Skip to content

Commit d87558c

Browse files
committed
src: make --use-system-ca per-env rather than per-process
1 parent 77d8197 commit d87558c

File tree

6 files changed

+14
-18
lines changed

6 files changed

+14
-18
lines changed

src/crypto/crypto_common.cc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ MaybeLocal<Value> GetValidationErrorReason(Environment* env, int err) {
6161
(err == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE) ||
6262
(err == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) ||
6363
((err == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT) &&
64-
!per_process::cli_options->use_system_ca);
64+
!env->options()->use_system_ca);
6565

6666
if (suggest_system_ca) {
6767
reason.append("; if the root CA is installed locally, "

src/crypto/crypto_context.cc

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -850,7 +850,7 @@ static void LoadCACertificates(void* data) {
850850

851851
{
852852
Mutex::ScopedLock cli_lock(node::per_process::cli_options_mutex);
853-
if (!per_process::cli_options->use_system_ca) {
853+
if (!per_process::cli_options->per_isolate->per_env->use_system_ca) {
854854
return;
855855
}
856856
}
@@ -959,7 +959,7 @@ X509_STORE* NewRootCertStore() {
959959
for (X509* cert : GetBundledRootCertificates()) {
960960
CHECK_EQ(1, X509_STORE_add_cert(store, cert));
961961
}
962-
if (per_process::cli_options->use_system_ca) {
962+
if (per_process::cli_options->per_isolate->per_env->use_system_ca) {
963963
for (X509* cert : GetSystemStoreCACertificates()) {
964964
CHECK_EQ(1, X509_STORE_add_cert(store, cert));
965965
}

src/node.cc

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -871,15 +871,6 @@ static ExitCode InitializeNodeWithArgsInternal(
871871
// default value.
872872
V8::SetFlagsFromString("--rehash-snapshot");
873873

874-
#if HAVE_OPENSSL
875-
// TODO(joyeecheung): make this a per-env option and move the normalization
876-
// into HandleEnvOptions.
877-
std::string use_system_ca;
878-
if (credentials::SafeGetenv("NODE_USE_SYSTEM_CA", &use_system_ca) &&
879-
use_system_ca == "1") {
880-
per_process::cli_options->use_system_ca = true;
881-
}
882-
#endif // HAVE_OPENSSL
883874
HandleEnvOptions(per_process::cli_options->per_isolate->per_env);
884875

885876
std::string node_options;

src/node_options.cc

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -993,6 +993,11 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
993993
&EnvironmentOptions::trace_env_native_stack,
994994
kAllowedInEnvvar);
995995

996+
AddOption("--use-system-ca",
997+
"use system's CA store",
998+
&EnvironmentOptions::use_system_ca,
999+
kAllowedInEnvvar);
1000+
9961001
AddOption(
9971002
"--trace-require-module",
9981003
"Print access to require(esm). Options are 'all' (print all usage) and "
@@ -1332,10 +1337,6 @@ PerProcessOptionsParser::PerProcessOptionsParser(
13321337
,
13331338
&PerProcessOptions::use_openssl_ca,
13341339
kAllowedInEnvvar);
1335-
AddOption("--use-system-ca",
1336-
"use system's CA store",
1337-
&PerProcessOptions::use_system_ca,
1338-
kAllowedInEnvvar);
13391340
AddOption("--use-bundled-ca",
13401341
"use bundled CA store"
13411342
#if !defined(NODE_OPENSSL_CERT_STORE)
@@ -2074,6 +2075,10 @@ void HandleEnvOptions(std::shared_ptr<EnvironmentOptions> env_options,
20742075

20752076
env_options->use_env_proxy = opt_getter("NODE_USE_ENV_PROXY") == "1";
20762077

2078+
#if HAVE_OPENSSL
2079+
env_options->use_system_ca = opt_getter("NODE_USE_SYSTEM_CA") == "1";
2080+
#endif // HAVE_OPENSSL
2081+
20772082
if (env_options->redirect_warnings.empty())
20782083
env_options->redirect_warnings = opt_getter("NODE_REDIRECT_WARNINGS");
20792084
}

src/node_options.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -221,6 +221,7 @@ class EnvironmentOptions : public Options {
221221
bool trace_env = false;
222222
bool trace_env_js_stack = false;
223223
bool trace_env_native_stack = false;
224+
bool use_system_ca = false;
224225
std::string trace_require_module;
225226
bool extra_info_on_fatal_exception = true;
226227
std::string unhandled_rejections;
@@ -357,7 +358,6 @@ class PerProcessOptions : public Options {
357358
bool ssl_openssl_cert_store = false;
358359
#endif
359360
bool use_openssl_ca = false;
360-
bool use_system_ca = false;
361361
bool use_bundled_ca = false;
362362
bool enable_fips_crypto = false;
363363
bool force_fips_crypto = false;

test/parallel/test-cli-node-options.js

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ if (common.hasCrypto) {
6868
if (!hasOpenSSL3)
6969
expectNoWorker('--openssl-config=_ossl_cfg', 'B\n');
7070
if (common.isMacOS) {
71-
expectNoWorker('--use-system-ca', 'B\n');
71+
expect('--use-system-ca', 'B\n');
7272
}
7373
}
7474

0 commit comments

Comments
 (0)