Skip to content

Commit fadcb2d

Browse files
tniessendanbev
authored andcommitted
crypto: simplify missing passphrase detection
PR-URL: #27089 Reviewed-By: Sam Roberts <[email protected]> Reviewed-By: Daniel Bevenius <[email protected]> Reviewed-By: Ben Noordhuis <[email protected]> Reviewed-By: James M Snell <[email protected]>
1 parent 5a8c55f commit fadcb2d

File tree

1 file changed

+14
-30
lines changed

1 file changed

+14
-30
lines changed

src/node_crypto.cc

+14-30
Original file line numberDiff line numberDiff line change
@@ -164,28 +164,8 @@ template int SSLWrap<TLSWrap>::SelectALPNCallback(
164164
unsigned int inlen,
165165
void* arg);
166166

167-
class PasswordCallbackInfo {
168-
public:
169-
explicit PasswordCallbackInfo(const char* passphrase)
170-
: passphrase_(passphrase) {}
171-
172-
inline const char* GetPassword() {
173-
needs_passphrase_ = true;
174-
return passphrase_;
175-
}
176-
177-
inline bool CalledButEmpty() {
178-
return needs_passphrase_ && passphrase_ == nullptr;
179-
}
180-
181-
private:
182-
const char* passphrase_;
183-
bool needs_passphrase_ = false;
184-
};
185-
186167
static int PasswordCallback(char* buf, int size, int rwflag, void* u) {
187-
PasswordCallbackInfo* info = static_cast<PasswordCallbackInfo*>(u);
188-
const char* passphrase = info->GetPassword();
168+
const char* passphrase = static_cast<char*>(u);
189169
if (passphrase != nullptr) {
190170
size_t buflen = static_cast<size_t>(size);
191171
size_t len = strlen(passphrase);
@@ -195,7 +175,7 @@ static int PasswordCallback(char* buf, int size, int rwflag, void* u) {
195175
return len;
196176
}
197177

198-
return 0;
178+
return -1;
199179
}
200180

201181
// Loads OpenSSL engine by engine id and returns it. The loaded engine
@@ -730,12 +710,11 @@ void SecureContext::SetKey(const FunctionCallbackInfo<Value>& args) {
730710

731711
node::Utf8Value passphrase(env->isolate(), args[1]);
732712

733-
PasswordCallbackInfo cb_info(len == 1 ? nullptr : *passphrase);
734713
EVPKeyPointer key(
735714
PEM_read_bio_PrivateKey(bio.get(),
736715
nullptr,
737716
PasswordCallback,
738-
&cb_info));
717+
*passphrase));
739718

740719
if (!key) {
741720
unsigned long err = ERR_get_error(); // NOLINT(runtime/int)
@@ -3136,7 +3115,8 @@ static ParseKeyResult ParsePrivateKey(EVPKeyPointer* pkey,
31363115
const PrivateKeyEncodingConfig& config,
31373116
const char* key,
31383117
size_t key_len) {
3139-
PasswordCallbackInfo pc_info(config.passphrase_.get());
3118+
// OpenSSL needs a non-const pointer, that's why the const_cast is required.
3119+
char* const passphrase = const_cast<char*>(config.passphrase_.get());
31403120

31413121
if (config.format_ == kKeyFormatPEM) {
31423122
BIOPointer bio(BIO_new_mem_buf(key, key_len));
@@ -3146,7 +3126,7 @@ static ParseKeyResult ParsePrivateKey(EVPKeyPointer* pkey,
31463126
pkey->reset(PEM_read_bio_PrivateKey(bio.get(),
31473127
nullptr,
31483128
PasswordCallback,
3149-
&pc_info));
3129+
passphrase));
31503130
} else {
31513131
CHECK_EQ(config.format_, kKeyFormatDER);
31523132

@@ -3163,7 +3143,7 @@ static ParseKeyResult ParsePrivateKey(EVPKeyPointer* pkey,
31633143
pkey->reset(d2i_PKCS8PrivateKey_bio(bio.get(),
31643144
nullptr,
31653145
PasswordCallback,
3166-
&pc_info));
3146+
passphrase));
31673147
} else {
31683148
PKCS8Pointer p8inf(d2i_PKCS8_PRIV_KEY_INFO_bio(bio.get(), nullptr));
31693149
if (p8inf)
@@ -3177,13 +3157,17 @@ static ParseKeyResult ParsePrivateKey(EVPKeyPointer* pkey,
31773157
}
31783158

31793159
// OpenSSL can fail to parse the key but still return a non-null pointer.
3180-
if (ERR_peek_error() != 0)
3160+
unsigned long err = ERR_peek_error(); // NOLINT(runtime/int)
3161+
if (err != 0)
31813162
pkey->reset();
31823163

31833164
if (*pkey)
31843165
return ParseKeyResult::kParseKeyOk;
3185-
if (pc_info.CalledButEmpty())
3186-
return ParseKeyResult::kParseKeyNeedPassphrase;
3166+
if (ERR_GET_LIB(err) == ERR_LIB_PEM &&
3167+
ERR_GET_REASON(err) == PEM_R_BAD_PASSWORD_READ) {
3168+
if (config.passphrase_.get() == nullptr)
3169+
return ParseKeyResult::kParseKeyNeedPassphrase;
3170+
}
31873171
return ParseKeyResult::kParseKeyFailed;
31883172
}
31893173

0 commit comments

Comments
 (0)