test

test

test

test

Author: Archkon

doc/api/tls.md

@@ -2353,7 +2353,7 @@ const additionalCerts = ['-----BEGIN CERTIFICATE-----\n...'];
 tls.setDefaultCACertificates([...currentCerts, ...additionalCerts]);
 ```
 
-## `tls.getCACertificates([type[, subjectNameOrCert]])`
+## `tls.getCACertificates([type[, cert]])`
 
 <!-- YAML
 added:
@@ -2364,9 +2364,12 @@ added:
 * `type` {string|undefined} The type of CA certificates that will be returned. Valid values
   are `"default"`, `"system"`, `"bundled"`, `"extra"` and `"openssl"`.
   **Default:** `"default"`.
-* `subjectNameOrCert` {string|ArrayBufferView|X509Certificate|undefined}
-  The subject name or certificate used to filter OpenSSL CA certificates.
-  Required when `type` is `"openssl"`.
+* `cert` {string|ArrayBufferView|X509Certificate|undefined} The certificate used
+  to look up its issuer in the selected CA store. Strings must contain a
+  PEM-encoded certificate. An `ArrayBufferView` may contain a PEM or DER encoded
+  certificate.
+  Required when `type` is `"openssl"`, or when `type` is `"default"` and
+  [`--use-openssl-ca`][] is enabled.
 * Returns: {string\[]} An array of PEM-encoded certificates. The array may contain duplicates
   if the same certificate is repeatedly stored in multiple sources.
 
@@ -2375,10 +2378,15 @@ Returns an array containing the CA certificates from various sources, depending
 * `"default"`: return the CA certificates that will be used by the Node.js TLS clients by default.
   * When [`--use-bundled-ca`][] is enabled (default), or [`--use-openssl-ca`][] is not enabled,
     this would include CA certificates from the bundled Mozilla CA store.
+  * When OpenSSL's default CA store is selected, either at build time or through
+    [`--use-openssl-ca`][], `cert` is required. OpenSSL's default certificate
+    locations form the base of the default CA store. Certificate directories
+    use subject-hash lookup and cannot be enumerated without a certificate
+    lookup key. Calling this method without `cert` throws.
   * When [`--use-system-ca`][] is enabled, this would also include certificates from the system's
     trusted store.
-  * When [`NODE_EXTRA_CA_CERTS`][] is used, this would also include certificates loaded from the specified
-    file.
+  * When [`NODE_EXTRA_CA_CERTS`][] is used, certificates from the specified
+    file are included in the default CA store.
 * `"system"`: return the CA certificates that are loaded from the system's trusted store, according
   to rules set by [`--use-system-ca`][]. This can be used to get the certificates from the system
   when [`--use-system-ca`][] is not enabled.
@@ -2387,10 +2395,9 @@ Returns an array containing the CA certificates from various sources, depending
 * `"extra"`: return the CA certificates loaded from [`NODE_EXTRA_CA_CERTS`][]. It's an empty array if
   [`NODE_EXTRA_CA_CERTS`][] is not set.
 * `"openssl"`: return CA certificates looked up from OpenSSL's default CA
-  store using `subjectNameOrCert`. If `subjectNameOrCert` is a certificate,
-  its issuer name is used for the lookup. If it is a subject name string, the
-  subject name is used directly. This follows OpenSSL's hashed-directory lookup
-  behavior for certificates loaded from the default certificate directory.
+  store using the issuer name of `cert`. This follows OpenSSL's
+  hashed-directory lookup behavior for certificates loaded from the default
