From db35fee1e1ca909f0f33940c0d9501a72baf2375 Mon Sep 17 00:00:00 2001
From: Sam Roberts <vieuxtech@gmail.com>
Date: Thu, 8 Nov 2018 13:40:46 -0800
Subject: [PATCH] tls: get the local certificate after tls handshake

Add an API to get the local certificate chosen during TLS handshake from
the SSL context.

Fix: https://github.com/nodejs/node/issues/24095

PR-URL: https://github.com/nodejs/node/pull/24261
Fixes: https://github.com/nodejs/node/issues/24095
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Daniel Bevenius <daniel.bevenius@gmail.com>
---
 doc/api/tls.md                                | 17 ++++++++++++++
 lib/_tls_common.js                            |  3 +++
 lib/_tls_wrap.js                              | 12 +++++++++-
 src/node_crypto.cc                            | 23 +++++++++++++++++--
 src/node_crypto.h                             |  1 +
 .../test-tls-peer-certificate-multi-keys.js   | 12 ++++++++--
 test/parallel/test-tls-peer-certificate.js    |  2 ++
 .../test-tls-pfx-authorizationerror.js        |  4 ++++
 8 files changed, 69 insertions(+), 5 deletions(-)

diff --git a/doc/api/tls.md b/doc/api/tls.md
index 1d0d8bfad27739..5bda2f26c0af33 100644
--- a/doc/api/tls.md
+++ b/doc/api/tls.md
@@ -566,6 +566,22 @@ added: v0.11.4
 Always returns `true`. This may be used to distinguish TLS sockets from regular
 `net.Socket` instances.
 
