Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 016e352

Browse filesBrowse files
sam-githubBethGriggs
sam-github
authored and
BethGriggs
committed
test: test TLS client authentication
TLS client authentication should be tested, including failure scenarios. PR-URL: #24733 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
1 parent 39af61f commit 016e352
Copy full SHA for 016e352

File tree

Expand file treeCollapse file tree

3 files changed

+339
-3
lines changed
Open diff view settings
Filter options
Expand file treeCollapse file tree

3 files changed

+339
-3
lines changed
Open diff view settings
Collapse file

‎doc/api/tls.md‎

Copy file name to clipboardExpand all lines: doc/api/tls.md
+2Lines changed: 2 additions & 0 deletions
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -1092,6 +1092,8 @@ changes:
10921092
certificate can match or chain to.
10931093
For self-signed certificates, the certificate is its own CA, and must be
10941094
provided.
1095+
For PEM encoded certificates, supported types are "X509 CERTIFICATE", and
1096+
"CERTIFICATE".
10951097
* `cert` {string|string[]|Buffer|Buffer[]} Cert chains in PEM format. One cert
10961098
chain should be provided per private key. Each cert chain should consist of
10971099
the PEM formatted certificate for a provided private `key`, followed by the
Collapse file

‎test/fixtures/tls-connect.js‎

Copy file name to clipboardExpand all lines: test/fixtures/tls-connect.js
+6-3Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,15 +26,18 @@ const keys = exports.keys = {
2626
agent5: load('agent5', 'ca2'),
2727
agent6: load('agent6', 'ca1'),
2828
agent7: load('agent7', 'fake-cnnic-root'),
29+
agent10: load('agent10', 'ca2'),
30+
ec10: load('ec10', 'ca5'),
2931
ec: load('ec', 'ec'),
3032
};
3133

32-
function load(cert, issuer) {
33-
issuer = issuer || cert; // Assume self-signed if no issuer
34+
// root is the self-signed root of the trust chain, not an intermediate ca.
35+
function load(cert, root) {
36+
root = root || cert; // Assume self-signed if no issuer
3437
const id = {
3538
key: fixtures.readKey(cert + '-key.pem', 'binary'),
3639
cert: fixtures.readKey(cert + '-cert.pem', 'binary'),
37-
ca: fixtures.readKey(issuer + '-cert.pem', 'binary'),
40+
ca: fixtures.readKey(root + '-cert.pem', 'binary'),
3841
};
3942
return id;
4043
}
Collapse file

