@encharm/cws 4.4.0 → 4.5.1

package/src/headers/{18 → 22}/crypto/crypto_keys.h

@@ -18,22 +18,6 @@
 
 namespace node {
 namespace crypto {
-enum PKEncodingType {
-  // RSAPublicKey / RSAPrivateKey according to PKCS#1.
-  kKeyEncodingPKCS1,
-  // PrivateKeyInfo or EncryptedPrivateKeyInfo according to PKCS#8.
-  kKeyEncodingPKCS8,
-  // SubjectPublicKeyInfo according to X.509.
-  kKeyEncodingSPKI,
-  // ECPrivateKey according to SEC1.
-  kKeyEncodingSEC1
-};
-
-enum PKFormatType {
-  kKeyFormatDER,
-  kKeyFormatPEM,
-  kKeyFormatJWK
-};
 
 enum KeyType {
   kKeyTypeSecret,
@@ -48,138 +32,119 @@ enum KeyEncodingContext {
 };
 
 enum class ParseKeyResult {
+  kParseKeyNotRecognized =
+      static_cast<int>(EVPKeyPointer::PKParseError::NOT_RECOGNIZED),
+  kParseKeyNeedPassphrase =
+      static_cast<int>(EVPKeyPointer::PKParseError::NEED_PASSPHRASE),
+  kParseKeyFailed = static_cast<int>(EVPKeyPointer::PKParseError::FAILED),
   kParseKeyOk,
-  kParseKeyNotRecognized,
-  kParseKeyNeedPassphrase,
-  kParseKeyFailed
 };
 
-struct AsymmetricKeyEncodingConfig {
-  bool output_key_object_ = false;
-  PKFormatType format_ = kKeyFormatDER;
-  v8::Maybe<PKEncodingType> type_ = v8::Nothing<PKEncodingType>();
-};
+// Objects of this class can safely be shared among threads.
+class KeyObjectData final : public MemoryRetainer {
+ public:
+  static KeyObjectData CreateSecret(ByteSource key);
 
-using PublicKeyEncodingConfig = AsymmetricKeyEncodingConfig;
+  static KeyObjectData CreateAsymmetric(KeyType type, EVPKeyPointer&& pkey);
 
-struct PrivateKeyEncodingConfig : public AsymmetricKeyEncodingConfig {
-  const EVP_CIPHER* cipher_;
-  // The ByteSource alone is not enough to distinguish between "no passphrase"
-  // and a zero-length passphrase (which can be a null pointer), therefore, we
-  // use a NonCopyableMaybe.
-  NonCopyableMaybe<ByteSource> passphrase_;
-};
+  KeyObjectData(std::nullptr_t = nullptr);
 
-// This uses the built-in reference counter of OpenSSL to manage an EVP_PKEY
-// which is slightly more efficient than using a shared pointer and easier to
-// use.
-class ManagedEVPPKey : public MemoryRetainer {
- public:
-  ManagedEVPPKey() : mutex_(std::make_shared<Mutex>()) {}
-  explicit ManagedEVPPKey(EVPKeyPointer&& pkey);
-  ManagedEVPPKey(const ManagedEVPPKey& that);
-  ManagedEVPPKey& operator=(const ManagedEVPPKey& that);
-
-  operator bool() const;
-  EVP_PKEY* get() const;
-  Mutex* mutex() const;
+  inline operator bool() const { return data_ != nullptr; }
 
-  void MemoryInfo(MemoryTracker* tracker) const override;
-  SET_MEMORY_INFO_NAME(ManagedEVPPKey)
-  SET_SELF_SIZE(ManagedEVPPKey)
+  KeyType GetKeyType() const;
 
-  static PublicKeyEncodingConfig GetPublicKeyEncodingFromJs(
-      const v8::FunctionCallbackInfo<v8::Value>& args,
-      unsigned int* offset,
-      KeyEncodingContext context);
+  // These functions allow unprotected access to the raw key material and should
+  // only be used to implement cryptographic operations requiring the key.
+  const EVPKeyPointer& GetAsymmetricKey() const;
+  const char* GetSymmetricKey() const;
+  size_t GetSymmetricKeySize() const;
 