+  certificate directory.
 
 ## `tls.getCiphers()`
 
@@ -2570,7 +2577,7 @@ added: v0.11.3
 [`tls.connect()`]: #tlsconnectoptions-callback
 [`tls.createSecureContext()`]: #tlscreatesecurecontextoptions
 [`tls.createServer()`]: #tlscreateserveroptions-secureconnectionlistener
-[`tls.getCACertificates()`]: #tlsgetcacertificatestype
+[`tls.getCACertificates()`]: #tlsgetcacertificatestype-cert
 [`tls.getCiphers()`]: #tlsgetciphers
 [`tls.rootCertificates`]: #tlsrootcertificates
 [`x509.checkHost()`]: crypto.md#x509checkhostname-options

lib/tls.js

@@ -39,12 +39,13 @@ const {
   ERR_OUT_OF_RANGE,
   ERR_INVALID_ARG_VALUE,
   ERR_INVALID_ARG_TYPE,
+  ERR_MISSING_ARGS,
 } = require('internal/errors').codes;
 
 const {
   getBundledRootCertificates,
   getExtraCACertificates,
-  // getOpenSSLCACertificates,
+  lookupDefaultCACertificates,
   lookupOpenSSLCACertificates,
   getSystemCACertificates,
   resetRootCertStore,
@@ -150,37 +151,30 @@ function cacheSystemCACertificates() {
 
   return systemCACertificates;
 }
-
-// let opensslCACertificates;
-// function cacheOpenSSLCACertificates() {
-//   opensslCACertificates ||= ObjectFreeze(getOpenSSLCACertificates());
-
-//   return opensslCACertificates;
-// }
-
 let opensslCACertificateLookup;
-function cacheOpenSSLCertificateLookup(subjectNameOrCert) {
+function cacheOpenSSLCertificateLookup(cert) {
   opensslCACertificateLookup ??= new SafeMap();
 
-  const key = isArrayBufferView(subjectNameOrCert) ?
+  const key = isArrayBufferView(cert) ?
     `buffer:${Buffer.from(
-      subjectNameOrCert.buffer,
-      subjectNameOrCert.byteOffset,
-      subjectNameOrCert.byteLength).toString('base64')}` :
-    `subject:${subjectNameOrCert}`;
+      cert.buffer,
+      cert.byteOffset,
+      cert.byteLength).toString('base64')}` :
+    `cert:${cert}`;
 
   const cached = opensslCACertificateLookup.get(key);
   if (cached !== undefined) return cached;
 
-  const result = ObjectFreeze(lookupOpenSSLCACertificates(subjectNameOrCert));
+  const result = ObjectFreeze(lookupOpenSSLCACertificates(cert));
   opensslCACertificateLookup.set(key, result);
   return result;
 }
 
 let defaultCACertificates;
+let defaultCACertificateLookup;
 let hasResetDefaultCACertificates = false;
 
-function cacheDefaultCACertificates() {
+function cacheDefaultCACertificates(cert) {
   if (defaultCACertificates) { return defaultCACertificates; }
 
   if (hasResetDefaultCACertificates) {
@@ -189,26 +183,44 @@ function cacheDefaultCACertificates() {
     return defaultCACertificates;
   }
 
-  defaultCACertificates = [];
-
-  if (!getOptionValue('--use-openssl-ca')) {
-    const bundled = cacheBundledRootCertificates();
-    for (let i = 0; i < bundled.length; ++i) {
-      ArrayPrototypePush(defaultCACertificates, bundled[i]);
+  if (getOptionValue('[ssl_openssl_cert_store]')) {
+    if (cert === undefined) {
+      throw new ERR_MISSING_ARGS('cert');
     }
-    if (getOptionValue('--use-system-ca')) {
-      const system = cacheSystemCACertificates();
-      for (let i = 0; i < system.length; ++i) {
+    cert = validateOpenSSLCACertificate(cert);
+
+    const key = isArrayBufferView(cert) ?
+      `buffer:${Buffer.from(
+        cert.buffer,
+        cert.byteOffset,
+        cert.byteLength).toString('base64')}` :
+      `cert:${cert}`;
+
+    defaultCACertificateLookup ??= new SafeMap();
+    const cached = defaultCACertificateLookup.get(key);
