Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

tls: expose built-in root certificates #26415

Closed
wants to merge 1 commit into from
Closed

tls: expose built-in root certificates #26415

wants to merge 1 commit into from

Conversation

bnoordhuis
Copy link
Member

Fixes: #25824

@nodejs-github-bot
Copy link
Collaborator

@bnoordhuis build started: https://ci.nodejs.org/blue/organizations/jenkins/node-test-pull-request-lite-pipeline/detail/node-test-pull-request-lite-pipeline/2751/pipeline

@nodejs-github-bot nodejs-github-bot added c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. labels Mar 3, 2019
vsemozhetbyt
vsemozhetbyt reviewed Mar 3, 2019
View reviewed changes
doc/api/tls.md Outdated Show resolved Hide resolved
doc/api/tls.md Outdated Show resolved Hide resolved
BridgeAR
BridgeAR approved these changes Mar 4, 2019
View reviewed changes
Copy link
Member

@BridgeAR BridgeAR left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM with the doc comments being addressed.

sam-github
sam-github approved these changes Mar 4, 2019
View reviewed changes
Copy link
Contributor

@sam-github sam-github left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A suggestion about the naming and docs, but otherwise LGTM, thanks.

doc/api/tls.md Outdated Show resolved Hide resolved
doc/api/tls.md Outdated Show resolved Hide resolved
@sam-github sam-github added the semver-minor PRs that contain new features and should be released in the next minor version. label Mar 4, 2019
@bnoordhuis
Copy link
Member Author

Thanks for the reviews, feedback incorporated. I also added a regression test (forgot to check it in.)

@sam-github
Copy link
Contributor

@bnoordhuis no comment on calling it tls.DEFAULT_CA like the other defaults?

vsemozhetbyt
vsemozhetbyt reviewed Mar 5, 2019
View reviewed changes
doc/api/tls.md Outdated Show resolved Hide resolved
@bnoordhuis
Copy link
Member Author

no comment on calling it tls.DEFAULT_CA like the other defaults?

No strong opinion anyway. :-) I was waiting to see if anyone else commented on that.

FWIW, if I had to pick something in all caps, I'd probably opt for tls.CA_ROOTS or something like that.

@sam-github
Copy link
Contributor

To be clear, I'm not opionated about the capsiness of the name, they both look like fine names, it's this story that seem strange to me:

TLS exposes default values of some of the options as module properties:

  • tls .DEFAULT_CIPHERS, default value of tls.createSecureContext({ciphers: ...
  • tls.DEFAULT_ECDH_CURVE, default value ... {ecdhCurve:
  • tls.DEFAULT_MAX_VERSION, default value of ... {maxVersion:
  • tls.DEFAULT_MIN_VERSION, default value of ... {minVersion:

and now:

  • tls.CA_ROOTS / tls.roots the default value of .... {ca:

Perhaps I'm unreasonably perturbed by pattern breaks?

@bnoordhuis
Copy link
Member Author

The tls.DEFAULT_FOO exports are reassignable (and the new value gets picked up the next time a connection is created) but this one isn't, that's why I picked a different style for the name.

I suppose making the default CA roots fully overridable by assigning to tls.DEFAULT_CA or whatever isn't completely out of the question but I don't know.

@jasnell
Copy link
Member

jasnell commented Mar 6, 2019

I'd really prefer if we could move away from that DEFAULT_FOO setter pattern on the module as it's just not going to work for the ESM side of things. That's not blocking for this PR but we need to consider an alternative approach at some point here.

@sam-github
Copy link
Contributor

@jasnell That is a bit of a side-track, but what would it have to look like to be esm-ok?

@bnoordhuis I see your point about not being able to be used to change the default, so being a bit different from the other DEFAULT_ definitions. I suspect reassignability might come as a feature request, and eventually we'll make it possible. It looks like you set the descriptor so that it will throw if anyone tries to set it, so that's good, nobody can complain that they set it and it didn't do anything. That was good enough for me, YMMV.

@bnoordhuis
Copy link
Member Author

I added one more sanity check to the test: https://ci.nodejs.org/job/node-test-pull-request/21294/

@BridgeAR
Copy link
Member

@sam-github @jasnell is this ready to land out of your perspective? (I did not check the comments fully)

@sam-github
Copy link
Contributor

Would be good to get some feedback by @jasnell on esm-safety, but given this pattern is used for other top-level vars in tls, I can't see why it would be blocking.

