-
Notifications
You must be signed in to change notification settings - Fork 67
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix(cli-repl): use tls allowPartialTrustChain flag MONGOSH-1878 (#2181)
This should bring back startup performance to pre-2.3.1 levels. Also pins kerberos to 2.1.0, since bumping it actually broke our Windows build.
- Loading branch information
Showing
11 changed files
with
295 additions
and
75 deletions.
There are no files selected for viewing
Large diffs are not rendered by default.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
157 changes: 157 additions & 0 deletions
157
scripts/nodejs-patches/005-node-tls-allowpartialtrustchain-commit-1b3420274ea.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,157 @@ | ||
| diff --git a/lib/internal/tls/secure-context.js b/lib/internal/tls/secure-context.js | ||
| index b0f971e4eef273..84e74105fdbba9 100644 | ||
| --- a/lib/internal/tls/secure-context.js | ||
| +++ b/lib/internal/tls/secure-context.js | ||
| @@ -130,6 +130,7 @@ function configSecureContext(context, options = kEmptyObject, name = 'options') | ||
| validateObject(options, name); | ||
|
|
||
| const { | ||
| + allowPartialTrustChain, | ||
| ca, | ||
| cert, | ||
| ciphers = getDefaultCiphers(), | ||
| @@ -182,6 +183,10 @@ function configSecureContext(context, options = kEmptyObject, name = 'options') | ||
| context.addRootCerts(); | ||
| } | ||
|
|
||
| + if (allowPartialTrustChain) { | ||
| + context.setAllowPartialTrustChain(); | ||
| + } | ||
| + | ||
| if (cert) { | ||
| setCerts(context, ArrayIsArray(cert) ? cert : [cert], `${name}.cert`); | ||
| } | ||
| diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc | ||
| index 1d60f7e856075a..cef0c877c67643 100644 | ||
| --- a/src/crypto/crypto_context.cc | ||
| +++ b/src/crypto/crypto_context.cc | ||
| @@ -273,6 +273,8 @@ Local<FunctionTemplate> SecureContext::GetConstructorTemplate( | ||
| SetProtoMethod(isolate, tmpl, "setKey", SetKey); | ||
| SetProtoMethod(isolate, tmpl, "setCert", SetCert); | ||
| SetProtoMethod(isolate, tmpl, "addCACert", AddCACert); | ||
| + SetProtoMethod( | ||
| + isolate, tmpl, "setAllowPartialTrustChain", SetAllowPartialTrustChain); | ||
| SetProtoMethod(isolate, tmpl, "addCRL", AddCRL); | ||
| SetProtoMethod(isolate, tmpl, "addRootCerts", AddRootCerts); | ||
| SetProtoMethod(isolate, tmpl, "setCipherSuites", SetCipherSuites); | ||
| @@ -354,6 +356,7 @@ void SecureContext::RegisterExternalReferences( | ||
| registry->Register(AddCACert); | ||
| registry->Register(AddCRL); | ||
| registry->Register(AddRootCerts); | ||
| + registry->Register(SetAllowPartialTrustChain); | ||
| registry->Register(SetCipherSuites); | ||
| registry->Register(SetCiphers); | ||
| registry->Register(SetSigalgs); | ||
| @@ -715,17 +718,39 @@ void SecureContext::SetCert(const FunctionCallbackInfo<Value>& args) { | ||
| USE(sc->AddCert(env, std::move(bio))); | ||
| } | ||
|
|
||
| +// NOLINTNEXTLINE(runtime/int) | ||
| +void SecureContext::SetX509StoreFlag(unsigned long flags) { | ||
| + X509_STORE* cert_store = GetCertStoreOwnedByThisSecureContext(); | ||
| + CHECK_EQ(1, X509_STORE_set_flags(cert_store, flags)); | ||
| +} | ||
| + | ||
| +X509_STORE* SecureContext::GetCertStoreOwnedByThisSecureContext() { | ||
| + if (own_cert_store_cache_ != nullptr) return own_cert_store_cache_; | ||
| + | ||
| + X509_STORE* cert_store = SSL_CTX_get_cert_store(ctx_.get()); | ||
| + if (cert_store == GetOrCreateRootCertStore()) { | ||
| + cert_store = NewRootCertStore(); | ||
| + SSL_CTX_set_cert_store(ctx_.get(), cert_store); | ||
| + } | ||
| + | ||
| + return own_cert_store_cache_ = cert_store; | ||
| +} | ||
| + | ||
| +void SecureContext::SetAllowPartialTrustChain( | ||
| + const FunctionCallbackInfo<Value>& args) { | ||
| + SecureContext* sc; | ||
| + ASSIGN_OR_RETURN_UNWRAP(&sc, args.This()); | ||
| + sc->SetX509StoreFlag(X509_V_FLAG_PARTIAL_CHAIN); | ||
| +} | ||
| + | ||
