File 0157-ssl-Make-sure-Trusted-CA-cert-use-latest-P... of Package erlang

Overview Repositories Revisions Requests Users Attributes Meta

File 0157-ssl-Make-sure-Trusted-CA-cert-use-latest-PEM.patch of Package erlang (Revision 218b3430555ecf8dc51659dea4ccdb8e)

Currently displaying revision 218b3430555ecf8dc51659dea4ccdb8e , Show latest

From 6f9c9d75775527695ab43c932619646c38bab3a9 Mon Sep 17 00:00:00 2001
From: Ingela Anderton Andin <ingela@erlang.org>
Date: Thu, 20 May 2021 16:18:25 +0200
Subject: [PATCH] ssl: Make sure Trusted CA cert use latest PEM

The ssl application caches PEM files, that contain certificates and keys.
Trusted certs provided by the cacertfile option are also tracked in a special
cache to be able to share data between connections that uses the same input
and hence save memory. Make sure that this cache also gets invalidated when
the regular PEM caches is invalidated.
---
 lib/ssl/src/ssl_manager.erl          |  21 ++++++
 lib/ssl/src/ssl_pem_cache.erl        |  12 ++-
 lib/ssl/src/ssl_pkix_db.erl          |  18 +++++
 lib/ssl/test/ssl_pem_cache_SUITE.erl | 108 ++++++++++++++++++++++++++-
 lib/ssl/test/x509_test.erl           |   1 +
 5 files changed, 155 insertions(+), 5 deletions(-)

diff --git a/lib/ssl/src/ssl_manager.erl b/lib/ssl/src/ssl_manager.erl
index 4f6f12163f..ed68cb3858 100644
--- a/lib/ssl/src/ssl_manager.erl
+++ b/lib/ssl/src/ssl_manager.erl
@@ -30,6 +30,7 @@
 	 connection_init/3, cache_pem_file/2,
 	 lookup_trusted_cert/4,
 	 clean_cert_db/2,
+         refresh_trusted_db/1, refresh_trusted_db/2,
 	 register_session/2, register_session/4, invalidate_session/2,
 	 insert_crls/2, insert_crls/3, delete_crls/1, delete_crls/2, 
 	 invalidate_session/3, name/1]).
@@ -157,6 +158,20 @@ clean_cert_db(Ref, File) ->
 		      {clean_cert_db, Ref, File}),
     ok.
 
+%%--------------------------------------------------------------------
+-spec refresh_trusted_db(normal | dist) -> ok.
+%%
+%% Description: Send refresh of trusted cert db to ssl_manager process should
+%% be called by ssl-connection processes.
+%%--------------------------------------------------------------------
+refresh_trusted_db(ManagerType) ->
+    put(ssl_manager, name(ManagerType)),
+    call(refresh_trusted_db).
+
+refresh_trusted_db(ManagerType, File) ->
+    put(ssl_manager, name(ManagerType)),
+    call({refresh_trusted_db, File}).
+
 %%--------------------------------------------------------------------
 %%
 %% Description: Make the session available for reuse.
@@ -286,6 +301,12 @@ handle_call({{delete_crls, CRLsOrPath}, _}, _From,
     {reply, ok, State};
 handle_call({{register_session, Host, Port, Session},_}, _, State0) ->
     State = client_register_session(Host, Port, Session, State0), 
+    {reply, ok, State};
+handle_call({refresh_trusted_db, _}, _, #state{certificate_db = Db} = State) ->
+    ssl_pkix_db:refresh_trusted_certs(Db),
+    {reply, ok, State};
+handle_call({{refresh_trusted_db, File}, _}, _, #state{certificate_db = Db} = State) ->
+    ssl_pkix_db:refresh_trusted_certs(File, Db),
     {reply, ok, State}.
 
 %%--------------------------------------------------------------------
diff --git a/lib/ssl/src/ssl_pem_cache.erl b/lib/ssl/src/ssl_pem_cache.erl
index 41bca2f7b5..ff449ab29b 100644
--- a/lib/ssl/src/ssl_pem_cache.erl
+++ b/lib/ssl/src/ssl_pem_cache.erl
@@ -154,7 +154,8 @@ init([Name]) ->
 handle_call({unconditionally_clear_pem_cache, _},_, 
 	    #state{pem_cache = PemCache} = State) ->
     ssl_pkix_db:clear(PemCache),
-    {reply, ok,  State}.
+    Result = ssl_manager:refresh_trusted_db(ssl_manager_type()),
+    {reply, Result,  State}.
 
 %%--------------------------------------------------------------------
 -spec  handle_cast(msg(), #state{}) -> {noreply, #state{}}.
@@ -170,6 +171,7 @@ handle_cast({cache_pem, File, Content}, #state{pem_cache = Db} = State) ->
 
 handle_cast({invalidate_pem, File}, #state{pem_cache = Db} = State) ->
     ssl_pkix_db:remove(File, Db),
+    ssl_manager:refresh_trusted_db(ssl_manager_type(), File),
     {noreply, State}.
 
