File 0001-ssl-Supress-warning-if-verify_none-is-expl... of Package erlang

Overview Repositories Revisions Requests Users Attributes Meta

File 0001-ssl-Supress-warning-if-verify_none-is-explicitly-set.patch of Package erlang (Revision 62614e362dc3ec433dd252b94460863a)

Currently displaying revision 62614e362dc3ec433dd252b94460863a , Show latest

From 9f2ee26c7b8cea25edb0968b69da1cb0fb84126b Mon Sep 17 00:00:00 2001
From: Ingela Anderton Andin <ingela@erlang.org>
Date: Wed, 10 Nov 2021 12:07:58 +0100
Subject: [PATCH 1/2] ssl: Supress warning if verify_none is explicitly set

Closes #5352
---
 lib/ssl/src/ssl.erl            | 17 ++++----
 lib/ssl/src/ssl_app.erl        |  2 +
 lib/ssl/test/ssl_api_SUITE.erl | 75 +++++++++++++++++++++++++++++++++-
 3 files changed, 85 insertions(+), 9 deletions(-)

diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index 672cd6ef14..b1ea481fc7 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -1526,14 +1526,15 @@ handle_options(Transport, Socket, Opts0, Role, Host) ->
     
     %% Ensure all options are evaluated at startup
     SslOpts1 = add_missing_options(SslOpts0, ?RULES),
-    SslOpts = #{protocol := Protocol}
+    SslOpts2 = #{protocol := Protocol}
         = process_options(SslOpts1,
                           #{},
                           #{role => Role,
                             host => Host,
                             rules => ?RULES}),
     
-    maybe_client_warn_no_verify(SslOpts, Role),
+    maybe_client_warn_no_verify(SslOpts2, Role),
+    SslOpts = maps:without([warn_verify_none], SslOpts2),
     %% Handle special options
     {Sock, Emulated} = emulated_options(Transport, Socket, Protocol, SockOpts0),
     ConnetionCb = connection_cb(Protocol),
@@ -1862,7 +1863,7 @@ handle_option(user_lookup_fun = Option, Value0,
     Value = validate_option(Option, Value0),
     OptionsMap#{Option => Value};
 handle_option(verify = Option, unbound, OptionsMap, #{rules := Rules}) ->
-    handle_verify_option(default_value(Option, Rules), OptionsMap);
+    handle_verify_option(default_value(Option, Rules), OptionsMap#{warn_verify_none => true});
 handle_option(verify = _Option, Value, OptionsMap, _Env) ->
     handle_verify_option(Value, OptionsMap);
 handle_option(verify_fun = Option, unbound, #{verify := Verify} = OptionsMap, #{rules := Rules})
@@ -2830,9 +2831,11 @@ add_filter(undefined, Filters) ->
 add_filter(Filter, Filters) ->
     [Filter | Filters].
 
-maybe_client_warn_no_verify(#{verify := verify_none, log_level := LogLevel}, client) ->
-    ssl_logger:log(warning, LogLevel, #{description => "Authenticity is not established by certificate path validation",
-                                        reason => "Option {verify, verify_peer} and cacertfile/cacerts is missing"}, #{});
+maybe_client_warn_no_verify(#{verify := verify_none,
+                             warn_verify_none := true,
+                             log_level := LogLevel}, client) ->
+            ssl_logger:log(warning, LogLevel, #{description => "Authenticity is not established by certificate path validation",
+                                                reason => "Option {verify, verify_peer} and cacertfile/cacerts is missing"}, #{});
 maybe_client_warn_no_verify(_,_) ->
-    %% Client certificate validation is optional in TLS 
+    %% Warning not needed. Note client certificate validation is optional in TLS
     ok.
diff --git a/lib/ssl/src/ssl_app.erl b/lib/ssl/src/ssl_app.erl
index 91d91add4a..dcee94bc56 100644
--- a/lib/ssl/src/ssl_app.erl
+++ b/lib/ssl/src/ssl_app.erl
@@ -40,6 +40,8 @@ stop(_State) ->
 %% Description: Start SSL logger
 start_logger() ->
     Config = #{level => debug,
+               config => #{type => file,
+                           file => "/tmp/ssl_handler.log"},
                filter_default => stop,
                formatter => {ssl_logger, #{}}},
     Filter = {fun logger_filters:domain/2,{log,sub,[otp,ssl]}},
diff --git a/lib/ssl/test/ssl_api_SUITE.erl b/lib/ssl/test/ssl_api_SUITE.erl
index ec831cfb90..d067f7847a 100644
--- a/lib/ssl/test/ssl_api_SUITE.erl
+++ b/lib/ssl/test/ssl_api_SUITE.erl
@@ -171,7 +171,11 @@
          invalid_options_tls13/0,
          invalid_options_tls13/1,
          cookie/0,
-         cookie/1
+         cookie/1,
+	 warn_verify_none/0,
+	 warn_verify_none/1,
+	 suppress_warn_verify_none/0,
+         suppress_warn_verify_none/1
         ]).
 
