From 65b4fb840ed7ae80fdca5d2c92dd647590d99686 Mon Sep 17 00:00:00 2001
From: Tim Perry <1526883+pimterry@users.noreply.github.com>
Date: Thu, 5 Sep 2024 16:15:01 +0200
Subject: [PATCH] crypto: return a clearer error when loading an unsupported
 pkcs12

PR-URL: https://github.com/nodejs/node/pull/54485
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 src/crypto/crypto_context.cc         |  10 ++++++++++
 test/fixtures/keys/legacy.pfx        | Bin 0 -> 1058 bytes
 test/parallel/test-tls-legacy-pfx.js |  27 +++++++++++++++++++++++++++
 3 files changed, 37 insertions(+)
 create mode 100644 test/fixtures/keys/legacy.pfx
 create mode 100644 test/parallel/test-tls-legacy-pfx.js

diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
index 48fecc82c159d8..aa5ba34c761224 100644
--- a/src/crypto/crypto_context.cc
+++ b/src/crypto/crypto_context.cc
@@ -1148,6 +1148,16 @@ void SecureContext::LoadPKCS12(const FunctionCallbackInfo<Value>& args) {
   if (!ret) {
     // TODO(@jasnell): Should this use ThrowCryptoError?
     unsigned long err = ERR_get_error();  // NOLINT(runtime/int)
+
+#if OPENSSL_VERSION_MAJOR >= 3
+    if (ERR_GET_REASON(err) == ERR_R_UNSUPPORTED) {
+      // OpenSSL's "unsupported" error without any context is very
+      // common and not very helpful, so we override it:
+      return THROW_ERR_CRYPTO_UNSUPPORTED_OPERATION(
+          env, "Unsupported PKCS12 PFX data");
+    }
+#endif
+
     const char* str = ERR_reason_error_string(err);
     str = str != nullptr ? str : "Unknown error";
 
diff --git a/test/fixtures/keys/legacy.pfx b/test/fixtures/keys/legacy.pfx
new file mode 100644
index 0000000000000000000000000000000000000000..66fa746fa5e573d2e7cded1632863f4294736c97
GIT binary patch
literal 1058
zcmXqLVv%EFWHxAGe!|A7)#lOmotKfFaX}OFRhA~^i$LMC22G4_5K?Rlni%f_g>Eu2
zG61Pd2pL8LPdJB_*TBX=4#DLy5M<%#l6n>(cGBh|6B7pm6C<mE6dMP`LS`ldJ|-rH
z1uPs#4j!#_oM!Q(p^33#YeM?}o4+0B-nw!1;`c0>pf9%f4EI^wC}l~H*|O@h-RD>9
z{gxN^IrB!dzBnp)HHxX_T<twxZ@&0+A)g%~THl}52_*aczG|<Z)LZc7Xs?;pU;nAg
zqCRSOCL3)ropgU%NyB;NUpwBNYmnN^Fn>GWu`9>&P53UVn#6OI%no|~y7%cMtq1J(
z_qQ+w{=M29I-&UL<8K_>=hnnoDXf}SbnVFWxYvcDvAMq&B_%k#e#E_bNA0G0zk~ET
z62B(2_0CqRe4+T(Y4^ITi)|Et@-YW*Hec5mB@=nR>3Nfd^HzyprQi8pFNwZ<t~&nt
z3%0C=N&cK-n@)5WhCP^STQl=o;EnY4ollQVyy?Gp@5fI)Hs3kqXBXOEHu&D9EM2w3
zScL6R$1c9#pZA+Y{dN|=?Q^l}%=E9>zRM*U%Idnjd;?0nEm-uAU$i|h!BcZW`0k?K
zS|6i~bAh3+c<*hSb$+I$S-_NptGcGV9n1_iujJnQoSgLPgw6y*=KtqsUEP{_1QfaO
zm;)sR##1a!jK_e&hk$q=8#gqS@Nh9Q0VUgjf=vc8Y+Nv5U}EB9;b7POXZOP8@L5n~
z1GOh`ta*@Pt#!!Meqzj?39W4_rbqL+AL)2!e&d9X&hfd05yn%c9OPE<-RW@CJD%Xa
zc%57TyQuLh3xW2HTYmrcEZKDQtLjICtmcX)=XXcVO>JtDEvIY$(iVSr{g%R}s~;oN
zqsx9s=yP=CJMt906StgrU3|s6H5<>QY>B*h<U40UexmBu<AN1(XAY+{RtfLi>!+2u
zfqlu;Bdp@HzRfl3Z1`&2JpFXj%Lk8tnU}Tj{$4ZZrtREwrm=6k=j)lh(wk!=?KP`>
z^4D{=dd&slKa0BVEUfxAEt=`-s*55q>=vaz)D50rlCFB}G$rVs_PYAA>(guA#NP7c
z&p*3=k#11lzTdLSe74>CANF*#YDcb;OucZs#L2Gf!F7g^tp8kbp#kf8c4-`6Tf_BZ
z#Vf}4>*k$CPv7_@N?mbc>0I*Y#pU)h4eS5<os0=O$kt}?$i4GbX;#!i(Kj>ZPQG1i
zZ8W{tx505w>P$mb17&!uaf%v>v544~9y0N6Q@b%+>W2h-c}h_5X8sTZLjy$vPBvC;
vK4vB<Rt6T4Yq{dDStD0;$4_5eyo2TAn;Wm)53+FV+Bi%1<!R4AQ0xH!yGG9N

literal 0
HcmV?d00001

diff --git a/test/parallel/test-tls-legacy-pfx.js b/test/parallel/test-tls-legacy-pfx.js
new file mode 100644
index 00000000000000..33b4c58fc6ccc3
--- /dev/null
+++ b/test/parallel/test-tls-legacy-pfx.js
@@ -0,0 +1,27 @@
+'use strict';
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+if (!common.hasOpenSSL3)
+  common.skip('OpenSSL legacy failures are only testable with OpenSSL 3+');
+
+const fixtures = require('../common/fixtures');
+
+const {
+  assert, connect, keys
+} = require(fixtures.path('tls-connect'));
+
+const legacyPfx = fixtures.readKey('legacy.pfx');
+
+connect({
+  client: {
+    pfx: legacyPfx,
+    passphrase: 'legacy',
+    rejectUnauthorized: false
+  },
+  server: keys.agent1
+}, common.mustCall((e, pair, cleanup) => {
+  assert.strictEqual(e.code, 'ERR_CRYPTO_UNSUPPORTED_OPERATION');
+  assert.strictEqual(e.message, 'Unsupported PKCS12 PFX data');
+  cleanup();
+}));