File 1551-public_key-ssl-add-password-fun-for-decodi... of Package erlang

Overview Repositories Revisions Requests Users Attributes Meta

File 1551-public_key-ssl-add-password-fun-for-decoding-keyfile.patch of Package erlang (Revision fe162c0c563b11430d77cc39dc990d22)

Currently displaying revision fe162c0c563b11430d77cc39dc990d22 , Show latest

From c6e437b5e914deb06983cc7bd224d1b1e2d8f9ea Mon Sep 17 00:00:00 2001
From: Jakub Witczak <kuba@erlang.org>
Date: Fri, 14 Jan 2022 17:20:35 +0100
Subject: [PATCH] public_key,ssl: add password fun for decoding keyfiles

Implementing password fun option for ssl connect API

This change allows password option to accept as a value
either a string or a fun. Added specific tests and
documentation.

The motivation for this change is to better protect a
private key. If the private key is protected by password the
password may be retreived using user supplied function therefore
enabling storing password in a secure vault or something similar.
---
 lib/public_key/doc/src/public_key.xml    |   1 +
 lib/public_key/src/public_key.erl        |  10 +-
 lib/public_key/test/public_key_SUITE.erl |  57 ++--
 lib/ssl/doc/src/ssl.xml                  |   4 +-
 lib/ssl/src/ssl.erl                      |  11 +-
 lib/ssl/src/ssl_config.erl               |   2 +-
 lib/ssl/test/ssl_api_SUITE.erl           |   3 +-
 lib/ssl/test/ssl_test_lib.erl            |  36 ++-
 lib/ssl/test/tls_api_SUITE.erl           | 372 +++++++++++++++--------
 9 files changed, 331 insertions(+), 165 deletions(-)

diff --git a/lib/public_key/doc/src/public_key.xml b/lib/public_key/doc/src/public_key.xml
index 4c674333b2..884425cf15 100644
--- a/lib/public_key/doc/src/public_key.xml
+++ b/lib/public_key/doc/src/public_key.xml
@@ -418,6 +418,7 @@
 entries. Notice that if the PEM entry is of type
 'SubjectPublickeyInfo', it is further decoded to an
 <c>rsa_public_key()</c> or <c>dsa_public_key()</c>.
+ Password can be either an octet string or function which returns same type.
 </desc> 
 </func>
 
diff --git a/lib/public_key/src/public_key.erl b/lib/public_key/src/public_key.erl
index 0b5061f695..b3b830b3c8 100644
--- a/lib/public_key/src/public_key.erl
+++ b/lib/public_key/src/public_key.erl
@@ -241,8 +241,11 @@ pem_entry_decode({Asn1Type, Der, not_encrypted}) when is_atom(Asn1Type),
 						 is_binary(Der) ->
 der_decode(Asn1Type, Der).
 
--spec pem_entry_decode(PemEntry, Password) -> term() when PemEntry :: pem_entry(),
- Password :: string() .
+-spec pem_entry_decode(PemEntry, Password) -> term() when
+ PemEntry :: pem_entry(),
+ Password :: string() | fun(() -> string()).
+pem_entry_decode(PemEntry, PasswordFun) when is_function(PasswordFun) ->
+ pem_entry_decode(PemEntry, PasswordFun());
 pem_entry_decode({Asn1Type, Der, not_encrypted}, _) when is_atom(Asn1Type),
 							 is_binary(Der) ->
 der_decode(Asn1Type, Der);
@@ -264,8 +267,7 @@ pem_entry_decode({Asn1Type, CryptDer, {Cipher, Salt}} = PemEntry,
 				is_binary(Salt) andalso
 				((erlang:byte_size(Salt) == 8) or (erlang:byte_size(Salt) == 16)) andalso
 				is_list(Password) ->
- do_pem_entry_decode(PemEntry, Password).	
-
+ do_pem_entry_decode(PemEntry, Password).
 
 %%--------------------------------------------------------------------
 %%
diff --git a/lib/public_key/test/public_key_SUITE.erl b/lib/public_key/test/public_key_SUITE.erl
index b176cbef6a..3984110f5d 100644
--- a/lib/public_key/test/public_key_SUITE.erl
+++ b/lib/public_key/test/public_key_SUITE.erl
@@ -62,8 +62,10 @@
 init_ec_pem_encode_generated/1,
 ec_pem_encode_generated/0,
 ec_pem_encode_generated/1,
- encrypted_pem/0,
- encrypted_pem/1,
+ encrypted_pem_pwdstring/0,
+ encrypted_pem_pwdstring/1,
+ encrypted_pem_pwdfun/0,
+ encrypted_pem_pwdfun/1,
 dh_pem/0,
 dh_pem/1,
 pkcs10_pem/0,
@@ -121,7 +123,8 @@
 ]).
 
 -define(TIMEOUT, 120000). % 2 min
-
+-define(PASSWORD1, "1234abcd").
+-define(PASSWORD2, "4567efgh").
 
 %%--------------------------------------------------------------------
 %% Common Test interface functions -----------------------------------
@@ -158,13 +161,13 @@ all() ->
 ].
 
 groups() -> 
- [{pem_decode_encode, [], [dsa_pem, rsa_pem, rsa_pss_pss_pem, ec_pem, encrypted_pem,
+ [{pem_decode_encode, [], [dsa_pem, rsa_pem, rsa_pss_pss_pem, ec_pem,
+			 encrypted_pem_pwdstring, encrypted_pem_pwdfun,
 			 dh_pem, cert_pem, pkcs7_pem, pkcs10_pem, ec_pem2,
 			 rsa_priv_pkcs8, dsa_priv_pkcs8, ec_priv_pkcs8,
- eddsa_priv_pkcs8, eddsa_priv_rfc5958,
- ec_pem_encode_generated,
- gen_ec_param_prime_field, gen_ec_param_char_2_field
- ]},
+			 eddsa_priv_pkcs8, eddsa_priv_rfc5958,
+			 ec_pem_encode_generated, gen_ec_param_prime_field,
+			 gen_ec_param_char_2_field]},
 {sign_verify, [], [rsa_sign_verify, rsa_pss_sign_verify, dsa_sign_verify]}
 ].
 %%-------------------------------------------------------------------
@@ -451,37 +454,45 @@ ec_pem_encode_generated(_Config) ->
 
 %%--------------------------------------------------------------------
 
-encrypted_pem() ->
- [{doc, "Encrypted PEM-file decode/encode"}].
-encrypted_pem(Config) when is_list(Config) ->
+encrypted_pem_pwdstring() ->
+ [{doc, "Encrypted PEM-file decode/encode with password string used"}].
+encrypted_pem_pwdstring(Config) when is_list(Config) ->
+ encrypted_pem(Config, ?PASSWORD1, ?PASSWORD2).
+
+encrypted_pem_pwdfun() ->
+ [{doc, "Encrypted PEM-file decode/encode with password fun used"}].
+encrypted_pem_pwdfun(Config) when is_list(Config) ->
+ encrypted_pem(Config, fun() -> ?PASSWORD1 end, fun() -> ?PASSWORD2 end).
+
+encrypted_pem(Config, Password1, Password2) ->
 Datadir = proplists:get_value(data_dir, Config),
 
 [{'RSAPrivateKey', DerRSAKey, not_encrypted}] =
-	erl_make_certs:pem_to_der(filename:join(Datadir, "client_key.pem")),
+ erl_make_certs:pem_to_der(filename:join(Datadir, "client_key.pem")),
 
 RSAKey = public_key:der_decode('RSAPrivateKey', DerRSAKey),
 
 Salt0 = crypto:strong_rand_bytes(8),
 Entry0 = public_key:pem_entry_encode('RSAPrivateKey', RSAKey,
-					 {{"DES-EDE3-CBC", Salt0}, "1234abcd"}),
- RSAKey = public_key:pem_entry_decode(Entry0,"1234abcd"),
+ {{"DES-EDE3-CBC", Salt0}, ?PASSWORD1}),
+ RSAKey = public_key:pem_entry_decode(Entry0, Password1),
 Des3KeyFile = filename:join(Datadir, "des3_client_key.pem"),
 erl_make_certs:der_to_pem(Des3KeyFile, [Entry0]),
 [{'RSAPrivateKey', _, {"DES-EDE3-CBC", Salt0}}] =
-	erl_make_certs:pem_to_der(Des3KeyFile),
+ erl_make_certs:pem_to_der(Des3KeyFile),
 
 Salt1 = crypto:strong_rand_bytes(8),
 Entry1 = public_key:pem_entry_encode('RSAPrivateKey', RSAKey,
-					 {{"DES-CBC", Salt1}, "4567efgh"}),
+ {{"DES-CBC", Salt1}, ?PASSWORD2}),
 DesKeyFile = filename:join(Datadir, "des_client_key.pem"),
 erl_make_certs:der_to_pem(DesKeyFile, [Entry1]),
- [{'RSAPrivateKey', _, {"DES-CBC", Salt1}} =Entry2] =
-	erl_make_certs:pem_to_der(DesKeyFile),
+ [{'RSAPrivateKey', _, {"DES-CBC", Salt1}} = Entry2] =
+ erl_make_certs:pem_to_der(DesKeyFile),
 {ok, Pem} = file:read_file(DesKeyFile),
 check_encapsulated_header(Pem),
- true = check_entry_type(public_key:pem_entry_decode(Entry2, "4567efgh"),
-			 'RSAPrivateKey').
- 
+ true = check_entry_type(public_key:pem_entry_decode(Entry2, Password2),
+ 'RSAPrivateKey').
+
 %%--------------------------------------------------------------------
 
 dh_pem() ->
@@ -783,7 +794,7 @@ pkix_path_validation(Config) when is_list(Config) ->
 % RsaPssKey = {public_key:generate_key({rsa, 1024, 65537}), pss_params(sha256)},
 RsaPssKey = {hardcode_rsa_key(1), pss_params(sha256)},
 
- CaKPSS = {TrustedPSSCert,_} = erl_make_certs:make_cert([{key, RsaPssKey},
+ _CaKPSS = {TrustedPSSCert,_} = erl_make_certs:make_cert([{key, RsaPssKey},
 {subject, [
 {name, "RSASSA-PSS Public Key"},
 {?'id-at-name', {printableString, "public_key"}},
@@ -794,7 +805,7 @@ pkix_path_validation(Config) when is_list(Config) ->
 {org_unit, "testing dep"}
 ]}
 ]),
- ChainPSSCert = {CertPSS, _} = erl_make_certs:make_cert([{issuer, {TrustedPSSCert,RsaPssKey}}]),
+ _ChainPSSCert = {CertPSS, _} = erl_make_certs:make_cert([{issuer, {TrustedPSSCert,RsaPssKey}}]),
 {ok, _} = public_key:pkix_path_validation(TrustedPSSCert, [CertPSS], []).
 
 pkix_path_validation_root_expired() ->
diff --git a/lib/ssl/doc/src/ssl.xml b/lib/ssl/doc/src/ssl.xml
index f75005e1ac..486e21d51e 100644
--- a/lib/ssl/doc/src/ssl.xml
+++ b/lib/ssl/doc/src/ssl.xml
@@ -358,11 +358,11 @@
 <datatype>
 <name name="key_password"/>
 <desc>
-	String containing the user's password. Only used if the 
+	String containing the user's password or a function returning same type. Only used if the
 	private keyfile is password-protected.
 </desc>
 </datatype>
- 
+
 <datatype>
 <name name="cipher_suites"/>
 <desc>
diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index d1ca621e22..d70df3c473 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -347,7 +347,7 @@
 key_id := crypto:key_id(), 
 password => crypto:password()}. % exported
 -type key_pem() :: file:filename().
--type key_password() :: string().
+-type key_password() :: string() | fun(() -> string()).
 -type cipher_suites() :: ciphers(). 
 -type ciphers() :: [erl_cipher_suite()] |
 string(). % (according to old API) exported
@@ -1736,6 +1736,12 @@ handle_option(padding_check = Option, Value0, #{versions := Versions} = Options
 assert_option_dependency(Option, versions, Versions, ['tlsv1']),
 Value = validate_option(Option, Value0),
 OptionsMap#{Option => Value};
+handle_option(password = Option, unbound, OptionsMap, #{rules := Rules}) ->
+ Value = validate_option(Option, default_value(Option, Rules)),
+ OptionsMap#{password => Value};
+handle_option(password = Option, Value0, OptionsMap, _Env) ->
+ Value = validate_option(Option, Value0),
+ OptionsMap#{password => Value};
 handle_option(psk_identity = Option, unbound, OptionsMap, #{rules := Rules}) ->
 Value = validate_option(Option, default_value(Option, Rules)),
 OptionsMap#{Option => Value};
@@ -2283,6 +2289,9 @@ validate_option(partial_chain, Value, _)
 validate_option(password, Value, _)
 when is_list(Value) ->
 Value;
+validate_option(password, Value, _)
+ when is_function(Value, 0) ->
+ Value;
 validate_option(protocol, Value = tls, _) ->
 Value;
 validate_option(protocol, Value = dtls, _) ->
diff --git a/lib/ssl/src/ssl_config.erl b/lib/ssl/src/ssl_config.erl
index 89198eaa2b..80a5b4f44c 100644
--- a/lib/ssl/src/ssl_config.erl
+++ b/lib/ssl/src/ssl_config.erl
@@ -43,7 +43,7 @@
 init(#{erl_dist := ErlDist,
 key := Key,
 keyfile := KeyFile,
- password := Password,
+ password := Password, %% Can be fun() or string()
 dh := DH,
 dhfile := DHFile} = SslOpts, Role) ->
 
