Handling of path validation errors by the application

Changed the behavior of the verify_fun option so that
the application can be responsible for handling path validation
errors even on the server side. Also replaced the not yet
documented validate_extensions_fun to be handled by the
verify_fun instead.

If the verify callback fun returns {fail, Reason}, the verification process is
immediately stopped and an alert is sent to the peer and the TLS/SSL
handshake is terminated. If the verify callback fun returns {valid,
UserState}, the verification process is continued.  If the verify callback
fun always returns {valid, UserState}, the TLS/SSL handshake will not be
terminated with respect to verification failures and the connection
will be established. The verify callback fun will also be
able to verify application specific extensions.

1 files changed, 27 insertions, 8 deletions

diff --git a/lib/public_key/test/public_key_SUITE.erl b/lib/public_key/test/public_key_SUITE.erl
index 09235ff460..46b8c3db8b 100644
--- a/lib/public_key/test/public_key_SUITE.erl
+++ b/lib/public_key/test/public_key_SUITE.erl
@@ -369,16 +369,35 @@ pkix_path_validation(Config) when is_list(Config) ->
     CertK3 = {Cert3,_}  = erl_make_certs:make_cert([{issuer, CertK1}, 
 					       {extensions, [{basic_constraints, false}]}]),
     {Cert4,_}  = erl_make_certs:make_cert([{issuer, CertK3}]),
-    {error, E={bad_cert,missing_basic_constraint}} = 
+    {error, {bad_cert,missing_basic_constraint}} =
 	public_key:pkix_path_validation(Trusted, [Cert1, Cert3,Cert4], []),
-    
-    {ok, {_,_,[E]}} = public_key:pkix_path_validation(Trusted, [Cert1, Cert3,Cert4], 
-						      [{verify,false}]),
-
-    {error,  {bad_cert,unknown_ca}} = public_key:pkix_path_validation(unknown_ca, [Cert1, Cert3, Cert4], []),
 
-    {ok, {_,_,[{bad_cert,unknown_ca}]}} =
-	public_key:pkix_path_validation(unknown_ca, [Cert1], [{verify, false}]),
+    VerifyFunAndState0  = {fun(_,{bad_cert, missing_basic_constraint}, UserState) ->
+				   {valid, UserState};
+			      (_,{bad_cert, _} = Reason, _) ->
+				   {fail, Reason};
+			      (_,{extension, _}, UserState) ->
+				   {unknown, UserState}
+			   end, []},
+    {ok, _} =
+	public_key:pkix_path_validation(Trusted, [Cert1, Cert3,Cert4],
+					[{verify_fun, VerifyFunAndState0}]),
+
+    {error, {bad_cert, unknown_ca}} =
+	public_key:pkix_path_validation(unknown_ca, [Cert1, Cert3, Cert4], []),
+
+    VerifyFunAndState1 =
+	{fun(_,{bad_cert, unknown_ca}, UserState) ->
+		 {valid, UserState};
+	    (_,{bad_cert, _} = Reason, _) ->
+		 {fail, Reason};
+	    (_,{extension, _}, UserState) ->
+		 {unknown, UserState}
+	 end, []},
+
+    {ok, _} =
+	public_key:pkix_path_validation(unknown_ca, [Cert1], [{verify_fun,
+							      VerifyFunAndState1}]),
     ok.
 
 %%--------------------------------------------------------------------