nodejs/nodejs-use-system-certs.patch

87 lines
2.5 KiB
Diff

From 515a1619d3b13a7af52d58dee9a43b981e45c2bb Mon Sep 17 00:00:00 2001
From: Stephen Gallagher <sgallagh@redhat.com>
Date: Tue, 1 Dec 2015 16:29:07 -0500
Subject: [PATCH 2/2] Do not bundle CA Certificates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
CA Certificates are provided by Fedora.
Forwarded: need some feedback before submitting the matter upstream
Author: Jérémy Lal <kapouer@melix.org>
Last-Update: 2014-03-02
Modified 2014-05-02 by T.C. Hollingsworth <tchollingsworth@gmail.com> with the
correct path for Fedora
Modified 2015-12-01 by Stephen Gallagher <sgallagh@redhat.com> to update for
Node.js 4.2
---
src/node_crypto.cc | 31 ++++++++-----------------------
1 file changed, 8 insertions(+), 23 deletions(-)
diff --git a/src/node_crypto.cc b/src/node_crypto.cc
index b03e6444ff8a3b4209d1e7806380e80566da243c..331c155aebfa0a42277dbe48e03a0b866b98bd06 100644
--- a/src/node_crypto.cc
+++ b/src/node_crypto.cc
@@ -125,11 +125,11 @@ struct ClearErrorOnReturn {
};
static uv_mutex_t* locks;
const char* const root_certs[] = {
-#include "node_root_certs.h" // NOLINT(build/include_order)
+ NULL
};
X509_STORE* root_cert_store;
// Just to generate static methods
@@ -704,36 +704,21 @@ void SecureContext::AddRootCerts(const FunctionCallbackInfo<Value>& args) {
(void) &clear_error_on_return; // Silence compiler warning.
CHECK_EQ(sc->ca_store_, nullptr);
if (!root_cert_store) {
- root_cert_store = X509_STORE_new();
-
- for (size_t i = 0; i < ARRAY_SIZE(root_certs); i++) {
- BIO* bp = NodeBIO::New();
-
- if (!BIO_write(bp, root_certs[i], strlen(root_certs[i]))) {
- BIO_free_all(bp);
- return;
- }
-
- X509 *x509 = PEM_read_bio_X509(bp, nullptr, CryptoPemCallback, nullptr);
-
- if (x509 == nullptr) {
- BIO_free_all(bp);
- return;
- }
-
- X509_STORE_add_cert(root_cert_store, x509);
-
- BIO_free_all(bp);
- X509_free(x509);
+ if (SSL_CTX_load_verify_locations(sc->ctx_, "/etc/pki/tls/certs/ca-bundle.crt", NULL) == 1) {
+ root_cert_store = SSL_CTX_get_cert_store(sc->ctx_);
+ } else {
+ // empty store
+ root_cert_store = X509_STORE_new();
}
+ } else {
+ SSL_CTX_set_cert_store(sc->ctx_, root_cert_store);
}
sc->ca_store_ = root_cert_store;
- SSL_CTX_set_cert_store(sc->ctx_, sc->ca_store_);
}
void SecureContext::SetCiphers(const FunctionCallbackInfo<Value>& args) {
SecureContext* sc = Unwrap<SecureContext>(args.Holder());
--
2.7.0