GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — tls: allow obvious key/passphrase combinations · nodejs/node@df9d8ee

File tree

Expand file treeCollapse file tree
Open diff view settings
Filter options
  • doc/api
    • tls.md
  • lib
    • _tls_common.js
  • src
    • node_crypto.cc
  • test/parallel
    • test-tls-passphrase.js
Expand file treeCollapse file tree
Open diff view settings
Collapse file

‎doc/api/tls.md‎

Copy file name to clipboardExpand all lines: doc/api/tls.md
+7-6Lines changed: 7 additions & 6 deletions
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -891,12 +891,13 @@ added: v0.11.13
891891
individually. PFX is usually encrypted, if it is, `passphrase` will be used
892892
to decrypt it.
893893
* `key` {string|string[]|Buffer|Buffer[]|Object[]} Optional private keys in
894-
PEM format. Single keys will be decrypted with `passphrase` if necessary.
895-
Multiple keys, probably using different algorithms, can be provided either
896-
as an array of unencrypted key strings or buffers, or an array of objects in
897-
the form `{pem: <string|buffer>, passphrase: <string>}`. The object form can
898-
only occur in an array, and it _must_ include a passphrase, even if key is
899-
not encrypted.
894+
PEM format. PEM allows the option of private keys being encrypted. Encrypted
895+
keys will be decrypted with `options.passphrase`. Multiple keys using
896+
different algorithms can be provided either as an array of unencrypted key
897+
strings or buffers, or an array of objects in the form `{pem:
898+
<string|buffer>[, passphrase: <string>]}`. The object form can only occur in
899+
an array. `object.passphrase` is optional. Encrypted keys will be decrypted
900+
with `object.passphrase` if provided, or `options.passphrase` if it is not.
900901
* `passphrase` {string} Optional shared passphrase used for a single private
901902
key and/or a PFX.
902903
* `cert` {string|string[]|Buffer|Buffer[]} Optional cert chains in PEM format.
Collapse file

‎lib/_tls_common.js‎

Copy file name to clipboardExpand all lines: lib/_tls_common.js
+3-9Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -78,17 +78,11 @@ exports.createSecureContext = function createSecureContext(options, context) {
7878
if (Array.isArray(options.key)) {
7979
for (i = 0; i < options.key.length; i++) {
8080
const key = options.key[i];
81-
if (key.passphrase)
82-
c.context.setKey(key.pem, key.passphrase);
83-
else
84-
c.context.setKey(key);
81+
const passphrase = key.passphrase || options.passphrase;
82+
c.context.setKey(key.pem || key, passphrase);
8583
}
8684
} else {
87-
if (options.passphrase) {
88-
c.context.setKey(options.key, options.passphrase);
89-
} else {
90-
c.context.setKey(options.key);
91-
}
85+
c.context.setKey(options.key, options.passphrase);
9286
}
9387
}
9488

Collapse file

‎src/node_crypto.cc‎

Copy file name to clipboardExpand all lines: src/node_crypto.cc
+4-1Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -446,7 +446,10 @@ void SecureContext::SetKey(const FunctionCallbackInfo<Value>& args) {
446446
}
447447

448448
if (len == 2) {
449-
THROW_AND_RETURN_IF_NOT_STRING(args[1], "Pass phrase");
449+
if (args[1]->IsUndefined() || args[1]->IsNull())
450+
len = 1;
451+
else
452+
THROW_AND_RETURN_IF_NOT_STRING(args[1], "Pass phrase");
450453
}
451454

452455
BIO *bio = LoadBIO(env, args[0]);
Collapse file

‎test/parallel/test-tls-passphrase.js‎

Copy file name to clipboardExpand all lines: test/parallel/test-tls-passphrase.js
+83-14Lines changed: 83 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -51,21 +51,19 @@ server.listen(0, common.mustCall(function() {
5151
tls.connect({
5252
port: this.address().port,
5353
key: rawKey,
54-
passphrase: 'passphrase', // Ignored.
54+
passphrase: 'ignored',
5555
cert: cert,
5656
rejectUnauthorized: false
5757
}, common.mustCall(function() {}));
5858

5959
// Buffer[]
60-
/* XXX(sam) Should work, but its unimplemented ATM.
6160
tls.connect({
6261
port: this.address().port,
6362
key: [passKey],
6463
passphrase: 'passphrase',
6564
cert: [cert],
6665
rejectUnauthorized: false
6766
}, common.mustCall(function() {}));
68-
*/
6967

7068
tls.connect({
7169
port: this.address().port,
@@ -77,7 +75,7 @@ server.listen(0, common.mustCall(function() {
7775
tls.connect({
7876
port: this.address().port,
7977
key: [rawKey],
80-
passphrase: 'passphrase', // Ignored.
78+
passphrase: 'ignored',
8179
cert: [cert],
8280
rejectUnauthorized: false
8381
}, common.mustCall(function() {}));
@@ -101,21 +99,19 @@ server.listen(0, common.mustCall(function() {
10199
tls.connect({
102100
port: this.address().port,
103101
key: rawKey.toString(),
104-
passphrase: 'passphrase', // Ignored.
102+
passphrase: 'ignored',
105103
cert: cert.toString(),
106104
rejectUnauthorized: false
107105
}, common.mustCall(function() {}));
108106

