src: refactor GetPeerCertificate by danbev · Pull Request #17372 · nodejs/node

danbev · 2017-11-28T14:06:43Z

These commits split the GetPeerCertificate function into smaller function as described in the TODO comment:

// TODO(indutny): Split it into multiple smaller functions

I've mostly left the code as it was and want to trigger CI to pick up any issues.

Checklist

make -j4 test (UNIX), or vcbuild test (Windows) passes
commit message follows commit guidelines

Affected core subsystem(s)

src

danbev · 2017-11-28T14:07:12Z

CI: https://ci.nodejs.org/job/node-test-pull-request/11777/

addaleax · 2017-11-30T00:39:02Z

Why is this a pointer?

The reason was so that code in GetPeerCertificate depends on the value being pointed to by info be updated. But I realise that info does not have to be a pointer and we only need update it's pointer for this to work. Not sure if that made sense but I'll add a commit and hopefully this will become clearer. Thanks for pointing this out.

addaleax · 2017-11-30T00:40:12Z

Feel free to switch this over to the non-deprecated overload of Set() if you like :)

Ah good point, I'll update to use the function taking a context. Thanks

Related: it would be more efficient to move these two lines out of the loop. Likewise in GetLastIssuedCert().

addaleax · 2017-11-30T00:41:46Z

Similar question here

bnoordhuis · 2017-11-30T10:14:34Z

You don't have to pass a pointer since you don't replace the Object, just add properties to it.

Thanks, I've changed this now (locally).

bnoordhuis · 2017-11-30T10:16:50Z

Not a hugely useful comment. If you call the function AddIssuerToObject(), it's self-documenting.

I like that, I'll rename the function.

bnoordhuis · 2017-11-30T10:18:20Z

Since you're here, can you punctuate the comments?

Absolutely.

bnoordhuis · 2017-11-30T10:21:51Z

Unrelated observation: I think this could just be for (;;) { - the same check is effectively done at the end of the loop when i == 0.

Nice, I'll take a closer look at this.

bnoordhuis · 2017-11-30T10:26:15Z

It might be nicer (certainly more Obviously Correct) to move the sk_X509_pop_free() on error into this function.

I'll take a look and fix this. Thanks

I've pushed a few commit but I've not addressed this yet. Will revisit this next week. I was wondering if you meant that I add sk_X509_pop_free() to this function in addition to the one in GetPeerCertificate which I think is needed as peer_cert is used after this function?

bnoordhuis · 2017-11-30T10:30:27Z

Related: it would be more efficient to move these two lines out of the loop. Likewise in GetLastIssuedCert().

bnoordhuis · 2017-11-30T10:31:19Z

Can you drop the braces for consistency with the surrounding code?

Yeah, I'll remove them

bnoordhuis · 2017-11-30T10:34:32Z

peer_certs can't be const because it's modified inside the function.

Thanks, I've changed that now.

danbev · 2017-12-02T13:54:23Z

Related: it would be more efficient to move these two lines out of the loop. Likewise in > GetLastIssuedCert().

I've pushed a few commit but I've not addressed this yet. Will revisit this next week.

danbev · 2017-12-02T13:55:15Z

Rebased CI: https://ci.nodejs.org/job/node-test-pull-request/11852/

danbev · 2017-12-05T08:05:14Z

Local<Object> ca_info = X509ToObject(env, ca);
info->Set(env->issuercert_string(), ca_info);
Related: it would be more efficient to move these two lines out of the loop. Likewise in GetLastIssuedCert().

@bnoordhuis I've been looking into moving these lines out of the loop and ran into an issue. My understanding is that this code is creating a link/chain of #issuerCertificate from the object instance. Something like:

object -> #issuerCertificate -> ca_info -> #issuerCertificate -> ca_info

Without setting the #issuerCertificate in the loop a certificates would be skipped. Sorry if I'm missing something here, I've been looking at this for a while now and think I need some help.

danbev · 2017-12-05T08:06:04Z

CI: https://ci.nodejs.org/job/node-test-pull-request/11881/

addaleax · 2017-12-05T11:55:29Z

nit: destruct → destroy? :)

Perhaps this comment could be remove now. Just reading it again perhaps the method signature should be changed to:
if (CloneSSLCerts(&cert, ssl_certs, &peer_certs)) {
What do you think, would that be clear without the comment?

Yep, self-explanatory now.

bnoordhuis · 2017-12-06T00:38:58Z

I think we've settled on .FromJust() (232 vs 44 hits for .ToChecked() at the time of writing.)

Thanks, I'll correct these.

bnoordhuis · 2017-12-06T00:46:33Z

bnoordhuis · 2017-12-06T00:58:33Z

You're right you can't factor out the .Set() calls because they build up a linked list but that arguably makes AddIssuerToObject() a bit of a misnomer.
Can you try to pass arguments in the same order to both functions?

