Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

Commit 9b30bc4

Browse filesBrowse files
shigekiMylesBorins
authored andcommitted
tls: fix getEphemeralKeyInfo to support X25519
`EVP_PKEY_EC` only covers ANSI X9.62 curves not IETF ones(curve25519 and curve448). This fixes to add support of X25519 in `tlsSocket.getEphemeralKeyInfo()`. X448 should be added in the future upgrade to OpenSSL-1.1.1. PR-URL: #20273 Fixes: #20262 Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Tobias Nießen <tniessen@tnie.de>
1 parent e45e5b8 commit 9b30bc4
Copy full SHA for 9b30bc4

File tree

Expand file treeCollapse file tree

3 files changed

+25
-7
lines changed
Open diff view settings
Filter options
Expand file treeCollapse file tree

3 files changed

+25
-7
lines changed
Open diff view settings
Collapse file

‎src/node_crypto.cc‎

Copy file name to clipboardExpand all lines: src/node_crypto.cc
+16-5Lines changed: 16 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2096,27 +2096,38 @@ void SSLWrap<Base>::GetEphemeralKeyInfo(
20962096
EVP_PKEY* key;
20972097

20982098
if (SSL_get_server_tmp_key(w->ssl_, &key)) {
2099-
switch (EVP_PKEY_id(key)) {
2099+
int kid = EVP_PKEY_id(key);
2100+
switch (kid) {
21002101
case EVP_PKEY_DH:
21012102
info->Set(context, env->type_string(),
21022103
FIXED_ONE_BYTE_STRING(env->isolate(), "DH")).FromJust();
21032104
info->Set(context, env->size_string(),
21042105
Integer::New(env->isolate(), EVP_PKEY_bits(key))).FromJust();
21052106
break;
21062107
case EVP_PKEY_EC:
2108+
// TODO(shigeki) Change this to EVP_PKEY_X25519 and add EVP_PKEY_X448
2109+
// after upgrading to 1.1.1.
2110+
case NID_X25519:
21072111
{
2108-
EC_KEY* ec = EVP_PKEY_get1_EC_KEY(key);
2109-
int nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
2110-
EC_KEY_free(ec);
2112+
const char* curve_name;
2113+
if (kid == EVP_PKEY_EC) {
2114+
EC_KEY* ec = EVP_PKEY_get1_EC_KEY(key);
2115+
int nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
2116+
curve_name = OBJ_nid2sn(nid);
2117+
EC_KEY_free(ec);
2118+
} else {
2119+
curve_name = OBJ_nid2sn(kid);
2120+
}
21112121
info->Set(context, env->type_string(),
21122122
FIXED_ONE_BYTE_STRING(env->isolate(), "ECDH")).FromJust();
21132123
info->Set(context, env->name_string(),
21142124
OneByteString(args.GetIsolate(),
2115-
OBJ_nid2sn(nid))).FromJust();
2125+
curve_name)).FromJust();
21162126
info->Set(context, env->size_string(),
21172127
Integer::New(env->isolate(),
21182128
EVP_PKEY_bits(key))).FromJust();
21192129
}
2130+
break;
21202131
}
21212132
EVP_PKEY_free(key);
21222133
}
Collapse file

‎src/node_crypto.h‎

Copy file name to clipboardExpand all lines: src/node_crypto.h
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,8 @@
4444
#endif // !OPENSSL_NO_ENGINE
4545
#include <openssl/err.h>
4646
#include <openssl/evp.h>
47+
// TODO(shigeki) Remove this after upgrading to 1.1.1
48+
#include <openssl/obj_mac.h>
4749
#include <openssl/pem.h>
4850
#include <openssl/x509.h>
4951
#include <openssl/x509v3.h>
Collapse file

‎test/parallel/test-tls-client-getephemeralkeyinfo.js‎

Copy file name to clipboardExpand all lines: test/parallel/test-tls-client-getephemeralkeyinfo.js
+7-2Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -82,13 +82,18 @@ function testECDHE256() {
8282
}
8383

8484
function testECDHE512() {
85-
test(521, 'ECDH', 'secp521r1', null);
85+
test(521, 'ECDH', 'secp521r1', testX25519);
86+
ntests++;
87+
}
88+
89+
function testX25519() {
90+
test(253, 'ECDH', 'X25519', null);
8691
ntests++;
8792
}
8893

8994
testNOT_PFS();
9095

9196
process.on('exit', function() {
9297
assert.strictEqual(ntests, nsuccess);
93-
assert.strictEqual(ntests, 5);
98+
assert.strictEqual(ntests, 6);
9499
});

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.