tls: support code compatibility using OpenSSL default CAfile

Author: Archkon

lib/tls.js

@@ -45,6 +45,7 @@ const {
   getBundledRootCertificates,
   getExtraCACertificates,
   // getOpenSSLCACertificates,
+  getOpenSSLDefaultCACertificates,
   lookupOpenSSLCACertificates,
   getSystemCACertificates,
   resetRootCertStore,
@@ -158,6 +159,14 @@ function cacheSystemCACertificates() {
 //   return opensslCACertificates;
 // }
 
+let opensslDefaultCACertificates;
+function cacheOpenSSLDefaultCACertificates() {
+  opensslDefaultCACertificates ||= ObjectFreeze(
+    getOpenSSLDefaultCACertificates());
+
+  return opensslDefaultCACertificates;
+}
+
 let opensslCACertificateLookup;
 function cacheOpenSSLCertificateLookup(subjectNameOrCert) {
   opensslCACertificateLookup ??= new SafeMap();
@@ -191,15 +200,19 @@ function cacheDefaultCACertificates() {
 
   defaultCACertificates = [];
 
-  if (!getOptionValue('--use-openssl-ca')) {
+  if (getOptionValue('--use-openssl-ca')) {
+    const openssl = cacheOpenSSLDefaultCACertificates();
+    for (let i = 0; i < openssl.length; ++i) {
+      ArrayPrototypePush(defaultCACertificates, openssl[i]);
+    }
+  } else {
     const bundled = cacheBundledRootCertificates();
     for (let i = 0; i < bundled.length; ++i) {
       ArrayPrototypePush(defaultCACertificates, bundled[i]);
     }
     if (getOptionValue('--use-system-ca')) {
       const system = cacheSystemCACertificates();
       for (let i = 0; i < system.length; ++i) {
-
         ArrayPrototypePush(defaultCACertificates, system[i]);
       }
     }
@@ -208,7 +221,6 @@ function cacheDefaultCACertificates() {
   if (process.env.NODE_EXTRA_CA_CERTS) {
     const extra = cacheExtraCACertificates();
     for (let i = 0; i < extra.length; ++i) {
-
       ArrayPrototypePush(defaultCACertificates, extra[i]);
     }
   }
@@ -284,6 +296,7 @@ if (isBuildingSnapshot()) {
     extraCACertificates = undefined;
     systemCACertificates = undefined;
     // opensslCACertificates = undefined;
+    opensslDefaultCACertificates = undefined;
     opensslCACertificateLookup = undefined;
     if (hasResetDefaultCACertificates) {
       defaultCACertificates = undefined;

src/crypto/crypto_context.cc

@@ -1446,6 +1446,31 @@ void GetOpenSSLCACertificates(const FunctionCallbackInfo<Value>& args) {
 }
 */
 
+void GetOpenSSLDefaultCACertificates(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  std::vector<X509*> certs;
+  std::string cert_file;
+  // SSL_CERT_DIR uses subject-hash lookups, so there is no exact list without
+  // a lookup key. Only the default CA file can be enumerated here.
+  if (!credentials::SafeGetenv(X509_get_default_cert_file_env(), &cert_file)) {
+    cert_file = X509_get_default_cert_file();
+  }
+  if (!cert_file.empty()) {
+    LoadCertsFromFile(&certs, cert_file.c_str());
+  }
+  auto cleanup = OnScopeLeave([&certs]() {
+    for (X509* cert : certs) {
+      X509_free(cert);
+    }
+  });
+
+  Local<Array> results;
+  if (X509sToArrayOfStrings(env, certs.begin(), certs.end(), certs.size())
+          .ToLocal(&results)) {
+    args.GetReturnValue().Set(results);
+  }
+}
+
 static X509StorePointer NewOpenSSLDefaultCertificateStore(Environment* env) {
   X509StorePointer store(X509_STORE_new(), X509_STORE_free);
   if (!store) {
@@ -1671,6 +1696,10 @@ void SecureContext::Initialize(Environment* env, Local<Object> target) {
       context, target, "getSystemCACertificates", GetSystemCACertificates);
   // SetMethodNoSideEffect(
   //     context, target, "getOpenSSLCACertificates", GetOpenSSLCACertificates);
+  SetMethodNoSideEffect(context,
+                        target,
+                        "getOpenSSLDefaultCACertificates",
+                        GetOpenSSLDefaultCACertificates);
   SetMethodNoSideEffect(context,
                         target,
                         "lookupOpenSSLCACertificates",
@@ -1731,6 +1760,7 @@ void SecureContext::RegisterExternalReferences(
   registry->Register(GetBundledRootCertificates);
   registry->Register(GetSystemCACertificates);
   // registry->Register(GetOpenSSLCACertificates);
+  registry->Register(GetOpenSSLDefaultCACertificates);
   registry->Register(LookupOpenSSLCACertificates);
   registry->Register(GetExtraCACertificates);
   registry->Register(ResetRootCertStore);