 %% Apply export
@@ -192,6 +196,7 @@
          tls_close/1,
          no_recv_no_active/1,
          ssl_getstat/1,
+	 log/2,
          %%TODO Keep?
          run_error_server/1,
          run_error_server_close/1,
@@ -292,7 +297,9 @@ gen_api_tests() ->
      invalid_options,
      cb_info,
      log_alert,
-     getstat
+     getstat,
+     warn_verify_none,
+     suppress_warn_verify_none
     ].
 
 handshake_paus_tests() ->
@@ -2485,6 +2492,65 @@ cookie(Config) when is_list(Config) ->
     cookie_extension(Config, true),
     cookie_extension(Config, false).
 
+warn_verify_none() ->
+    [{doc, "Test that verify_none default generates warning."}].
+warn_verify_none(Config) when is_list(Config)->
+    ok = logger:add_handler(?MODULE,?MODULE,#{config=>self()}),
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+					{from, self()},
+                                        {options, ServerOpts},
+                                        {mfa, {ssl_test_lib, no_result, []}}]),
+    Port = ssl_test_lib:inet_port(Server),
+    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
+                                        {from, self()},
+                                        {host, Hostname},
+	                                {options, ClientOpts},
+					{mfa, {ssl_test_lib, no_result, []}}]),
+    receive
+        warning_generated ->
+            ok = logger:remove_handler(?MODULE)
+    after 500 ->
+            ok = logger:remove_handler(?MODULE),
+            ct:fail(no_warning)
+    end,
+    ssl_test_lib:close(Client),
+    ssl_test_lib:close(Server).
+
+suppress_warn_verify_none() ->
+    [{doc, "Test that explicit verify_none supresses warning."}].
+suppress_warn_verify_none(Config) when is_list(Config)->
+    ok = logger:add_handler(?MODULE,?MODULE,#{config=>self()}),
+
+    ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
+    ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+                                        {from, self()},
+                                        {options, ServerOpts},
+					    {mfa, {ssl_test_lib, no_result, []}}]),
+    Port = ssl_test_lib:inet_port(Server),
+    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
+                                        {from, self()},
+				        {host, Hostname},
+				        {options, [{verify, verify_none} | ClientOpts]},
+			                {mfa, {ssl_test_lib, no_result, []}}]),
+     receive
+         warning_generated ->
+	     ok = logger:remove_handler(?MODULE),
+             ct:fail(warning)
+     after 500 ->
+	     ok = logger:remove_handler(?MODULE)
+     end,
+    ssl_test_lib:close(Client),
+    ssl_test_lib:close(Server).
+
 %%% Checker functions
 connection_information_result(Socket) ->
     {ok, Info = [_ | _]} = ssl:connection_information(Socket),
@@ -2909,3 +2975,8 @@ ssl_getstat(Socket) ->
         _  ->
             ok
     end.
+
+log(#{msg:={report,Report}},#{config:=Pid}) ->
+    Pid ! warning_generated;
+log(_,_) ->
+    ok.
-- 
2.31.1

Places

File 0001-ssl-Supress-warning-if-verify_none-is-explicitly-set.patch of Package erlang (Revision 62614e362dc3ec433dd252b94460863a)

Places