diff --git a/lib/ssl/test/ssl_api_SUITE.erl b/lib/ssl/test/ssl_api_SUITE.erl
index a4c7f24a00..e7dc0eb43f 100644
--- a/lib/ssl/test/ssl_api_SUITE.erl
+++ b/lib/ssl/test/ssl_api_SUITE.erl
@@ -2621,7 +2621,8 @@ check_random_nonce(Config) when is_list(Config) ->
 Randoms = lists:flatten([ssl_test_lib:get_result([Server, Client]) ||
 {Server, Client} <- ConnectionPairs]),
 Deltas = [abs(FourBytes - SecsSince) ||
- {_Id, {_, <<FourBytes:32, _/binary>>}, SecsSince} <- Randoms],
+ {_FromPid,
+ {_Id, {_, <<FourBytes:32, _/binary>>}, SecsSince}} <- Randoms],
 MeanDelta = lists:sum(Deltas) div N,
 case ?config(version, Config) of
 'tlsv1.3' ->
diff --git a/lib/ssl/test/ssl_test_lib.erl b/lib/ssl/test/ssl_test_lib.erl
index beabdcb8de..628e7119ba 100644
--- a/lib/ssl/test/ssl_test_lib.erl
+++ b/lib/ssl/test/ssl_test_lib.erl
@@ -157,6 +157,7 @@
 ]).
 
 -export([make_rsa_cert/1,
+ make_rsa_cert_with_protected_keyfile/2,
 make_dsa_cert/1,
 make_ecdsa_cert/1,
 make_ecdh_rsa_cert/1,
@@ -1128,7 +1129,7 @@ get_result([], Acc) ->
 get_result([Pid | Tail], Acc) ->
 receive
 	{Pid, Msg} ->
-	 get_result(Tail, [Msg | Acc])
+	 get_result(Tail, [{Pid, Msg} | Acc])
 end.
 
 check_result(Server, ServerMsg, Client, ClientMsg) ->
@@ -1764,7 +1765,7 @@ make_rsa_cert(Config) ->
 	 [{server_rsa_opts, [{reuseaddr, true} | ServerConf]},
 	 {server_rsa_verify_opts, [{reuseaddr, true}, {verify, verify_peer} | ServerConf]},
 	 {client_rsa_opts, ClientConf},
- {client_rsa_verify_opts, [{verify, verify_peer} |ClientConf]},
+ {client_rsa_verify_opts, [{verify, verify_peer} |ClientConf]},
 {server_rsa_der_opts, [{reuseaddr, true} | ServerDerConf]},
 	 {server_rsa_der_verify_opts, [{reuseaddr, true}, {verify, verify_peer} | ServerDerConf]},
 	 {client_rsa_der_opts, ClientDerConf},
@@ -1774,6 +1775,34 @@ make_rsa_cert(Config) ->
 	 Config
 end.
 
+make_rsa_cert_with_protected_keyfile(Config0, Password) ->
+ Config1 = make_rsa_cert(Config0),
+
+ ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config1),
+ [PemEntry] = pem_to_der(proplists:get_value(keyfile, ClientOpts)),
+ ASN1OctetStrTag = 4,
+ IV = <<4,8,154,8,95,192,188,232,4,8,154,8,95,192,188,232>>,
+ Length = <<16:8/unsigned-big-integer>>,
+ Params = {"AES-256-CBC",
+ {'PBES2-params',
+ {'PBES2-params_keyDerivationFunc',
+ ?'id-PBKDF2',
+ {'PBKDF2-params',
+ {specified, <<125,96,67,95,2,233,224,174>>},
+ 2048,asn1_NOVALUE,
+ {'PBKDF2-params_prf', ?'id-hmacWithSHA1','NULL'}}},
+ {'PBES2-params_encryptionScheme',
+ ?'id-aes256-CBC',
+ {asn1_OPENTYPE, <<ASN1OctetStrTag, Length/binary, IV/binary>>}}}},
+ ProtectedPemEntry = public_key:pem_entry_encode(
+ 'PrivateKeyInfo',public_key:pem_entry_decode(PemEntry),
+ {Params, Password}),
+ ProtectedClientKeyFile = filename:join(proplists:get_value(priv_dir,Config1),
+ "tls_password_client.pem"),
+ der_to_pem(ProtectedClientKeyFile, [ProtectedPemEntry]),
+ ProtectedClientOpts = [{keyfile,ProtectedClientKeyFile} | proplists:delete(keyfile, ClientOpts)],
+ [{client_protected_rsa_opts, ProtectedClientOpts} | Config1].
+
 make_rsa_1024_cert(Config) ->
 CryptoSupport = crypto:supports(),
 case proplists:get_bool(rsa, proplists:get_value(public_keys, CryptoSupport)) of
@@ -1994,6 +2023,7 @@ run_server_error(Opts) ->
 Pid = proplists:get_value(from, Opts),
 Transport = proplists:get_value(transport, Opts, ssl),
 ?LOG("~nssl:listen(~p, ~p)~n", [Port, Options]),
+ Timeout = proplists:get_value(timeout, Opts, infinity),
 case Transport:listen(Port, Options) of
 	{ok, #sslsocket{} = ListenSocket} ->
 	 %% To make sure error_client will
@@ -2001,7 +2031,7 @@ run_server_error(Opts) ->
 	 Pid ! {listen, up},
 	 send_selected_port(Pid, Port, ListenSocket),
 	 ?LOG("~nssl:transport_accept(~p)~n", [ListenSocket]),
-	 case Transport:transport_accept(ListenSocket) of
+	 case Transport:transport_accept(ListenSocket, Timeout) of
 		{error, _} = Error ->
 		 Pid ! {self(), Error};
 		{ok, AcceptSocket} ->
diff --git a/lib/ssl/test/tls_api_SUITE.erl b/lib/ssl/test/tls_api_SUITE.erl
index e2e1629336..7acf0e19f7 100644
--- a/lib/ssl/test/tls_api_SUITE.erl
+++ b/lib/ssl/test/tls_api_SUITE.erl
@@ -22,6 +22,7 @@
 -module(tls_api_SUITE).
 
