summaryrefslogtreecommitdiff
path: root/src/node_crypto.h
AgeCommit message (Collapse)Author
2017-03-03tls: fix macro to check NPN featureShigeki Ohtsu
In order to check if NPN feature is enabled, use `#ifndef OPENSSL_NO_NEXTPROTONEG` rather than `#ifdef OPENSSL_NPN_NEGOTIATED` because the former is used in ssl.h. Fixes: https://github.com/nodejs/node/issues/11650 PR-URL: https://github.com/nodejs/node/pull/11655 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Fedor Indutny <fedor@indutny.com>
2016-11-23crypto: allow adding extra certs to well-known CAsSam Roberts
In closed environments, self-signed or privately signed certificates are commonly used, and rejected by Node.js since their root CAs are not well-known. Allow extending the set of well-known compiled-in CAs via environment, so they can be set as a matter of policy. PR-URL: https://github.com/nodejs/node/pull/9139 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
2016-11-09crypto: fix handling of root_cert_store.Adam Langley
SecureContext::AddRootCerts only parses the root certificates once and keeps the result in root_cert_store, a global X509_STORE. This change addresses the following issues: 1. SecureContext::AddCACert would add certificates to whatever X509_STORE was being used, even if that happened to be root_cert_store. Thus adding a CA certificate to a SecureContext would also cause it to be included in unrelated SecureContexts. 2. AddCRL would crash if neither AddRootCerts nor AddCACert had been called first. 3. Calling AddCACert without calling AddRootCerts first, and with an input that didn't contain any certificates, would leak an X509_STORE. 4. AddCRL would add the CRL to whatever X509_STORE was being used. Thus, like AddCACert, unrelated SecureContext objects could be affected. The following, non-obvious behaviour remains: calling AddRootCerts doesn't /add/ them, rather it sets the CA certs to be the root set and overrides any previous CA certificates. Points 1–3 are probably unimportant because the SecureContext is typically configured by `createSecureContext` in `lib/_tls_common.js`. This function either calls AddCACert or AddRootCerts and only calls AddCRL after setting up CA certificates. Point four could still apply in the unlikely case that someone configures a CRL without explicitly configuring the CAs. PR-URL: https://github.com/nodejs/node/pull/9409 Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
2016-11-09crypto: Use reference count to manage cert_storeAdam Majer
Setting reference count at the time of setting cert_store instead of trying to manage it by modifying internal states in destructor. PR-URL: https://github.com/nodejs/node/pull/9409 Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: Shigeki Ohtsu <ohtsu@ohtsu.org>
2016-06-29src: remove unused md_ data membersBen Noordhuis
The code assigned the result of EVP_get_digestbyname() to data members called md_ that were not used outside the initialization functions. PR-URL: https://github.com/nodejs/node/pull/7374 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
2016-06-28src: fix whitespace/blank_line cpplint warningsBen Noordhuis
PR-URL: https://github.com/nodejs/node/pull/7462 Reviewed-By: Trevor Norris <trev.norris@gmail.com>
2016-05-25src: add include guards to internal headersBen Noordhuis
For consistency with the newly added src/base64.h header, check that NODE_WANT_INTERNALS is defined and set in internal headers. PR-URL: https://github.com/nodejs/node/pull/6948 Refs: https://github.com/nodejs/node/pull/6910 Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Trevor Norris <trev.norris@gmail.com>
2016-05-24src: inherit first from AsyncWrapTrevor Norris
To make sure casting a class of multiple inheritance from a void* to AsyncWrap succeeds make AsyncWrap the first inherited class. PR-URL: https://github.com/nodejs/node/pull/6184 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Anna Henningsen <anna@addaleax.net>
2016-04-18crypto: better error message for createHashCalvin Metcalf
calling digest or update on a hash object after digest has been called now gives a topical error message instead of an error message saying that the hash failed to initialize. PR-URL: https://github.com/nodejs/node/pull/6042 Reviewed-By: Brian White <mscdex@mscdex.net> Reviewed-By: James M Snell <jasnell@gmail.com>
2016-03-05crypto: simplify Certificate class bindingsAlexander Makarenko
Replace Certificate C++ class with simple functions. Update crypto.Certificate methods accordingly. PR-URL: https://github.com/nodejs/node/pull/5382 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
2016-02-03tls: add getProtocol() to TLS socketsBrian White
This commit adds a new method for TLS sockets that returns the negotiated protocol version. PR-URL: https://github.com/nodejs/node/pull/4995 Reviewed-By: Sakthipriyan Vairamani <thechargingvolcano@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: James M Snell <jasnell@gmail.com>
2016-01-04tls_wrap: clear errors on returnFedor Indutny
Adopt `MarkPopErrorOnReturn` from `node_crypto.cc`, and use it to clear errors after `SSL_read`/`SSL_write`/`SSL_shutdown` functions. See: https://github.com/nodejs/node/issues/4485 PR-URL: https://github.com/nodejs/node/pull/4515 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
2015-12-07crypto: simplify using pre-existing keys with ECDHMichael Ruddy
These changes simplify using ECDH with private keys that are not dynamically generated with ECDH.generateKeys. Support for computing the public key corresponding to the given private key was added. Validity checks to reduce the possibility of computing a weak or invalid shared secret were also added. Finally, ECDH.setPublicKey was softly deprecated. PR-URL: https://github.com/nodejs/node/pull/3511 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
2015-11-13tls: copy client CAs and cert store on CertCbFedor Indutny
Copy client CA certs and cert store when asynchronously selecting `SecureContext` during `SNICallback`. We already copy private key, certificate, and certificate chain, but the client CA certs were missing. Fix: #2772 PR-URL: https://github.com/nodejs/node/pull/3537 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