Perhaps a better name would be AddIssuerChainToObject?
Can you try to pass arguments in the same order to both functions?
Yep, I'll update the order. Thanks

bnoordhuis · 2017-12-06T00:59:40Z

Yep, self-explanatory now.

addaleax · 2017-12-10T02:35:53Z

CI: https://ci.nodejs.org/job/node-test-commit/14720/

danbev · 2017-12-12T07:04:11Z

test/windows-fanned failure looks unrelated

console output:

ERROR: Error fetching remote repo 'jenkins_tmp'hudson.plugins.git.GitException: Failed to fetch from git@github.com:janeasystems/node_binary_tmp.git	at hudson.plugins.git.GitSCM.fetchFrom(GitSCM.java:825)	at hudson.plugins.git.GitSCM.retrieveChanges(GitSCM.java:1092)	at hudson.plugins.git.GitSCM.checkout(GitSCM.java:1123)	at hudson.scm.SCM.checkout(SCM.java:495)	at hudson.model.AbstractProject.checkout(AbstractProject.java:1202)	at hudson.model.AbstractBuild$AbstractBuildExecution.defaultCheckout(AbstractBuild.java:574)	at jenkins.scm.SCMCheckoutStrategy.checkout(SCMCheckoutStrategy.java:86)	at hudson.model.AbstractBuild$AbstractBuildExecution.run(AbstractBuild.java:499)	at hudson.model.Run.execute(Run.java:1724)	at hudson.matrix.MatrixRun.run(MatrixRun.java:146)	at hudson.model.ResourceController.execute(ResourceController.java:97)	at hudson.model.Executor.run(Executor.java:421)Caused by: hudson.plugins.git.GitException: Command "git reset --hard" returned status code 128:stdout: stderr: fatal: Unable to create 'c:/workspace/node-test-binary-windows/.git/index.lock': File exists.

danbev · 2017-12-12T07:05:16Z

@bnoordhuis When you get a chance would you be able to take a look at the lastest updates and see what you think?

bnoordhuis

LGTM with two requests.

bnoordhuis · 2017-12-12T09:54:27Z

In a similar vein, can you add *peer_certs = nullptr;?

bnoordhuis · 2017-12-12T09:57:11Z

Just a suggestion but it would be better if this function didn't mutate and invalidate peer_certs.
Failing that, perhaps pass peer_certs as an indirect pointer and set *peer_certs = nullptr; here?

Sounds good, I'll take a look. Thanks

jasnell

LGTM with @bnoordhuis suggestion

BridgeAR · 2018-01-19T17:15:30Z

@danbev would you be so kind and please update this accordingly to the suggestions? :-)

danbev · 2018-01-20T05:52:25Z

@BridgeAR I hope to revisit this next week (though I've got a sick kid here and I might not be working at all next week by the looks of it)

BridgeAR · 2018-01-31T02:11:05Z

Ping @danbev

BridgeAR · 2018-02-07T03:39:16Z

Ping @danbev

danbev · 2018-02-07T04:57:38Z

@BridgeAR I've just not had time to revisit this yet but intend to.

BridgeAR · 2018-03-02T04:20:09Z

CI https://ci.nodejs.org/job/node-test-pull-request/13433/

BridgeAR · 2018-03-02T04:20:51Z

@bnoordhuis @jasnell @addaleax PTAL

danbev · 2018-03-02T10:59:03Z

I'm setting this to in-progress as I've not hade time to look closer at @bnoordhuis latest suggestions. I hope to make some time for this soon.

PR-URL: nodejs#17372 Reviewed-By: Anna Henningsen <anna@addaleax.net> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: James M Snell <jasnell@gmail.com>

bnoordhuis · 2018-03-02T16:02:45Z

#19087 - had 30 minutes to kill. :-)

danbev · 2018-03-03T07:40:57Z

Closing in favour of #19087

nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. crypto Issues and PRs related to the crypto subsystem. labels Nov 28, 2017

addaleax approved these changes Nov 30, 2017
View reviewed changes

bnoordhuis reviewed Nov 30, 2017
View reviewed changes

danbev force-pushed the refactor_getpeercertificate branch from 7042685 to 476e116Compare December 2, 2017 13:50

addaleax reviewed Dec 5, 2017
View reviewed changes

bnoordhuis reviewed Dec 6, 2017
View reviewed changes

MylesBorins force-pushed the master branch from b7405ab to 7f086ddCompare December 8, 2017 16:37

bnoordhuis approved these changes Dec 12, 2017
View reviewed changes

jasnell approved these changes Dec 12, 2017
View reviewed changes

maclover7 added the wip Issues and PRs that are still a work in progress. label Dec 19, 2017

maclover7 force-pushed the master branch from bb5575a to 993b716Compare January 26, 2018 22:02

cjihrig force-pushed the master branch from 993b716 to 082f952Compare January 26, 2018 22:36

src: refactor GetPeerCertificate
d00841b

danbev force-pushed the refactor_getpeercertificate branch from 9806458 to d00841bCompare February 22, 2018 06:12

BridgeAR added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. and removed wip Issues and PRs that are still a work in progress. labels Mar 2, 2018

danbev added the wip Issues and PRs that are still a work in progress. label Mar 2, 2018

bnoordhuis mentioned this pull request Mar 2, 2018
src: use std::unique_ptr for STACK_OF(X509) #19087
Closed

danbev closed this Mar 3, 2018

danbev deleted the refactor_getpeercertificate branch March 6, 2018 11:48

Uh oh!

Uh oh!

Conversation

danbev commented Nov 28, 2017

Checklist

Affected core subsystem(s)

Uh oh!

danbev commented Nov 28, 2017

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

danbev commented Dec 2, 2017

Uh oh!

danbev commented Dec 2, 2017

Uh oh!

danbev commented Dec 5, 2017

Uh oh!

danbev commented Dec 5, 2017

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

danbevDec 6, 2017• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

danbevDec 6, 2017•
edited
Loading