 -include_lib("common_test/include/ct.hrl").
+-include_lib("public_key/include/public_key.hrl").
 -include_lib("ssl/src/ssl_record.hrl").
 -include_lib("ssl/src/ssl_internal.hrl").
 -include_lib("ssl/src/ssl_api.hrl").
@@ -42,7 +43,7 @@
 -export([tls_upgrade/0,
 tls_upgrade/1,
 tls_upgrade_new_opts/0,
- tls_upgrade_new_opts/1, 
+ tls_upgrade_new_opts/1,
 tls_upgrade_with_timeout/0,
 tls_upgrade_with_timeout/1,
 tls_downgrade/0,
@@ -59,6 +60,12 @@
 tls_client_closes_socket/1,
 tls_closed_in_active_once/0,
 tls_closed_in_active_once/1,
+ tls_password_incorrect/0,
+ tls_password_incorrect/1,
+ tls_password_correct/0,
+ tls_password_correct/1,
+ tls_password_badarg/0,
+ tls_password_badarg/1,
 tls_reset_in_active_once/0,
 tls_reset_in_active_once/1,
 tls_monitor_listener/0,
@@ -101,6 +108,9 @@
 ]).
 
 -define(SLEEP, 500).
+-define(CORRECT_PASSWORD, "hello test").
+-define(INCORRECT_PASSWORD, "hello").
+-define(BADARG_PASSWORD, hello).
 
 %%--------------------------------------------------------------------
 %% Common Test interface functions -----------------------------------
@@ -132,6 +142,9 @@ api_tests() ->
 tls_shutdown_write,
 tls_shutdown_both,
 tls_shutdown_error,
+ tls_password_correct,
+ tls_password_incorrect,
+ tls_password_badarg,
 tls_client_closes_socket,
 tls_closed_in_active_once,
 tls_reset_in_active_once,
@@ -155,7 +168,8 @@ init_per_suite(Config0) ->
 try crypto:start() of
 	ok ->
 	 ssl_test_lib:clean_start(),
-	 ssl_test_lib:make_rsa_cert(Config0)
+	 ssl_test_lib:make_rsa_cert_with_protected_keyfile(Config0,
+ ?CORRECT_PASSWORD)
 catch _:_ ->
 	 {skip, "Crypto did not start"}
 end.
@@ -166,7 +180,7 @@ end_per_suite(_Config) ->
 application:stop(crypto).
 
 init_per_group(GroupName, Config) ->
- ssl_test_lib:init_per_group(GroupName, Config). 
+ ssl_test_lib:init_per_group(GroupName, Config).
 
 end_per_group(GroupName, Config) ->
 ssl_test_lib:end_per_group(GroupName, Config).
@@ -178,7 +192,7 @@ init_per_testcase(Testcase, Config) when Testcase == tls_server_handshake_timeou
 init_per_testcase(_, Config) ->
 ct:timetrap({seconds, 5}),
 Config.
-end_per_testcase(_TestCase, Config) -> 
+end_per_testcase(_TestCase, Config) ->
 Config.
 
 %%--------------------------------------------------------------------
@@ -193,28 +207,28 @@ tls_upgrade(Config) when is_list(Config) ->
 {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 TcpOpts = [binary, {reuseaddr, true}],
 
- Server = ssl_test_lib:start_upgrade_server([{node, ServerNode}, {port, 0}, 
-						{from, self()}, 
-						{mfa, {?MODULE, 
+ Server = ssl_test_lib:start_upgrade_server([{node, ServerNode}, {port, 0},
+						{from, self()},
+						{mfa, {?MODULE,
 						 upgrade_result, []}},
-						{tcp_options, 
+						{tcp_options,
 						 [{active, false} | TcpOpts]},
 						{ssl_options, [{verify, verify_peer} | ServerOpts]}]),
 Port = ssl_test_lib:inet_port(Server),
- Client = ssl_test_lib:start_upgrade_client([{node, ClientNode}, 
-						{port, Port}, 
+ Client = ssl_test_lib:start_upgrade_client([{node, ClientNode},
+						{port, Port},
 				 {host, Hostname},
-				 {from, self()}, 
+				 {from, self()},
 				 {mfa, {?MODULE, upgrade_result, []}},
 				 {tcp_options, [binary]},
 				 {ssl_options, [{verify, verify_peer},
 {server_name_indication, Hostname} | ClientOpts]}]),
- 
+
 ct:log("Testcase ~p, Client ~p Server ~p ~n",
 		 [self(), Client, Server]),
- 
+
 ssl_test_lib:check_result(Server, ok, Client, ok),
- 
+
 ssl_test_lib:close(Server),
 ssl_test_lib:close(Client).
 