-  static NonCopyableMaybe<PrivateKeyEncodingConfig> GetPrivateKeyEncodingFromJs(
-      const v8::FunctionCallbackInfo<v8::Value>& args,
-      unsigned int* offset,
-      KeyEncodingContext context);
+  void MemoryInfo(MemoryTracker* tracker) const override;
+  SET_MEMORY_INFO_NAME(KeyObjectData)
+  SET_SELF_SIZE(KeyObjectData)
 
-  static ManagedEVPPKey GetParsedKey(Environment* env,
-                                     EVPKeyPointer&& pkey,
-                                     ParseKeyResult ret,
-                                     const char* default_msg);
+  Mutex& mutex() const;
 
-  static ManagedEVPPKey GetPublicOrPrivateKeyFromJs(
-    const v8::FunctionCallbackInfo<v8::Value>& args,
-    unsigned int* offset);
+  static v8::Maybe<ncrypto::EVPKeyPointer::PublicKeyEncodingConfig>
+  GetPublicKeyEncodingFromJs(const v8::FunctionCallbackInfo<v8::Value>& args,
+                             unsigned int* offset,
+                             KeyEncodingContext context);
 
-  static ManagedEVPPKey GetPrivateKeyFromJs(
+  static KeyObjectData GetPrivateKeyFromJs(
       const v8::FunctionCallbackInfo<v8::Value>& args,
       unsigned int* offset,
       bool allow_key_object);
 
-  static v8::Maybe<bool> ToEncodedPublicKey(
+  static KeyObjectData GetPublicOrPrivateKeyFromJs(
+      const v8::FunctionCallbackInfo<v8::Value>& args, unsigned int* offset);
+
+  static v8::Maybe<ncrypto::EVPKeyPointer::PrivateKeyEncodingConfig>
+  GetPrivateKeyEncodingFromJs(const v8::FunctionCallbackInfo<v8::Value>& args,
+                              unsigned int* offset,
+                              KeyEncodingContext context);
+
+  v8::Maybe<void> ToEncodedPublicKey(
       Environment* env,
-      ManagedEVPPKey key,
-      const PublicKeyEncodingConfig& config,
+      const ncrypto::EVPKeyPointer::PublicKeyEncodingConfig& config,
       v8::Local<v8::Value>* out);
 
-  static v8::Maybe<bool> ToEncodedPrivateKey(
+  v8::Maybe<void> ToEncodedPrivateKey(
       Environment* env,
-      ManagedEVPPKey key,
-      const PrivateKeyEncodingConfig& config,
+      const ncrypto::EVPKeyPointer::PrivateKeyEncodingConfig& config,
       v8::Local<v8::Value>* out);
 
- private:
-  size_t size_of_private_key() const;
-  size_t size_of_public_key() const;
-
-  EVPKeyPointer pkey_;
-  std::shared_ptr<Mutex> mutex_;
-};
-
-// Objects of this class can safely be shared among threads.
-class KeyObjectData : public MemoryRetainer {
- public:
-  static std::shared_ptr<KeyObjectData> CreateSecret(ByteSource key);
-
-  static std::shared_ptr<KeyObjectData> CreateAsymmetric(
-      KeyType type,
-      const ManagedEVPPKey& pkey);
-
-  KeyType GetKeyType() const;
-
-  // These functions allow unprotected access to the raw key material and should
-  // only be used to implement cryptographic operations requiring the key.
-  ManagedEVPPKey GetAsymmetricKey() const;
-  const char* GetSymmetricKey() const;
-  size_t GetSymmetricKeySize() const;
+  inline KeyObjectData addRef() const {
+    return KeyObjectData(key_type_, mutex_, data_);
+  }
 