‎test/parallel/test-tls-client-auth.js‎

Copy file name to clipboard
+331Lines changed: 331 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,331 @@
1+
'use strict';
2+
3+
require('../common');
4+
const fixtures = require('../common/fixtures');
5+
6+
const {
7+
assert, connect, keys
8+
} = require(fixtures.path('tls-connect'));
9+
10+
// Use ec10 and agent10, they are the only identities with intermediate CAs.
11+
const client = keys.ec10;
12+
const server = keys.agent10;
13+
14+
// The certificates aren't for "localhost", so override the identity check.
15+
function checkServerIdentity(hostname, cert) {
16+
assert.strictEqual(hostname, 'localhost');
17+
assert.strictEqual(cert.subject.CN, 'agent10.example.com');
18+
}
19+
20+
// Split out the single end-entity cert and the subordinate CA for later use.
21+
split(client.cert, client);
22+
split(server.cert, server);
23+
24+
function split(file, into) {
25+
const certs = /([^]*END CERTIFICATE-----\r?\n)(-----BEGIN[^]*)/.exec(file);
26+
assert.strictEqual(certs.length, 3);
27+
into.single = certs[1];
28+
into.subca = certs[2];
29+
}
30+
31+
// Typical setup, nothing special, complete cert chains sent to peer.
32+
connect({
33+
client: {
34+
key: client.key,
35+
cert: client.cert,
36+
ca: server.ca,
37+
checkServerIdentity,
38+
},
39+
server: {
40+
key: server.key,
41+
cert: server.cert,
42+
ca: client.ca,
43+
requestCert: true,
44+
},
45+
}, function(err, pair, cleanup) {
46+
assert.ifError(err);
47+
return cleanup();
48+
});
49+
50+
// As above, but without requesting client's cert.
51+
connect({
52+
client: {
53+
ca: server.ca,
54+
checkServerIdentity,
55+
},
56+
server: {
57+
key: server.key,
58+
cert: server.cert,
59+
ca: client.ca,
60+
},
61+
}, function(err, pair, cleanup) {
62+
assert.ifError(err);
63+
return cleanup();
64+
});
65+
66+
// Request cert from client that doesn't have one.
67+
connect({
68+
client: {
69+
ca: server.ca,
70+
checkServerIdentity,
71+
},
72+
server: {
73+
key: server.key,
74+
cert: server.cert,
75+
ca: client.ca,
76+
requestCert: true,
77+
},
78+
}, function(err, pair, cleanup) {
79+
assert.strictEqual(err.code, 'ECONNRESET');
80+
return cleanup();
81+
});
82+
83+
// Typical configuration error, incomplete cert chains sent, we have to know the
84+
// peer's subordinate CAs in order to verify the peer.
85+
connect({
86+
client: {
87+
key: client.key,
88+
cert: client.single,
89+
ca: [server.ca, server.subca],
90+
checkServerIdentity,
91+
},
92+
server: {
93+
key: server.key,
94+
cert: server.single,
95+
ca: [client.ca, client.subca],
96+
requestCert: true,
97+
},
98+
}, function(err, pair, cleanup) {
99+
assert.ifError(err);
100+
return cleanup();
101+
});
102+
103+
// Like above, but provide root CA and subordinate CA as multi-PEM.
104+
connect({
105+
client: {
106+
key: client.key,
107+
cert: client.single,
108+
ca: server.ca + '\n' + server.subca,
109+
checkServerIdentity,
110+
},
111+
server: {
112+
key: server.key,
113+
cert: server.single,
114+
ca: client.ca + '\n' + client.subca,
115+
requestCert: true,
116+
},
117+
}, function(err, pair, cleanup) {
118+
assert.ifError(err);
119+
return cleanup();
120+
});
121+
122+
// Like above, but provide multi-PEM in an array.
123+
connect({
124+
client: {
125+
key: client.key,
126+
cert: client.single,
127+
ca: [server.ca + '\n' + server.subca],
128+
checkServerIdentity,
129+
},
130+
server: {
131+
key: server.key,
132+
cert: server.single,
133+
ca: [client.ca + '\n' + client.subca],
134+
requestCert: true,
135+
},
136+
}, function(err, pair, cleanup) {
137+
assert.ifError(err);
138+
return cleanup();
139+
});
140+
141+
// Fail to complete server's chain
142+
connect({
143+
client: {
144+
ca: server.ca,
145+
checkServerIdentity,
146+
},
147+
server: {
148+
key: server.key,
149+
cert: server.single,
150+
},
151+
}, function(err, pair, cleanup) {
152+
assert.strictEqual(err.code, 'UNABLE_TO_VERIFY_LEAF_SIGNATURE');
153+
return cleanup();
154+
});
155+
156+
// Fail to complete client's chain.
157+
connect({
158+
client: {
159+
key: client.key,
160+
cert: client.single,
161+
ca: server.ca,
162+
checkServerIdentity,