@@ -228,30 +242,30 @@ tls_upgrade_new_opts(Config) when is_list(Config) ->
 {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 TcpOpts = [binary, {reuseaddr, true}],
 
- Server = ssl_test_lib:start_upgrade_server([{node, ServerNode}, {port, 0}, 
-						{from, self()}, 
-						{mfa, {?MODULE, 
+ Server = ssl_test_lib:start_upgrade_server([{node, ServerNode}, {port, 0},
+						{from, self()},
+						{mfa, {?MODULE,
 						 upgrade_result_new_opts, []}},
-						{tcp_options, 
+						{tcp_options,
 						 [{active, false} | TcpOpts]},
 						{ssl_options, [{verify, verify_peer},
 {mode, list} | ServerOpts]}]),
 Port = ssl_test_lib:inet_port(Server),
- Client = ssl_test_lib:start_upgrade_client([{node, ClientNode}, 
-						{port, Port}, 
+ Client = ssl_test_lib:start_upgrade_client([{node, ClientNode},
+						{port, Port},
 				 {host, Hostname},
-				 {from, self()}, 
+				 {from, self()},
 				 {mfa, {?MODULE, upgrade_result_new_opts, []}},
 				 {tcp_options, [binary]},
 				 {ssl_options, [{verify, verify_peer},
 {mode, list},
 {server_name_indication, Hostname} | ClientOpts]}]),
- 
+
 ct:log("Testcase ~p, Client ~p Server ~p ~n",
 		 [self(), Client, Server]),
- 
+
 ssl_test_lib:check_result(Server, ok, Client, ok),
- 
+
 ssl_test_lib:close(Server),
 ssl_test_lib:close(Client).
 
@@ -265,29 +279,29 @@ tls_upgrade_with_timeout(Config) when is_list(Config) ->
 {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 TcpOpts = [binary, {reuseaddr, true}],
 
- Server = ssl_test_lib:start_upgrade_server([{node, ServerNode}, {port, 0}, 
-						{from, self()}, 
+ Server = ssl_test_lib:start_upgrade_server([{node, ServerNode}, {port, 0},
+						{from, self()},
 						{timeout, 5000},
-						{mfa, {?MODULE, 
+						{mfa, {?MODULE,
 						 upgrade_result, []}},
-						{tcp_options, 
+						{tcp_options,
 						 [{active, false} | TcpOpts]},
 						{ssl_options, [{verify, verify_peer} | ServerOpts]}]),
 Port = ssl_test_lib:inet_port(Server),
- Client = ssl_test_lib:start_upgrade_client([{node, ClientNode}, 
-						{port, Port}, 
+ Client = ssl_test_lib:start_upgrade_client([{node, ClientNode},
+						{port, Port},
 						{host, Hostname},
-						{from, self()}, 
+						{from, self()},
 						{mfa, {?MODULE, upgrade_result, []}},
 						{tcp_options, TcpOpts},
 						{ssl_options, [{verify, verify_peer},
 {server_name_indication, Hostname} | ClientOpts]}]),
- 
+
 ct:log("Testcase ~p, Client ~p Server ~p ~n",
 		 [self(), Client, Server]),
- 
+
 ssl_test_lib:check_result(Server, ok, Client, ok),
- 
+
 ssl_test_lib:close(Server),
 ssl_test_lib:close(Client).
 
@@ -297,7 +311,7 @@ tls_downgrade() ->
 tls_downgrade(Config) when is_list(Config) ->
 ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
 ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
- 
+
 {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 
 Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
@@ -310,7 +324,7 @@ tls_downgrade(Config) when is_list(Config) ->
 					{from, self()},
 					{mfa, {?MODULE, tls_downgrade_result, [self()]}},
 					{options, [{active, false}, {verify, verify_peer} | ClientOpts]}]),
- 
+
 ssl_test_lib:check_result(Server, ready, Client, ready),
 
 Server ! go,
@@ -328,23 +342,23 @@ tls_shutdown(Config) when is_list(Config) ->
 ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
 ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
 {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
- Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
+ Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+					{from, self()},
 			 {mfa, {?MODULE, tls_shutdown_result, [server]}},
 			 {options, [{exit_on_close, false},
 				 {active, false} | ServerOpts]}]),
 Port = ssl_test_lib:inet_port(Server),
- Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+ Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
 					{host, Hostname},
-					{from, self()}, 
-					{mfa, 
+					{from, self()},
+					{mfa,
 					 {?MODULE, tls_shutdown_result, [client]}},
-					{options, 
+					{options,
 					 [{exit_on_close, false},
 					 {active, false} | ClientOpts]}]),
- 
+
 ssl_test_lib:check_result(Server, ok, Client, ok),
- 
+
 ssl_test_lib:close(Server),
 ssl_test_lib:close(Client).
 
@@ -355,17 +369,17 @@ tls_shutdown_write(Config) when is_list(Config) ->
 ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
 ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
 {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
- Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
+ Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+					{from, self()},
 			 {mfa, {?MODULE, tls_shutdown_write_result, [server]}},
 			 {options, [{active, false} | ServerOpts]}]),
 Port = ssl_test_lib:inet_port(Server),
- Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+ Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
 					{host, Hostname},
-			 {from, self()}, 
+			 {from, self()},
 			 {mfa, {?MODULE, tls_shutdown_write_result, [client]}},
 			 {options, [{active, false} | ClientOpts]}]),
- 
+
 ssl_test_lib:check_result(Server, ok, Client, {error, closed}).
 
 %%--------------------------------------------------------------------
@@ -375,17 +389,17 @@ tls_shutdown_both(Config) when is_list(Config) ->
 ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
 ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
 {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
- Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
+ Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+					{from, self()},
 			 {mfa, {?MODULE, tls_shutdown_both_result, [server]}},
 			 {options, [{active, false} | ServerOpts]}]),
 Port = ssl_test_lib:inet_port(Server),
- Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+ Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
 					{host, Hostname},
-			 {from, self()}, 
+			 {from, self()},
 			 {mfa, {?MODULE, tls_shutdown_both_result, [client]}},
 			 {options, [{active, false} | ClientOpts]}]),
- 
+
 ssl_test_lib:check_result(Server, ok, Client, {error, closed}).
 
 %%--------------------------------------------------------------------
@@ -403,25 +417,25 @@ tls_shutdown_error(Config) when is_list(Config) ->
 tls_client_closes_socket() ->
 [{doc,"Test what happens when client closes socket before handshake is completed"}].
 