-  void MemoryInfo(MemoryTracker* tracker) const override;
-  SET_MEMORY_INFO_NAME(KeyObjectData)
-  SET_SELF_SIZE(KeyObjectData)
+  inline KeyObjectData addRefWithType(KeyType type) const {
+    return KeyObjectData(type, mutex_, data_);
+  }
 
  private:
   explicit KeyObjectData(ByteSource symmetric_key);
+  explicit KeyObjectData(KeyType type, EVPKeyPointer&& pkey);
+
+  static KeyObjectData GetParsedKey(KeyType type,
+                                    Environment* env,
+                                    EVPKeyPointer&& pkey,
+                                    ParseKeyResult ret,
+                                    const char* default_msg);
+
+  KeyType key_type_;
+  mutable std::shared_ptr<Mutex> mutex_;
+
+  struct Data {
+    const ByteSource symmetric_key;
+    const EVPKeyPointer asymmetric_key;
+    explicit Data(ByteSource symmetric_key)
+        : symmetric_key(std::move(symmetric_key)) {}
+    explicit Data(EVPKeyPointer asymmetric_key)
+        : asymmetric_key(std::move(asymmetric_key)) {}
+  };
+  std::shared_ptr<Data> data_;
 
-  KeyObjectData(
-      KeyType type,
-      const ManagedEVPPKey& pkey);
-
-  const KeyType key_type_;
-  const ByteSource symmetric_key_;
-  const unsigned int symmetric_key_len_;
-  const ManagedEVPPKey asymmetric_key_;
+  KeyObjectData(KeyType type,
+                std::shared_ptr<Mutex> mutex,
+                std::shared_ptr<Data> data)
+      : key_type_(type), mutex_(mutex), data_(data) {}
 };
 
 class KeyObjectHandle : public BaseObject {
  public:
+  static bool HasInstance(Environment* env, v8::Local<v8::Value> value);
   static v8::Local<v8::Function> Initialize(Environment* env);
   static void RegisterExternalReferences(ExternalReferenceRegistry* registry);
 
   static v8::MaybeLocal<v8::Object> Create(Environment* env,
-                                           std::shared_ptr<KeyObjectData> data);
+                                           const KeyObjectData& data);
 
   // TODO(tniessen): track the memory used by OpenSSL types
   SET_NO_MEMORY_INFO()
   SET_MEMORY_INFO_NAME(KeyObjectHandle)
   SET_SELF_SIZE(KeyObjectHandle)
 
-  const std::shared_ptr<KeyObjectData>& Data();
+  const KeyObjectData& Data();
 
  protected:
   static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
@@ -197,6 +162,9 @@ class KeyObjectHandle : public BaseObject {
       const v8::FunctionCallbackInfo<v8::Value>& args);
   v8::Local<v8::Value> GetAsymmetricKeyType() const;
 
+  static void CheckEcKeyData(const v8::FunctionCallbackInfo<v8::Value>& args);
+  bool CheckEcKeyData() const;
+
   static void GetSymmetricKeySize(
       const v8::FunctionCallbackInfo<v8::Value>& args);
 
@@ -204,15 +172,15 @@ class KeyObjectHandle : public BaseObject {
 
   v8::MaybeLocal<v8::Value> ExportSecretKey() const;
   v8::MaybeLocal<v8::Value> ExportPublicKey(
-      const PublicKeyEncodingConfig& config) const;
+      const ncrypto::EVPKeyPointer::PublicKeyEncodingConfig& config) const;
   v8::MaybeLocal<v8::Value> ExportPrivateKey(
-      const PrivateKeyEncodingConfig& config) const;
+      const ncrypto::EVPKeyPointer::PrivateKeyEncodingConfig& config) const;
 
   KeyObjectHandle(Environment* env,
                   v8::Local<v8::Object> wrap);
 
  private:
-  std::shared_ptr<KeyObjectData> data_;
+  KeyObjectData data_;
 };
 
 class NativeKeyObject : public BaseObject {
@@ -230,8 +198,8 @@ class NativeKeyObject : public BaseObject {
 
   class KeyObjectTransferData : public worker::TransferData {
    public:
-    explicit KeyObjectTransferData(const std::shared_ptr<KeyObjectData>& data)
-        : data_(data) {}
+    explicit KeyObjectTransferData(const KeyObjectData& data)
+        : data_(data.addRef()) {}
 
     BaseObjectPtr<BaseObject> Deserialize(
         Environment* env,
@@ -243,7 +211,7 @@ class NativeKeyObject : public BaseObject {
     SET_NO_MEMORY_INFO()
 
    private:
-    std::shared_ptr<KeyObjectData> data_;
+    KeyObjectData data_;
   };
 
