File 1064-ssl-Use-cert-rec-in-db.patch of Package erlang

Overview Repositories Revisions Requests Users Attributes Meta

File 1064-ssl-Use-cert-rec-in-db.patch of Package erlang (Revision 459ea22809e09a8cdcc656806aa931bc)

Currently displaying revision 459ea22809e09a8cdcc656806aa931bc , Show latest

From aa815ba05cfd75cd0288cf04427450b467f51439 Mon Sep 17 00:00:00 2001
From: Dan Gudmundsson <dgud@erlang.org>
Date: Mon, 19 Apr 2021 13:36:04 +0200
Subject: [PATCH 4/5] ssl: Use cert rec in db

Continuation of the refactoring.
---
 lib/ssl/src/ssl_certificate.erl | 15 ++++++---------
 lib/ssl/src/ssl_crl.erl         | 10 +++++-----
 lib/ssl/src/ssl_manager.erl     |  6 +++---
 lib/ssl/src/ssl_pkix_db.erl     | 30 +++++++++++++-----------------
 4 files changed, 27 insertions(+), 34 deletions(-)

diff --git a/lib/ssl/src/ssl_certificate.erl b/lib/ssl/src/ssl_certificate.erl
index 6358c7a668..0351dec3c1 100644
--- a/lib/ssl/src/ssl_certificate.erl
+++ b/lib/ssl/src/ssl_certificate.erl
@@ -261,8 +261,7 @@ certificate_chain(#cert{otp=OtpCert}=Cert, CertDbHandle, CertsDbRef, Chain, List
 	    false  ->
 		{public_key:pkix_issuer_id(OtpCert, other), false}
 	end,
-    
-    case IssuerAndSelfSigned of 
+    case IssuerAndSelfSigned of
 	{_, true = SelfSigned} ->
 	    do_certificate_chain(CertDbHandle, CertsDbRef, Chain, ignore, ignore, SelfSigned, ListDb);
 	{{error, issuer_not_found}, SelfSigned} ->
@@ -270,7 +269,7 @@ certificate_chain(#cert{otp=OtpCert}=Cert, CertDbHandle, CertsDbRef, Chain, List
 		{ok, {SerialNr, Issuer}} ->
 		    do_certificate_chain(CertDbHandle, CertsDbRef, Chain,
 					 SerialNr, Issuer, SelfSigned, ListDb);
-		_ ->
+		_Err ->
 		    %% Guess the the issuer must be the root
 		    %% certificate. The verification of the
 		    %% cert chain will fail if guess is
@@ -287,8 +286,7 @@ do_certificate_chain(_, _, [RootCert | _] = Chain, _, _, true, _) ->
 do_certificate_chain(CertDbHandle, CertsDbRef, Chain, SerialNr, Issuer, _, ListDb) ->
     case ssl_manager:lookup_trusted_cert(CertDbHandle, CertsDbRef,
 						SerialNr, Issuer) of
-	{ok, {IssuerCert, ErlCert}} ->
-            Cert = #cert{der=IssuerCert, otp=ErlCert},
+	{ok, Cert} ->
 	    certificate_chain(Cert, CertDbHandle, CertsDbRef, [Cert | Chain], ListDb);
 	_ ->
 	    %% The trusted cert may be obmitted from the chain as the
@@ -300,7 +298,7 @@ do_certificate_chain(CertDbHandle, CertsDbRef, Chain, SerialNr, Issuer, _, ListD
 
