Skip to content

Commit 8fce134

Browse files
committed
crypto: addressed PR comments
1 parent 87a7def commit 8fce134

File tree

3 files changed

+46
-39
lines changed

3 files changed

+46
-39
lines changed

doc/api/cli.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1540,8 +1540,8 @@ See `SSL_CERT_DIR` and `SSL_CERT_FILE`.
15401540
Node.js uses the trusted CA certificates present in the system store along with
15411541
the `--use-bundled-ca`, `--use-openssl-ca` options.
15421542

1543-
Note, Only current user certificates are accessible using this method, not the
1544-
local machine store. This option is available to Windows only.
1543+
Only current user certificates are accessible using this method, not the local
1544+
machine store. This option is available to Windows only.
15451545

15461546
### `--use-largepages=mode`
15471547

src/crypto/crypto_context.cc

Lines changed: 36 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -200,60 +200,59 @@ int SSL_CTX_use_certificate_chain(SSL_CTX* ctx,
200200
void ReadSystemStoreCertificates(
201201
std::vector<std::string>* system_root_certificates) {
202202
#ifdef _WIN32
203-
const HCERTSTORE hStore = CertOpenSystemStoreW(0, L"ROOT");
204-
CHECK_NE(hStore, nullptr);
203+
CertStorePointer system_store;
205204

206-
auto cleanup =
207-
OnScopeLeave([hStore]() { CHECK_EQ(CertCloseStore(hStore, 0), TRUE); });
205+
PCCERT_CONTEXT certificate_context_ptr = nullptr;
208206

209-
PCCERT_CONTEXT pCtx = nullptr;
207+
std::vector<X509*> system_root_certificates_X509;
210208

211-
while ((pCtx = CertEnumCertificatesInStore(hStore, pCtx)) != nullptr) {
212-
const DWORD cbSize = CertGetNameStringW(
213-
pCtx, CERT_NAME_SIMPLE_DISPLAY_TYPE, 0, nullptr, nullptr, 0);
209+
while ((certificate_context_ptr = CertEnumCertificatesInStore(
210+
system_store.ref_, certificate_context_ptr)) != nullptr) {
211+
const DWORD certificate_buffer_size =
212+
CertGetNameStringW(certificate_context_ptr,
213+
CERT_NAME_SIMPLE_DISPLAY_TYPE,
214+
0,
215+
nullptr,
216+
nullptr,
217+
0);
214218

215-
CHECK_GT(cbSize, 0);
219+
CHECK_GT(certificate_buffer_size, 0);
216220

217-
std::vector<wchar_t> pszName(cbSize);
221+
std::vector<wchar_t> certificate_name(certificate_buffer_size);
218222

219-
CHECK_GT(CertGetNameStringW(pCtx,
223+
CHECK_GT(CertGetNameStringW(certificate_context_ptr,
220224
CERT_NAME_SIMPLE_DISPLAY_TYPE,
221225
0,
222226
nullptr,
223-
pszName.data(),
224-
cbSize),
227+
certificate_name.data(),
228+
certificate_buffer_size),
225229
0);
230+
const unsigned char* certificate_src_ptr =
231+
reinterpret_cast<const unsigned char*>(
232+
certificate_context_ptr->pbCertEncoded);
233+
const size_t certificate_src_length =
234+
certificate_context_ptr->cbCertEncoded;
226235

227-
const char* certificate_src_ptr =
228-
reinterpret_cast<const char*>(pCtx->pbCertEncoded);
229-
const size_t slen = pCtx->cbCertEncoded;
230-
const size_t dlen = base64_encoded_size(slen);
236+
X509* cert =
237+
d2i_X509(nullptr, &certificate_src_ptr, certificate_src_length);
231238

232-
char* certificate_dst_ptr = UncheckedMalloc(dlen);
233-
234-
CHECK_NOT_NULL(certificate_dst_ptr);
235-
236-
auto cleanup =
237-
OnScopeLeave([certificate_dst_ptr]() { free(certificate_dst_ptr); });
238-
239-
const size_t written =
240-
base64_encode(certificate_src_ptr, slen, certificate_dst_ptr, dlen);
241-
CHECK_EQ(written, dlen);
239+
system_root_certificates_X509.emplace_back(cert);
240+
}
242241

243-
std::string base64_string_output(certificate_dst_ptr, dlen);
242+
for (size_t i = 0; i < system_root_certificates_X509.size(); i++) {
243+
int result = 0;
244244

245-
constexpr size_t distance = 72;
246-
size_t pos = distance;
245+
BIOPointer bio(BIO_new(BIO_s_mem()));
246+
CHECK(bio);
247247

248-
while (pos < base64_string_output.size()) {
249-
base64_string_output.insert(pos, "\n");
250-
pos += distance + 1;
251-
}
248+
BUF_MEM* mem = nullptr;
249+
result = PEM_write_bio_X509(bio.get(), system_root_certificates_X509[i]);
252250

253-
base64_string_output = "-----BEGIN CERTIFICATE-----\n" +
254-
base64_string_output + "\n-----END CERTIFICATE-----";
251+
BIO_get_mem_ptr(bio.get(), &mem);
252+
std::string certificate_string_pem(mem->data, mem->length);
253+
system_root_certificates->emplace_back(certificate_string_pem);
255254

256-
system_root_certificates->emplace_back(std::move(base64_string_output));
255+
bio.reset();
257256
}
258257
#endif
259258
}

src/crypto/crypto_context.h

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,14 @@ namespace crypto {
1515
// Node.js doesn't, so pin the max to what we do support.
1616
constexpr int kMaxSupportedVersion = TLS1_3_VERSION;
1717

18+
#if _WIN32
19+
struct CertStorePointer {
20+
const HCERTSTORE ref_;
21+
CertStorePointer() : ref_(CertOpenSystemStoreW(0, L"ROOT")) {}
22+
~CertStorePointer() { CHECK_EQ(CertCloseStore(ref_, 0), TRUE); }
23+
};
24+
#endif
25+
1826
void GetRootCertificates(
1927
const v8::FunctionCallbackInfo<v8::Value>& args);
2028

0 commit comments

Comments
 (0)