fix: do not persist the keys loaded from PKCS#12 on Windows #14645
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Instead of getting the handle with `CryptAcquireCertificatePrivateKey`, we get it from a property of the certificate context.
teo-tsirpanis
commented
Aug 15, 2024
| @@ -121,9 +112,7 @@ StatusOr<UniqueCertStore> OpenP12File(std::string const& source) { | |||
| StatusOr<UniqueCertContext> GetCertificate(HCERTSTORE certstore, | |||
| std::string const& source) { | |||
| // Get the certificate from the store. | |||
| PCCERT_CONTEXT cert_raw = CertFindCertificateInStore( | |||
There was a problem hiding this comment.
CertFindCertificateInStore supports searching with more complex criteria. We just want the first/only certificate in the store, and therefore can use the simpler CertEnumCertificatesInStore.
|
/gcbrun |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #14645 +/- ##
==========================================
- Coverage 93.59% 90.91% -2.68%
==========================================
Files 2316 1755 -561
Lines 207122 133091 -74031
==========================================
- Hits 193849 121004 -72845
+ Misses 13273 12087 -1186 ☔ View full report in Codecov by Sentry. |
dbolduc
reviewed
Aug 16, 2024
dbolduc
approved these changes
Aug 16, 2024
|
Thanks @teo-tsirpanis for the help on Windows! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
As part of investigating #14349, I noticed that the
PFXImportCertStorefunction persists the keys on disk by default. This PR fixes that by passing thePKCS12_NO_PERSIST_KEYflag, and geting a preallocatedHCRYPTPROVto get the certificate's key.Validated locally by running
_build/Default/google/cloud/storage/oauth2_service_account_credentials_test.exe --gtest_filter=ServiceAccountCredentialsTest.ParseSimpleP12 --gtest_repeat=-1and letting the test run hundreds of times. I'm not sure if this will fix the occasional CI failures, but this looks like an improvement to me.This change is