Skip to content

Commit cf6e599

Browse files
CMCDragonkaiCMCDragonkai
committed
WIP
1 parent be65422 commit cf6e599

File tree

5 files changed

+369
-75
lines changed

5 files changed

+369
-75
lines changed

‎src/config.ts

+35-24
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,8 @@ type QUICConfig = {
2121
* Private key as a PEM string or Uint8Array buffer containing PEM formatted
2222
* key. You can pass multiple keys. The number of keys must match the number
2323
* of certs. Each key must be associated to the the corresponding cert chain.
24+
*
25+
* Currently multiple key and certificate chains is not supported.
2426
*/
2527
key?: string | Array<string> | Uint8Array | Array<Uint8Array>;
2628

@@ -30,6 +32,8 @@ type QUICConfig = {
3032
* certificate chain in subject to issuer order. Multiple certificate chains
3133
* can be passed. The number of certificate chains must match the number of
3234
* keys. Each certificate chain must be associated to the corresponding key.
35+
*
36+
* Currently multiple key and certificate chains is not supported.
3337
*/
3438
cert?: string | Array<string> | Uint8Array | Array<Uint8Array>;
3539

@@ -43,19 +47,21 @@ type QUICConfig = {
4347
* - rsa_pss_rsae_sha256
4448
* - rsa_pss_rsae_sha384
4549
* - rsa_pss_rsae_sha512
46-
* - rsa_pss_pss_sha256
47-
* - rsa_pss_pss_sha384
48-
* - rsa_pss_pss_sha512
4950
* - ecdsa_secp256r1_sha256
5051
* - ecdsa_secp384r1_sha384
5152
* - ecdsa_secp521r1_sha512
5253
* - ed25519
53-
* - ed448
5454
*/
5555
sigalgs?: string;
5656

57+
/**
58+
* Verify the other peer.
59+
* Clients by default set this to true.
60+
* Servers by default set this to false.
61+
*/
5762
verifyPeer: boolean;
58-
logKeys: string | undefined;
63+
64+
logKeys?: string;
5965
grease: boolean;
6066
maxIdleTimeout: number;
6167
maxRecvUdpPayloadSize: number;
@@ -70,29 +76,28 @@ type QUICConfig = {
7076
enableEarlyData: boolean;
7177
};
7278

79+
/**
80+
* BoringSSL does not support:
81+
* - rsa_pss_pss_sha256
82+
* - rsa_pss_pss_sha384
83+
* - rsa_pss_pss_sha512
84+
* - ed448
85+
*/
7386
const sigalgs = [
7487
'rsa_pkcs1_sha256',
7588
'rsa_pkcs1_sha384',
7689
'rsa_pkcs1_sha512',
7790
'rsa_pss_rsae_sha256',
7891
'rsa_pss_rsae_sha384',
7992
'rsa_pss_rsae_sha512',
80-
'rsa_pss_pss_sha256',
81-
'rsa_pss_pss_sha384',
82-
'rsa_pss_pss_sha512',
8393
'ecdsa_secp256r1_sha256',
8494
'ecdsa_secp384r1_sha384',
8595
'ecdsa_secp521r1_sha512',
8696
'ed25519',
87-
'ed448',
8897
].join(':');
8998

9099
const clientDefault: QUICConfig = {
91-
ca: undefined,
92-
key: undefined,
93-
cert: undefined,
94100
sigalgs,
95-
logKeys: undefined,
96101
verifyPeer: true,
97102
grease: true,
98103
maxIdleTimeout: 5000,
@@ -104,16 +109,13 @@ const clientDefault: QUICConfig = {
104109
initialMaxStreamsBidi: 100,
105110
initialMaxStreamsUni: 100,
106111
disableActiveMigration: true,
112+
// Test if this is needed
107113
applicationProtos: ['http/0.9'],
108114
enableEarlyData: true,
109115
};
110116

111117
const serverDefault: QUICConfig = {
112-
ca: undefined,
113-
key: undefined,
114-
cert: undefined,
115118
sigalgs,
116-
logKeys: undefined,
117119
verifyPeer: false,
118120
grease: true,
119121
maxIdleTimeout: 5000,
@@ -125,6 +127,7 @@ const serverDefault: QUICConfig = {
125127
initialMaxStreamsBidi: 100,
126128
initialMaxStreamsUni: 100,
127129
disableActiveMigration: true,
130+
// Test if this is needed
128131
applicationProtos: ['http/0.9'],
129132
enableEarlyData: true,
130133
};
@@ -207,13 +210,21 @@ function buildQuicheConfig(config: QUICConfig): QuicheConfig {
207210
}
208211
certChainPEMBuffers = certChainPEMs.map((c) => textEncoder.encode(c));
209212
}
210-
const quicheConfig: QuicheConfig = quiche.Config.withBoringSslCtx(
211-
config.verifyPeer,
212-
caPEMBuffer,
213-
keyPEMBuffers,
214-
certChainPEMBuffers,
215-
config.sigalgs,
216-
);
213+
let quicheConfig: QuicheConfig;
214+
try {
215+
quicheConfig = quiche.Config.withBoringSslCtx(
216+
config.verifyPeer,
217+
caPEMBuffer,
218+
keyPEMBuffers,
219+
certChainPEMBuffers,
220+
config.sigalgs,
221+
);
222+
} catch (e) {
223+
throw new errors.ErrorQUICConfig(
224+
`Failed to build Quiche config with custom SSL context: ${e.message}`,
225+
{ cause: e }
226+
);
227+
}
217228
if (config.logKeys != null) {
218229
quicheConfig.logKeys();
219230
}

