA(sc->ctx_.get(), x509);

X509_free(x509);

}

}

void SecureContext::AddCRL(const FunctionCallbackInfo<Value>& args) {

Environment* env = Environment::GetCurrent(args);

SecureContext* sc;

ASSIGN_OR_RETURN_UNWRAP(&sc, args.Holder());

if (args.Length() != 1) {

return THROW_ERR_MISSING_ARGS(env, "CRL argument is mandatory");

}

ClearErrorOnReturn clear_error_on_return;

BIOPointer bio(LoadBIO(env, args[0]));

if (!bio)

return;

DeleteFnPtr<X509_CRL, X509_CRL_free> crl(

PEM_read_bio_X509_CRL(bio.get(), nullptr, NoPasswordCallback, nullptr));

if (!crl)

return env->ThrowError("Failed to parse CRL");

X509_STORE* cert_store = SSL_CTX_get_cert_store(sc->ctx_.get());

if (cert_store == root_cert_store) {

cert_store = NewRootCertStore();

SSL_CTX_set_cert_store(sc->ctx_.get(), cert_store);

}