tls: add setKeyCert() to tls.Socket

PR-URL: #53636
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Tim Perry <pimterry@gmail.com>

Author: mscdex

doc/api/tls.md

@@ -1574,6 +1574,20 @@ When running as the server, the socket will be destroyed with an error after
 For TLSv1.3, renegotiation cannot be initiated, it is not supported by the
 protocol.
 
+### `tlsSocket.setKeyCert(context)`
+
+<!-- YAML
+added: REPLACEME
+-->
+
+*`context` {Object|tls.SecureContext} An object containing at least `key` and
+`cert` properties from the [`tls.createSecureContext()`][]`options`, or a
+ TLS context object created with [`tls.createSecureContext()`][] itself.
+
+The `tlsSocket.setKeyCert()` method sets the private key and certificate to use
+for the socket. This is mainly useful if you wish to select a server certificate
+from a TLS server's `ALPNCallback`.
+
 ### `tlsSocket.setMaxSendFragment(size)`
 
 <!-- YAML

lib/_tls_wrap.js

@@ -1144,6 +1144,17 @@ TLSSocket.prototype.getX509Certificate = function() {
 returncert ? newInternalX509Certificate(cert) : undefined;
 };
 
+TLSSocket.prototype.setKeyCert=function(context){
+if(this._handle){
+letsecureContext;
+if(contextinstanceofcommon.SecureContext)
+secureContext=context;
+else
+secureContext=tls.createSecureContext(context);
+this._handle.setKeyCert(secureContext.context);
+}
+};
+
 // Proxy TLSSocket handle methods
 functionmakeSocketMethodProxy(name){
 returnfunctionsocketMethodProxy(...args){

src/crypto/crypto_tls.cc

@@ -1595,6 +1595,33 @@ void TLSWrap::SetALPNProtocols(const FunctionCallbackInfo<Value>& args) {
  }
 }
 
+voidTLSWrap::SetKeyCert(const FunctionCallbackInfo<Value>& args) {
+ TLSWrap* w;
+ASSIGN_OR_RETURN_UNWRAP(&w, args.This());
+ Environment* env = w->env();
+
+if (w->is_client()) return;
+
+if (args.Length() < 1 || !args[0]->IsObject())
+return env->ThrowTypeError("Must give a SecureContext as first argument");
+
+ Local<Value> ctx = args[0];
+if (UNLIKELY(ctx.IsEmpty())) return;
+
+ Local<FunctionTemplate> cons = env->secure_context_constructor_template();
+if (cons->HasInstance(ctx)) {
+ SecureContext* sc = Unwrap<SecureContext>(ctx.As<Object>());
+CHECK_NOT_NULL(sc);
+if (!UseSNIContext(w->ssl_, BaseObjectPtr<SecureContext>(sc)) ||
+ !w->SetCACerts(sc)) {
+unsignedlong err = ERR_get_error(); // NOLINT(runtime/int)
+returnThrowCryptoError(env, err, "SetKeyCert");
+ }
+ } else {
+return env->ThrowTypeError("Must give a SecureContext as first argument");
+ }
+}
+
 voidTLSWrap::GetPeerCertificate(const FunctionCallbackInfo<Value>& args) {
  TLSWrap* w;
 ASSIGN_OR_RETURN_UNWRAP(&w, args.This());
@@ -2130,6 +2157,7 @@ void TLSWrap::Initialize(
 SetProtoMethod(isolate, t, "renegotiate", Renegotiate);
 SetProtoMethod(isolate, t, "requestOCSP", RequestOCSP);
 SetProtoMethod(isolate, t, "setALPNProtocols", SetALPNProtocols);
+SetProtoMethod(isolate, t, "setKeyCert", SetKeyCert);
 SetProtoMethod(isolate, t, "setOCSPResponse", SetOCSPResponse);
 SetProtoMethod(isolate, t, "setServername", SetServername);
 SetProtoMethod(isolate, t, "setSession", SetSession);

src/crypto/crypto_tls.h

@@ -213,6 +213,7 @@ class TLSWrap : public AsyncWrap,
 staticvoidRenegotiate(const v8::FunctionCallbackInfo<v8::Value>& args);
 staticvoidRequestOCSP(const v8::FunctionCallbackInfo<v8::Value>& args);
 staticvoidSetALPNProtocols(const v8::FunctionCallbackInfo<v8::Value>& args);
+staticvoidSetKeyCert(const v8::FunctionCallbackInfo<v8::Value>& args);
 staticvoidSetOCSPResponse(const v8::FunctionCallbackInfo<v8::Value>& args);
 staticvoidSetServername(const v8::FunctionCallbackInfo<v8::Value>& args);
 staticvoidSetSession(const v8::FunctionCallbackInfo<v8::Value>& args);

test/parallel/test-tls-server-setkeycert.js

@@ -0,0 +1,56 @@
+'use strict';
+constcommon=require('../common');
+
+if(!common.hasCrypto)
+common.skip('missing crypto');
+
+constassert=require('assert');
+const{ X509Certificate }=require('crypto');
+consttls=require('tls');
+constfixtures=require('../common/fixtures');
+
+constaltKeyCert={
+key: fixtures.readKey('agent2-key.pem'),
+cert: fixtures.readKey('agent2-cert.pem'),
+minVersion: 'TLSv1.2',
+};
+
+constaltKeyCertVals=[
+altKeyCert,
+tls.createSecureContext(altKeyCert),
+];
+
+(functionnext(){
+if(!altKeyCertVals.length)
+return;
+constaltKeyCertVal=altKeyCertVals.shift();
+constoptions={
+key: fixtures.readKey('agent1-key.pem'),
+cert: fixtures.readKey('agent1-cert.pem'),
+minVersion: 'TLSv1.3',
+ALPNCallback: common.mustCall(function({ servername, protocols }){
+this.setKeyCert(altKeyCertVal);
+assert.deepStrictEqual(protocols,['acme-tls/1']);
+returnprotocols[0];
+}),
+};
+
+tls.createServer(options,(s)=>s.end()).listen(0,function(){
+this.on('connection',common.mustCall((socket)=>this.close()));
+
+tls.connect({
+port: this.address().port,
+rejectUnauthorized: false,
+ALPNProtocols: ['acme-tls/1'],
+},common.mustCall(function(){
+assert.strictEqual(this.getProtocol(),'TLSv1.3');
+constaltCert=newX509Certificate(altKeyCert.cert);
+assert.strictEqual(
+this.getPeerX509Certificate().raw.equals(altCert.raw),
+true
+);
+this.end();
+next();
+}));
+});
+})();