+    if (cached !== undefined) return cached;
+
+    const result = ObjectFreeze(lookupDefaultCACertificates(cert));
+    defaultCACertificateLookup.set(key, result);
+    return result;
+  }
 
-        ArrayPrototypePush(defaultCACertificates, system[i]);
-      }
+  defaultCACertificates = [];
+
+  const bundled = cacheBundledRootCertificates();
+  for (let i = 0; i < bundled.length; ++i) {
+    ArrayPrototypePush(defaultCACertificates, bundled[i]);
+  }
+  if (getOptionValue('--use-system-ca')) {
+    const system = cacheSystemCACertificates();
+    for (let i = 0; i < system.length; ++i) {
+      ArrayPrototypePush(defaultCACertificates, system[i]);
     }
   }
 
   if (process.env.NODE_EXTRA_CA_CERTS) {
     const extra = cacheExtraCACertificates();
     for (let i = 0; i < extra.length; ++i) {
-
       ArrayPrototypePush(defaultCACertificates, extra[i]);
     }
   }
@@ -217,40 +229,35 @@ function cacheDefaultCACertificates() {
   return defaultCACertificates;
 }
 
-function validateOpenSSLCACertificateFilter(subjectNameOrCert) {
-  if (subjectNameOrCert !== null &&
-      (typeof subjectNameOrCert === 'object' ||
-       typeof subjectNameOrCert === 'function') &&
-      isX509Certificate(subjectNameOrCert)) {
-    return subjectNameOrCert[kHandle].pem();
+function validateOpenSSLCACertificate(cert) {
+  if (cert !== null &&
+      (typeof cert === 'object' || typeof cert === 'function') &&
+      isX509Certificate(cert)) {
+    return cert[kHandle].pem();
   }
-  if (typeof subjectNameOrCert !== 'string' &&
-      !isArrayBufferView(subjectNameOrCert)) {
+  if (typeof cert !== 'string' && !isArrayBufferView(cert)) {
     throw new ERR_INVALID_ARG_TYPE(
-      'subjectNameOrCert',
-      ['string', 'ArrayBufferView', 'X509Certificate'],
-      subjectNameOrCert);
+      'cert', ['string', 'ArrayBufferView', 'X509Certificate'], cert);
   }
-  return subjectNameOrCert;
+  return cert;
 }
 
 // TODO(joyeecheung): support X509Certificate output?
-function getCACertificates(type = 'default', subjectNameOrCert) {
+function getCACertificates(type = 'default', cert) {
   validateString(type, 'type');
 
   switch (type) {
     case 'default':
-      return cacheDefaultCACertificates();
+      return cacheDefaultCACertificates(cert);
     case 'bundled':
       return cacheBundledRootCertificates();
     case 'system':
       return cacheSystemCACertificates();
     case 'extra':
       return cacheExtraCACertificates();
     case 'openssl':
-      subjectNameOrCert =
-        validateOpenSSLCACertificateFilter(subjectNameOrCert);
-      return cacheOpenSSLCertificateLookup(subjectNameOrCert);
+      cert = validateOpenSSLCACertificate(cert);
+      return cacheOpenSSLCertificateLookup(cert);
     default:
       throw new ERR_INVALID_ARG_VALUE('type', type);
   }
@@ -272,6 +279,7 @@ function setDefaultCACertificates(certs) {
 
   resetRootCertStore(certs);
   defaultCACertificates = undefined; // Reset the cached default certificates
+  defaultCACertificateLookup = undefined;
   hasResetDefaultCACertificates = true;
 }
 
@@ -285,6 +293,7 @@ if (isBuildingSnapshot()) {
     systemCACertificates = undefined;
     // opensslCACertificates = undefined;
     opensslCACertificateLookup = undefined;
+    defaultCACertificateLookup = undefined;
     if (hasResetDefaultCACertificates) {
       defaultCACertificates = undefined;
     }