2015-10-27tls,crypto: move NPN protcol data to hidden valueShigeki Ohtsu
This fix is to be consistent implementation with ALPN. Tow NPN protocol data in the persistent memebers move to hidden variables in the wrap object. PR-URL: https://github.com/nodejs/node/pull/2564 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
2015-10-27tls, crypto: add ALPN SupportShigeki Ohtsu
ALPN is added to tls according to RFC7301, which supersedes NPN. When the server receives both NPN and ALPN extensions from the client, ALPN takes precedence over NPN and the server does not send NPN extension to the client. alpnProtocol in TLSSocket always returns false when no selected protocol exists by ALPN. In https server, http/1.1 token is always set when no options.ALPNProtocols exists. PR-URL: https://github.com/nodejs/node/pull/2564 Reviewed-By: Fedor Indutny <fedor@indutny.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
2015-10-16tls: add TLSSocket.getEphemeralKeyInfo()Shigeki Ohtsu
Returns an object representing a type, name and size of an ephemeral key exchange in a client connection. Currently only DHE and ECHE are supported. This api only works on on a client connection. When it is called on a server connection, null is returned. When its key exchange is not ephemeral, an empty object is returned. PR-URL: https://github.com/nodejs/node/pull/1831 Reviewed-By: indutny - Fedor Indutny <fedor.indutny@gmail.com> Reviewed-By: bnoordhuis - Ben Noordhuis <info@bnoordhuis.nl>
2015-09-06src: replace usage of v8::Handle with v8::LocalMichaël Zasso
v8::Handle is deprecated: https://codereview.chromium.org/1224623004 PR-URL: https://github.com/nodejs/io.js/pull/2202 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
2015-08-08tls: introduce internal `onticketkeycallback`Fedor Indutny
`enableTicketKeyCallback` and `onticketkeycallback` could be potentially used to renew the TLS Session Tickets before they expire. However this commit will introduce it only for private use yet, because we are not sure about the API, and already need this feature for testing. See: https://github.com/nodejs/io.js/issues/2304 PR-URL: https://github.com/nodejs/io.js/pull/2312 Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
2015-06-17async-wrap: add provider id and object info cbTrevor Norris
Re-add the wrapper class id to AsyncWrap instances so they can be tracked directly in a heapdump. Previously the class id was given without setting the heap dump wrapper class info provider. Causing a segfault when a heapdump was taken. This has been added, and the label_ set to the given provider name so each instance can be identified. The id will not be set of the passed object has no internal field count. As the class pointer cannot be retrieved from the object. In order to properly report the allocated size of each class, the new pure virtual method self_size() has been introduces. PR-URL: https://github.com/nodejs/io.js/pull/1896 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
2015-06-16crypto: add cert check to CNNIC WhitelistShigeki Ohtsu
When client connect to the server with certification issued by either CNNIC Root CA or CNNIC EV Root CA, check hash of server certification in the list of CNNICHashWhitelist.inc. If it's not, CERT_REVOKED error returns. See for details in https://blog.mozilla.org/security/2015/04/02/distrusting-new-cnnic-certificates/ PR-URL: https://github.com/nodejs/io.js/pull/1895 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
2015-05-01tls: use `SSL_set_cert_cb` for async SNI/OCSPFedor Indutny
Do not enable ClientHello parser for async SNI/OCSP. Use new OpenSSL-1.0.2's API `SSL_set_cert_cb` to pause the handshake process and load the cert/OCSP response asynchronously. Hopefuly this will make whole async SNI/OCSP process much faster and will eventually let us remove the ClientHello parser itself (which is currently used only for async session, see #1462 for the discussion of removing it). NOTE: Ported our code to `SSL_CTX_add1_chain_cert` to use `SSL_CTX_get0_chain_certs` in `CertCbDone`. Test provided for this feature. Fix: https://github.com/iojs/io.js/issues/1423 PR-URL: https://github.com/iojs/io.js/pull/1464 Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
2015-04-30tls: zero SSL_CTX freelist for a singleUse socketFedor Indutny
When connecting to server with `keepAlive` turned off - make sure that the read/write buffers won't be kept in a single use SSL_CTX instance after the socket will be destroyed. Fix: https://github.com/iojs/io.js/issues/1522 PR-URL: https://github.com/iojs/io.js/pull/1529 Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
2015-04-30crypto: track external memory for SSL structuresFedor Indutny
Ensure that GC kicks in at the right times and the RSS does not blow up. Fix: https://github.com/iojs/io.js/issues/1522 PR-URL: https://github.com/iojs/io.js/pull/1529 Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
2015-04-30tls: destroy SSL once it is out of useFedor Indutny
Do not keep SSL structure in memory once socket is closed. This should lower the memory usage in many cases. Fix: https://github.com/iojs/io.js/issues/1522 PR-URL: https://github.com/iojs/io.js/pull/1529 Reviewed-By: Shigeki Ohtsu <ohtsu@iij.ad.jp>
2015-01-28crypto: implement privateEncrypt/publicDecryptFedor Indutny
PR-URL: https://github.com/iojs/io.js/pull/625 Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Fix iojs/io.js#477
2015-01-21src: add ASSERT_EQ style macrosBen Noordhuis
Add ASSERT counterparts to the CHECK_EQ/CHECK_NE/etc. family of macros. PR-URL: https://github.com/iojs/io.js/pull/529 Reviewed-By: Trevor Norris <trev.norris@gmail.com>
2015-01-12Remove excessive copyright/license boilerplateisaacs
The copyright and license notice is already in the LICENSE file. There is no justifiable reason to also require that it be included in every file, since the individual files are not individually distributed except as part of the entire package.
