Skip to content

tls: multiple PFX support in createSecureContext#14793

Closed
djphoenix wants to merge 7 commits intonodejs:masterfrom
djphoenix:tls-multi-pfx
Closed

tls: multiple PFX support in createSecureContext#14793
djphoenix wants to merge 7 commits intonodejs:masterfrom
djphoenix:tls-multi-pfx

Conversation

@djphoenix
Copy link
Contributor

@djphoenix djphoenix commented Aug 12, 2017

Fixes: #14756

Checklist
  • make -j4 test (UNIX), or vcbuild test (Windows) passes
  • tests and/or benchmarks are included
  • documentation is changed or added
  • commit message follows commit guidelines
Affected core subsystem(s)

tls

@nodejs-github-bot nodejs-github-bot added the tls Issues and PRs related to the tls subsystem. label Aug 12, 2017
@djphoenix djphoenix force-pushed the tls-multi-pfx branch 2 times, most recently from 1d13a0b to 41ca43b Compare August 12, 2017 17:35
mscdex
mscdex reviewed Aug 12, 2017
View reviewed changes
test/parallel/test-tls-multi-pfx.js Outdated
Copy link
Contributor

@mscdex mscdex Aug 12, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we should add a third case for when an object is supplied with an encrypted key and the passphrase from options is used.

Copy link
Contributor Author

@djphoenix djphoenix Aug 12, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ACK (partially). Maybe add separate case out of "multi-pfx" test?

@Trott Trott added the semver-minor PRs that contain new features and should be released in the next minor version. label Aug 13, 2017
jasnell
jasnell reviewed Aug 13, 2017
View reviewed changes
test/parallel/test-tls-multi-pfx.js Outdated
Copy link
Member

@jasnell jasnell Aug 13, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The copyright and license header should not be added to new files

Copy link
Contributor Author

@djphoenix djphoenix Aug 14, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ACK, removed

jasnell
jasnell reviewed Aug 23, 2017
View reviewed changes
lib/_tls_common.js Outdated
Copy link
Member

@jasnell jasnell Aug 23, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Buffer.isBuffer()

Copy link
Member

@jasnell jasnell Aug 23, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, should this be limited to just Buffer instances? We likely should allow any Uint8Array

Copy link
Member

@addaleax addaleax Aug 23, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

see #14978 (comment) :D

Copy link
Contributor Author

@djphoenix djphoenix Aug 23, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ACK

jasnell
jasnell reviewed Aug 23, 2017
View reviewed changes
test/parallel/test-tls-multi-pfx.js Outdated
Copy link
Member

@jasnell jasnell Aug 23, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please use the new ../common/fixtures stuff... e.g.

const fixtures = require('../common/fixtures');
/*... */
{
  buffer: fixtures.readKey('agent1-pfx.pem')
}

jasnell
jasnell reviewed Aug 23, 2017
View reviewed changes
test/parallel/test-tls-multi-pfx.js Outdated
Copy link
Member

@jasnell jasnell Aug 23, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

common.mustCall() here

Copy link
Contributor Author

@djphoenix djphoenix Aug 23, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jasnell in listen (L24) also? Or not necessary?

jasnell
jasnell reviewed Aug 23, 2017
View reviewed changes
test/parallel/test-tls-multi-pfx.js Outdated
Copy link
Member

@jasnell jasnell Aug 23, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

common.mustCall() here also

@jasnell
Copy link
Member

jasnell commented Aug 23, 2017

CI: https://ci.nodejs.org/job/node-test-pull-request/9803/

@djphoenix
Copy link
Contributor Author

djphoenix commented Aug 23, 2017

Fixed FIPS failure (actually bad fixture). @jasnell another try?

@djphoenix
Copy link
Contributor Author

djphoenix commented Aug 28, 2017

ping?

@jasnell
Copy link
Member

jasnell commented Aug 29, 2017

Hey, sorry @djphoenix ... new CI here! https://ci.nodejs.org/job/node-test-pull-request/9862/

BridgeAR
BridgeAR reviewed Aug 29, 2017
View reviewed changes
lib/_tls_common.js Outdated
Copy link
Member

@BridgeAR BridgeAR Aug 29, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not completely happy with the buffer check here.