 find_issuer(#cert{der=DerCert, otp=OtpCert}, CertDbHandle, CertsDbRef, ListDb) ->
     IsIssuerFun =
-	fun({_Key, {_Der, #'OTPCertificate'{} = ErlCertCandidate}}, Acc) ->
+	fun({_Key, #cert{otp=ErlCertCandidate}}, Acc) ->
 		case public_key:pkix_is_issuer(OtpCert, ErlCertCandidate) of
 		    true ->
 			case verify_cert_signer(DerCert, ErlCertCandidate#'OTPCertificate'.tbsCertificate) of
@@ -501,7 +499,7 @@ handle_partial_chain([#cert{der=IssuerCert, otp=OTPCert}=Cert| Rest] = Path, Par
         true -> %% IssuerCert = ROOT (That is ROOT was included in chain)
             {ok, {SerialNr, IssuerId}} = public_key:pkix_issuer_id(OTPCert, self),
             case ssl_manager:lookup_trusted_cert(CertDbHandle, CertDbRef, SerialNr, IssuerId) of
-                {ok, {IssuerCert, _}} -> %% Match sent ROOT to trusted ROOT 
+                {ok, #cert{der=IssuerCert}} -> %% Match sent ROOT to trusted ROOT 
                     maybe_shorten_path(Path, PartialChainHandler, {Cert, Rest});
                 {ok, _} -> %% Did not match trusted ROOT
                     maybe_shorten_path(Path, PartialChainHandler, {invalid_issuer, Path});
@@ -512,8 +510,7 @@ handle_partial_chain([#cert{der=IssuerCert, otp=OTPCert}=Cert| Rest] = Path, Par
             case other_issuer(Cert, CertDbHandle, CertDbRef) of
                 {other, {SerialNr, IssuerId}} ->
                     case ssl_manager:lookup_trusted_cert(CertDbHandle, CertDbRef, SerialNr, IssuerId) of
-                        {ok, {NewDer, NewOtp}} ->
-                            NewCert = #cert{der=NewDer, otp=NewOtp},
+                        {ok, #cert{otp=NewOtp}=NewCert} ->
                             case public_key:pkix_is_self_signed(NewOtp) of
                                 true -> %% NewIssuerCert is a trusted ROOT cert
                                     maybe_shorten_path([NewCert | Path], PartialChainHandler, {NewCert, Path});
diff --git a/lib/ssl/src/ssl_crl.erl b/lib/ssl/src/ssl_crl.erl
index 12d261bcdc..f2e3239aa3 100644
--- a/lib/ssl/src/ssl_crl.erl
+++ b/lib/ssl/src/ssl_crl.erl
@@ -35,7 +35,7 @@ trusted_cert_and_path(CRL, {SerialNumber, Issuer}, CertPath, {Db, DbRef}) ->
 	undefined ->
             %% But not found in our database
 	    search_certpath(CRL, CertPath, Db, DbRef);
-	{ok, {_, OtpCert}}  ->
+	{ok, #cert{otp=OtpCert}}  ->
 	    {ok, Root, Chain} = ssl_certificate:certificate_chain(OtpCert, Db, DbRef),
 	    {ok, Root,  lists:reverse(Chain)}
     end;
@@ -44,7 +44,7 @@ trusted_cert_and_path(CRL, issuer_not_found, CertPath, {Db, DbRef}) ->
 	{error, unknown_ca} ->
             Issuer = public_key:pkix_normalize_name(public_key:pkix_crl_issuer(CRL)),
             IsIssuerFun =
-                fun({_Key, {_Der,ErlCertCandidate}}, Acc) ->
+                fun({_Key, #cert{otp=ErlCertCandidate}}, Acc) ->
                         verify_crl_issuer(CRL, ErlCertCandidate, Issuer, Acc);
                    (_, Acc) ->
                         Acc
@@ -63,13 +63,13 @@ trusted_cert_and_path(CRL, issuer_not_found, CertPath, {Db, DbRef}) ->
 search_certpath(CRL, CertPath, Db, DbRef) ->
     Issuer = public_key:pkix_normalize_name(public_key:pkix_crl_issuer(CRL)),
     IsIssuerFun =
-	fun({_Der,ErlCertCandidate}, Acc) ->
+	fun(#cert{otp=ErlCertCandidate}, Acc) ->
 		verify_crl_issuer(CRL, ErlCertCandidate, Issuer, Acc);
 	   (_, Acc) ->
 		Acc
 	end,
-    case find_issuer(IsIssuerFun, certpath,
-                     [{Der, public_key:pkix_decode_cert(Der,otp)} || Der <- CertPath]) of
+    Certs = [#cert{der=Der, otp=public_key:pkix_decode_cert(Der,otp)} || Der <- CertPath],
+    case find_issuer(IsIssuerFun, certpath, Certs) of
 	{ok, OtpCert} ->
 	    {ok, Root, Chain} = ssl_certificate:certificate_chain(OtpCert, Db, DbRef),
 	    {ok, Root, lists:reverse(Chain)};
diff --git a/lib/ssl/src/ssl_manager.erl b/lib/ssl/src/ssl_manager.erl
index 9d0dbc2d9b..14a2748f61 100644
--- a/lib/ssl/src/ssl_manager.erl
+++ b/lib/ssl/src/ssl_manager.erl
@@ -138,9 +138,9 @@ cache_pem_file(File, DbHandle) ->
 
