From 8dfe0732447c552ad9f52c3a6ac0f0bbc8a7a1e2 Mon Sep 17 00:00:00 2001
From: Yury Popov <github@phoenix.dj>
Date: Sat, 12 Aug 2017 19:06:35 +0300
Subject: [PATCH] tls: multiple PFX in createSecureContext

Add support for multiple PFX files in tls.createSecureContext.
Also added support for object-style PFX pass.

PR-URL: https://github.com/nodejs/node/pull/14793
Fixes: https://github.com/nodejs/node/issues/14756
Reviewed-By: Ruben Bridgewater <ruben@bridgewater.de>
Reviewed-By: Fedor Indutny <fedor.indutny@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
---
 doc/api/tls.md                      |  12 ++++---
 lib/_tls_common.js                  |  29 ++++++++++------
 test/fixtures/keys/Makefile         |   8 +++++
 test/fixtures/keys/ec-pfx.pem       | Bin 0 -> 1006 bytes
 test/parallel/test-tls-multi-pfx.js |  50 ++++++++++++++++++++++++++++
 5 files changed, 85 insertions(+), 14 deletions(-)
 create mode 100644 test/fixtures/keys/ec-pfx.pem
 create mode 100644 test/parallel/test-tls-multi-pfx.js

diff --git a/doc/api/tls.md b/doc/api/tls.md
index e18bbb62b1908f..ebcf85438fdeb5 100644
--- a/doc/api/tls.md
+++ b/doc/api/tls.md
@@ -934,10 +934,14 @@ changes:
 -->
 
 * `options` {Object}
-  * `pfx` {string|Buffer} Optional PFX or PKCS12 encoded private key and
-    certificate chain. `pfx` is an alternative to providing `key` and `cert`
-    individually. PFX is usually encrypted, if it is, `passphrase` will be used
-    to decrypt it.
+  * `pfx` {string|string[]|Buffer|Buffer[]|Object[]} Optional PFX or PKCS12
+    encoded private key and certificate chain. `pfx` is an alternative to
+    providing `key` and `cert` individually. PFX is usually encrypted, if it is,
+    `passphrase` will be used to decrypt it. Multiple PFX can be provided either
+    as an array of unencrypted PFX buffers, or an array of objects in the form
+    `{buf: <string|buffer>[, passphrase: <string>]}`. The object form can only
+    occur in an array. `object.passphrase` is optional. Encrypted PFX will be
+    decrypted with `object.passphrase` if provided, or `options.passphrase` if it is not.
   * `key` {string|string[]|Buffer|Buffer[]|Object[]} Optional private keys in
     PEM format. PEM allows the option of private keys being encrypted. Encrypted
     keys will be decrypted with `options.passphrase`.  Multiple keys using
diff --git a/lib/_tls_common.js b/lib/_tls_common.js
index 36b2ebdad68d0b..3d191b8244871e 100644
--- a/lib/_tls_common.js
+++ b/lib/_tls_common.js
@@ -137,20 +137,29 @@ exports.createSecureContext = function createSecureContext(options, context) {
   }
 
   if (options.pfx) {
-    var pfx = options.pfx;
-    var passphrase = options.passphrase;
-
     if (!crypto)
       crypto = require('crypto');
 
-    pfx = crypto._toBuf(pfx);
-    if (passphrase)
-      passphrase = crypto._toBuf(passphrase);
-
-    if (passphrase) {
-      c.context.loadPKCS12(pfx, passphrase);
+    if (Array.isArray(options.pfx)) {
+      for (i = 0; i < options.pfx.length; i++) {
+        const pfx = options.pfx[i];
+        const raw = pfx.buf ? pfx.buf : pfx;
+        const buf = crypto._toBuf(raw);
+        const passphrase = pfx.passphrase || options.passphrase;
+        if (passphrase) {
+          c.context.loadPKCS12(buf, crypto._toBuf(passphrase));
+        } else {
+          c.context.loadPKCS12(buf);
+        }
+      }
     } else {
-      c.context.loadPKCS12(pfx);
+      const buf = crypto._toBuf(options.pfx);
+      const passphrase = options.passphrase;
+      if (passphrase) {
+        c.context.loadPKCS12(buf, crypto._toBuf(passphrase));
+      } else {
+        c.context.loadPKCS12(buf);
+      }
     }
   }
 
diff --git a/test/fixtures/keys/Makefile b/test/fixtures/keys/Makefile
index c7390eda0eefc4..27fda1eef27c87 100644
--- a/test/fixtures/keys/Makefile
+++ b/test/fixtures/keys/Makefile
@@ -335,6 +335,14 @@ ec-cert.pem: ec-csr.pem ec-key.pem
 		-signkey ec-key.pem \
 		-out ec-cert.pem
 