I think it would be good to verify that the input is indeed a buffer and that does not happen here.

If the object attribute name would not be buffer it would be easy to distinguish the object from the buffer and you could write something like:

const raw = pfx.buf ? pfx.buf : pfx;
if (!ArrayBuffer.isView(raw))
  throw new Error("foobar");
const buf = crypto._toBuf(raw);

Copy link
Contributor Author

@djphoenix djphoenix Aug 29, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks as a good proposal. ACK.

doc/api/tls.md Outdated
Copy link
Member

@BridgeAR BridgeAR Aug 29, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How come string is not supported anymore?

Copy link
Contributor Author

@djphoenix djphoenix Aug 29, 2017

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

PKCS12 is very rarely stored in PEM format, by default it's DER-encoded. But I forget about binary strings in JS. Will revert it, ACK.

@djphoenix
Copy link
Contributor Author

djphoenix commented Aug 29, 2017

@jasnell CI failures seems like unrelated to changes.

@djphoenix
Copy link
Contributor Author

djphoenix commented Aug 29, 2017

@BridgeAR fixed your picks. @jasnell seems like it's ready for another CI.

@jasnell
Copy link
Member

jasnell commented Aug 29, 2017

New CI: https://ci.nodejs.org/job/node-test-pull-request/9870/

@jasnell jasnell requested review from indutny and shigeki August 29, 2017 17:06
indutny
indutny approved these changes Aug 31, 2017
View reviewed changes
Copy link
Member

@indutny indutny left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, if it works.

@indutny
Copy link
Member

indutny commented Aug 31, 2017

cc @shigeki @bnoordhuis PTAL

@djphoenix
tls: multiple PFX in createSecureContext
21e2413 
Add support for multiple PFX files in tls.createSecureContext.
Also added support for object-style PFX pass.

Fixes: nodejs#14756
@djphoenix
Fix buffer type check
a389780
@djphoenix
Use fixtures API in test
f8fdff4
@djphoenix
Use mustCall for test callbacks
f2607b3
BridgeAR
BridgeAR approved these changes Sep 2, 2017
View reviewed changes
Copy link
Member

@BridgeAR BridgeAR left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Still LGTM

@BridgeAR
Copy link
Member

BridgeAR commented Sep 4, 2017

New CI https://ci.nodejs.org/job/node-test-pull-request/9933/

indutny
indutny approved these changes Sep 5, 2017
View reviewed changes
Copy link
Member

@indutny indutny left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@djphoenix
Copy link
Contributor Author

djphoenix commented Sep 6, 2017

Still waiting for @shigeki and @bnoordhuis

@BridgeAR
Copy link
Member

BridgeAR commented Sep 8, 2017

Landed in 372dc86

@BridgeAR BridgeAR closed this Sep 8, 2017
BridgeAR pushed a commit that referenced this pull request Sep 8, 2017
@djphoenix @BridgeAR
tls: multiple PFX in createSecureContext
372dc86 
Add support for multiple PFX files in tls.createSecureContext.
Also added support for object-style PFX pass.

PR-URL: #14793
Fixes: #14756
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
@MylesBorins
Copy link
Contributor

MylesBorins commented Sep 10, 2017

@BridgeAR it seems like @djphoenix was still waiting for a review from @shigeki and @bnoordhuis. Was there a reason it landed before?

@MylesBorins
Copy link
Contributor

MylesBorins commented Sep 10, 2017

Also fwiw I've landed this on v8.x-staging and it is on track to be released in the next 8.x release. Just wanted to confirm that this should be released before doing so

MylesBorins pushed a commit that referenced this pull request Sep 10, 2017
@djphoenix @MylesBorins
tls: multiple PFX in createSecureContext
2114c03 
Add support for multiple PFX files in tls.createSecureContext.
Also added support for object-style PFX pass.