‎src/native/napi/config.rs

+27-28
Original file line numberDiff line numberDiff line change
@@ -90,35 +90,34 @@ impl Config {
9090
)?;
9191
}
9292
// Setup all certificates and keys
93-
// The below may not actually work
94-
// We assume we can just use certificate and add them to it
95-
// However this may not be possible
9693
if let (Some(key), Some(cert)) = (key, cert) {
97-
for (k, c) in key.iter().zip(cert.iter()) {
98-
let private_key = boring::pkey::PKey::private_key_from_pem(&k)
99-
.or_else(
100-
|err| Err(Error::from_reason(err.to_string()))
101-
)?;
102-
ssl_ctx_builder.set_private_key(&private_key).or_else(
103-
|e| Err(napi::Error::from_reason(e.to_string()))
104-
)?;
105-
let x509_cert_chain = boring::x509::X509::stack_from_pem(
106-
&c.to_vec()
107-
).or_else(
108-
|err| Err(napi::Error::from_reason(err.to_string()))
109-
)?;
110-
for (i, cert) in x509_cert_chain.iter().enumerate() {
111-
if i == 0 {
112-
ssl_ctx_builder.set_certificate(cert,).or_else(
113-
|err| Err(Error::from_reason(err.to_string()))
114-
)?;
115-
} else {
116-
ssl_ctx_builder.add_extra_chain_cert(
117-
cert.clone(),
118-
).or_else(
119-
|err| Err(Error::from_reason(err.to_string()))
120-
)?;
121-
}
94+
// Right now the boring crate does not provide a straight forward way of
95+
// setting multiple independent certificate chains. So we are just picking
96+
// the first key and cert pair.
97+
let (k, c) = (key[0].to_vec(), cert[0].to_vec());
98+
let private_key = boring::pkey::PKey::private_key_from_pem(&k)
99+
.or_else(
100+
|err| Err(Error::from_reason(err.to_string()))
101+
)?;
102+
ssl_ctx_builder.set_private_key(&private_key).or_else(
103+
|e| Err(napi::Error::from_reason(e.to_string()))
104+
)?;
105+
let x509_cert_chain = boring::x509::X509::stack_from_pem(
106+
&c
107+
).or_else(
108+
|err| Err(napi::Error::from_reason(err.to_string()))
109+
)?;
110+
for (i, cert) in x509_cert_chain.iter().enumerate() {
111+
if i == 0 {
112+
ssl_ctx_builder.set_certificate(cert,).or_else(
113+
|err| Err(Error::from_reason(err.to_string()))
114+
)?;
115+
} else {
116+
ssl_ctx_builder.add_extra_chain_cert(
117+
cert.clone(),
118+
).or_else(
119+
|err| Err(Error::from_reason(err.to_string()))
120+
)?;
122121
}
123122
}
124123
}

‎tests/QUICServer.test.ts

+2-2
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ describe(QUICServer.name, () => {
5656
issuerPrivateKey: keyPairRSA.privateKey,
5757
duration: 60 * 60 * 24 * 365 * 10,
5858
});
59-
keyPairRSAPEM = await testsUtils.keyPairRSAtoPEM(keyPairRSA);
59+
keyPairRSAPEM = await testsUtils.keyPairRSAToPEM(keyPairRSA);
6060
certRSAPEM = testsUtils.certToPEM(certRSA);
6161
keyPairECDSA = await testsUtils.generateKeyPairECDSA();
6262
certECDSA = await testsUtils.generateCertificate({
@@ -65,7 +65,7 @@ describe(QUICServer.name, () => {
6565
issuerPrivateKey: keyPairECDSA.privateKey,
6666
duration: 60 * 60 * 24 * 365 * 10,
6767
});
68-
keyPairECDSAPEM = await testsUtils.keyPairECDSAtoPEM(keyPairECDSA);
68+
keyPairECDSAPEM = await testsUtils.keyPairECDSAToPEM(keyPairECDSA);
6969
certECDSAPEM = testsUtils.certToPEM(certECDSA);
7070
keyPairEd25519 = await testsUtils.generateKeyPairEd25519();
7171
certEd25519 = await testsUtils.generateCertificate({

0 commit comments

Comments
 (0)