   BaseObject::TransferMode GetTransferMode() const override;
@@ -252,13 +220,12 @@ class NativeKeyObject : public BaseObject {
  private:
   NativeKeyObject(Environment* env,
                   v8::Local<v8::Object> wrap,
-                  const std::shared_ptr<KeyObjectData>& handle_data)
-    : BaseObject(env, wrap),
-      handle_data_(handle_data) {
+                  const KeyObjectData& handle_data)
+      : BaseObject(env, wrap), handle_data_(handle_data.addRef()) {
     MakeWeak();
   }
 
-  std::shared_ptr<KeyObjectData> handle_data_;
+  KeyObjectData handle_data_;
 };
 
 enum WebCryptoKeyFormat {
@@ -323,20 +290,18 @@ class KeyExportJob final : public CryptoJob<KeyExportTraits> {
     CryptoJob<KeyExportTraits>::RegisterExternalReferences(New, registry);
   }
 
-  KeyExportJob(
-      Environment* env,
-      v8::Local<v8::Object> object,
-      CryptoJobMode mode,
-      std::shared_ptr<KeyObjectData> key,
-      WebCryptoKeyFormat format,
-      AdditionalParams&& params)
-      : CryptoJob<KeyExportTraits>(
-            env,
-            object,
-            AsyncWrap::PROVIDER_KEYEXPORTREQUEST,
-            mode,
-            std::move(params)),
-        key_(key),
+  KeyExportJob(Environment* env,
+               v8::Local<v8::Object> object,
+               CryptoJobMode mode,
+               const KeyObjectData& key,
+               WebCryptoKeyFormat format,
+               AdditionalParams&& params)
+      : CryptoJob<KeyExportTraits>(env,
+                                   object,
+                                   AsyncWrap::PROVIDER_KEYEXPORTREQUEST,
+                                   mode,
+                                   std::move(params)),
+        key_(key.addRef()),
         format_(format) {}
 
   WebCryptoKeyFormat format() const { return format_; }
@@ -369,23 +334,28 @@ class KeyExportJob final : public CryptoJob<KeyExportTraits> {
     }
   }
 
-  v8::Maybe<bool> ToResult(
-      v8::Local<v8::Value>* err,
-      v8::Local<v8::Value>* result) override {
+  v8::Maybe<void> ToResult(v8::Local<v8::Value>* err,
+                           v8::Local<v8::Value>* result) override {
     Environment* env = AsyncWrap::env();
     CryptoErrorStore* errors = CryptoJob<KeyExportTraits>::errors();
     if (out_.size() > 0) {
       CHECK(errors->Empty());
       *err = v8::Undefined(env->isolate());
       *result = out_.ToArrayBuffer(env);
-      return v8::Just(!result->IsEmpty());
+      if (result->IsEmpty()) {
+        return v8::Nothing<void>();
+      }
+    } else {
+      if (errors->Empty()) errors->Capture();
+      CHECK(!errors->Empty());
+      *result = v8::Undefined(env->isolate());
+      if (!errors->ToException(env).ToLocal(err)) {
+        return v8::Nothing<void>();
+      }
     }
-
-    if (errors->Empty())
-      errors->Capture();
-    CHECK(!errors->Empty());
-    *result = v8::Undefined(env->isolate());
-    return v8::Just(errors->ToException(env).ToLocal(err));
+    CHECK(!result->IsEmpty());
+    CHECK(!err->IsEmpty());
+    return v8::JustVoid();
   }
 
   SET_SELF_SIZE(KeyExportJob)
@@ -395,18 +365,18 @@ class KeyExportJob final : public CryptoJob<KeyExportTraits> {
   }
 
  private:
-  std::shared_ptr<KeyObjectData> key_;
+  KeyObjectData key_;
   WebCryptoKeyFormat format_;
   ByteSource out_;
 };
 
-WebCryptoKeyExportStatus PKEY_SPKI_Export(
-    KeyObjectData* key_data,
-    ByteSource* out);
+WebCryptoKeyExportStatus PKEY_SPKI_Export(const KeyObjectData& key_data,
+                                          ByteSource* out);
+
+WebCryptoKeyExportStatus PKEY_PKCS8_Export(const KeyObjectData& key_data,
+                                           ByteSource* out);
 