Would be good to have some @nodejs/collaborators weigh in on the naming. Its bike shedding, but we'll have to live with the shed for a long time, best be happy with it now.

@Trott
Copy link
Member

Trott commented Mar 11, 2019

Would be good to have some @nodejs/collaborators weigh in on the naming. Its bike shedding, but we'll have to live with the shed for a long time, best be happy with it now.

Since you're inviting the bike shed discussion: I'd prefer rootCertificates to roots.

@bnoordhuis
Copy link
Member Author

Is there consensus on the name?

mcollina
mcollina approved these changes Mar 22, 2019
View reviewed changes
Copy link
Member

@mcollina mcollina left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM I don't care about the names.

@ronkorving
Copy link
Contributor

If bike shedding, I would also prefer rootCertificates (+0) to roots, but regardless the name am very happy to see this land. LGTM.

@BridgeAR
Copy link
Member

I agree with @ronkorving and @Trott that rootCertificates is a nicer name but in the end I am fine with either.

@sam-github sam-github mentioned this pull request Apr 4, 2019
Open
@bnoordhuis
Copy link
Member Author

The test failures are #23089 and #24593.

@nodejs-github-bot
Copy link
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/22331/

@bnoordhuis bnoordhuis added author ready PRs that have at least one approval, no pending requests for changes, and a CI started. and removed author ready PRs that have at least one approval, no pending requests for changes, and a CI started. labels May 2, 2019
@bnoordhuis
Copy link
Member Author

Rebased one more time. CI: https://ci.nodejs.org/job/node-test-pull-request/23139/

@nodejs-github-bot
Copy link
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/23139/

@bnoordhuis
Copy link
Member Author

Again because 11:23:07 collect2: fatal error: ld terminated with signal 9 [Killed]:

https://ci.nodejs.org/job/node-test-pull-request/23161/

@nodejs-github-bot
Copy link
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/23161/

@nodejs-github-bot
Copy link
Collaborator

CI: https://ci.nodejs.org/job/node-test-pull-request/23169/

@bnoordhuis bnoordhuis closed this May 20, 2019
bnoordhuis added a commit to bnoordhuis/io.js that referenced this pull request May 20, 2019
@bnoordhuis
tls: expose built-in root certificates
f1a3968 
Fixes: nodejs#25824
PR-URL: nodejs#26415
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Rich Trott <[email protected]>
Reviewed-By: Ron Korving <[email protected]>
Reviewed-By: Ruben Bridgewater <[email protected]>
Reviewed-By: Sam Roberts <[email protected]>
Reviewed-By: Vse Mozhet Byt <[email protected]>
@bnoordhuis
Copy link
Member Author

Landed in f1a3968, cheers.

targos pushed a commit that referenced this pull request May 20, 2019
@bnoordhuis @targos
tls: expose built-in root certificates
bdd75d0 
Fixes: #25824
PR-URL: #26415
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Rich Trott <[email protected]>
Reviewed-By: Ron Korving <[email protected]>
Reviewed-By: Ruben Bridgewater <[email protected]>
Reviewed-By: Sam Roberts <[email protected]>
Reviewed-By: Vse Mozhet Byt <[email protected]>
BridgeAR added a commit that referenced this pull request May 21, 2019
@BridgeAR
2019-05-21, Version 12.3.0 (Current)
e0afe0e 
Notable changes:

* process:
  * Log errors using `util.inspect` in case of fatal exceptions
    (Ruben Bridgewater) #27243
* repl:
  * Add `process.on('uncaughtException')` support (Ruben Bridgewater)
    #27151
* stream:
  * Implemented `Readable.from` async iterator utility (Guy Bedford)
    #27660
* tls:
  * Expose built-in root certificates (Ben Noordhuis)
    #26415
  * Support `net.Server` options (Luigi Pinca)
    #27665
  * Expose `keylog` event on TLSSocket (Alba Mendez)
    #27654
* worker:
  * Added the ability to unshift messages from the `MessagePort`
    (Anna Henningsen) #27294
@BridgeAR BridgeAR mentioned this pull request May 21, 2019
Merged
4 tasks
BridgeAR added a commit that referenced this pull request May 21, 2019
@BridgeAR
2019-05-21, Version 12.3.0 (Current)
20c11be 
Notable changes:

