1
1
function x509Error ( msg , cert ) {
2
- throw new Error ( 'SASL channel binding: ' + msg + ' when parsing public certificate ' + cert . toString ( 'base64' ) )
2
+ return new Error ( 'SASL channel binding: ' + msg + ' when parsing public certificate ' + cert . toString ( 'base64' ) )
3
3
}
4
4
5
5
function readASN1Length ( data , index ) {
6
6
let length = data [ index ++ ]
7
7
if ( length < 0x80 ) return { length, index }
8
8
9
9
const lengthBytes = length & 0x7f
10
- if ( lengthBytes > 4 ) x509Error ( 'bad length' , data )
10
+ if ( lengthBytes > 4 ) throw x509Error ( 'bad length' , data )
11
11
12
12
length = 0
13
13
for ( let i = 0 ; i < lengthBytes ; i ++ ) {
@@ -18,11 +18,11 @@ function readASN1Length(data, index) {
18
18
}
19
19
20
20
function readASN1OID ( data , index ) {
21
- if ( data [ index ++ ] !== 0x6 ) x509Error ( 'non-OID data' , data ) // 6 = OID
21
+ if ( data [ index ++ ] !== 0x6 ) throw x509Error ( 'non-OID data' , data ) // 6 = OID
22
22
23
23
const { length : OIDLength , index : indexAfterOIDLength } = readASN1Length ( data , index )
24
24
index = indexAfterOIDLength
25
- lastIndex = index + OIDLength
25
+ let lastIndex = index + OIDLength
26
26
27
27
const byte1 = data [ index ++ ]
28
28
let oid = ( ( byte1 / 40 ) >> 0 ) + '.' + ( byte1 % 40 )
@@ -43,7 +43,7 @@ function readASN1OID(data, index) {
43
43
}
44
44
45
45
function expectASN1Seq ( data , index ) {
46
- if ( data [ index ++ ] !== 0x30 ) x509Error ( 'non-sequence data' , data ) // 30 = Sequence
46
+ if ( data [ index ++ ] !== 0x30 ) throw x509Error ( 'non-sequence data' , data ) // 30 = Sequence
47
47
return readASN1Length ( data , index )
48
48
}
49
49
@@ -85,10 +85,10 @@ function signatureAlgorithmHashFromCertificate(data, index) {
85
85
case '1.2.840.10045.4.3.4' :
86
86
return 'SHA-512'
87
87
// RSASSA-PSS: hash is indicated separately
88
- case '1.2.840.113549.1.1.10' :
88
+ case '1.2.840.113549.1.1.10' : {
89
89
index = indexAfterOID
90
90
index = expectASN1Seq ( data , index ) . index
91
- if ( data [ index ++ ] !== 0xa0 ) x509Error ( 'non-tag data' , data ) // a0 = constructed tag 0
91
+ if ( data [ index ++ ] !== 0xa0 ) throw x509Error ( 'non-tag data' , data ) // a0 = constructed tag 0
92
92
index = readASN1Length ( data , index ) . index // skip over tag length field
93
93
index = expectASN1Seq ( data , index ) . index // skip over sequence length field
94
94
const { oid : hashOID } = readASN1OID ( data , index )
@@ -105,17 +105,18 @@ function signatureAlgorithmHashFromCertificate(data, index) {
105
105
case '2.16.840.1.101.3.4.2.3' :
106
106
return 'SHA-512'
107
107
}
108
- x509Error ( 'unknown hash OID ' + hashOID , data )
108
+ throw x509Error ( 'unknown hash OID ' + hashOID , data )
109
+ }
109
110
// Ed25519 -- see https: return//github.com/openssl/openssl/issues/15477
110
111
case '1.3.101.110' :
111
112
case '1.3.101.112' : // ph
112
113
return 'SHA-512'
113
114
// Ed448 -- still not in pg 17.2 (if supported, digest would be SHAKE256 x 64 bytes)
114
115
case '1.3.101.111' :
115
116
case '1.3.101.113' : // ph
116
- x509Error ( 'Ed448 certificate channel binding is not currently supported by Postgres' )
117
+ throw x509Error ( 'Ed448 certificate channel binding is not currently supported by Postgres' )
117
118
}
118
- x509Error ( 'unknown OID ' + oid , data )
119
+ throw x509Error ( 'unknown OID ' + oid , data )
119
120
}
120
121
121
122
module . exports = { signatureAlgorithmHashFromCertificate }
0 commit comments