 
@@ -253,3 +255,11 @@ bypass_cache() ->
 	_ ->
 	    false
     end.
+
+ssl_manager_type() ->
+    case get(ssl_pem_cache) of
+        ?MODULE ->
+            normal;
+        _ ->
+            dist
+    end.
diff --git a/lib/ssl/src/ssl_pkix_db.erl b/lib/ssl/src/ssl_pkix_db.erl
index aeb8953d04..62c3601a6e 100644
--- a/lib/ssl/src/ssl_pkix_db.erl
+++ b/lib/ssl/src/ssl_pkix_db.erl
@@ -31,6 +31,8 @@
 
 -export([create/1, create_pem_cache/1, 
 	 add_crls/3, remove_crls/2, remove/1, add_trusted_certs/3, 
+         refresh_trusted_certs/1,
+         refresh_trusted_certs/2,
 	 extract_trusted_certs/1,
 	 remove_trusted_certs/2, insert/3, remove/2, clear/1, db_size/1,
 	 ref_count/3, lookup_trusted_cert/4, foldl/3, select_cert_by_issuer/2,
@@ -144,6 +146,22 @@ add_trusted_certs(_Pid, File, [ _, {RefDb, FileMapDb} | _] = Db) ->
 	    new_trusted_cert_entry(File, Db)
     end.
 
+refresh_trusted_certs(File, [CertsDb, {_, FileMapDb} | _]) ->
+    case lookup(File, FileMapDb) of
+        [Ref] ->
+            {ok, Content} = decode_pem_file(File),
+            remove_trusted_certs(Ref, CertsDb),
+            add_certs_from_pem(Content, Ref, CertsDb);
+        undefined ->
+            ok
+    end.
+refresh_trusted_certs([_, {_, FileMapDb} | _] = Db) ->
+    Refresh = fun({File, _}, Acc) ->
+                      refresh_trusted_certs(File, Db),
+                      Acc
+              end,
+    foldl(Refresh, refresh, FileMapDb).
+
 extract_trusted_certs({der, DerList}) ->
     {ok, {extracted, certs_from_der(DerList)}};
 extract_trusted_certs({der_otp, DerList}) ->
diff --git a/lib/ssl/test/ssl_pem_cache_SUITE.erl b/lib/ssl/test/ssl_pem_cache_SUITE.erl
index 50d8089054..ddc65d116d 100644
--- a/lib/ssl/test/ssl_pem_cache_SUITE.erl
+++ b/lib/ssl/test/ssl_pem_cache_SUITE.erl
@@ -26,6 +26,7 @@
 
 -include_lib("common_test/include/ct.hrl").
 -include_lib("kernel/include/file.hrl").
+-include_lib("public_key/include/public_key.hrl").
 
 %% Callback functions
 -export([all/0,
@@ -43,9 +44,13 @@
          clear_pem_cache/0,
          clear_pem_cache/1,
          invalid_insert/0,
-         invalid_insert/1
+         invalid_insert/1,
+         new_root_pem/0,
+         new_root_pem/1,
+         check_cert/3
         ]).
 
+
 -define(CLEANUP_INTERVAL, 5000).
 
 %%--------------------------------------------------------------------
@@ -55,7 +60,9 @@ all() ->
     [
      pem_cleanup, 
      clear_pem_cache,
-     invalid_insert].
+     invalid_insert,
+     new_root_pem
+    ].
 
 groups() ->
     [].
@@ -88,8 +95,8 @@ init_per_testcase(pem_cleanup = Case, Config) ->
     ct:timetrap({minutes, 1}),
     Config;
 init_per_testcase(_, Config) ->
-    ssl:start(),
-    ct:timetrap({seconds, 5}),
+    ssl_test_lib:clean_start(),
+    ct:timetrap({seconds, 10}),
     Config.
 
 end_per_testcase(_TestCase, Config) ->
@@ -184,7 +191,92 @@ invalid_insert(Config)when is_list(Config) ->
     1 = ssl_pkix_db:db_size(get_fileref_db()).
 