2014-10-23src: mark more destructors with override keywordBen Noordhuis
The previous commits fixed oversights in destructors that should have been marked virtual but weren't. This commit marks destructors from derived classes with the override keyword.
2014-10-23src: mark SSLWrap destructor as virtualBen Noordhuis
Like the previous commit but this time for the SSLWrap destructor.
2014-10-23src: replace NULL with nullptrBen Noordhuis
Now that we are building with C++11 features enabled, replace use of NULL with nullptr. The benefit of using nullptr is that it can never be confused for an integral type because it does not support implicit conversions to integral types except boolean - unlike NULL, which is defined as a literal `0`.
2014-10-12src: replace assert() with CHECK()Ben Noordhuis
Mechanically replace assert() statements with UNREACHABLE(), CHECK(), or CHECK_{EQ,NE,LT,GT,LE,GE}() statements. The exceptions are src/node.h and src/node_object_wrap.h because they are public headers. PR-URL: https://github.com/node-forward/node/pull/16 Reviewed-By: Fedor Indutny <fedor@indutny.com>
2014-09-23crypto: export externals to internal structsFedor Indutny
Export External getters for a internal structs: SSL, SSL_CTX.
2014-09-18crypto: never store pointer to conn in SSL_CTXFedor Indutny
SSL_CTX is shared between multiple connections and is not a right place to store per-connection data. fix #8348 Reviewed-By: Trevor Norris
2014-08-29tls, crypto: add DHE supportShigeki Ohtsu
In case of an invalid DH parameter file, it is sliently discarded. To use auto DH parameter in a server and DHE key length check in a client, we need to wait for the next release of OpenSSL-1.0.2. Reviewed-By: Fedor Indutny <fedor@indutny.com>
2014-08-29crypto: introduce ECDHFedor Indutny
2014-08-27crypto: allow padding in RSA methodsFedor Indutny
Reviewed-By: Trevor Norris <trevnorris@gmail.com>
2014-08-11crypto: add RSA encryptionseishun
Reviewed-By: Fedor Indutny <fedor@indutny.com>
2014-04-18src: lint after OCSP commitsFedor Indutny
2014-04-18tls: support OCSP on client and serverFedor Indutny
2014-03-13src: update to v8 3.24 APIsFedor Indutny
2014-03-04crypto: allow setting add'l authenticated dataBrian White
2014-02-22src: remove `node_isolate` from sourceFedor Indutny
fix #6899
2014-02-18crypto: allow custom generator for DiffieHellmanBrian White
2014-02-18crypto: make NewSessionDoneCb publicFedor Indutny
Generic friend classes do not work well with old compiler versions (and MSVC).
2014-02-18tls: introduce asynchronous `newSession`Fedor Indutny
fix #7105
2014-02-05async_wrap: add provider types/pass to constructorTrevor Norris
These will be used to allow users to filter for which types of calls they wish their callbacks to run. Signed-off-by: Timothy J Fontaine <tjfontaine@gmail.com>
2014-02-05tls: more session configuration options, methodsFedor Indutny
Introduce `ticketKeys` server option, `session` client option, `getSession()` and `getTLSTicket()` methods. fix #7032
2014-01-22crypto: throw only in direct C++ methodsFedor Indutny
Do not throw in internal C++ methods, that clobbers logic and may lead to the situations, where both exception was thrown and the value was returned (via `args.GetReturnValue().Set()`). That doesn't play nicely with v8. fix #6912
2014-01-20lib: introduce `.setMaxSendFragment(size)`Fedor Indutny
fix #6889
generated by cgit v1.2.3 (git 2.39.1) at 2024-05-21 14:58:32 +0000