Skip to content

tls: Add PSK support (v9.0.0-pre) #14978

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
taylorzane wants to merge 28 commits into from
Closed

tls: Add PSK support (v9.0.0-pre) #14978

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
28 commits
Select commit Hold shift + click to select a range
fc041a8
tls: Applied PR #6701 to master, and updated outdated code snippets, …
taylorzane Aug 22, 2017
9e188bc
tls: Updated TLS-PSK Circuit test to pass all assertions.
taylorzane Aug 22, 2017
51db277
tls: Updated TLS documentation to detail that pskIdentity must be enc…
taylorzane Aug 22, 2017
09b9a8e
tls: Updated TLS-PSK tests to use `method() {}` syntax instead of `me…
taylorzane Aug 22, 2017
e954c49
tls: Updated SetPskIdentity to not throw when provided with too many …
taylorzane Aug 22, 2017
caadeaf
tls: Updated createSecureContext TLS-PSK logic to use `internal/error…
taylorzane Aug 22, 2017
45c120b
tls: Updated formatting to conform with eslint rules.
taylorzane Aug 22, 2017
eef89b8
tls: Added #14978 PR to the `changes:` section. Improved wording of p…
taylorzane Aug 22, 2017
6f095f8
tls: Updated tests to use the `common.skip` method when crypto is not…
taylorzane Aug 22, 2017
ba22b97
tls: Updated `onpskexchange` callback to use `ArrayBuffer.isView`. Cl…
taylorzane Aug 22, 2017
ba0727e
tls: Added `HandleScope` to PSK callbacks. Updated calls to `onpskexc…
taylorzane Aug 22, 2017
361b5ed
tls: Updated a few `assert` calls to use the proper `CHECK` call.
taylorzane Aug 22, 2017
49a285f
tls: Updated PSK callbacks to use `MaybeLocal` overload of `NewFromUt…
taylorzane Aug 22, 2017
16921ab
tls: Updated docs and tests to reflect changes to the TLS-PSK API.
taylorzane Aug 23, 2017
959887e
tls: Updated TLS-PSK API to only accept strings for `psk` and `identi…
taylorzane Aug 23, 2017
65cb351
tls: Updated TLS-PSK tests to not use `common.PORT` when possible. Ad…
taylorzane Aug 25, 2017
7b43283
tls: Updated TLS to check that TLS-PSK callback is a function. Update…
taylorzane Aug 25, 2017
bbbb658
tls: Updated `PSKClientCallback` to use a better method for casting a…
taylorzane Aug 25, 2017
5136c93
tls: Fixed linter error in _tls_common.js.
taylorzane Aug 25, 2017
6ed9f92
tls: Updated `PSKServerCallback` to use a better method for casting a…
taylorzane Aug 25, 2017
97a71bd
tls: Renamed `pskIdentity` to `pskIdentityHint`. Updated errors to us…
taylorzane Apr 13, 2018
b810f97
tls: Updated PSK callbacks to use the new syntax for getting the SSL …
taylorzane Apr 13, 2018
92fc64e
tls: Updated PSK tests to use new error messages, improved test asser…
taylorzane Apr 13, 2018
4880511
tls: Resolved lint errors.
taylorzane Apr 13, 2018
40fae68
tls: Updated PSK code to latest best practices.
taylorzane Apr 25, 2018
001b3bd
tls: Removed an unused env string.
taylorzane Apr 25, 2018
34e54c9
tls: Updated PSK functions to use automatic memory management.
taylorzane May 24, 2018
31fff46
tls: Add PSK support
taylorzane Aug 22, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
tls: Renamed pskIdentity to pskIdentityHint. Updated errors to us… 
…e the new error throwing format.
  • Loading branch information
@taylorzane
taylorzane committed Oct 1, 2018
commit 97a71bd60ba0536480bde08afe45067c51f81f33
2 changes: 1 addition & 1 deletion doc/api/tls.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1380,7 +1380,7 @@ changes:
`rejectUnauthorized` if a client attempts to specify a certificate for the
session.
* *Note*: `psk` must be a hexadecimal string.
* `pskIdentity`: {string} The identity hint to send to clients when
* `pskIdentityHint`: {string} The identity hint to send to clients when
negotiating TLS-PSK.

