Repository navigation
Expand file tree
/
Copy pathcrypto_tls_certificates.cc
More file actions
113 lines (93 loc) · 3.74 KB
/
Copy pathcrypto_tls_certificates.cc
File metadata and controls
113 lines (93 loc) · 3.74 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
#include "crypto/crypto_tls_certificates.h"
#include "crypto/crypto_context.h"
#include "crypto/crypto_keys.h"
#include "crypto/crypto_util.h"
namespace node::crypto {
using ncrypto::DeleteFnPtr;
using ncrypto::EVPKeyPointer;
using ncrypto::X509Pointer;
X509_STORE* GetOrCreateOwnedCertStore(Environment* env,
SSL_CTX* ctx,
X509_STORE** cache) {
if (cache != nullptr && *cache != nullptr) return *cache;
X509_STORE* cert_store = SSL_CTX_get_cert_store(ctx);
if (cert_store == GetOrCreateRootCertStore(env)) {
cert_store = NewRootCertStore(env);
SSL_CTX_set_cert_store(ctx, cert_store);
}
if (cache != nullptr) *cache = cert_store;
return cert_store;
}
void UseDefaultRootCertStore(Environment* env, SSL_CTX* ctx) {
X509_STORE* store = GetOrCreateRootCertStore(env);
// Increment reference count so global store is not deleted along with CTX.
X509_STORE_up_ref(store);
SSL_CTX_set_cert_store(ctx, store);
}
size_t AddCACertificates(Environment* env,
SSL_CTX* ctx,
const ncrypto::BIOPointer& bio,
X509_STORE** cache) {
if (!bio) return 0;
size_t count = 0;
while (X509Pointer x509 = X509Pointer(PEM_read_bio_X509_AUX(
bio.get(), nullptr, NoPasswordCallback, nullptr))) {
CHECK_EQ(1,
X509_STORE_add_cert(GetOrCreateOwnedCertStore(env, ctx, cache),
x509.get()));
CHECK_EQ(1, SSL_CTX_add_client_CA(ctx, x509.get()));
count++;
}
return count;
}
bool AddCRL(Environment* env,
SSL_CTX* ctx,
const ncrypto::BIOPointer& bio,
X509_STORE** cache) {
if (!bio) return false;
using CRLPointer = DeleteFnPtr<X509_CRL, X509_CRL_free>;
// So that ERR_peek_last_error() below only reports errors from this loop.
ERR_clear_error();
bool added = false;
while (CRLPointer crl = CRLPointer(PEM_read_bio_X509_CRL(
bio.get(), nullptr, NoPasswordCallback, nullptr))) {
X509_STORE* cert_store = GetOrCreateOwnedCertStore(env, ctx, cache);
CHECK_EQ(1, X509_STORE_add_crl(cert_store, crl.get()));
CHECK_EQ(
1,
X509_STORE_set_flags(
cert_store, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL));
added = true;
}
// The loop stops either because the BIO is exhausted, which OpenSSL reports
// as PEM_R_NO_START_LINE, or because a CRL failed to parse. Only the former
// means every CRL in the bundle made it into the store.
unsigned long err = ERR_peek_last_error(); // NOLINT(runtime/int)
if (ERR_GET_LIB(err) != ERR_LIB_PEM ||
ERR_GET_REASON(err) != PEM_R_NO_START_LINE) {
return false;
}
return added;
}
PrivateKeyResult UsePrivateKey(SSL_CTX* ctx,
const ncrypto::BIOPointer& bio,
const ByteSource* passphrase) {
if (!bio) return PrivateKeyResult::kParseError;
ByteSource empty_passphrase;
if (passphrase == nullptr) passphrase = &empty_passphrase;
// This redirection is necessary because the PasswordCallback expects a
// pointer to a pointer to the passphrase ByteSource to allow passing in
// const ByteSources.
const ByteSource* pass_ptr = passphrase;
EVPKeyPointer key(
PEM_read_bio_PrivateKey(bio.get(), nullptr, PasswordCallback, &pass_ptr));
if (!key) return PrivateKeyResult::kParseError;
if (!SSL_CTX_use_PrivateKey(ctx, key.get()))
return PrivateKeyResult::kApplyError;
return PrivateKeyResult::kSuccess;
}
bool UsePrivateKey(SSL_CTX* ctx, const KeyObjectData& key) {
if (key.GetKeyType() != KeyType::kKeyTypePrivate) return false;
return SSL_CTX_use_PrivateKey(ctx, key.GetAsymmetricKey().get());
}
} // namespace node::crypto