test/fixtures/tls-check-openssl-ca-certificates.js

@@ -8,10 +8,24 @@ const { includesCert } = require('../common/tls');
 
 const expectedCertFiles = process.env.EXPECTED_CERT_FILES ?
   JSON.parse(process.env.EXPECTED_CERT_FILES) : [process.env.SSL_CERT_FILE];
+const expectedDefaultCertFiles = process.env.EXPECTED_DEFAULT_CERT_FILES ?
+  JSON.parse(process.env.EXPECTED_DEFAULT_CERT_FILES) : [];
+const unexpectedDefaultCertFiles = process.env.UNEXPECTED_DEFAULT_CERT_FILES ?
+  JSON.parse(process.env.UNEXPECTED_DEFAULT_CERT_FILES) : [];
 const defaultCerts = tls.getCACertificates('default');
-assert.deepStrictEqual(defaultCerts, []);
 assert.strictEqual(defaultCerts, tls.getCACertificates());
 assert.strictEqual(defaultCerts, tls.getCACertificates('default'));
+assert.strictEqual(defaultCerts.length, expectedDefaultCertFiles.length);
+
+for (const certFile of expectedDefaultCertFiles) {
+  const cert = fs.readFileSync(certFile, 'utf8');
+  assert(includesCert(defaultCerts, cert));
+}
+
+for (const certFile of unexpectedDefaultCertFiles) {
+  const cert = fs.readFileSync(certFile, 'utf8');
+  assert(!includesCert(defaultCerts, cert));
+}
 
 const expectedCerts = expectedCertFiles.map((certFile) => {
   const cert = fs.readFileSync(certFile, 'utf8');

test/parallel/test-tls-get-ca-certificates-openssl.js

@@ -1,7 +1,9 @@
 'use strict';
 
 // This tests that tls.getCACertificates('openssl', subjectNameOrCert) looks up
-// certificates from OpenSSL's default certificate file and hashed directories.
+// certificates from OpenSSL's default certificate file and hashed directories,
+// while tls.getCACertificates('default') only enumerates the default certificate
+// file without scanning hashed directories.
 
 const common = require('../common');
 if (!common.hasCrypto) common.skip('missing crypto');
@@ -56,6 +58,12 @@ spawnSyncAndExitWithoutError(
     env: {
       ...process.env,
       EXPECTED_CERT_FILES: JSON.stringify(expectedCertFiles),
+      EXPECTED_DEFAULT_CERT_FILES: JSON.stringify([expectedCertFiles[0]]),
+      UNEXPECTED_DEFAULT_CERT_FILES: JSON.stringify([
+        expectedCertFiles[1],
+        expectedCertFiles[2],
+        unexpectedCertFile,
+      ]),
       UNEXPECTED_CERT_FILE: unexpectedCertFile,
       NODE_EXTRA_CA_CERTS: undefined,
       SSL_CERT_FILE: expectedCertFiles[0],