aboutsummaryrefslogtreecommitdiffstats
path: root/lib/ssl/src/ssl_crl.erl
diff options
context:
space:
mode:
authorFred Hebert <[email protected]>2016-08-22 09:57:57 -0400
committerFred Hebert <[email protected]>2016-08-22 09:57:57 -0400
commit911ab85688b21832c13d686d44c6b9064e9604a5 (patch)
tree4281fa28a219d0294422b66754b25ce34e895dca /lib/ssl/src/ssl_crl.erl
parent59ec0761d69608a6d4be2db1967e71efdb9f535d (diff)
downloadotp-911ab85688b21832c13d686d44c6b9064e9604a5.tar.gz
otp-911ab85688b21832c13d686d44c6b9064e9604a5.tar.bz2
otp-911ab85688b21832c13d686d44c6b9064e9604a5.zip
Fixing CRL searching in cache bypass
Diffstat (limited to 'lib/ssl/src/ssl_crl.erl')
-rw-r--r--lib/ssl/src/ssl_crl.erl28
1 files changed, 20 insertions, 8 deletions
diff --git a/lib/ssl/src/ssl_crl.erl b/lib/ssl/src/ssl_crl.erl
index d9f21e04ac..01be1fb9ab 100644
--- a/lib/ssl/src/ssl_crl.erl
+++ b/lib/ssl/src/ssl_crl.erl
@@ -47,7 +47,7 @@ trusted_cert_and_path(CRL, issuer_not_found, {Db, DbRef} = DbHandle) ->
{ok, unknown_crl_ca, []}
end.
-find_issuer(CRL, {Db,_}) ->
+find_issuer(CRL, {Db,DbRef}) ->
Issuer = public_key:pkix_normalize_name(public_key:pkix_crl_issuer(CRL)),
IsIssuerFun =
fun({_Key, {_Der,ErlCertCandidate}}, Acc) ->
@@ -55,15 +55,27 @@ find_issuer(CRL, {Db,_}) ->
(_, Acc) ->
Acc
end,
-
- try ssl_pkix_db:foldl(IsIssuerFun, issuer_not_found, Db) of
- issuer_not_found ->
- {error, issuer_not_found}
- catch
- {ok, _} = Result ->
- Result
+ if is_reference(DbRef) -> % actual DB exists
+ try ssl_pkix_db:foldl(IsIssuerFun, issuer_not_found, Db) of
+ issuer_not_found ->
+ {error, issuer_not_found}
+ catch
+ {ok, _} = Result ->
+ Result
+ end;
+ is_tuple(DbRef), element(1,DbRef) =:= extracted -> % cache bypass byproduct
+ {extracted, CertsData} = DbRef,
+ Certs = [Entry || {decoded, Entry} <- CertsData],
+ try lists:foldl(IsIssuerFun, issuer_not_found, Certs) of
+ issuer_not_found ->
+ {error, issuer_not_found}
+ catch
+ {ok, _} = Result ->
+ Result
+ end
end.
+
verify_crl_issuer(CRL, ErlCertCandidate, Issuer, NotIssuer) ->
TBSCert = ErlCertCandidate#'OTPCertificate'.tbsCertificate,
case public_key:pkix_normalize_name(TBSCert#'OTPTBSCertificate'.subject) of