#include "node.h"

#include "node_buffer.h"

#include "node_crypto.h"

#include "node_crypto_bio.h"

#include "node_crypto_groups.h"

#include "tls_wrap.h" // TLSWrap

#include "async-wrap.h"

#include "async-wrap-inl.h"

#include "env.h"

#include "env-inl.h"

#include "string_bytes.h"

#include "util.h"

#include "util-inl.h"

#include "v8.h"

#include "CNNICHashWhitelist.inc"

#include "StartComAndWoSignData.inc"

#include <errno.h>

#include <limits.h> // INT_MAX

#include <math.h>

#include <stdlib.h>

#include <string.h>

#define THROW_AND_RETURN_IF_NOT_STRING_OR_BUFFER(val, prefix) \

do { \

if (!Buffer::HasInstance(val) && !val->IsString()) { \

return env->ThrowTypeError(prefix " must be a string or a buffer"); \

} \

} while (0)

#define THROW_AND_RETURN_IF_NOT_BUFFER(val, prefix) \

do { \

if (!Buffer::HasInstance(val)) { \

return env->ThrowTypeError(prefix " must be a buffer"); \

} \

} while (0)

#define THROW_AND_RETURN_IF_NOT_STRING(val, prefix) \

do { \

if (!val->IsString()) { \

return env->ThrowTypeError(prefix " must be a string"); \

} \

} while (0)

static const char PUBLIC_KEY_PFX[] = "-----BEGIN PUBLIC KEY-----";

static const int PUBLIC_KEY_PFX_LEN = sizeof(PUBLIC_KEY_PFX) - 1;

static const char PUBRSA_KEY_PFX[] = "-----BEGIN RSA PUBLIC KEY-----";

static const int PUBRSA_KEY_PFX_LEN = sizeof(PUBRSA_KEY_PFX) - 1;

static const char CERTIFICATE_PFX[] = "-----BEGIN CERTIFICATE-----";

static const int CERTIFICATE_PFX_LEN = sizeof(CERTIFICATE_PFX) - 1;

static const int X509_NAME_FLAGS = ASN1_STRFLGS_ESC_CTRL

| ASN1_STRFLGS_UTF8_CONVERT

| XN_FLAG_SEP_MULTILINE

| XN_FLAG_FN_SN;

namespace node {

namespace crypto {

using v8::AccessorSignature;

using v8::Array;

using v8::Boolean;

using v8::Context;

using v8::DEFAULT;

using v8::DontDelete;

using v8::EscapableHandleScope;

using v8::Exception;

using v8::External;

using v8::False;

using v8::FunctionCallbackInfo;

using v8::FunctionTemplate;

using v8::HandleScope;

using v8::Integer;

using v8::Isolate;

using v8::Local;

using v8::Null;

using v8::Object;

using v8::Persistent;

using v8::PropertyAttribute;

using v8::PropertyCallbackInfo;

using v8::ReadOnly;

using v8::String;

using v8::Value;

static const uint8_t CNNIC_ROOT_CA_SUBJECT_DATA[] =

"\x30\x32\x31\x0B\x30\x09\x06\x03\x55\x04\x06\x13\x02\x43\x4E\x31\x0E\x30"

"\x0C\x06\x03\x55\x04\x0A\x13\x05\x43\x4E\x4E\x49\x43\x31\x13\x30\x11\x06"

"\x03\x55\x04\x03\x13\x0A\x43\x4E\x4E\x49\x43\x20\x52\x4F\x4F\x54";

static const uint8_t* cnnic_p = CNNIC_ROOT_CA_SUBJECT_DATA;

static X509_NAME* cnnic_name =

d2i_X509_NAME(nullptr, &cnnic_p, sizeof(CNNIC_ROOT_CA_SUBJECT_DATA)-1);

static const uint8_t CNNIC_EV_ROOT_CA_SUBJECT_DATA[] =

"\x30\x81\x8A\x31\x0B\x30\x09\x06\x03\x55\x04\x06\x13\x02\x43\x4E\x31\x32"

"\x30\x30\x06\x03\x55\x04\x0A\x0C\x29\x43\x68\x69\x6E\x61\x20\x49\x6E\x74"

"\x65\x72\x6E\x65\x74\x20\x4E\x65\x74\x77\x6F\x72\x6B\x20\x49\x6E\x66\x6F"