PR-URL: #14793
Fixes: #14756
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
@MylesBorins MylesBorins mentioned this pull request Sep 10, 2017
Merged
@djphoenix
Copy link
Contributor Author

djphoenix commented Sep 11, 2017 •
edited
Loading

@djphoenix was still waiting for a review

@MylesBorins not me, but @indutny tagged them before, so I pinged also. Not blocking for me (and for @BridgeAR also as I see).

@BridgeAR
Copy link
Member

BridgeAR commented Sep 11, 2017

@MylesBorins to me it looked like a trivial change that was good to go and there was no response since the review request for a week. And as it did not come from @djphoenix it felt more like a "nice to have" in this case. So I went ahead and landed it.

@MylesBorins
Copy link
Contributor

MylesBorins commented Sep 11, 2017 via email

MylesBorins pushed a commit that referenced this pull request Sep 11, 2017
@djphoenix @MylesBorins
tls: multiple PFX in createSecureContext
8dfe073 
Add support for multiple PFX files in tls.createSecureContext.
Also added support for object-style PFX pass.

PR-URL: #14793
Fixes: #14756
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
MylesBorins pushed a commit that referenced this pull request Sep 11, 2017
@djphoenix @MylesBorins
tls: multiple PFX in createSecureContext
1c37c92 
Add support for multiple PFX files in tls.createSecureContext.
Also added support for object-style PFX pass.

PR-URL: #14793
Fixes: #14756
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
@djphoenix djphoenix deleted the tls-multi-pfx branch September 11, 2017 23:50
MylesBorins pushed a commit that referenced this pull request Sep 12, 2017
@djphoenix @MylesBorins
tls: multiple PFX in createSecureContext
d6ad9d7 
Add support for multiple PFX files in tls.createSecureContext.
Also added support for object-style PFX pass.

PR-URL: #14793
Fixes: #14756
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
MylesBorins added a commit that referenced this pull request Sep 12, 2017
@MylesBorins
2017-09-12, Version 8.5.0 (Current)
a2a2ff4 
Notable Changes

* build:
  * Snapshots are now re-enabled in V8
  #14875

* console:
  * Implement minimal `console.group()`.
  #14910

* deps:
  * upgrade libuv to 1.14.1
    #14866
  * update nghttp2 to v1.25.0
    #14955

* dns:
  * Add `verbatim` option to dns.lookup(). When true, results from the
    DNS resolver are passed on as-is, without the reshuffling that
    Node.js otherwise does that puts IPv4 addresses before IPv6
    addresses.
    #14731

* fs:
  * add fs.copyFile and fs.copyFileSync which allows for more efficient
    copying of files.
    #15034

* inspector:
  * Enable async stack traces
    #13870

* module:
  * Add support for ESM. This is currently behind the
    `--experimental-modules` flag and requires the .mjs extension.
    `node --experimental-modules index.mjs`
    #14369

* napi:
  * implement promise
    #14365

* os:
  * Add support for CIDR notation to the output of the
    networkInterfaces() method.
    #14307

* perf_hooks:
  * An initial implementation of the Performance Timing API for
    Node.js. This is the same Performance Timing API implemented by
    modern browsers with a number of Node.js specific properties. The
    User Timing mark() and measure() APIs are implemented, as is a
    Node.js specific flavor of the Frame Timing for measuring event
    loop duration.
    #14680

* tls:
  * multiple PFX in createSecureContext
    [#14793](#14793)

* Added new collaborators:
  * BridgeAR – Ruben Bridgewater

PR-URL: #15308
MylesBorins added a commit that referenced this pull request Sep 12, 2017
@MylesBorins
2017-09-12, Version 8.5.0 (Current)
a10856a 
Notable Changes

* build:
  * Snapshots are now re-enabled in V8
  #14875

* console:
  * Implement minimal `console.group()`.
  #14910

* deps:
  * upgrade libuv to 1.14.1
    #14866
  * update nghttp2 to v1.25.0
    #14955

* dns:
  * Add `verbatim` option to dns.lookup(). When true, results from the
    DNS resolver are passed on as-is, without the reshuffling that
    Node.js otherwise does that puts IPv4 addresses before IPv6
    addresses.
    #14731