| void SecureContext::SetCACert(const BIOPointer& bio) { | ||
| ClearErrorOnReturn clear_error_on_return; | ||
| if (!bio) return; | ||
| - X509_STORE* cert_store = SSL_CTX_get_cert_store(ctx_.get()); | ||
| while (X509Pointer x509 = X509Pointer(PEM_read_bio_X509_AUX( | ||
| bio.get(), nullptr, NoPasswordCallback, nullptr))) { | ||
| - if (cert_store == GetOrCreateRootCertStore()) { | ||
| - cert_store = NewRootCertStore(); | ||
| - SSL_CTX_set_cert_store(ctx_.get(), cert_store); | ||
| - } | ||
| - CHECK_EQ(1, X509_STORE_add_cert(cert_store, x509.get())); | ||
| + CHECK_EQ(1, | ||
| + X509_STORE_add_cert(GetCertStoreOwnedByThisSecureContext(), | ||
| + x509.get())); | ||
| CHECK_EQ(1, SSL_CTX_add_client_CA(ctx_.get(), x509.get())); | ||
| } | ||
| } | ||
| @@ -754,11 +779,7 @@ Maybe<bool> SecureContext::SetCRL(Environment* env, const BIOPointer& bio) { | ||
| return Nothing<bool>(); | ||
| } | ||
|
|
||
| - X509_STORE* cert_store = SSL_CTX_get_cert_store(ctx_.get()); | ||
| - if (cert_store == GetOrCreateRootCertStore()) { | ||
| - cert_store = NewRootCertStore(); | ||
| - SSL_CTX_set_cert_store(ctx_.get(), cert_store); | ||
| - } | ||
| + X509_STORE* cert_store = GetCertStoreOwnedByThisSecureContext(); | ||
|
|
||
| CHECK_EQ(1, X509_STORE_add_crl(cert_store, crl.get())); | ||
| CHECK_EQ(1, | ||
| @@ -1042,8 +1063,6 @@ void SecureContext::LoadPKCS12(const FunctionCallbackInfo<Value>& args) { | ||
| sc->issuer_.reset(); | ||
| sc->cert_.reset(); | ||
|
|
||
| - X509_STORE* cert_store = SSL_CTX_get_cert_store(sc->ctx_.get()); | ||
| - | ||
| DeleteFnPtr<PKCS12, PKCS12_free> p12; | ||
| EVPKeyPointer pkey; | ||
| X509Pointer cert; | ||
| @@ -1097,11 +1116,7 @@ void SecureContext::LoadPKCS12(const FunctionCallbackInfo<Value>& args) { | ||
| for (int i = 0; i < sk_X509_num(extra_certs.get()); i++) { | ||
| X509* ca = sk_X509_value(extra_certs.get(), i); | ||
|
|
||
| - if (cert_store == GetOrCreateRootCertStore()) { | ||
| - cert_store = NewRootCertStore(); | ||
| - SSL_CTX_set_cert_store(sc->ctx_.get(), cert_store); | ||
| - } | ||
| - X509_STORE_add_cert(cert_store, ca); | ||
| + X509_STORE_add_cert(sc->GetCertStoreOwnedByThisSecureContext(), ca); | ||
| SSL_CTX_add_client_CA(sc->ctx_.get(), ca); | ||
| } | ||
| ret = true; | ||
| diff --git a/src/crypto/crypto_context.h b/src/crypto/crypto_context.h | ||
| index 607b0984ba647a..4c76bdc5ec1a7c 100644 | ||
| --- a/src/crypto/crypto_context.h | ||
| +++ b/src/crypto/crypto_context.h | ||
| @@ -65,6 +65,9 @@ class SecureContext final : public BaseObject { | ||
| void SetCACert(const BIOPointer& bio); | ||
| void SetRootCerts(); | ||
|
|
||
| + void SetX509StoreFlag(unsigned long flags); // NOLINT(runtime/int) | ||
| + X509_STORE* GetCertStoreOwnedByThisSecureContext(); | ||
| + | ||
| // TODO(joyeecheung): track the memory used by OpenSSL types | ||
| SET_NO_MEMORY_INFO() | ||
| SET_MEMORY_INFO_NAME(SecureContext) | ||
| @@ -91,6 +94,8 @@ class SecureContext final : public BaseObject { | ||
| #endif // !OPENSSL_NO_ENGINE | ||
| static void SetCert(const v8::FunctionCallbackInfo<v8::Value>& args); | ||
| static void AddCACert(const v8::FunctionCallbackInfo<v8::Value>& args); | ||
| + static void SetAllowPartialTrustChain( | ||
| + const v8::FunctionCallbackInfo<v8::Value>& args); | ||
| static void AddCRL(const v8::FunctionCallbackInfo<v8::Value>& args); | ||
| static void AddRootCerts(const v8::FunctionCallbackInfo<v8::Value>& args); | ||
| static void SetCipherSuites(const v8::FunctionCallbackInfo<v8::Value>& args); | ||
| @@ -143,6 +148,8 @@ class SecureContext final : public BaseObject { | ||
| SSLCtxPointer ctx_; | ||
| X509Pointer cert_; | ||
| X509Pointer issuer_; | ||
| + // Non-owning cache for SSL_CTX_get_cert_store(ctx_.get()) | ||
| + X509_STORE* own_cert_store_cache_ = nullptr; | ||
| #ifndef OPENSSL_NO_ENGINE | ||
| bool client_cert_engine_provided_ = false; | ||
| EnginePointer private_key_engine_; |