 
+new_root_pem() ->
+    [{doc, "Test that changed PEM-files on disk followed by ssl:clear_pem_cache() invalidates"
+      "trusted CA cache as well as ordinary PEM cache"}].
+new_root_pem(Config)when is_list(Config) ->
+    PrivDir = proplists:get_value(priv_dir, Config),
+    #{cert := OrgSRoot} = SRoot = 
+        public_key:pkix_test_root_cert("OTP test server ROOT",  [{key, ssl_test_lib:hardcode_rsa_key(6)}]),
+    
+    DerConfig = public_key:pkix_test_data(#{server_chain => #{root => SRoot,
+                                                              intermediates => [[{key, ssl_test_lib:hardcode_rsa_key(5)}]],
+                                                              peer =>  [{key, ssl_test_lib:hardcode_rsa_key(4)}]},
+                                            client_chain => #{root => [{key, ssl_test_lib:hardcode_rsa_key(1)}],
+                                                              intermediates => [[{key, ssl_test_lib:hardcode_rsa_key(2)}]],
+                                                              peer =>  [{key, ssl_test_lib:hardcode_rsa_key(3)}]}}),
+
+    ClientBase = filename:join(PrivDir, "client_test"),
+    SeverBase =  filename:join(PrivDir, "server_test"),
+    PemConfig = x509_test:gen_pem_config_files(DerConfig, ClientBase, SeverBase),
+    ClientConf = proplists:get_value(client_config, PemConfig),
+    ServerConf = proplists:get_value(server_config, PemConfig),
+
+    SCAFile =  proplists:get_value(cacertfile, ServerConf),
+
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+
+    %% Start a connection and keep it up for a little while, so that 
+    %% it will be up when the second connection is started.
+    Server =
+	ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+				   {from, self()},
+				   {mfa, {ssl_test_lib, no_result, []}},
+				   {options, ServerConf}]),
+    Port = ssl_test_lib:inet_port(Server),
+    Client =
+	ssl_test_lib:start_client([{node, ClientNode},
+                                   {port, Port}, {host, Hostname},
+				   {mfa, {?MODULE, check_cert, [OrgSRoot, SCAFile]}},
+				   {from, self()}, {options, [{verify, verify_peer} |ClientConf]}]),
+
+    ssl_test_lib:check_result(Client, ok),
+
+    %% Create new configuration
+    Key = ssl_test_lib:hardcode_rsa_key(1),
+    OTPCert = public_key:pkix_decode_cert(OrgSRoot, otp),
+    TBS = OTPCert#'OTPCertificate'.tbsCertificate,
+    #'RSAPrivateKey'{modulus=N, publicExponent=E} = Key,
+    Public = #'RSAPublicKey'{modulus=N, publicExponent=E},
+    Algo = #'PublicKeyAlgorithm'{algorithm= ?rsaEncryption, parameters='NULL'},
+    SPKI = #'OTPSubjectPublicKeyInfo'{algorithm = Algo,
+                                      subjectPublicKey = Public},
+    NewCert = public_key:pkix_sign(TBS#'OTPTBSCertificate'{subjectPublicKeyInfo = SPKI}, Key),
+
+    DerConfig1 = public_key:pkix_test_data(#{server_chain =>
+                                                 #{root =>  #{cert => NewCert, key => Key},
+                                                   intermediates => [[{key, ssl_test_lib:hardcode_rsa_key(5)}]],
+                                                   peer => [{key, ssl_test_lib:hardcode_rsa_key(4)}]},
+                                             client_chain =>
+                                                 #{root => [{key, ssl_test_lib:hardcode_rsa_key(1)}],
+                                                   intermediates =>  [[{key, ssl_test_lib:hardcode_rsa_key(2)}]],
+                                                   peer => [{key, ssl_test_lib:hardcode_rsa_key(3)}]}}),
+
+    %% Overwrite old config files
+    _ = x509_test:gen_pem_config_files(DerConfig1, ClientBase, SeverBase),
+
+    %% Make sure chache is cleared 
+    ssl:clear_pem_cache(),
+    
+    Server1 =
+	ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+				   {from, self()},
+				   {mfa, {ssl_test_lib, no_result, []}},
+				   {options, ServerConf}]),
+    Port1 = ssl_test_lib:inet_port(Server1),
 
+    %% Start second connection
+    Client1 = ssl_test_lib:start_client([{node, ClientNode},
+                                         {port, Port1}, {host, Hostname},
+                                         {from, self()},
+                                         {mfa, {?MODULE, check_cert, [NewCert, SCAFile]}},
+                                         {options, [{verify, verify_peer} | ClientConf]}]),
+    ssl_test_lib:check_result(Client1, ok),
+    ssl_test_lib:close(Server),
+    ssl_test_lib:close(Server1),
+    ssl_test_lib:close(Client),
+    ssl_test_lib:close(Client1).
+    
 %%--------------------------------------------------------------------
 %% Internal funcations 
 %%--------------------------------------------------------------------
@@ -234,3 +326,11 @@ basic_verify_test_no_close(Config) ->
 
     ssl_test_lib:check_result(Server, ok, Client, ok),
     {Server, Client}.
+
+
+check_cert(Socket, RootCert, File) ->
+    {ok, Cert} = ssl:peercert(Socket),
+    {ok, Extracted} = ssl_pkix_db:extract_trusted_certs(File),
+    {ok, RootCert, _} = ssl_certificate:certificate_chain(Cert, ets:new(foo, []), Extracted, []),
+    ok.
+
diff --git a/lib/ssl/test/x509_test.erl b/lib/ssl/test/x509_test.erl
index e99c35e249..ee38a71698 100644
--- a/lib/ssl/test/x509_test.erl
+++ b/lib/ssl/test/x509_test.erl
@@ -107,4 +107,5 @@ extension({Id, Data, Critical}) ->
 
 der_to_pem(File, Entries) ->
     PemBin = public_key:pem_encode(Entries),
+    _ = file:delete(File),
     file:write_file(File, PemBin).
-- 
2.26.2

Places

File 0157-ssl-Make-sure-Trusted-CA-cert-use-latest-PEM.patch of Package erlang (Revision 218b3430555ecf8dc51659dea4ccdb8e)

Places