+ec-pfx.pem: ec-cert.pem ec-key.pem
+	openssl pkcs12 -export \
+		-descert \
+		-in ec-cert.pem \
+		-inkey ec-key.pem \
+		-out ec-pfx.pem \
+		-password pass:
+
 dh512.pem:
 	openssl dhparam -out dh512.pem 512
 
diff --git a/test/fixtures/keys/ec-pfx.pem b/test/fixtures/keys/ec-pfx.pem
new file mode 100644
index 0000000000000000000000000000000000000000..3a4aa7dd696085b04b9a169fb0bfaccb296ee714
GIT binary patch
literal 1006
zcmXqLVt&QM$ZXKWyn&5VtIebBJ1-+U<ANsUg)B|XbAiG$4Vswx5mIamnwT1ZLN!c`
z3_z+BA;V}O!^Q<Qfd^<J9}CCioi9(Rt~JwPV&Y(EXkzjRF1eQ`nR|B2E|uIv4%45l
zJ<TB<5F31#M|dU|+nlAVdgew5PWU6J`aqy`DR;x8GTZQNYj?I;$KUKZbo|$J(>qmM
z*K!sZ)l})GJH80~Ic=GXHm8%&)%O~bJ0|n3Nx8|Ye$y=3<;wBn$NASS5r`?!`1tk3
zpDF9Ie;$6dXub2{7CmF9kgPBN@45!Jl<sl!D!%ns>i2gAxf8BJi{rJ+qEyaU)T=Er
z+@`r;v%buw-{CXoTOD(Y_)sBs;n<^ha@m!)e;m+PdOqR$jz<UOR#>U;o_O1(lKa)F
zPjXtbMCUGD*5vVfkJZ72$A26zxthV>edq4CJ^VpyMS|n@I2qni-d>%3;KQzh)3OfJ
zE;I1)*dO>(yYKzI%Z{eAr_8Ky;3{M6E4XGA9X#QL(XLH@tivMjiEywe+S<k*<e9W{
zURtEP*(&e#4wwCY=j=F_yz6xDgD0;{c3#@%7=BT?N5W-R)f%(ka*fTBvt}9J@p*fu
z$ZX1U!+kp=SEX#tmtOd;^J=zBRG;6kr<H|o7UeybnEE;3jr?nl{{^nk1&!>h4om$r
zoVsvJ>eLxre*4&--2XT8g0+}JJa5d;ZMtE%41avu*_it{FnMysx+{01wbtEgESo!5
zXc3<l<GGDjestR!GAw2m4UiIkdoYnHNurVO;(EvZ7ArRhiezYc@;cR2tym`e?0v?S
zv*IBvy5^iqeg~f09P@7X?eqZVI{(Oj&u{$8c&`26L_utaxc{k=|JzyERw&$kzQX6-
ztIN076qRq;u_w?;Yqr+Mr8YfBvsNs)opyI)i-kcGBNI}>ThRE0rSYRd<2!@K*KFLd
zB*?|cw4iZ|LE}cuba{I!OQP(WUDrVAlBIEigZ<nI6&2SVkNBkAs9kP&Y}bc^wayK}
zXAR0jdn5ApueW1(Tlx85bno|F@7T7<DvMT`EI7F4Uz|3NefGWB-~5wZeCjT{zC3HN
zahBz+wfcEGgnub4*>bO4A*#k#_LYQq*{n$-l9PA??^zuAyK=GY;>M%L@=i<(+5Lyr
zY3iC?^Nbw6eoWo`=DGf3E0N$WLgELz3{?%3;ojpEH56kJ3FMeuv(W$SOwF15I-@mo
z-&@}}W@2DyplHC!#;VQ7%p}Fiz#?)*(m`|DvB|efFMWu6r0`Ams?6d|EF2!(#-Bbs
J+{^&-EC37!#6<uA

literal 0
HcmV?d00001

diff --git a/test/parallel/test-tls-multi-pfx.js b/test/parallel/test-tls-multi-pfx.js
new file mode 100644
index 00000000000000..f750aec325c957
--- /dev/null
+++ b/test/parallel/test-tls-multi-pfx.js
@@ -0,0 +1,50 @@
+'use strict';
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('assert');
+const tls = require('tls');
+const fixtures = require('../common/fixtures');
+
+const options = {
+  pfx: [
+    {
+      buf: fixtures.readKey('agent1-pfx.pem'),
+      passphrase: 'sample'
+    },
+    fixtures.readKey('ec-pfx.pem')
+  ]
+};
+
+const ciphers = [];
+
+const server = tls.createServer(options, function(conn) {
+  conn.end('ok');
+}).listen(0, function() {
+  const ecdsa = tls.connect(this.address().port, {
+    ciphers: 'ECDHE-ECDSA-AES256-GCM-SHA384',
+    rejectUnauthorized: false
+  }, common.mustCall(function() {
+    ciphers.push(ecdsa.getCipher());
+    const rsa = tls.connect(server.address().port, {
+      ciphers: 'ECDHE-RSA-AES256-GCM-SHA384',
+      rejectUnauthorized: false
+    }, common.mustCall(function() {
+      ciphers.push(rsa.getCipher());
+      ecdsa.end();
+      rsa.end();
+      server.close();
+    }));
+  }));
+});
+
+process.on('exit', function() {
+  assert.deepStrictEqual(ciphers, [{
+    name: 'ECDHE-ECDSA-AES256-GCM-SHA384',
+    version: 'TLSv1/SSLv3'
+  }, {
+    name: 'ECDHE-RSA-AES256-GCM-SHA384',
+    version: 'TLSv1/SSLv3'
+  }]);
+});