GeezerVison is showing github.com — crypto: preserve OpenSSL errors from KDF failures · nodejs/node@3cd1576
File treeExpand file treeCollapse file tree Open diff view settings Expand file treeCollapse file tree Open diff view settings Collapse file Copy file name to clipboardExpand all lines: deps/ncrypto/ncrypto.cc -8Lines changed: 0 additions & 8 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -2642,8 +2642,6 @@ DataPointer hkdf(const Digest& md, | 2642 | 2642 | const Buffer<const unsigned char>& info, | 2643 | 2643 | const Buffer<const unsigned char>& salt, | 2644 | 2644 | size_t length) { | 2645 | | - ClearErrorOnReturn clearErrorOnReturn; | 2646 | | - | 2647 | 2645 | if (!checkHkdfLength(md, length) || info.len > INT_MAX || | 2648 | 2646 | salt.len > INT_MAX) { | 2649 | 2647 | return {}; | @@ -2714,8 +2712,6 @@ DataPointer scrypt(const Buffer<const char>& pass, | 2714 | 2712 | uint64_t p, | 2715 | 2713 | uint64_t maxmem, | 2716 | 2714 | size_t length) { | 2717 | | - ClearErrorOnReturn clearErrorOnReturn; | 2718 | | - | 2719 | 2715 | if (pass.len > INT_MAX || salt.len > INT_MAX) { | 2720 | 2716 | return {}; | 2721 | 2717 | } | @@ -2742,8 +2738,6 @@ DataPointer pbkdf2(const Digest& md, | 2742 | 2738 | const Buffer<const unsigned char>& salt, | 2743 | 2739 | uint32_t iterations, | 2744 | 2740 | size_t length) { | 2745 | | - ClearErrorOnReturn clearErrorOnReturn; | 2746 | | - | 2747 | 2741 | if (pass.len > INT_MAX || salt.len > INT_MAX || length > INT_MAX) { | 2748 | 2742 | return {}; | 2749 | 2743 | } | @@ -2775,8 +2769,6 @@ DataPointer argon2(const Buffer<const char>& pass, | 2775 | 2769 | const Buffer<const unsigned char>& secret, | 2776 | 2770 | const Buffer<const unsigned char>& ad, | 2777 | 2771 | Argon2Type type) { | 2778 | | - ClearErrorOnReturn clearErrorOnReturn; | 2779 | | - | 2780 | 2772 | std::string_view algorithm; | 2781 | 2773 | switch (type) { | 2782 | 2774 | case Argon2Type::ARGON2I: | |
Collapse file Copy file name to clipboardExpand all lines: test/parallel/test-crypto-argon2-job.js +18-8Lines changed: 18 additions & 8 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -29,19 +29,30 @@ const empty = Buffer.alloc(0); | 29 | 29 |
| 30 | 30 | // Parameters that OpenSSL's Argon2 KDF rejects. | 31 | 31 | const badParams = [ | 32 | | - { lanes: 0, keylen: 32, memcost: 16, iter: 1 }, // lanes < 1 | 33 | | - { lanes: 1, keylen: 32, memcost: 0, iter: 1 }, // memcost == 0 | 34 | | - { lanes: 1, keylen: 32, memcost: 16, iter: 0 }, // iter == 0 | | 32 | + { lanes: 0, keylen: 32, memcost: 16, iter: 1, | | 33 | + reason: /invalid thread pool size/ }, | | 34 | + { lanes: 1, keylen: 32, memcost: 0, iter: 1, | | 35 | + reason: /invalid memory size/ }, | | 36 | + { lanes: 1, keylen: 32, memcost: 16, iter: 0, | | 37 | + reason: /invalid iteration count/ }, | 35 | 38 | ]; | 36 | 39 |
| 37 | | -for (const { lanes, keylen, memcost, iter } of badParams) { | | 40 | +function assertError(err, { reason }) { | | 41 | + assert.ok(err); | | 42 | + const details = [err.message, ...(err.opensslErrorStack ?? [])]; | | 43 | + assert.ok(details.some((msg) => reason.test(msg)), | | 44 | + `did not find ${reason} in ${details}`); | | 45 | +} | | 46 | + | | 47 | +for (const params of badParams) { | | 48 | + const { lanes, keylen, memcost, iter } = params; | | 49 | + | 38 | 50 | { | 39 | 51 | const job = new Argon2Job( | 40 | 52 | kCryptoJobSync, pass, salt, lanes, keylen, memcost, iter, | 41 | 53 | empty, empty, kTypeArgon2id); | 42 | 54 | const { 0: err, 1: result } = job.run(); | 43 | | - assert.ok(err); | 44 | | - assert.match(err.message, /Deriving bits failed/); | | 55 | + assertError(err, params); | 45 | 56 | assert.strictEqual(result, undefined); | 46 | 57 | } | 47 | 58 |
| @@ -50,8 +61,7 @@ for (const { lanes, keylen, memcost, iter } of badParams) { | 50 | 61 | kCryptoJobAsync, pass, salt, lanes, keylen, memcost, iter, | 51 | 62 | empty, empty, kTypeArgon2id); | 52 | 63 | job.ondone = common.mustCall((err, result) => { | 53 | | - assert.ok(err); | 54 | | - assert.match(err.message, /Deriving bits failed/); | | 64 | + assertError(err, params); | 55 | 65 | assert.strictEqual(result, undefined); | 56 | 66 | }); | 57 | 67 | job.run(); | |
Collapse file Copy file name to clipboardExpand all lines: test/parallel/test-crypto-no-algorithm.js +17Lines changed: 17 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -26,6 +26,23 @@ if (isMainThread) { | 26 | 26 | `did not find ${expected} in ${err.opensslErrorStack}`); | 27 | 27 | } | 28 | 28 | })); | | 29 | + | | 30 | + const derivations = [ | | 31 | + ['HKDF', () => crypto.hkdfSync('sha256', Buffer.alloc(32), Buffer.alloc(8), | | 32 | + Buffer.alloc(0), 32)], | | 33 | + ['PBKDF2', () => crypto.pbkdf2Sync('secret', Buffer.alloc(16), 1000, 32, | | 34 | + 'sha256')], | | 35 | + ]; | | 36 | + for (const { 0: name, 1: derive } of derivations) { | | 37 | + try { | | 38 | + derive(); | | 39 | + } catch (err) { | | 40 | + const expected = /digital envelope routines::unsupported/; | | 41 | + const details = [err.message, ...(err.opensslErrorStack ?? [])]; | | 42 | + assert(details.some((msg) => expected.test(msg)), | | 43 | + `${name}: did not find ${expected} in ${details}`); | | 44 | + } | | 45 | + } | 29 | 46 | } | 30 | 47 |
| 31 | 48 | { | |
|