"\x72\x6D\x61\x74\x69\x6F\x6E\x20\x43\x65\x6E\x74\x65\x72\x31\x47\x30\x45"

"\x06\x03\x55\x04\x03\x0C\x3E\x43\x68\x69\x6E\x61\x20\x49\x6E\x74\x65\x72"

"\x6E\x65\x74\x20\x4E\x65\x74\x77\x6F\x72\x6B\x20\x49\x6E\x66\x6F\x72\x6D"

"\x61\x74\x69\x6F\x6E\x20\x43\x65\x6E\x74\x65\x72\x20\x45\x56\x20\x43\x65"

"\x72\x74\x69\x66\x69\x63\x61\x74\x65\x73\x20\x52\x6F\x6F\x74";

static const uint8_t* cnnic_ev_p = CNNIC_EV_ROOT_CA_SUBJECT_DATA;

static X509_NAME *cnnic_ev_name =

d2i_X509_NAME(nullptr, &cnnic_ev_p,

sizeof(CNNIC_EV_ROOT_CA_SUBJECT_DATA)-1);

static Mutex* mutexes;

const char* const root_certs[] = {

#include "node_root_certs.h" // NOLINT(build/include_order)

};

std::string extra_root_certs_file; // NOLINT(runtime/string)

X509_STORE* root_cert_store;

std::vector<X509*> root_certs_vector;

template class SSLWrap<TLSWrap>;

template void SSLWrap<TLSWrap>::AddMethods(Environment* env,

Local<FunctionTemplate> t);

template void SSLWrap<TLSWrap>::InitNPN(SecureContext* sc);

template void SSLWrap<TLSWrap>::SetSNIContext(SecureContext* sc);

template int SSLWrap<TLSWrap>::SetCACerts(SecureContext* sc);

template SSL_SESSION* SSLWrap<TLSWrap>::GetSessionCallback(

SSL* s,

unsigned char* key,

int len,

int* copy);

template int SSLWrap<TLSWrap>::NewSessionCallback(SSL* s,

SSL_SESSION* sess);

template void SSLWrap<TLSWrap>::OnClientHello(

void* arg,

const ClientHelloParser::ClientHello& hello);

#ifdef OPENSSL_NPN_NEGOTIATED

template int SSLWrap<TLSWrap>::AdvertiseNextProtoCallback(

SSL* s,

const unsigned char** data,

unsigned int* len,

void* arg);

template int SSLWrap<TLSWrap>::SelectNextProtoCallback(

SSL* s,

unsigned char** out,

unsigned char* outlen,

const unsigned char* in,

unsigned int inlen,

void* arg);

#endif

#ifdef NODE__HAVE_TLSEXT_STATUS_CB

template int SSLWrap<TLSWrap>::TLSExtStatusCallback(SSL* s, void* arg);

#endif

template void SSLWrap<TLSWrap>::DestroySSL();

template int SSLWrap<TLSWrap>::SSLCertCallback(SSL* s, void* arg);

template void SSLWrap<TLSWrap>::WaitForCertCb(CertCb cb, void* arg);

#ifdef TLSEXT_TYPE_application_layer_protocol_negotiation

template int SSLWrap<TLSWrap>::SelectALPNCallback(

SSL* s,

const unsigned char** out,

unsigned char* outlen,

const unsigned char* in,

unsigned int inlen,

void* arg);

#endif // TLSEXT_TYPE_application_layer_protocol_negotiation

static void crypto_threadid_cb(CRYPTO_THREADID* tid) {

}

static void crypto_lock_init(void) {

mutexes = new Mutex[CRYPTO_num_locks()];

}

static void crypto_lock_cb(int mode, int n, const char* file, int line) {

}

static int CryptoPemCallback(char *buf, int size, int rwflag, void *u) {

}

void ThrowCryptoError(Environment* env,

}

inline void CheckEntropy() {

}

bool EntropySource(unsigned char* buffer, size_t length) {

}

void SecureContext::Initialize(Environment* env, Local<Object> target) {

}

void SecureContext::New(const FunctionCallbackInfo<Value>& args) {

Environment* env = Environment::GetCurrent(args);

new SecureContext(env, args.This());

}

void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {

}

static BIO* LoadBIO(Environment* env, Local<Value> v) {

HandleScope scope(env->isolate());

if (v->IsString()) {

const node::Utf8Value s(env->isolate(), v);

return NodeBIO::NewFixed(*s, s.length());