-WebCryptoKeyExportStatus PKEY_PKCS8_Export(
-    KeyObjectData* key_data,
-    ByteSource* out);
+int GetOKPCurveFromName(const char* name);
 
 namespace Keys {
 void Initialize(Environment* env, v8::Local<v8::Object> target);

package/src/headers/{18 → 22}/crypto/crypto_tls.h

@@ -13,7 +13,7 @@
 //
 // THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
 // OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURpPOSE AND NONINFRINGEMENT. IN
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
 // NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
 // DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
 // OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
@@ -34,6 +34,7 @@
 #include <openssl/ssl.h>
 
 #include <string>
+#include <vector>
 
 namespace node {
 namespace crypto {
@@ -47,6 +48,8 @@ class TLSWrap : public AsyncWrap,
     kServer
   };
 
+  enum class UnderlyingStreamWriteStatus { kHasActive, kVacancy };
+
   static void Initialize(v8::Local<v8::Object> target,
                          v8::Local<v8::Value> unused,
                          v8::Local<v8::Context> context,
@@ -102,6 +105,7 @@ class TLSWrap : public AsyncWrap,
 
   std::string diagnostic_name() const override;
 
+ private:
   // OpenSSL structures are opaque. Estimate SSL memory size for OpenSSL 1.1.1b:
   //   SSL: 6224
   //   SSL->SSL3_STATE: 1040
@@ -134,7 +138,8 @@ class TLSWrap : public AsyncWrap,
           v8::Local<v8::Object> obj,
           Kind kind,
           StreamBase* stream,
-          SecureContext* sc);
+          SecureContext* sc,
+          UnderlyingStreamWriteStatus under_stream_ws);
 
   static void SSLInfoCallback(const SSL* ssl_, int where, int ret);
   void InitSSL();
@@ -165,13 +170,12 @@ class TLSWrap : public AsyncWrap,
 
   int SetCACerts(SecureContext* sc);
 
-  int GetSSLError(int status) const;
-
   static int SelectSNIContextCallback(SSL* s, int* ad, void* arg);
 
   static void CertCbDone(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void DestroySSL(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void EnableCertCb(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void EnableALPNCb(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void EnableKeylogCallback(
       const v8::FunctionCallbackInfo<v8::Value>& args);
   static void EnableSessionCallbacks(
@@ -209,6 +213,7 @@ class TLSWrap : public AsyncWrap,
   static void Renegotiate(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void RequestOCSP(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void SetALPNProtocols(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void SetKeyCert(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void SetOCSPResponse(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void SetServername(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void SetSession(const v8::FunctionCallbackInfo<v8::Value>& args);
@@ -216,6 +221,8 @@ class TLSWrap : public AsyncWrap,
   static void Start(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void VerifyError(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void Wrap(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void WritesIssuedByPrevListenerDone(
+      const v8::FunctionCallbackInfo<v8::Value>& args);
 
 #ifdef SSL_set_max_send_fragment
   static void SetMaxSendFragment(
@@ -238,11 +245,13 @@ class TLSWrap : public AsyncWrap,
                                         unsigned char* psk,
                                         unsigned int max_psk_len);
 #endif
-public:
+
   Environment* const env_;
   Kind kind_;
   SSLSessionPointer next_sess_;
+  public:
   SSLPointer ssl_;
+  private:
   ClientHelloParser hello_parser_;
   v8::Global<v8::ArrayBufferView> ocsp_response_;
   BaseObjectPtr<SecureContext> sni_context_;
@@ -282,6 +291,12 @@ public:
   void* cert_cb_arg_ = nullptr;
 
   BIOPointer bio_trace_;
+
+  bool has_active_write_issued_by_prev_listener_ = false;
+
+ public:
+  std::vector<unsigned char> alpn_protos_;  // Accessed by SelectALPNCallback.
+  bool alpn_callback_enabled_ = false;      // Accessed by SelectALPNCallback.
 };
 
 }  // namespace crypto