* fs:
  * add fs.copyFile and fs.copyFileSync which allows for more efficient
    copying of files.
    #15034

* inspector:
  * Enable async stack traces
    #13870

* module:
  * Add support for ESM. This is currently behind the
    `--experimental-modules` flag and requires the .mjs extension.
    `node --experimental-modules index.mjs`
    #14369

* napi:
  * implement promise
    #14365

* os:
  * Add support for CIDR notation to the output of the
    networkInterfaces() method.
    #14307

* perf_hooks:
  * An initial implementation of the Performance Timing API for
    Node.js. This is the same Performance Timing API implemented by
    modern browsers with a number of Node.js specific properties. The
    User Timing mark() and measure() APIs are implemented, as is a
    Node.js specific flavor of the Frame Timing for measuring event
    loop duration.
    #14680

* tls:
  * multiple PFX in createSecureContext
    [#14793](#14793)

* Added new collaborators:
  * BridgeAR – Ruben Bridgewater

PR-URL: #15308
addaleax pushed a commit to addaleax/node that referenced this pull request Sep 13, 2017
@djphoenix @addaleax
tls: multiple PFX in createSecureContext
d7b1734 
Add support for multiple PFX files in tls.createSecureContext.
Also added support for object-style PFX pass.

PR-URL: nodejs#14793
Fixes: nodejs#14756
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
addaleax pushed a commit to addaleax/node that referenced this pull request Sep 13, 2017
@MylesBorins @addaleax
2017-09-12, Version 8.5.0 (Current)
ad2a0b2 
Notable Changes

* build:
  * Snapshots are now re-enabled in V8
  nodejs#14875

* console:
  * Implement minimal `console.group()`.
  nodejs#14910

* deps:
  * upgrade libuv to 1.14.1
    nodejs#14866
  * update nghttp2 to v1.25.0
    nodejs#14955

* dns:
  * Add `verbatim` option to dns.lookup(). When true, results from the
    DNS resolver are passed on as-is, without the reshuffling that
    Node.js otherwise does that puts IPv4 addresses before IPv6
    addresses.
    nodejs#14731

* fs:
  * add fs.copyFile and fs.copyFileSync which allows for more efficient
    copying of files.
    nodejs#15034

* inspector:
  * Enable async stack traces
    nodejs#13870

* module:
  * Add support for ESM. This is currently behind the
    `--experimental-modules` flag and requires the .mjs extension.
    `node --experimental-modules index.mjs`
    nodejs#14369

* napi:
  * implement promise
    nodejs#14365

* os:
  * Add support for CIDR notation to the output of the
    networkInterfaces() method.
    nodejs#14307

* perf_hooks:
  * An initial implementation of the Performance Timing API for
    Node.js. This is the same Performance Timing API implemented by
    modern browsers with a number of Node.js specific properties. The
    User Timing mark() and measure() APIs are implemented, as is a
    Node.js specific flavor of the Frame Timing for measuring event
    loop duration.
    nodejs#14680

* tls:
  * multiple PFX in createSecureContext
    [nodejs#14793](nodejs#14793)

* Added new collaborators:
  * BridgeAR – Ruben Bridgewater

PR-URL: nodejs#15308
@gibfahn
Copy link
Member

gibfahn commented Jan 15, 2018

Release team were -1 on landing on v6.x, if you disagree let us know.

@djphoenix
Copy link
Contributor Author

djphoenix commented Jan 16, 2018

@gibfahn I’m not sure, so let NodeJS team decide. For me it’s enough to have this feature in latest versions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@addaleax addaleax addaleax left review comments

@jasnell jasnell jasnell approved these changes

@BridgeAR BridgeAR BridgeAR approved these changes

@shigeki shigeki Awaiting requested review from shigeki

+2 more reviewers

@mscdex mscdex mscdex left review comments

@indutny indutny indutny approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

semver-minor PRs that contain new features and should be released in the next minor version. tls Issues and PRs related to the tls subsystem.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

10 participants

@djphoenix @jasnell @indutny @BridgeAR @MylesBorins @gibfahn @mscdex @addaleax @Trott @nodejs-github-bot