src: fix missing extra ca in tls.rootCertificates #32075
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Fixes tls.rootCertificates missing certificates loaded from NODE_EXTRA_CA_CERTS. Fixes: nodejs#32074
nodejs-github-bot
added
c++
|
@nodejs/crypto |
|
Seems reasonable to me. I don't think that adding a NL to the PEM is semver-major, particularly since PEM tooling is robust to extra NLs. In other words if people used to be adding a NL while concatenation certs and were getting "END X -----\n-----BEGIN ..." between certs and now get "END X -----\n\n-----BEGIN ...", IMO, the output is still within spec. All bug fixes have a non-zero chance of breaking code which depends on implementation details. |
|
Looks as though all of the node ASAN builds were failing across the node.js ecosystem when this PR was submitted. Doesn't appear to be related to this PR. |
bnoordhuis
reviewed
Mar 4, 2020
- Moved X509ToPEM function to node_crypto.cc - Removed braces for single line statements - Modified X509ToPEM so that it throws crypto errors for unexpected OpenSSL errors
jasnell
reviewed
Mar 5, 2020
jasnell
reviewed
Mar 5, 2020
addaleax
approved these changes
Mar 5, 2020
bnoordhuis
approved these changes
Mar 5, 2020
jasnell
approved these changes
Mar 5, 2020
BridgeAR
added
the
author ready
|
Landed in 091444a |
Merged
ebickle
added a commit
to ebickle/node
that referenced
this pull request
Mar 17, 2020
Adds CAs from NODE_EXTRA_CA_CERTS to root_certs_vector in node_crypto.cc so that the extra certificates are always added to SecureContext instances. tls.rootCertificates restored to previous behavior of returning built-in Node.js certificates when --openssl-use-def-ca-store CLI option is set. Fixes: nodejs#32229 Fixes: nodejs#32010 Refs: nodejs#32075
3 tasks
MylesBorins
pushed a commit
to ebickle/node
that referenced
this pull request
Mar 26, 2020
Adds CAs from NODE_EXTRA_CA_CERTS to root_certs_vector in node_crypto.cc so that the extra certificates are always added to SecureContext instances. tls.rootCertificates restored to previous behavior of returning built-in Node.js certificates when --openssl-use-def-ca-store CLI option is set. Fixes: nodejs#32229 Fixes: nodejs#32010 Refs: nodejs#32075
ebickle
added a commit
to ebickle/node
that referenced
this pull request
Apr 8, 2020
Adds CAs from NODE_EXTRA_CA_CERTS to root_certs_vector in node_crypto.cc so that the extra certificates are always added to SecureContext instances. tls.rootCertificates restored to previous behavior of returning built-in Node.js certificates when --openssl-use-def-ca-store CLI option is set. Fixes: nodejs#32229 Fixes: nodejs#32010 Refs: nodejs#32075
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fixes tls.rootCertificates missing certificates loaded from NODE_EXTRA_CA_CERTS.
Fixes: #32074
Potentially contains a semver-major breaking change. Change adheres to all existing specifications, but there is a non-zero risk that callers may have written code that does not expect changes to the contents of the
tls.rootCertificatesarray.tls.rootCertificatesnow includes certificate loaded fromNODE_EXTRA_CA_CERTSenvironment variable.tls.rootCertificatesis now terminated with a\nline break. This adheres to the PEM file format specification and is generally preferred - many non node.js systems fail if the line-break is not specified.Notes for code reviewers:
X509_STORE*to ensure thattls.rootCertificatesreflects the true certificates used bySecureContextand to avoid synchronizing/maintaining a separate variable innode_crypto.cc.X509ToPEMfunction was placed innode_crypto_common.ccsince it pairs with the existingX509ToObjectfunction.GetRootCertificatesfunction returns without setting a JavaScript return value when an unexpected error occurs (e.g. error callingPEM_write_bio_X509). This was done to remain consistent with the previous implementation ofGetRootCertificates.Checklist
make -j4 test(UNIX), orvcbuild test(Windows) passes