+### tlsSocket.getCertificate()
+<!-- YAML
+added: REPLACEME
+-->
+
+* Returns: {Object}
+
+Returns an object representing the local certificate. The returned object has
+some properties corresponding to the fields of the certificate.
+
+See [`tls.TLSSocket.getPeerCertificate()`][] for an example of the certificate
+structure.
+
+If there is no local certificate, an empty object will be returned. If the
+socket has been destroyed, `null` will be returned.
+
 ### tlsSocket.getCipher()
 <!-- YAML
 added: v0.11.4
@@ -658,6 +674,7 @@ certificate.
 ```
 
 If the peer does not provide a certificate, an empty object will be returned.
+If the socket has been destroyed, `null` will be returned.
 
 ### tlsSocket.getPeerFinished()
 <!-- YAML
diff --git a/lib/_tls_common.js b/lib/_tls_common.js
index 7153334a141777..4028b02be28e17 100644
--- a/lib/_tls_common.js
+++ b/lib/_tls_common.js
@@ -202,6 +202,9 @@ exports.createSecureContext = function createSecureContext(options) {
   return c;
 };
 
+// Translate some fields from the handle's C-friendly format into more idiomatic
+// javascript object representations before passing them back to the user.  Can
+// be used on any cert object, but changing the name would be semver-major.
 exports.translatePeerCertificate = function translatePeerCertificate(c) {
   if (!c)
     return null;
diff --git a/lib/_tls_wrap.js b/lib/_tls_wrap.js
index f0d86f3d870f09..2e32366028ef71 100644
--- a/lib/_tls_wrap.js
+++ b/lib/_tls_wrap.js
@@ -660,7 +660,17 @@ TLSSocket.prototype.setSession = function(session) {
 TLSSocket.prototype.getPeerCertificate = function(detailed) {
   if (this._handle) {
     return common.translatePeerCertificate(
-      this._handle.getPeerCertificate(detailed));
+      this._handle.getPeerCertificate(detailed)) || {};
+  }
+
+  return null;
+};
+
+TLSSocket.prototype.getCertificate = function() {
+  if (this._handle) {
+    // It's not a peer cert, but the formatting is identical.
+    return common.translatePeerCertificate(
+      this._handle.getCertificate()) || {};
   }
 
   return null;
diff --git a/src/node_crypto.cc b/src/node_crypto.cc
index f34c37c7db7ac4..1842d03dcbb87d 100644
--- a/src/node_crypto.cc
+++ b/src/node_crypto.cc
@@ -1409,6 +1409,7 @@ void SSLWrap<Base>::AddMethods(Environment* env, Local<FunctionTemplate> t) {
   HandleScope scope(env->isolate());
 
   env->SetProtoMethodNoSideEffect(t, "getPeerCertificate", GetPeerCertificate);
+  env->SetProtoMethodNoSideEffect(t, "getCertificate", GetCertificate);
   env->SetProtoMethodNoSideEffect(t, "getFinished", GetFinished);
   env->SetProtoMethodNoSideEffect(t, "getPeerFinished", GetPeerFinished);
   env->SetProtoMethodNoSideEffect(t, "getSession", GetSession);
@@ -1871,8 +1872,26 @@ void SSLWrap<Base>::GetPeerCertificate(
   }
 
  done:
-  if (result.IsEmpty())
-    result = Object::New(env->isolate());
+  args.GetReturnValue().Set(result);
+}
+
+
+template <class Base>
+void SSLWrap<Base>::GetCertificate(
+    const FunctionCallbackInfo<Value>& args) {
+  Base* w;
+  ASSIGN_OR_RETURN_UNWRAP(&w, args.Holder());
+  Environment* env = w->ssl_env();
+
+  ClearErrorOnReturn clear_error_on_return;
+
+  Local<Object> result;
+
+  X509Pointer cert(SSL_get_certificate(w->ssl_.get()));
+
+  if (cert)
+    result = X509ToObject(env, cert.get());
+
   args.GetReturnValue().Set(result);
 }
 
diff --git a/src/node_crypto.h b/src/node_crypto.h
index 0c26c1f6ff1d09..f85cdd32081895 100644
--- a/src/node_crypto.h
+++ b/src/node_crypto.h
@@ -272,6 +272,7 @@ class SSLWrap {
 
   static void GetPeerCertificate(
       const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void GetCertificate(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetFinished(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetPeerFinished(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetSession(const v8::FunctionCallbackInfo<v8::Value>& args);
diff --git a/test/parallel/test-tls-peer-certificate-multi-keys.js b/test/parallel/test-tls-peer-certificate-multi-keys.js
index b178daa2ba9328..a2548d6bcffb9e 100644
--- a/test/parallel/test-tls-peer-certificate-multi-keys.js
+++ b/test/parallel/test-tls-peer-certificate-multi-keys.js
@@ -26,7 +26,6 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const tls = require('tls');
-const util = require('util');
 const fixtures = require('../common/fixtures');
 
 const options = {
@@ -37,13 +36,22 @@ const options = {
 const server = tls.createServer(options, function(cleartext) {
   cleartext.end('World');
 });
+
+server.once('secureConnection', common.mustCall(function(socket) {
+  const cert = socket.getCertificate();
+  // The server's local cert is the client's peer cert.
+  assert.deepStrictEqual(
+    cert.subject.OU,
+    ['Information Technology', 'Engineering', 'Marketing']
+  );
+}));
+
 server.listen(0, common.mustCall(function() {
   const socket = tls.connect({
     port: this.address().port,
     rejectUnauthorized: false
   }, common.mustCall(function() {
     const peerCert = socket.getPeerCertificate();
-    console.error(util.inspect(peerCert));
     assert.deepStrictEqual(
       peerCert.subject.OU,
       ['Information Technology', 'Engineering', 'Marketing']
diff --git a/test/parallel/test-tls-peer-certificate.js b/test/parallel/test-tls-peer-certificate.js
index 266f5571410fb4..5eac36628d658e 100644
--- a/test/parallel/test-tls-peer-certificate.js
+++ b/test/parallel/test-tls-peer-certificate.js
@@ -43,6 +43,8 @@ connect({
 }, function(err, pair, cleanup) {
   assert.ifError(err);
   const socket = pair.client.conn;
+  const localCert = socket.getCertificate();
+  assert.deepStrictEqual(localCert, {});
   let peerCert = socket.getPeerCertificate();
   assert.ok(!peerCert.issuerCertificate);
 
diff --git a/test/parallel/test-tls-pfx-authorizationerror.js b/test/parallel/test-tls-pfx-authorizationerror.js
index 64b6e1485dc538..a4ea97f104e564 100644
--- a/test/parallel/test-tls-pfx-authorizationerror.js
+++ b/test/parallel/test-tls-pfx-authorizationerror.js
@@ -22,6 +22,8 @@ const server = tls
       rejectUnauthorized: false
     },
     common.mustCall(function(c) {
+      assert.strictEqual(c.getPeerCertificate().serialNumber,
+                         'FAD50CC6A07F516C');
       assert.strictEqual(c.authorizationError, null);
       c.end();
     })
@@ -35,6 +37,8 @@ const server = tls
         rejectUnauthorized: false
       },
       function() {
+        assert.strictEqual(client.getCertificate().serialNumber,
+                           'FAD50CC6A07F516C');
         client.end();
         server.close();
       }