FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

src: add openssl-system-ca-path configure option · nodejs/node@0b93bbb · GitHub

/ node Public

Commit 0b93bbb

Browse files
danbev
authored and
evanlucas
committed
src: add openssl-system-ca-path configure option
The motivation for this commit is that we need to specify system CA certificates when building node. While we are aware of the environment variable NODE_EXTRA_CA_CERTS this is not a great solution as we build an RPM and we also don't want users to be able to unset them. The suggestion is to add a configure time property like this: --openssl-system-ca-path=OPENSSL_SYSTEM_CA_PATH Use the specified path to system CA (PEM format) in addition to the OpenSSL supplied CA store or compiled- in Mozilla CA copy. Usage example: $ ./configure --openssl-system-ca-path=/etc/pki/tls/certs/ca-bundle.crt This would add the specified CA certificates in addition to the ones already being used. PR-URL: #16790 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Tobias Nießen <tniessen@tnie.de>
1 parent 75405a1 commit 0b93bbb

4 files changed

Lines changed: 27 additions & 1 deletion

File tree

‎configure‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,12 @@ parser.add_option('--openssl-use-def-ca-store',
172172
dest='use_openssl_ca_store',
173173
help='Use OpenSSL supplied CA store instead of compiled-in Mozilla CA copy.')
174174

175+
parser.add_option('--openssl-system-ca-path',
176+
action='store',
177+
dest='openssl_system_ca_path',
178+
help='Use the specified path to system CA (PEM format) in addition to '
179+
'the OpenSSL supplied CA store or compiled-in Mozilla CA copy.')
180+
175181
shared_optgroup.add_option('--shared-http-parser',
176182
action='store_true',
177183
dest='shared_http_parser',
@@ -1013,6 +1019,8 @@ def configure_openssl(o):
10131019
o['variables']['openssl_no_asm'] = 1 if options.openssl_no_asm else 0
10141020
if options.use_openssl_ca_store:
10151021
o['defines'] += ['NODE_OPENSSL_CERT_STORE']
1022+
if options.openssl_system_ca_path:
1023+
o['variables']['openssl_system_ca_path'] = options.openssl_system_ca_path
10161024
o['variables']['node_without_node_options'] = b(options.without_node_options)
10171025
if options.without_node_options:
10181026
o['defines'] += ['NODE_WITHOUT_NODE_OPTIONS']

‎node.gyp‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -297,13 +297,24 @@
297297
'<(SHARED_INTERMEDIATE_DIR)/node_javascript.cc',
298298
],
299299

300+
'variables': {
301+
'openssl_system_ca_path%': '',
302+
},
303+
300304
'defines': [
301305
'NODE_ARCH="<(target_arch)"',
302306
'NODE_PLATFORM="<(OS)"',
303307
'NODE_WANT_INTERNALS=1',
304308
# Warn when using deprecated V8 APIs.
305309
'V8_DEPRECATION_WARNINGS=1',
310+
'NODE_OPENSSL_SYSTEM_CERT_PATH="<(openssl_system_ca_path)"',
306311
],
312+
313+
'direct_dependent_settings': {
314+
'defines': [
315+
'NODE_OPENSSL_SYSTEM_CERT_PATH="<(openssl_system_ca_path)"',
316+
],
317+
},
307318
},
308319
{
309320
'target_name': 'mkssldef',

‎src/node_crypto.cc‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,8 @@ static const char* const root_certs[] = {
147147
#include "node_root_certs.h" // NOLINT(build/include_order)
148148
};
149149

150+
static const char system_cert_path[] = NODE_OPENSSL_SYSTEM_CERT_PATH;
151+
150152
static std::string extra_root_certs_file; // NOLINT(runtime/string)
151153

152154
static X509_STORE* root_cert_store;
@@ -799,6 +801,9 @@ static X509_STORE* NewRootCertStore() {
799801
}
800802

801803
X509_STORE* store = X509_STORE_new();
804+
if (*system_cert_path != '\0') {
805+
X509_STORE_load_locations(store, system_cert_path, nullptr);
806+
}
802807
if (ssl_openssl_cert_store) {
803808
X509_STORE_set_default_paths(store);
804809
} else {

‎test/parallel/test-process-config.js‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,9 @@ if (!fs.existsSync(configPath)) {
4545
let config = fs.readFileSync(configPath, 'utf8');
4646

4747
// Clean up comment at the first line.
48-
config = config.split('\n').slice(1).join('\n').replace(/'/g, '"');
48+
config = config.split('\n').slice(1).join('\n');
49+
config = config.replace(/"/g, '\\"');
50+
config = config.replace(/'/g, '"');
4951
config = JSON.parse(config, function(key, value) {
5052
if (value === 'true') return true;
5153
if (value === 'false') return false;

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL