Check X.509 ASN.1, BIO, time, OID, and DER conversion results.
Preserve invalid-time diagnostics, reject incomplete BIO writes, format
RSA exponents atomically, and avoid truncating long object identifiers.
Preserve valid siblings in legacy name objects by omitting individual
non-text AttributeValues. Continue treating structural failures and
failed conversion of supported string types as conversion failures.
Reject empty or malformed SAN and AIA extensions, and prevent TLS
hostname checks from falling back to commonName after a malformed SAN.
Guard missing public keys and non-NIST curve names. Scope fallible
backend probes without consuming callback errors, parse checkIP()
inputs to exact address bytes, and preserve unrelated backend errors.
Assisted-by: Codex
Co-authored-by: Matteo Collina <hello@matteocollina.com>
Signed-off-by: Matteo Collina <hello@matteocollina.com>
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Refs: https://hackerone.com/reports/3910015
Refs: https://hackerone.com/reports/3824331
Refs: https://hackerone.com/reports/3944830
Refs: https://hackerone.com/reports/3944847
PR-URL: https://github.com/nodejs-private/node-private/pull/966
Reviewed-By: James M Snell <jasnell@gmail.com>
Pass group names through EC key generation and report provider names
in key details without requiring an OpenSSL NID. Preserve established
curve aliases and synchronous invalid-curve errors.
Filter built-in curves through EC parameter generation and refresh
getCurves() results when FIPS properties change.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/66108
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Resolve provider ciphers before serializing private keys and retain the
fetched implementation across encoding configuration copies and async
key generation. Keep format-specific restrictions in the serializers.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/66108
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Import RSA public keys through OSSL_DECODER on OpenSSL 3 so the
resulting keys stay provider-backed. Preserve the PKCS#1 input structure
and the ASN.1 encodings accepted by the legacy decoder.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/66108
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Provider-backed keys can have no numeric OpenSSL ID. Identify and
construct asymmetric keys by algorithm name, replacing the custom PQC
name-to-NID substitution with provider-aware matching in ncrypto.
Centralize known algorithm names, public key-type names, capabilities,
and backend compatibility in ncrypto. Use named key generation jobs and
remove asymmetric EVP_PKEY constants from the internal JavaScript
binding.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/65966
Reviewed-By: James M Snell <jasnell@gmail.com>
This commit sets the OpenSSL error mark before calling
X509_STORE_load_locations and pops the error mark afterwards.
The motivation for this is that it is possible that
X509_STORE_load_locations can produce errors if the configuration
option --openssl-system-ca-path file does not exist. Later if a
different function is called which calls an OpenSSL function it could
fail because these errors might still be on the OpenSSL error stack.
Currently, all functions that call NewRootCertStore clear the
OpenSSL error queue upon returning, but this was not the case for
example in v12.18.0.
PR-URL: https://github.com/nodejs/node/pull/35514
Fixes: https://github.com/nodejs/node/issues/35456
Reviewed-By: Rich Trott <rtrott@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Filip Skokan