163+
},
164+
server: {
165+
key: server.key,
166+
cert: server.cert,
167+
ca: client.ca,
168+
requestCert: true,
169+
},
170+
}, function(err, pair, cleanup) {
171+
assert.ifError(pair.client.error);
172+
assert.ifError(pair.server.error);
173+
assert.strictEqual(err.code, 'ECONNRESET');
174+
return cleanup();
175+
});
176+
177+
// Fail to find CA for server.
178+
connect({
179+
client: {
180+
checkServerIdentity,
181+
},
182+
server: {
183+
key: server.key,
184+
cert: server.cert,
185+
},
186+
}, function(err, pair, cleanup) {
187+
assert.strictEqual(err.code, 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY');
188+
return cleanup();
189+
});
190+
191+
// Server sent their CA, but CA cannot be trusted if it is not locally known.
192+
connect({
193+
client: {
194+
checkServerIdentity,
195+
},
196+
server: {
197+
key: server.key,
198+
cert: server.cert + '\n' + server.ca,
199+
},
200+
}, function(err, pair, cleanup) {
201+
assert.strictEqual(err.code, 'SELF_SIGNED_CERT_IN_CHAIN');
202+
return cleanup();
203+
});
204+
205+
// Server sent their CA, wrongly, but its OK since we know the CA locally.
206+
connect({
207+
client: {
208+
checkServerIdentity,
209+
ca: server.ca,
210+
},
211+
server: {
212+
key: server.key,
213+
cert: server.cert + '\n' + server.ca,
214+
},
215+
}, function(err, pair, cleanup) {
216+
assert.ifError(err);
217+
return cleanup();
218+
});
219+
220+
// Fail to complete client's chain.
221+
connect({
222+
client: {
223+
key: client.key,
224+
cert: client.single,
225+
ca: server.ca,
226+
checkServerIdentity,
227+
},
228+
server: {
229+
key: server.key,
230+
cert: server.cert,
231+
ca: client.ca,
232+
requestCert: true,
233+
},
234+
}, function(err, pair, cleanup) {
235+
assert.strictEqual(err.code, 'ECONNRESET');
236+
return cleanup();
237+
});
238+
239+
// Fail to find CA for client.
240+
connect({
241+
client: {
242+
key: client.key,
243+
cert: client.cert,
244+
ca: server.ca,
245+
checkServerIdentity,
246+
},
247+
server: {
248+
key: server.key,
249+
cert: server.cert,
250+
requestCert: true,
251+
},
252+
}, function(err, pair, cleanup) {
253+
assert.strictEqual(err.code, 'ECONNRESET');
254+
return cleanup();
255+
});
256+
257+
// Confirm lack of support for "BEGIN TRUSTED CERTIFICATE".
258+
connect({
259+
client: {
260+
key: client.key,
261+
cert: client.cert,
262+
ca: server.ca.replace(/CERTIFICATE/g, 'TRUSTED CERTIFICATE'),
263+
checkServerIdentity,
264+
},
265+
server: {
266+
key: server.key,
267+
cert: server.cert,
268+
ca: client.ca,
269+
requestCert: true,
270+
},
271+
}, function(err, pair, cleanup) {
272+
assert.strictEqual(err.code, 'UNABLE_TO_GET_ISSUER_CERT_LOCALLY');
273+
return cleanup();
274+
});
275+
276+
// Confirm lack of support for "BEGIN TRUSTED CERTIFICATE".
277+
connect({
278+
client: {
279+
key: client.key,
280+
cert: client.cert,
281+
ca: server.ca,
282+
checkServerIdentity,
283+
},
284+
server: {
285+
key: server.key,
286+
cert: server.cert,
287+
ca: client.ca.replace(/CERTIFICATE/g, 'TRUSTED CERTIFICATE'),
288+
requestCert: true,
289+
},
290+
}, function(err, pair, cleanup) {
291+
assert.strictEqual(err.code, 'ECONNRESET');
292+
return cleanup();
293+
});
294+
295+
// Confirm support for "BEGIN X509 CERTIFICATE".
296+
connect({
297+
client: {
298+
key: client.key,
299+
cert: client.cert,
300+
ca: server.ca.replace(/CERTIFICATE/g, 'X509 CERTIFICATE'),
301+
checkServerIdentity,
302+
},
303+
server: {
304+
key: server.key,
305+
cert: server.cert,
306+
ca: client.ca,
307+
requestCert: true,
308+
},
309+
}, function(err, pair, cleanup) {
310+
assert.ifError(err);
311+
return cleanup();
312+
});
313+
314+
// Confirm support for "BEGIN X509 CERTIFICATE".
315+
connect({
316+
client: {
317+
key: client.key,
318+
cert: client.cert,
319+
ca: server.ca,
320+
checkServerIdentity,
321+
},
322+
server: {
323+
key: server.key,
324+
cert: server.cert,
325+
ca: client.ca.replace(/CERTIFICATE/g, 'X509 CERTIFICATE'),
326+
requestCert: true,
327+
},
328+
}, function(err, pair, cleanup) {
329+
assert.ifError(err);
330+
return cleanup();
331+
});

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.