mirror of
https://github.com/nodejs/node.git
synced 2026-10-28 10:15:07 +08:00
Lazizbek Ergashev
ef2be18590
AddCRL() read a single PEM block and returned, so a crl option holding several concatenated CRLs only ever got its first entry into the store. Any certificate whose issuer's CRL came later in the bundle then failed with UNABLE_TO_GET_CRL. Read in a loop until the BIO is exhausted, the way AddCACertificates() right above it already does for ca bundles. Signed-off-by: Lazizbek Ergashev <lazerg2@gmail.com> PR-URL: https://github.com/nodejs/node/pull/65577 Fixes: https://github.com/nodejs/node/issues/65576 Reviewed-By: Tim Perry <pimterry@gmail.com> Reviewed-By: Anna Henningsen <anna@addaleax.net>
43 lines
1.2 KiB
JavaScript
43 lines
1.2 KiB
JavaScript
'use strict';
|
|
const common = require('../common');
|
|
if (!common.hasCrypto)
|
|
common.skip('missing crypto');
|
|
|
|
// Verify that every CRL in a concatenated PEM bundle is loaded, not just the
|
|
// first one. agent3 is revoked by ca2-crl-agent3.pem, but not by ca2-crl.pem.
|
|
|
|
const fixtures = require('../common/fixtures');
|
|
const tls = require('tls');
|
|
const {
|
|
assert, connect, keys
|
|
} = require(fixtures.path('tls-connect'));
|
|
|
|
const crl = fixtures.readKey('ca2-crl.pem') +
|
|
fixtures.readKey('ca2-crl-agent3.pem');
|
|
|
|
connect({
|
|
client: {
|
|
servername: 'agent3',
|
|
ca: keys.agent3.ca,
|
|
crl,
|
|
},
|
|
server: {
|
|
cert: keys.agent3.cert,
|
|
key: keys.agent3.key,
|
|
},
|
|
}, common.mustCall((err, pair, cleanup) => {
|
|
assert(err);
|
|
assert.strictEqual(err.code, 'CERT_REVOKED');
|
|
return cleanup();
|
|
}));
|
|
|
|
// A bundle whose second entry does not parse must throw rather than quietly
|
|
// apply only the CRLs that were read.
|
|
const lines = fixtures.readKey('ca2-crl-agent3.pem', 'utf8').split('\n');
|
|
lines[2] = 'AAAA' + lines[2].slice(4);
|
|
assert.throws(() => {
|
|
tls.createSecureContext({
|
|
crl: fixtures.readKey('ca2-crl.pem', 'utf8') + lines.join('\n'),
|
|
});
|
|
}, { code: 'ERR_CRYPTO_OPERATION_FAILED' });
|