-tls_client_closes_socket(Config) when is_list(Config) -> 
+tls_client_closes_socket(Config) when is_list(Config) ->
 ServerOpts = ssl_test_lib:ssl_options(server_opts, Config),
 {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 TcpOpts = [binary, {reuseaddr, true}],
- 
- Server = ssl_test_lib:start_upgrade_server_error([{node, ServerNode}, {port, 0}, 
-						 {from, self()}, 
+
+ Server = ssl_test_lib:start_upgrade_server_error([{node, ServerNode}, {port, 0},
+						 {from, self()},
 						 {tcp_options, TcpOpts},
 						 {ssl_options, ServerOpts}]),
 Port = ssl_test_lib:inet_port(Server),
 
 Connect = fun() ->
-		 {ok, _Socket} = rpc:call(ClientNode, gen_tcp, connect, 
-					 [Hostname, Port, [binary]]),	 
-		 %% Make sure that handshake is called before 
+		 {ok, _Socket} = rpc:call(ClientNode, gen_tcp, connect,
+					 [Hostname, Port, [binary]]),
+		 %% Make sure that handshake is called before
 		 %% client process ends and closes socket.
 		 ct:sleep(?SLEEP)
 	 end,
- 
+
 _Client = spawn_link(Connect),
 
 ssl_test_lib:check_result(Server, {error,closed}).
@@ -460,7 +474,7 @@ tls_reset_in_active_once(Config) when is_list(Config) ->
 %%--------------------------------------------------------------------
 tls_closed_in_active_once() ->
 [{doc, "Test that active once can be used to deliver not only all data"
- " but even the close message, see ERL-1409, in normal operation." 
+ " but even the close message, see ERL-1409, in normal operation."
 " This is also test, with slightly different circumstances in"
 " the old tls_closed_in_active_once test"
 " renamed tls_reset_in_active_once"}].
@@ -536,7 +550,7 @@ tls_monitor_listener(Config) when is_list(Config) ->
 
 Sessions1 = session_info(Version),
 true = (Sessions1 == 1),
- 
+
 1 = count_children(workers, ssl_listen_tracker_sup).
 
 %%--------------------------------------------------------------------
@@ -560,9 +574,9 @@ tls_tcp_msg(Config) when is_list(Config) ->
 ct:log("Testcase ~p connected to Server ~p ~n", [self(), Server]),
 gen_tcp:send(Socket, "<SOME GARBLED NON SSL MESSAGE>"),
 
- receive 
+ receive
 	{tcp_closed, Socket} ->
-	 receive 
+	 receive
 		{Server, {error, Error}} ->
 		 ct:log("Error ~p", [Error])
 	 end
@@ -600,7 +614,7 @@ tls_tcp_msg_big(Config) when is_list(Config) ->
 		{Server, {error, Error}} ->
 		 ct:log("Error ~p", [Error]);
 		{'EXIT', Server, _} ->
-		 ok	 
+		 ok
 	 end
 end.
 
@@ -619,7 +633,7 @@ tls_dont_crash_on_handshake_garbage(Config) ->
 {mfa, ssl_test_lib, no_result},
 {options, [{versions, [Version]} | ServerOpts]}]),
 Port = ssl_test_lib:inet_port(Server),
- 
+
 {ok, Socket} = gen_tcp:connect(Hostname, Port, [binary, {active, false}]),
 
 %% Send hello and garbage record
@@ -639,7 +653,7 @@ tls_dont_crash_on_handshake_garbage(Config) ->
 _ ->
 ssl_test_lib:check_server_alert(Server, handshake_failure)
 end.
- 
+
 %%--------------------------------------------------------------------
 tls_tcp_error_propagation_in_active_mode() ->
 [{doc,"Test that process receives {ssl_error, Socket, closed} when tcp error ocurres"}].
@@ -660,7 +674,7 @@ tls_tcp_error_propagation_in_active_mode(Config) when is_list(Config) ->
 {from, self()},
 {mfa, {?MODULE, receive_msg, []}},
 {options, ClientOpts}]),
- 
+
 {status, _, _, StatusInfo} = sys:get_status(Pid),
 [_, _,_, _, Prop] = StatusInfo,
 State = ssl_test_lib:state(Prop),
@@ -675,21 +689,21 @@ tls_tcp_error_propagation_in_active_mode(Config) when is_list(Config) ->
 peername() ->
 [{doc,"Test API function peername/1"}].
 
-peername(Config) when is_list(Config) -> 
+peername(Config) when is_list(Config) ->
 ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
 ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
 {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
- Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
+ Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+					{from, self()},
 			 {mfa, {ssl, peername, []}},
 			 {options, ServerOpts}]),
 Port = ssl_test_lib:inet_port(Server),
- Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+ Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
 					{host, Hostname},
-					{from, self()}, 
+					{from, self()},
 					{mfa, {ssl, peername, []}},
 					{options, [{port, 0} | ClientOpts]}]),
- 
+
 ClientPort = ssl_test_lib:inet_port(Client),
 ServerIp = ssl_test_lib:node_to_hostip(ServerNode, server),
 ClientIp = ssl_test_lib:node_to_hostip(ClientNode, client),
@@ -700,39 +714,39 @@ peername(Config) when is_list(Config) ->
 		 [self(), Client, Server]),
 
 ssl_test_lib:check_result(Server, ServerMsg, Client, ClientMsg),
- 
+
 ssl_test_lib:close(Server),
 ssl_test_lib:close(Client).
 
