forked from nodejs/node
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
src: Add NODE_EXTRA_CA_CERTS to modified cert stores
Store loaded NODE_EXTRA_CA_CERTS into root_certs_vector, allowing them to be added to secure contexts when NewRootCertStore() is called. When NODE_EXTRA_CA_CERTS is specified, the bundled root certificates will no longer be preloaded at startup. This improves Node.js startup time and makes the behavior of NODE_EXTRA_CA_CERTS consistent with the default behavior when NODE_EXTRA_CA_CERTS is ommitted. Fixes: nodejs#32010 Refs: nodejs#40524
- Loading branch information
Showing
4 changed files
with
178 additions
and
31 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,55 @@ | ||
'use strict'; | ||
|
||
const common = require('../common'); | ||
|
||
if (!common.hasCrypto) | ||
common.skip('missing crypto'); | ||
|
||
const assert = require('assert'); | ||
const tls = require('tls'); | ||
const fixtures = require('../common/fixtures'); | ||
|
||
const { fork } = require('child_process'); | ||
|
||
if (process.env.CHILD) { | ||
const copts = { | ||
port: process.env.PORT, | ||
checkServerIdentity: common.mustCall() | ||
}; | ||
|
||
// New secure contexts have the well-known root CAs. | ||
copts.secureContext = tls.createSecureContext(); | ||
|
||
// Explicit calls to addCACert() add to the root certificates, | ||
// instead of replacing, so connection still succeeds. | ||
copts.secureContext.context.addCACert( | ||
fixtures.readKey('ca1-cert.pem') | ||
); | ||
|
||
const client = tls.connect(copts, common.mustCall(() => { | ||
client.end('hi'); | ||
})); | ||
|
||
return; | ||
} | ||
|
||
const options = { | ||
key: fixtures.readKey('agent3-key.pem'), | ||
cert: fixtures.readKey('agent3-cert.pem') | ||
}; | ||
|
||
const server = tls.createServer(options, common.mustCall((socket) => { | ||
socket.end('bye'); | ||
server.close(); | ||
})).listen(0, common.mustCall(() => { | ||
const env = Object.assign({}, process.env, { | ||
CHILD: 'yes', | ||
PORT: server.address().port, | ||
NODE_EXTRA_CA_CERTS: fixtures.path('keys', 'ca2-cert.pem') | ||
}); | ||
|
||
fork(__filename, { env }).on('exit', common.mustCall((status) => { | ||
// Client did not succeed in connecting | ||
assert.strictEqual(status, 0); | ||
})); | ||
})); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,47 @@ | ||
'use strict'; | ||
|
||
const common = require('../common'); | ||
|
||
if (!common.hasCrypto) | ||
common.skip('missing crypto'); | ||
|
||
const assert = require('assert'); | ||
const tls = require('tls'); | ||
const fixtures = require('../common/fixtures'); | ||
|
||
const { fork } = require('child_process'); | ||
|
||
if (process.env.CHILD) { | ||
const copts = { | ||
port: process.env.PORT, | ||
checkServerIdentity: common.mustCall(), | ||
crl: fixtures.readKey('ca2-crl.pem') | ||
}; | ||
|
||
const client = tls.connect(copts, common.mustCall(() => { | ||
client.end('hi'); | ||
})); | ||
|
||
return; | ||
} | ||
|
||
const options = { | ||
key: fixtures.readKey('agent3-key.pem'), | ||
cert: fixtures.readKey('agent3-cert.pem') | ||
}; | ||
|
||
const server = tls.createServer(options, common.mustCall((socket) => { | ||
socket.end('bye'); | ||
server.close(); | ||
})).listen(0, common.mustCall(() => { | ||
const env = Object.assign({}, process.env, { | ||
CHILD: 'yes', | ||
PORT: server.address().port, | ||
NODE_EXTRA_CA_CERTS: fixtures.path('keys', 'ca2-cert.pem') | ||
}); | ||
|
||
fork(__filename, { env }).on('exit', common.mustCall((status) => { | ||
// Client did not succeed in connecting | ||
assert.strictEqual(status, 0); | ||
})); | ||
})); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,48 @@ | ||
'use strict'; | ||
|
||
const common = require('../common'); | ||
|
||
if (!common.hasCrypto) | ||
common.skip('missing crypto'); | ||
|
||
const assert = require('assert'); | ||
const tls = require('tls'); | ||
const fixtures = require('../common/fixtures'); | ||
|
||
const { fork } = require('child_process'); | ||
|
||
if (process.env.CHILD) { | ||
const copts = { | ||
port: process.env.PORT, | ||
checkServerIdentity: common.mustCall(), | ||
pfx: fixtures.readKey('agent1.pfx'), | ||
passphrase: 'sample' | ||
}; | ||
|
||
const client = tls.connect(copts, common.mustCall(() => { | ||
client.end('hi'); | ||
})); | ||
|
||
return; | ||
} | ||
|
||
const options = { | ||
key: fixtures.readKey('agent3-key.pem'), | ||
cert: fixtures.readKey('agent3-cert.pem') | ||
}; | ||
|
||
const server = tls.createServer(options, common.mustCall((socket) => { | ||
socket.end('bye'); | ||
server.close(); | ||
})).listen(0, common.mustCall(() => { | ||
const env = Object.assign({}, process.env, { | ||
CHILD: 'yes', | ||
PORT: server.address().port, | ||
NODE_EXTRA_CA_CERTS: fixtures.path('keys', 'ca2-cert.pem') | ||
}); | ||
|
||
fork(__filename, { env }).on('exit', common.mustCall((status) => { | ||
// Client did not succeed in connecting | ||
assert.strictEqual(status, 0); | ||
})); | ||
})); |