diff options
| -rw-r--r-- | node.gyp | 3 | ||||
| -rw-r--r-- | src/crypto/crypto_context.cc | 10 | ||||
| -rw-r--r-- | src/crypto/crypto_context.h | 2 | ||||
| -rw-r--r-- | test/cctest/test_node_crypto.cc | 23 |
4 files changed, 35 insertions, 3 deletions
@@ -1360,6 +1360,9 @@ 'defines': [ 'HAVE_OPENSSL=1', ], + 'sources': [ + 'test/cctest/test_node_crypto.cc', + ] }], [ 'node_use_openssl=="true" and experimental_quic==1', { 'defines': [ diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc index d0210079166..856b34e54a9 100644 --- a/src/crypto/crypto_context.cc +++ b/src/crypto/crypto_context.cc @@ -186,12 +186,15 @@ int SSL_CTX_use_certificate_chain(SSL_CTX* ctx, issuer); } -static X509_STORE* NewRootCertStore() { +} // namespace + +X509_STORE* NewRootCertStore() { static std::vector<X509*> root_certs_vector; static Mutex root_certs_vector_mutex; Mutex::ScopedLock lock(root_certs_vector_mutex); - if (root_certs_vector.empty()) { + if (root_certs_vector.empty() && + per_process::cli_options->ssl_openssl_cert_store == false) { for (size_t i = 0; i < arraysize(root_certs); i++) { X509* x509 = PEM_read_bio_X509(NodeBIO::NewFixed(root_certs[i], @@ -209,7 +212,9 @@ static X509_STORE* NewRootCertStore() { X509_STORE* store = X509_STORE_new(); if (*system_cert_path != '\0') { + ERR_set_mark(); X509_STORE_load_locations(store, system_cert_path, nullptr); + ERR_pop_to_mark(); } Mutex::ScopedLock cli_lock(node::per_process::cli_options_mutex); @@ -224,7 +229,6 @@ static X509_STORE* NewRootCertStore() { return store; } -} // namespace void GetRootCertificates(const FunctionCallbackInfo<Value>& args) { Environment* env = Environment::GetCurrent(args); diff --git a/src/crypto/crypto_context.h b/src/crypto/crypto_context.h index e36a76c5a88..5a2126c2ea3 100644 --- a/src/crypto/crypto_context.h +++ b/src/crypto/crypto_context.h @@ -21,6 +21,8 @@ void GetRootCertificates( void IsExtraRootCertsFileLoaded( const v8::FunctionCallbackInfo<v8::Value>& args); +X509_STORE* NewRootCertStore(); + class SecureContext final : public BaseObject { public: using GetSessionCb = SSL_SESSION* (*)(SSL*, const unsigned char*, int, int*); diff --git a/test/cctest/test_node_crypto.cc b/test/cctest/test_node_crypto.cc new file mode 100644 index 00000000000..c0ce5f25496 --- /dev/null +++ b/test/cctest/test_node_crypto.cc @@ -0,0 +1,23 @@ +// This simulates specifying the configuration option --openssl-system-ca-path +// and settting it to a file that does not exist. +#define NODE_OPENSSL_SYSTEM_CERT_PATH "/missing/ca.pem" + +#include "crypto/crypto_context.h" +#include "node_options.h" +#include "openssl/err.h" +#include "gtest/gtest.h" + +/* + * This test verifies that a call to NewRootCertDir with the build time + * configuration option --openssl-system-ca-path set to an missing file, will + * not leave any OpenSSL errors on the OpenSSL error stack. + * See https://github.com/nodejs/node/issues/35456 for details. + */ +TEST(NodeCrypto, NewRootCertStore) { + node::per_process::cli_options->ssl_openssl_cert_store = true; + X509_STORE* store = node::crypto::NewRootCertStore(); + ASSERT_TRUE(store); + ASSERT_EQ(ERR_peek_error(), 0UL) << "NewRootCertStore should not have left " + "any errors on the OpenSSL error stack\n"; + X509_STORE_free(store); +} |