Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CRYPTO: Add configure option to use system CA certificates #11774

Closed
wants to merge 1 commit into from
Closed

CRYPTO: Add configure option to use system CA certificates #11774

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
6 changes: 6 additions & 0 deletions configure
View file
Open in desktop
Expand Up @@ -269,6 +269,10 @@ parser.add_option('--systemtap-includes',
action='store',
dest='systemtap_includes',
help='directory containing systemtap header files')
parser.add_option('--system-ca-certificates',
action='store',
dest='system_ca_certs',
help='Location of the system-provided certificate bundle')

parser.add_option('--tag',
action='store',
Expand Down Expand Up @@ -914,6 +918,8 @@ def configure_node(o):
else:
o['variables']['coverage'] = 'false'

o['variables']['system_ca_certs'] = options.system_ca_certs or ''

def configure_library(lib, output):
shared_lib = 'shared_' + lib
output['variables']['node_' + shared_lib] = b(getattr(options, shared_lib))
Expand Down
6 changes: 5 additions & 1 deletion node.gyp
View file
Open in desktop
Expand Up @@ -408,7 +408,11 @@
],
}],
],
}]]
}],
[ 'system_ca_certs!=""', {
'defines': [ 'SYSTEM_CA_CERTS="<(system_ca_certs)"' ],
}]
]
}, {
'defines': [ 'HAVE_OPENSSL=0' ]
}],
Expand Down
32 changes: 26 additions & 6 deletions src/node_crypto.cc
View file
Open in desktop
Expand Up @@ -696,7 +696,26 @@ static int X509_up_ref(X509* cert) {
#endif // OPENSSL_VERSION_NUMBER < 0x10100000L && !OPENSSL_IS_BORINGSSL


static X509_STORE* NewRootCertStore() {
static X509_STORE* NewRootCertStore(SecureContext* sc) {
X509_STORE* store;

#if defined(SYSTEM_CA_CERTS)

// Use the system CA certificates bundle provided at configure time instead
// of the built-in ones.
if (SSL_CTX_load_verify_locations(sc->ctx_, SYSTEM_CA_CERTS, NULL) == 1) {
store = SSL_CTX_get_cert_store(sc->ctx_);
} else { // Empty store
// If we can't read the SYSTEM_CERTS location, then the only safe action
// is to add no certificates at all. This might be supplemented later by
// the environment variable NODE_EXTRA_CA_CERTS
store = X509_STORE_new();
}

return store;

#else // use built-in CA certificates

if (root_certs_vector.empty()) {
for (size_t i = 0; i < arraysize(root_certs); i++) {
BIO* bp = NodeBIO::NewFixed(root_certs[i], strlen(root_certs[i]));
Expand All @@ -710,7 +729,7 @@ static X509_STORE* NewRootCertStore() {
}
}

X509_STORE* store = X509_STORE_new();
store = X509_STORE_new();
if (ssl_openssl_cert_store) {
X509_STORE_set_default_paths(store);
} else {
Expand All @@ -721,6 +740,7 @@ static X509_STORE* NewRootCertStore() {
}

return store;
#endif // SYSTEM_CERTS
}


Expand All @@ -745,7 +765,7 @@ void SecureContext::AddCACert(const FunctionCallbackInfo<Value>& args) {
while (X509* x509 =
PEM_read_bio_X509(bio, nullptr, CryptoPemCallback, nullptr)) {
if (cert_store == root_cert_store) {
cert_store = NewRootCertStore();
cert_store = NewRootCertStore(sc);
SSL_CTX_set_cert_store(sc->ctx_, cert_store);
}
X509_STORE_add_cert(cert_store, x509);
Expand Down Expand Up @@ -784,7 +804,7 @@ void SecureContext::AddCRL(const FunctionCallbackInfo<Value>& args) {

X509_STORE* cert_store = SSL_CTX_get_cert_store(sc->ctx_);
if (cert_store == root_cert_store) {
cert_store = NewRootCertStore();
cert_store = NewRootCertStore(sc);
SSL_CTX_set_cert_store(sc->ctx_, cert_store);
}

Expand Down Expand Up @@ -837,7 +857,7 @@ void SecureContext::AddRootCerts(const FunctionCallbackInfo<Value>& args) {
(void) &clear_error_on_return; // Silence compiler warning.

if (!root_cert_store) {
root_cert_store = NewRootCertStore();
root_cert_store = NewRootCertStore(sc);

if (!extra_root_certs_file.empty()) {
unsigned long err = AddCertsFromFile( // NOLINT(runtime/int)
Expand Down Expand Up @@ -1079,7 +1099,7 @@ void SecureContext::LoadPKCS12(const FunctionCallbackInfo<Value>& args) {
X509* ca = sk_X509_value(extra_certs, i);

if (cert_store == root_cert_store) {
cert_store = NewRootCertStore();
cert_store = NewRootCertStore(sc);
SSL_CTX_set_cert_store(sc->ctx_, cert_store);
}
X509_STORE_add_cert(cert_store, ca);
Expand Down