@tniessen tniessen Oct 28, 2017

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Non-blocking suggestion: I would prefer to call this pskIdentityHint. Depending on the application, identity hints may use a different format than identities, and even if they use the same format, their values may differ.

* *Note*: Must use UTF-8 encoding.
* `options`
Expand Down
12 changes: 6 additions & 6 deletions lib/_tls_common.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,7 +164,7 @@ exports.createSecureContext = function createSecureContext(options, context) {

if (options.pskCallback && c.context.enablePskCallback) {
if (typeof options.pskCallback !== 'function') {
throw new errors.TypeError('ERR_INVALID_ARG_TYPE', 'pskCallback',
throw new ERR_INVALID_ARG_TYPE('pskCallback',
'function', options.pskCallback);
}

Expand All @@ -178,19 +178,19 @@ exports.createSecureContext = function createSecureContext(options, context) {
ret = { psk: ret.psk, identity: ret.identity };

if (!typeof ret.psk === 'string') {
throw new errors.TypeError('ERR_INVALID_ARG_TYPE', 'psk', ['string']);
throw new ERR_INVALID_ARG_TYPE('psk', ['string']);
}
if (ret.psk.length / 2 > maxPskLen) {
throw new errors.RangeError(

@taylorzane taylorzane Aug 22, 2017

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this the proper error to throw? There wasn't an existing error that satisfied the previous generic RangeError, so I just used ERR_ASSERTION.

@taylorzane taylorzane Aug 22, 2017

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also, how is the formatting on these lines? It complies with eslint, but it's ugly as sin.

'ERR_ASSERTION',
`Pre-shared key exceed ${maxPskLen} bytes`
`Pre-shared key exceeds ${maxPskLen} bytes`
);
}

// Only set for the client callback, which must provide an identity.
if (maxIdentLen) {
if (typeof ret.identity !== 'string') {
throw new errors.TypeError('ERR_INVALID_ARG_TYPE', 'identity',
throw new ERR_INVALID_ARG_TYPE('identity',
'string');
}
if (ret.identity.length > maxIdentLen) {
Expand All @@ -206,8 +206,8 @@ exports.createSecureContext = function createSecureContext(options, context) {
};
c.context.enablePskCallback();

if (options.pskIdentity)
c.context.setPskIdentity(options.pskIdentity);
if (options.pskIdentityHint)
c.context.setPskIdentity(options.pskIdentityHint);
}

if (options.sessionIdContext) {
Expand Down
4 changes: 2 additions & 2 deletions lib/_tls_wrap.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -847,7 +847,7 @@ function Server(options, listener) {
secureProtocol: this.secureProtocol,
secureOptions: this.secureOptions,
pskCallback: this.pskCallback,
pskIdentity: this.pskIdentity,
pskIdentityHint: this.pskIdentityHint,
honorCipherOrder: this.honorCipherOrder,
crl: this.crl,
sessionIdContext: this.sessionIdContext
Expand Down Expand Up @@ -936,7 +936,7 @@ Server.prototype.setOptions = function(options) {
else
this.honorCipherOrder = true;
if (secureOptions) this.secureOptions = secureOptions;
if (options.pskIdentity) this.pskIdentity = options.pskIdentity;
if (options.pskIdentityHint) this.pskIdentityHint = options.pskIdentityHint;
if (options.pskCallback) this.pskCallback = options.pskCallback;
if (options.NPNProtocols) tls.convertNPNProtocols(options.NPNProtocols, this);
if (options.ALPNProtocols)
Expand Down