Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 0b93bbb

Browse filesBrowse files
danbevevanlucas
danbev
authored and
evanlucas
committed
src: add openssl-system-ca-path configure option
The motivation for this commit is that we need to specify system CA certificates when building node. While we are aware of the environment variable NODE_EXTRA_CA_CERTS this is not a great solution as we build an RPM and we also don't want users to be able to unset them. The suggestion is to add a configure time property like this: --openssl-system-ca-path=OPENSSL_SYSTEM_CA_PATH Use the specified path to system CA (PEM format) in addition to the OpenSSL supplied CA store or compiled- in Mozilla CA copy. Usage example: $ ./configure --openssl-system-ca-path=/etc/pki/tls/certs/ca-bundle.crt This would add the specified CA certificates in addition to the ones already being used. PR-URL: #16790 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl> Reviewed-By: Tobias Nießen <tniessen@tnie.de>
1 parent 75405a1 commit 0b93bbb
Copy full SHA for 0b93bbb

File tree

Expand file treeCollapse file tree

4 files changed

+27
-1
lines changed
Open diff view settings
Filter options
Expand file treeCollapse file tree

4 files changed

+27
-1
lines changed
Open diff view settings
Collapse file

‎configure‎

Copy file name to clipboardExpand all lines: configure
+8Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,12 @@ parser.add_option('--openssl-use-def-ca-store',
172172
dest='use_openssl_ca_store',
173173
help='Use OpenSSL supplied CA store instead of compiled-in Mozilla CA copy.')
174174

175+
parser.add_option('--openssl-system-ca-path',
176+
action='store',
177+
dest='openssl_system_ca_path',
178+
help='Use the specified path to system CA (PEM format) in addition to '
179+
'the OpenSSL supplied CA store or compiled-in Mozilla CA copy.')
180+
175181
shared_optgroup.add_option('--shared-http-parser',
176182
action='store_true',
177183
dest='shared_http_parser',
@@ -1013,6 +1019,8 @@ def configure_openssl(o):
10131019
o['variables']['openssl_no_asm'] = 1 if options.openssl_no_asm else 0
10141020
if options.use_openssl_ca_store:
10151021
o['defines'] += ['NODE_OPENSSL_CERT_STORE']
1022+
if options.openssl_system_ca_path:
1023+
o['variables']['openssl_system_ca_path'] = options.openssl_system_ca_path
10161024
o['variables']['node_without_node_options'] = b(options.without_node_options)
10171025
if options.without_node_options:
10181026
o['defines'] += ['NODE_WITHOUT_NODE_OPTIONS']
Collapse file

‎node.gyp‎

Copy file name to clipboardExpand all lines: node.gyp
+11Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -297,13 +297,24 @@
297297
'<(SHARED_INTERMEDIATE_DIR)/node_javascript.cc',
298298
],
299299

300+
'variables': {
301+
'openssl_system_ca_path%': '',
302+
},
303+
300304
'defines': [
301305
'NODE_ARCH="<(target_arch)"',
302306
'NODE_PLATFORM="<(OS)"',
303307
'NODE_WANT_INTERNALS=1',
304308
# Warn when using deprecated V8 APIs.
305309
'V8_DEPRECATION_WARNINGS=1',
310+
'NODE_OPENSSL_SYSTEM_CERT_PATH="<(openssl_system_ca_path)"',
306311
],
312+
313+
'direct_dependent_settings': {
314+
'defines': [
315+
'NODE_OPENSSL_SYSTEM_CERT_PATH="<(openssl_system_ca_path)"',
316+
],
317+
},
307318
},
308319
{
309320
'target_name': 'mkssldef',
Collapse file

‎src/node_crypto.cc‎

Copy file name to clipboardExpand all lines: src/node_crypto.cc
+5Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -147,6 +147,8 @@ static const char* const root_certs[] = {
147147
#include "node_root_certs.h" // NOLINT(build/include_order)
148148
};
149149

150+
static const char system_cert_path[] = NODE_OPENSSL_SYSTEM_CERT_PATH;
151+
150152
static std::string extra_root_certs_file; // NOLINT(runtime/string)
151153

152154
static X509_STORE* root_cert_store;
@@ -799,6 +801,9 @@ static X509_STORE* NewRootCertStore() {
799801
}
800802

801803
X509_STORE* store = X509_STORE_new();
804+
if (*system_cert_path != '\0') {
805+
X509_STORE_load_locations(store, system_cert_path, nullptr);
806+
}
802807
if (ssl_openssl_cert_store) {
803808
X509_STORE_set_default_paths(store);
804809
} else {
Collapse file

‎test/parallel/test-process-config.js‎

Copy file name to clipboardExpand all lines: test/parallel/test-process-config.js
+3-1Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,9 @@ if (!fs.existsSync(configPath)) {
4545
let config = fs.readFileSync(configPath, 'utf8');
4646

4747
// Clean up comment at the first line.
48-
config = config.split('\n').slice(1).join('\n').replace(/'/g, '"');
48+
config = config.split('\n').slice(1).join('\n');
49+
config = config.replace(/"/g, '\\"');
50+
config = config.replace(/'/g, '"');
4951
config = JSON.parse(config, function(key, value) {
5052
if (value === 'true') return true;
5153
if (value === 'false') return false;

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.