* esm:
  * Added the `--experimental-wasm-modules` flag to support
    WebAssembly modules (Myles Borins & Guy Bedford)
    #27659
* process:
  * Log errors using `util.inspect` in case of fatal exceptions
    (Ruben Bridgewater) #27243
* repl:
  * Add `process.on('uncaughtException')` support (Ruben Bridgewater)
    #27151
* stream:
  * Implemented `Readable.from` async iterator utility (Guy Bedford)
    #27660
* tls:
  * Expose built-in root certificates (Ben Noordhuis)
    #26415
  * Support `net.Server` options (Luigi Pinca)
    #27665
  * Expose `keylog` event on TLSSocket (Alba Mendez)
    #27654
* worker:
  * Added the ability to unshift messages from the `MessagePort`
    (Anna Henningsen) #27294

PR-URL: #27799
BridgeAR added a commit that referenced this pull request May 21, 2019
@BridgeAR
2019-05-21, Version 12.3.0 (Current)
9fec70a 
Notable changes:

* esm:
  * Added the `--experimental-wasm-modules` flag to support
    WebAssembly modules (Myles Borins & Guy Bedford)
    #27659
* process:
  * Log errors using `util.inspect` in case of fatal exceptions
    (Ruben Bridgewater) #27243
* repl:
  * Add `process.on('uncaughtException')` support (Ruben Bridgewater)
    #27151
* stream:
  * Implemented `Readable.from` async iterator utility (Guy Bedford)
    #27660
* tls:
  * Expose built-in root certificates (Ben Noordhuis)
    #26415
  * Support `net.Server` options (Luigi Pinca)
    #27665
  * Expose `keylog` event on TLSSocket (Alba Mendez)
    #27654
* worker:
  * Added the ability to unshift messages from the `MessagePort`
    (Anna Henningsen) #27294

PR-URL: #27799
bnoordhuis added a commit to bnoordhuis/io.js that referenced this pull request Aug 15, 2019
@bnoordhuis
tls: partially backport pull request nodejs#26415
eadc82b 
This is a partial backport of commit f1a3968 ("tls: expose built-in
root certificates") from the master branch. The original commit adds a
new API, this commit just backports the non-visible changes to ease
backporting follow-up commits.

Refs: nodejs#26415
@bnoordhuis bnoordhuis mentioned this pull request Aug 15, 2019
Closed
BethGriggs pushed a commit that referenced this pull request Sep 19, 2019
@bnoordhuis @BethGriggs
tls: partially backport pull request #26415
d57f797 
This is a partial backport of commit f1a3968 ("tls: expose built-in
root certificates") from the master branch. The original commit adds a
new API, this commit just backports the non-visible changes to ease
backporting follow-up commits.

PR-URL: #26415
Backport-PR-URL: #29137
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: James M Snell <[email protected]>
Reviewed-By: Luigi Pinca <[email protected]>
Reviewed-By: Matteo Collina <[email protected]>
Reviewed-By: Rich Trott <[email protected]>
Reviewed-By: Ron Korving <[email protected]>
Reviewed-By: Ruben Bridgewater <[email protected]>
Reviewed-By: Sam Roberts <[email protected]>
Reviewed-By: Vse Mozhet Byt <[email protected]>
@BethGriggs BethGriggs mentioned this pull request Sep 19, 2019
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@vsemozhetbyt vsemozhetbyt vsemozhetbyt left review comments

@sam-github sam-github sam-github approved these changes

@BridgeAR BridgeAR BridgeAR approved these changes

@cjihrig cjihrig cjihrig approved these changes

@lpinca lpinca lpinca approved these changes

@Trott Trott Trott approved these changes

@ronkorving ronkorving ronkorving approved these changes

@jasnell jasnell jasnell approved these changes

@mcollina mcollina mcollina approved these changes

Assignees
No one assigned
Labels
c++ Issues and PRs that require attention from people who are familiar with C++. lib / src Issues and PRs related to general changes in the lib or src directory. semver-minor PRs that contain new features and should be released in the next minor version.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Retrieve built-in root certificates within node application