GeezerVison is showing github.com — crypto: load system CA certificates off thread · nodejs/node@89fe635
File tree
Expand file treeCollapse file tree
Open diff view settings
Expand file treeCollapse file tree
Open diff view settings
Collapse file
Copy file name to clipboardExpand all lines: src/crypto/crypto_context.cc +21Lines changed: 21 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -814,6 +814,23 @@ static std::vector<X509*>& GetSystemStoreCACertificates() { |
814 | 814 | return system_store_certs; |
815 | 815 | } |
816 | 816 |
|
| 817 | +static void LoadSystemCACertificates(void* data) { |
| 818 | + GetSystemStoreCACertificates(); |
| 819 | +} |
| 820 | + |
| 821 | +static uv_thread_t system_ca_thread; |
| 822 | +static bool system_ca_thread_started = false; |
| 823 | +int LoadSystemCACertificatesOffThread() { |
| 824 | + // This is only run once during the initialization of the process, so |
| 825 | + // it is safe to use a static thread here. |
| 826 | + int r = |
| 827 | + uv_thread_create(&system_ca_thread, LoadSystemCACertificates, nullptr); |
| 828 | + if (r == 0) { |
| 829 | + system_ca_thread_started = true; |
| 830 | + } |
| 831 | + return r; |
| 832 | +} |
| 833 | + |
817 | 834 | static std::vector<X509*> InitializeExtraCACertificates() { |
818 | 835 | std::vector<X509*> extra_certs; |
819 | 836 | unsigned long err = LoadCertsFromFile( // NOLINT(runtime/int) |
@@ -925,6 +942,10 @@ void CleanupCachedRootCertificates() { |
925 | 942 | X509_free(cert); |
926 | 943 | } |
927 | 944 | } |
| 945 | + if (system_ca_thread_started) { |
| 946 | + uv_thread_join(&system_ca_thread); |
| 947 | + system_ca_thread_started = false; |
| 948 | + } |
928 | 949 | } |
929 | 950 |
|
930 | 951 | void GetBundledRootCertificates(const FunctionCallbackInfo<Value>& args) { |
|
Collapse file
Copy file name to clipboardExpand all lines: src/crypto/crypto_util.h +1Lines changed: 1 addition & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -45,6 +45,7 @@ void InitCryptoOnce(); |
45 | 45 | void InitCrypto(v8::Local<v8::Object> target); |
46 | 46 |
|
47 | 47 | extern void UseExtraCaCerts(std::string_view file); |
| 48 | +extern int LoadSystemCACertificatesOffThread(); |
48 | 49 | void CleanupCachedRootCertificates(); |
49 | 50 |
|
50 | 51 | int PasswordCallback(char* buf, int size, int rwflag, void* u); |
|
Collapse file
Copy file name to clipboardExpand all lines: src/node.cc +14Lines changed: 14 additions & 0 deletions | Original file line number | Diff line number | Diff line change |
|---|
@@ -1208,6 +1208,20 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args, |
1208 | 1208 | return result; |
1209 | 1209 | } |
1210 | 1210 |
|
| 1211 | + if (per_process::cli_options->use_system_ca) { |
| 1212 | + // Load the system CA certificates eagerly off the main thread to avoid |
| 1213 | + // blocking the main thread when the first TLS connection is made. We |
| 1214 | + // don't need to wait for the thread to finish with code here, as |
| 1215 | + // GetSystemStoreCACertificates() has a function-local static and any |
| 1216 | + // actual user of it will wait for that to complete initialization. |
| 1217 | + int r = crypto::LoadSystemCACertificatesOffThread(); |
| 1218 | + if (r != 0) { |
| 1219 | + FPrintF( |
| 1220 | + stderr, |
| 1221 | + "Warning: Failed to load system CA certificates off thread: %s\n", |
| 1222 | + uv_strerror(r)); |
| 1223 | + } |
| 1224 | + } |
1211 | 1225 | // Ensure CSPRNG is properly seeded. |
1212 | 1226 | CHECK(ncrypto::CSPRNG(nullptr, 0)); |
1213 | 1227 |
|
|