 %%--------------------------------------------------------------------
 sockname() ->
 [{doc,"Test API function sockname/1"}].
-sockname(Config) when is_list(Config) -> 
+sockname(Config) when is_list(Config) ->
 ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
 ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
 {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
- Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
+ Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+					{from, self()},
 			 {mfa, {ssl, sockname, []}},
 			 {options, ServerOpts}]),
 Port = ssl_test_lib:inet_port(Server),
- Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+ Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
 					{host, Hostname},
- {from, self()}, 
+ {from, self()},
 {mfa, {ssl, sockname, []}},
 {options, [{port, 0} | ClientOpts]}]),
- 
+
 ClientPort = ssl_test_lib:inet_port(Client),
 ServerIp = ssl_test_lib:node_to_hostip(ServerNode, server),
 ClientIp = ssl_test_lib:node_to_hostip(ClientNode, client),
 ServerMsg = {ok, {ServerIp, Port}},
 ClientMsg = {ok, {ClientIp, ClientPort}},
-			 
+
 ct:log("Testcase ~p, Client ~p Server ~p ~n",
 			 [self(), Client, Server]),
- 
+
 ssl_test_lib:check_result(Server, ServerMsg, Client, ClientMsg),
- 
+
 ssl_test_lib:close(Server),
 ssl_test_lib:close(Client).
 %%--------------------------------------------------------------------
@@ -759,7 +773,7 @@ tls_server_handshake_timeout(Config) ->
 		{'EXIT', Server, _} ->
 		 %% Make sure supervisor had time to react on process exit
 		 %% Could we come up with a better solution to this?
-		 ct:sleep(500), 
+		 ct:sleep(500),
 		 [] = supervisor:which_children(tls_connection_sup)
 	 end
 end.
@@ -767,26 +781,26 @@ tls_server_handshake_timeout(Config) ->
 %%--------------------------------------------------------------------
 transport_close() ->
 [{doc, "Test what happens if socket is closed on TCP level after a while of normal operation"}].
-transport_close(Config) when is_list(Config) -> 
+transport_close(Config) when is_list(Config) ->
 ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
 ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
 {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
- Server = 
-	ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-				 {from, self()}, 
+ Server =
+	ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+				 {from, self()},
 				 {mfa, {ssl_test_lib, send_recv_result, []}},
 				 {options, [{active, false} | ServerOpts]}]),
 Port = ssl_test_lib:inet_port(Server),
- {ok, TcpS} = rpc:call(ClientNode, gen_tcp, connect, 
+ {ok, TcpS} = rpc:call(ClientNode, gen_tcp, connect,
 			 [Hostname,Port,[binary, {active, false}]]),
- {ok, SslS} = rpc:call(ClientNode, ssl, connect, 
+ {ok, SslS} = rpc:call(ClientNode, ssl, connect,
 			 [TcpS,[{active, false}|ClientOpts]]),
- 
+
 ct:log("Testcase ~p, Client ~p Server ~p ~n",
 		 [self(), self(), Server]),
- ok = ssl:send(SslS, "Hello world"), 
- {ok,<<"Hello world">>} = ssl:recv(SslS, 11), 
- gen_tcp:close(TcpS), 
+ ok = ssl:send(SslS, "Hello world"),
+ {ok,<<"Hello world">>} = ssl:recv(SslS, 11),
+ gen_tcp:close(TcpS),
 {error, _} = ssl:send(SslS, "Hello world").
 
 %%--------------------------------------------------------------------
@@ -856,36 +870,36 @@ check_connection_processes(Sup, N, M) ->
 emulated_options() ->
 [{doc,"Test API function getopts/2 and setopts/2"}].
 
-emulated_options(Config) when is_list(Config) -> 
+emulated_options(Config) when is_list(Config) ->
 ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
 ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
 {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
 Values = [{mode, list}, {packet, 0}, {header, 0},
-		 {active, true}], 
- %% Shall be the reverse order of Values! 
+		 {active, true}],
+ %% Shall be the reverse order of Values!
 Options = [active, header, packet, mode],
- 
+
 NewValues = [{mode, binary}, {active, once}],
- %% Shall be the reverse order of NewValues! 
+ %% Shall be the reverse order of NewValues!
 NewOptions = [active, mode],
- 
- Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
-			 {mfa, {?MODULE, tls_socket_options_result, 
+
+ Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+					{from, self()},
+			 {mfa, {?MODULE, tls_socket_options_result,
 				 [Options, Values, NewOptions, NewValues]}},
 			 {options, ServerOpts}]),
 Port = ssl_test_lib:inet_port(Server),
- Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+ Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
 					{host, Hostname},
-			 {from, self()}, 
-			 {mfa, {?MODULE, tls_socket_options_result, 
+			 {from, self()},
+			 {mfa, {?MODULE, tls_socket_options_result,
 				 [Options, Values, NewOptions, NewValues]}},
 			 {options, ClientOpts}]),
- 
+
 ssl_test_lib:check_result(Server, ok, Client, ok),
 
 ssl_test_lib:close(Server),
- 
+
 {ok, Listen} = ssl:listen(0, ServerOpts),
 {ok,[{mode,list}]} = ssl:getopts(Listen, [mode]),
 ok = ssl:setopts(Listen, [{mode, binary}]),
@@ -896,40 +910,40 @@ accept_pool() ->
 [{doc,"Test having an accept pool."}].
 accept_pool(Config) when is_list(Config) ->
 ClientOpts = ssl_test_lib:ssl_options(client_rsa_opts, Config),
- ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config), 
+ ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
 
 {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
- Server0 = ssl_test_lib:start_server([{node, ServerNode}, {port, 0}, 
-					{from, self()}, 
+ Server0 = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+					{from, self()},
 					{accepters, 3},
 					{mfa, {ssl_test_lib, send_recv_result_active, []}},
 					{options, ServerOpts}]),
 Port = ssl_test_lib:inet_port(Server0),
 [Server1, Server2] = ssl_test_lib:accepters(2),
 
- Client0 = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+ Client0 = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
 					 {host, Hostname},
-					 {from, self()}, 
+					 {from, self()},
 					 {mfa, {ssl_test_lib, send_recv_result_active, []}},
 					 {options, ClientOpts}
 					]),
- 
- Client1 = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+
+ Client1 = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
 					 {host, Hostname},
-					 {from, self()}, 
+					 {from, self()},
 					 {mfa, {ssl_test_lib, send_recv_result_active, []}},
 					 {options, ClientOpts}
 					]),
- 
- Client2 = ssl_test_lib:start_client([{node, ClientNode}, {port, Port}, 
+
+ Client2 = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
 					 {host, Hostname},
-					 {from, self()}, 
+					 {from, self()},
 					 {mfa, {ssl_test_lib, send_recv_result_active, []}},
 					 {options, ClientOpts}
 					]),
 
 ssl_test_lib:check_ok([Server0, Server1, Server2, Client0, Client1, Client2]),
- 
+
 ssl_test_lib:close(Server0),
 ssl_test_lib:close(Server1),
 ssl_test_lib:close(Server2),
@@ -959,7 +973,7 @@ reuseaddr(Config) when is_list(Config) ->
 				 {options, [{active, false} | ClientOpts]}]),
 ssl_test_lib:close(Server),
 ssl_test_lib:close(Client),
- 
+
 Server1 =
 	ssl_test_lib:start_server([{node, ServerNode}, {port, Port},
 				 {from, self()},
@@ -976,6 +990,104 @@ reuseaddr(Config) when is_list(Config) ->
 ssl_test_lib:close(Server1),
 ssl_test_lib:close(Client1).
 