 %%--------------------------------------------------------------------
 -spec lookup_trusted_cert(term(), reference(), serialnumber(), issuer()) ->
-				 undefined | 
-				 {ok, {der_cert(), #'OTPCertificate'{}}}.
-%%				 
+          undefined |
+          {ok, #cert{}}.
+%%
 %% Description: Lookup the trusted cert with Key = {reference(),
 %% serialnumber(), issuer()}.
 %% --------------------------------------------------------------------
diff --git a/lib/ssl/src/ssl_pkix_db.erl b/lib/ssl/src/ssl_pkix_db.erl
index a91341de52..a110765fb9 100644
--- a/lib/ssl/src/ssl_pkix_db.erl
+++ b/lib/ssl/src/ssl_pkix_db.erl
@@ -94,7 +94,7 @@ remove(Dbs) ->
 
 %%--------------------------------------------------------------------
 -spec lookup_trusted_cert(db_handle(), certdb_ref(), serialnumber(), issuer()) ->
-				 undefined | {ok, {der_cert(), #'OTPCertificate'{}}}.
+				 undefined | {ok, #cert{}}.
 
 %%
 %% Description: Retrives the trusted certificate identified by 
@@ -303,21 +303,17 @@ add_certs(Cert, Ref, CertsDb) ->
 	    ok
     end.
 
-decode_certs(Ref, DerOrBoth) ->
-    try
-        {Cert, ErlCert} = case DerOrBoth of
-                              #cert{der=Der, otp=Otp} ->
-                                  {Der, Otp};
-                              Der ->
-                                  {Der, public_key:pkix_decode_cert(Der, otp)}
-                          end,
-        TBSCertificate = ErlCert#'OTPCertificate'.tbsCertificate,
-        SerialNumber = TBSCertificate#'OTPTBSCertificate'.serialNumber,
-        Issuer = public_key:pkix_normalize_name(
-                   TBSCertificate#'OTPTBSCertificate'.issuer),
-        {decoded, {{Ref, SerialNumber, Issuer}, {Cert, ErlCert}}}
-    catch
-	error:_ ->
+decode_certs(Ref, #cert{otp=ErlCert} = Cert) ->
+    TBSCertificate = ErlCert#'OTPCertificate'.tbsCertificate,
+    SerialNumber = TBSCertificate#'OTPTBSCertificate'.serialNumber,
+    Issuer = public_key:pkix_normalize_name(
+               TBSCertificate#'OTPTBSCertificate'.issuer),
+    {decoded, {{Ref, SerialNumber, Issuer}, Cert}};
+decode_certs(Ref, Der) ->
+    try public_key:pkix_decode_cert(Der, otp) of
+        ErlCert ->
+            decode_certs(Ref, #cert{der=Der, otp=ErlCert})
+    catch error:_ ->
 	    ?LOG_NOTICE("SSL WARNING: Ignoring a CA cert as "
                         "it could not be correctly decoded.~n"),
 	    undefined
@@ -346,7 +342,7 @@ add_crls(CRL, Mapping) ->
 
 remove_crls([_,_,_, {_, Mapping} | _], {?NO_DIST_POINT, CRLs}) ->
     [rm_crls(CRL, Mapping) || CRL <- CRLs];
-	
+
 remove_crls([_,_,_, {Cache, Mapping} | _], Path) ->
     case lookup(Path, Cache) of
 	undefined ->
-- 
2.26.2

Places

File 1064-ssl-Use-cert-rec-in-db.patch of Package erlang (Revision 459ea22809e09a8cdcc656806aa931bc)

Places