109107
// String[]
110-
/* XXX(sam) Should work, but its unimplemented ATM.
111108
tls.connect({
112109
port: this.address().port,
113110
key: [passKey.toString()],
114111
passphrase: 'passphrase',
115112
cert: [cert.toString()],
116113
rejectUnauthorized: false
117114
}, common.mustCall(function() {}));
118-
*/
119115

120116
tls.connect({
121117
port: this.address().port,
@@ -127,7 +123,7 @@ server.listen(0, common.mustCall(function() {
127123
tls.connect({
128124
port: this.address().port,
129125
key: [rawKey.toString()],
130-
passphrase: 'passphrase', // Ignored.
126+
passphrase: 'ignored',
131127
cert: [cert.toString()],
132128
rejectUnauthorized: false
133129
}, common.mustCall(function() {}));
@@ -140,6 +136,22 @@ server.listen(0, common.mustCall(function() {
140136
rejectUnauthorized: false
141137
}, common.mustCall(function() {}));
142138

139+
tls.connect({
140+
port: this.address().port,
141+
key: [{pem: passKey, passphrase: 'passphrase'}],
142+
passphrase: 'ignored',
143+
cert: cert,
144+
rejectUnauthorized: false
145+
}, common.mustCall(function() {}));
146+
147+
tls.connect({
148+
port: this.address().port,
149+
key: [{pem: passKey}],
150+
passphrase: 'passphrase',
151+
cert: cert,
152+
rejectUnauthorized: false
153+
}, common.mustCall(function() {}));
154+
143155
tls.connect({
144156
port: this.address().port,
145157
key: [{pem: passKey.toString(), passphrase: 'passphrase'}],
@@ -149,31 +161,30 @@ server.listen(0, common.mustCall(function() {
149161

150162
tls.connect({
151163
port: this.address().port,
152-
key: [{pem: rawKey, passphrase: 'passphrase'}],
164+
key: [{pem: rawKey, passphrase: 'ignored'}],
153165
cert: cert,
154166
rejectUnauthorized: false
155167
}, common.mustCall(function() {}));
156168

157169
tls.connect({
158170
port: this.address().port,
159-
key: [{pem: rawKey.toString(), passphrase: 'passphrase'}],
171+
key: [{pem: rawKey.toString(), passphrase: 'ignored'}],
160172
cert: cert,
161173
rejectUnauthorized: false
162174
}, common.mustCall(function() {}));
163175

164-
/* XXX(sam) Should work, but unimplemented ATM
165176
tls.connect({
166177
port: this.address().port,
167178
key: [{pem: rawKey}],
168-
passphrase: 'passphrase',
179+
passphrase: 'ignored',
169180
cert: cert,
170181
rejectUnauthorized: false
171182
}, common.mustCall(function() {}));
172183

173184
tls.connect({
174185
port: this.address().port,
175186
key: [{pem: rawKey.toString()}],
176-
passphrase: 'passphrase',
187+
passphrase: 'ignored',
177188
cert: cert,
178189
rejectUnauthorized: false
179190
}, common.mustCall(function() {}));
@@ -191,9 +202,37 @@ server.listen(0, common.mustCall(function() {
191202
cert: cert,
192203
rejectUnauthorized: false
193204
}, common.mustCall(function() {}));
194-
*/
195205
})).unref();
196206

207+
// Missing passphrase
208+
assert.throws(function() {
209+
tls.connect({
210+
port: server.address().port,
211+
key: passKey,
212+
cert: cert,
213+
rejectUnauthorized: false
214+
});
215+
}, /bad password read/);
216+
217+
assert.throws(function() {
218+
tls.connect({
219+
port: server.address().port,
220+
key: [passKey],
221+
cert: cert,
222+
rejectUnauthorized: false
223+
});
224+
}, /bad password read/);
225+
226+
assert.throws(function() {
227+
tls.connect({
228+
port: server.address().port,
229+
key: [{pem: passKey}],
230+
cert: cert,
231+
rejectUnauthorized: false
232+
});
233+
}, /bad password read/);
234+
235+
// Invalid passphrase
197236
assert.throws(function() {
198237
tls.connect({
199238
port: server.address().port,
@@ -203,3 +242,33 @@ assert.throws(function() {
203242
rejectUnauthorized: false
204243
});
205244
}, /bad decrypt/);
245+
246+
assert.throws(function() {
247+
tls.connect({
248+
port: server.address().port,
249+
key: [passKey],
250+
passphrase: 'invalid',
251+
cert: cert,
252+
rejectUnauthorized: false
253+
});
254+
}, /bad decrypt/);
255+
256+
assert.throws(function() {
257+
tls.connect({
258+
port: server.address().port,
259+
key: [{pem: passKey}],
260+
passphrase: 'invalid',
261+
cert: cert,
262+
rejectUnauthorized: false
263+
});
264+
}, /bad decrypt/);
265+
266+
assert.throws(function() {
267+
tls.connect({
268+
port: server.address().port,
269+
key: [{pem: passKey, passphrase: 'invalid'}],
270+
passphrase: 'passphrase', // Valid but unused
271+
cert: cert,
272+
rejectUnauthorized: false
273+
});
274+
}, /bad decrypt/);

0 commit comments

Comments
0 (0)
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.