}

if (Buffer::HasInstance(v)) {

return NodeBIO::NewFixed(Buffer::Data(v), Buffer::Length(v));

}

return nullptr;

}

void SecureContext::SetKey(const FunctionCallbackInfo<Value>& args) {

}

int SSL_CTX_get_issuer(SSL_CTX* ctx, X509* cert, X509** issuer) {

}

int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,

X509* x,

STACK_OF(X509)* extra_certs,

X509** cert,

X509** issuer) {

CHECK_EQ(*issuer, nullptr);

CHECK_EQ(*cert, nullptr);

int ret = SSL_CTX_use_certificate(ctx, x);

if (ret) {

// If we could set up our certificate, now proceed to

// the CA certificates.

int r;

SSL_CTX_clear_extra_chain_certs(ctx);

for (int i = 0; i < sk_X509_num(extra_certs); i++) {

X509* ca = sk_X509_value(extra_certs, i);

// NOTE: Increments reference count on `ca`

r = SSL_CTX_add1_chain_cert(ctx, ca);

if (!r) {

ret = 0;

*issuer = nullptr;

goto end;

}

// Note that we must not free r if it was successfully

// added to the chain (while we must free the main

// certificate, since its reference count is increased

// by SSL_CTX_use_certificate).

// Find issuer

if (*issuer != nullptr || X509_check_issued(ca, x) != X509_V_OK)

continue;

*issuer = ca;

}

}

// Try getting issuer from a cert store

if (ret) {

if (*issuer == nullptr) {

ret = SSL_CTX_get_issuer(ctx, x, issuer);

ret = ret < 0 ? 0 : 1;

// NOTE: get_cert_store doesn't increment reference count,

// no need to free `store`

} else {

// Increment issuer reference count

*issuer = X509_dup(*issuer);

if (*issuer == nullptr) {

ret = 0;

goto end;

}

}

}

end:

if (ret && x != nullptr) {

*cert = X509_dup(x);

if (*cert == nullptr)

ret = 0;

}

return ret;

}

int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,

}

void SecureContext::SetCert(const FunctionCallbackInfo<Value>& args) {

}

#if OPENSSL_VERSION_NUMBER < 0x10100000L && !defined(OPENSSL_IS_BORINGSSL)

static int X509_STORE_up_ref(X509_STORE* store) {

CRYPTO_add(&store->references, 1, CRYPTO_LOCK_X509_STORE);

return 1;

}

static int X509_up_ref(X509* cert) {

CRYPTO_add(&cert->references, 1, CRYPTO_LOCK_X509);

return 1;

}

#endif // OPENSSL_VERSION_NUMBER < 0x10100000L && !OPENSSL_IS_BORINGSSL

static X509_STORE* NewRootCertStore() {

if (root_certs_vector.empty()) {

for (size_t i = 0; i < arraysize(root_certs); i++) {

BIO* bp = NodeBIO::NewFixed(root_certs[i], strlen(root_certs[i]));

X509 *x509 = PEM_read_bio_X509(bp, nullptr, CryptoPemCallback, nullptr);

BIO_free(bp);

// Parse errors from the built-in roots are fatal.

CHECK_NE(x509, nullptr);

root_certs_vector.push_back(x509);

}

}

X509_STORE* store = X509_STORE_new();

if (ssl_openssl_cert_store) {

X509_STORE_set_default_paths(store);

} else {

for (X509 *cert : root_certs_vector) {

X509_up_ref(cert);

X509_STORE_add_cert(store, cert);

}

}

return store;

}

void SecureContext::AddCACert(const FunctionCallbackInfo<Value>& args) {

}

void SecureContext::AddCRL(const FunctionCallbackInfo<Value>& args) {

}

void UseExtraCaCerts(const std::string& file) {

extra_root_certs_file = file;

}

static unsigned long AddCertsFromFile( // NOLINT(runtime/int)

}

void SecureContext::AddRootCerts(const FunctionCallbackInfo<Value>& args) {

}

void SecureContext::SetCiphers(const FunctionCallbackInfo<Value>& args) {

}

void SecureContext::SetECDHCurve(const FunctionCallbackInfo<Value>& args) {

}

void SecureContext::SetDHParam(const FunctionCallbackInfo<Value>& args) {

}

void SecureContext::SetOptions(const FunctionCallbackInfo<Value>& args) {

}

void SecureContext::SetSessionIdContext(

}