+%%--------------------------------------------------------------------
+tls_password_correct() ->
+ [{doc, "Test that connection is possible with a correct password"}].
+tls_password_correct(Config) when is_list(Config) ->
+ F = fun (P) ->
+ ProtectedClientOpts = ?config(client_protected_rsa_opts, Config),
+ ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+
+ {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+ Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+ {from, self()},
+ {mfa, {?MODULE, tls_shutdown_result, [server]}},
+ {options, [{exit_on_close, false},
+ {active, false} | ServerOpts]}]),
+ Port = ssl_test_lib:inet_port(Server),
+ Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
+ {host, Hostname},
+ {from, self()},
+ {mfa,
+ {?MODULE, tls_shutdown_result, [client]}},
+ {options,
+ [{exit_on_close, false},
+ {verify, verify_none},
+ {active, false},
+ {password, P} | ProtectedClientOpts]}]),
+ ssl_test_lib:check_result(Server, ok, Client, ok),
+ ssl_test_lib:close(Server),
+ ssl_test_lib:close(Client)
+ end,
+ F(?CORRECT_PASSWORD),
+ F(fun() -> ?CORRECT_PASSWORD end).
+
+%%--------------------------------------------------------------------
+tls_password_incorrect() ->
+ [{doc, "Test that connection is not possible with wrong password"}].
+tls_password_incorrect(Config) when is_list(Config) ->
+ F = fun (P) ->
+ ProtectedClientOpts = ?config(client_protected_rsa_opts, Config),
+ ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+
+ {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+ Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0},
+ {from, self()},
+ {mfa, ssl_test_lib, no_result},
+ {options, [{active, false} | ServerOpts]}]),
+ Port = ssl_test_lib:inet_port(Server),
+ Client = ssl_test_lib:start_client_error([{node, ClientNode}, {port, Port},
+ {host, Hostname},
+ {from, self()},
+ {mfa, ssl_test_lib, no_result},
+ {options,
+ [{active, false},
+ {verify, verify_none},
+ {password, P} | ProtectedClientOpts]}]),
+ Results = ssl_test_lib:get_result([Server, Client]),
+ Pred = fun({Pid, {error, closed}}) ->
+ Server == Pid;
+ ({Pid, {error, {options, {keyfile, _, {error, _}}}}}) ->
+ Client == Pid;
+ (_) -> false
+ end,
+ true = lists:all(Pred, Results)
+ end,
+ F(?INCORRECT_PASSWORD),
+ F(fun() -> ?INCORRECT_PASSWORD end).
+
+%%--------------------------------------------------------------------
+tls_password_badarg() ->
+ [{doc, "Test that connection is not possible with badarg password"}].
+tls_password_badarg(Config) when is_list(Config) ->
+ F = fun (P, ServerError, ClientError) ->
+ ProtectedClientOpts = ?config(client_protected_rsa_opts, Config),
+ ServerOpts = ssl_test_lib:ssl_options(server_rsa_opts, Config),
+ {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+ Server = ssl_test_lib:start_server_error([{node, ServerNode}, {port, 0},
+ {from, self()},
+ {mfa, ssl_test_lib, no_result},
+ {timeout, 100},
+ {options, [{active, false} | ServerOpts]}]),
+ Port = ssl_test_lib:inet_port(Server),
+ Client = ssl_test_lib:start_client_error([{node, ClientNode}, {port, Port},
+ {host, Hostname},
+ {from, self()},
+ {mfa, ssl_test_lib, no_result},
+ {options,
+ [{active, false},
+ {verify, verify_none},
+ {password, P} | ProtectedClientOpts]}]),
+ ssl_test_lib:check_result(Server, ServerError, Client, ClientError)
+ end,
+ %% {options error comes from ssl app
+ F(?BADARG_PASSWORD, {error, timeout},
+ {error, {options, {password, ?BADARG_PASSWORD}}}),
+ %% {keyfile, badarg} error comes from crypto:macN, also handhsake is initiated
+ %% so different server error is observed
+ F(fun() -> ?BADARG_PASSWORD end, {error, closed},
+ {error, {keyfile,badarg}}).
+
 %%--------------------------------------------------------------------
 %% Internal functions ------------------------------------------------
 %%--------------------------------------------------------------------
@@ -991,7 +1103,7 @@ upgrade_result(Socket) ->
 upgrade_result_new_opts(Socket) ->
 ssl:setopts(Socket, [{active, true}]),
 ok = ssl:send(Socket, "Hello world"),
- %% Make sure list option set in ssl:connect/handskae overrides 
+ %% Make sure list option set in ssl:connect/handshake overrides
 %% previous gen_tcp socket option that was set to binary.
 "Hello world" = ssl_test_lib:active_recv(Socket, length("Hello world")),
 ok.
@@ -999,7 +1111,7 @@ upgrade_result_new_opts(Socket) ->
 tls_downgrade_result(Socket, Pid) ->
 ok = ssl_test_lib:send_recv_result(Socket),
 Pid ! {self(), ready},
- receive 
+ receive
 go ->
 ok
 end,
@@ -1062,20 +1174,20 @@ receive_msg(_) ->
 	Msg ->
 	 Msg
 end.
- 
+
 tls_socket_options_result(Socket, Options, DefaultValues, NewOptions, NewValues) ->
 %% Test get/set emulated opts
- {ok, DefaultValues} = ssl:getopts(Socket, Options), 
+ {ok, DefaultValues} = ssl:getopts(Socket, Options),
 ssl:setopts(Socket, NewValues),
 {ok, NewValues} = ssl:getopts(Socket, NewOptions),
 %% Test get/set inet opts
- {ok,[{nodelay,false}]} = ssl:getopts(Socket, [nodelay]), 
+ {ok,[{nodelay,false}]} = ssl:getopts(Socket, [nodelay]),
 ssl:setopts(Socket, [{nodelay, true}]),
 {ok,[{nodelay, true}]} = ssl:getopts(Socket, [nodelay]),
 {ok, All} = ssl:getopts(Socket, []),
 ct:log("All opts ~p~n", [All]),
 ok.
-	
+
 active_tcp_recv(Socket, N) ->
 active_tcp_recv(Socket, N, []).
 
-- 
2.31.1

Places

File 1551-public_key-ssl-add-password-fun-for-decoding-keyfile.patch of Package erlang (Revision fe162c0c563b11430d77cc39dc990d22)

Places