diff options
| author | Ingela Anderton Andin <[email protected]> | 2012-08-23 16:51:00 +0200 |
|---|---|---|
| committer | Ingela Anderton Andin <[email protected]> | 2012-08-24 12:33:32 +0200 |
| commit | 69d4a56d9f7ade14fd0496ffbf56d96bf9184aef (patch) | |
| tree | 4bbf93ee819059cac09be7d091d1bb765bb01428 /lib/ssl/src | |
| parent | ca5d326a52449380b25969b4f6e6979f94854f4f (diff) | |
| download | otp-69d4a56d9f7ade14fd0496ffbf56d96bf9184aef.tar.gz otp-69d4a56d9f7ade14fd0496ffbf56d96bf9184aef.tar.bz2 otp-69d4a56d9f7ade14fd0496ffbf56d96bf9184aef.zip | |
ssl & public_key: Workaround that some certificates encode countryname as utf8 and close down gracefully if other ASN-1 errors occur.
The reason certificate_unknown that is used as ALERT for ASN-1 encoding failure is described as:
Some other (unspecified) issue arose in processing the
certificate, rendering it unacceptable.
Diffstat (limited to 'lib/ssl/src')
| -rw-r--r-- | lib/ssl/src/ssl_handshake.erl | 29 |
1 files changed, 17 insertions, 12 deletions
diff --git a/lib/ssl/src/ssl_handshake.erl b/lib/ssl/src/ssl_handshake.erl index 28469dfa5f..bb26302fff 100644 --- a/lib/ssl/src/ssl_handshake.erl +++ b/lib/ssl/src/ssl_handshake.erl @@ -220,18 +220,23 @@ certify(#certificate{asn1_certificates = ASN1Certs}, CertDbHandle, CertDbRef, end, {Role, UserState0}} end, - {TrustedErlCert, CertPath} = - ssl_certificate:trusted_cert_and_path(ASN1Certs, CertDbHandle, CertDbRef), - - case public_key:pkix_path_validation(TrustedErlCert, - CertPath, - [{max_path_length, - MaxPathLen}, - {verify_fun, ValidationFunAndState}]) of - {ok, {PublicKeyInfo,_}} -> - {PeerCert, PublicKeyInfo}; - {error, Reason} -> - path_validation_alert(Reason) + try + {TrustedErlCert, CertPath} = + ssl_certificate:trusted_cert_and_path(ASN1Certs, CertDbHandle, CertDbRef), + case public_key:pkix_path_validation(TrustedErlCert, + CertPath, + [{max_path_length, + MaxPathLen}, + {verify_fun, ValidationFunAndState}]) of + {ok, {PublicKeyInfo,_}} -> + {PeerCert, PublicKeyInfo}; + {error, Reason} -> + path_validation_alert(Reason) + end + catch + error:_ -> + %% ASN-1 decode of certificate somehow failed + ?ALERT_REC(?FATAL, ?CERTIFICATE_UNKNOWN) end. %%-------------------------------------------------------------------- |