ssl: Do not leave zoombie nodes if tests fail

1 files changed, 165 insertions, 177 deletions

diff --git a/lib/ssl/test/ssl_dist_SUITE.erl b/lib/ssl/test/ssl_dist_SUITE.erl
index 5ebf9bb2de..55aa2eda2d 100644
--- a/lib/ssl/test/ssl_dist_SUITE.erl
+++ b/lib/ssl/test/ssl_dist_SUITE.erl
@@ -109,11 +109,11 @@ common_end(_, _Config) ->
 basic() ->
     [{doc,"Test that two nodes can connect via ssl distribution"}].
 basic(Config) when is_list(Config) ->
-    NH1 = start_ssl_node(Config),
+    gen_dist_test(basic_test, Config).
+
+basic_test(NH1, NH2, _) ->
     Node1 = NH1#node_handle.nodename,
-    NH2 = start_ssl_node(Config),
     Node2 = NH2#node_handle.nodename,
-
     pong = apply_on_ssl_node(NH1, fun () -> net_adm:ping(Node2) end),
 
     [Node2] = apply_on_ssl_node(NH1, fun () -> nodes() end),
@@ -161,18 +161,16 @@ basic(Config) when is_list(Config) ->
 				    ok
 			    end
 		    end)
-     end,
-    stop_ssl_node(NH1),
-    stop_ssl_node(NH2),
-    success(Config).
+     end.
 
 %%--------------------------------------------------------------------
 payload() ->
     [{doc,"Test that send a lot of data between the ssl distributed noes"}].
 payload(Config) when is_list(Config) ->
-    NH1 = start_ssl_node(Config),
+    gen_dist_test(payload_test, Config).
+
+payload_test(NH1, NH2, _) ->
     Node1 = NH1#node_handle.nodename,
-    NH2 = start_ssl_node(Config),
     Node2 = NH2#node_handle.nodename,
 
     pong = apply_on_ssl_node(NH1, fun () -> net_adm:ping(Node2) end),
@@ -204,10 +202,8 @@ payload(Config) when is_list(Config) ->
 				    ok
 			    end
 		    end)
-     end,
-    stop_ssl_node(NH1),
-    stop_ssl_node(NH2),
-    success(Config).
+     end.
+
 %%--------------------------------------------------------------------
 plain_options() ->
     [{doc,"Test specifying additional options"}].
@@ -218,20 +214,17 @@ plain_options(Config) when is_list(Config) ->
 	"client_verify verify_none server_verify verify_none "
 	"server_depth 1 client_depth 1 "
 	"server_hibernate_after 500 client_hibernate_after 500",
+    gen_dist_test(plain_options_test, [{additional_dist_opts, DistOpts} | Config]).
 
-    NH1 = start_ssl_node([{additional_dist_opts, DistOpts} | Config]),
+plain_options_test(NH1, NH2, _) ->
     Node1 = NH1#node_handle.nodename,
-    NH2 = start_ssl_node([{additional_dist_opts, DistOpts} | Config]),
     Node2 = NH2#node_handle.nodename,
 
     pong = apply_on_ssl_node(NH1, fun () -> net_adm:ping(Node2) end),
 
     [Node2] = apply_on_ssl_node(NH1, fun () -> nodes() end),
-    [Node1] = apply_on_ssl_node(NH2, fun () -> nodes() end),
+    [Node1] = apply_on_ssl_node(NH2, fun () -> nodes() end).
 
-    stop_ssl_node(NH1),
-    stop_ssl_node(NH2),
-    success(Config).
 %%--------------------------------------------------------------------
 plain_verify_options() ->
     [{doc,"Test specifying additional options"}].
@@ -240,20 +233,18 @@ plain_verify_options(Config) when is_list(Config) ->
 	"client_secure_renegotiate true "
 	"server_reuse_sessions true client_reuse_sessions true  "
 	"server_hibernate_after 500 client_hibernate_after 500",
+    gen_dist_test(plain_verify_options_test, [{additional_dist_opts, DistOpts} | Config]).
 
-    NH1 = start_ssl_node([{additional_dist_opts, DistOpts} | Config]),
+plain_verify_options_test(NH1, NH2, _) ->
     Node1 = NH1#node_handle.nodename,
-    NH2 = start_ssl_node([{additional_dist_opts, DistOpts} | Config]),
     Node2 = NH2#node_handle.nodename,
-
+    
     pong = apply_on_ssl_node(NH1, fun () -> net_adm:ping(Node2) end),
-
+    
     [Node2] = apply_on_ssl_node(NH1, fun () -> nodes() end),
-    [Node1] = apply_on_ssl_node(NH2, fun () -> nodes() end),
+    [Node1] = apply_on_ssl_node(NH2, fun () -> nodes() end).
+
 
-    stop_ssl_node(NH1),
-    stop_ssl_node(NH2),
-    success(Config).
 %%--------------------------------------------------------------------
 nodelay_option() ->
     [{doc,"Test specifying dist_nodelay option"}].
@@ -265,6 +256,7 @@ nodelay_option(Config) ->
     after
 	application:unset_env(kernel, dist_nodelay)
     end.
+%%--------------------------------------------------------------------
 
 listen_port_options() ->
     [{doc, "Test specifying listening ports"}].
@@ -285,32 +277,39 @@ listen_port_options(Config) when is_list(Config) ->
 	#node_handle{} ->
 	    %% If the node was able to start, it didn't take the port
 	    %% option into account.
+	    stop_ssl_node(NH1),
 	    exit(unexpected_success)
     catch
 	exit:{accept_failed, timeout} ->
 	    %% The node failed to start, as expected.
 	    ok
     end,
-
+    
     %% Try again, now specifying a high max port.
     PortOpt2 = "-kernel inet_dist_listen_min " ++ integer_to_list(Port1) ++
-        " inet_dist_listen_max 65535",
+	" inet_dist_listen_max 65535",
     NH2 = start_ssl_node([{additional_dist_opts, PortOpt2} | Config]),
-    Node2 = NH2#node_handle.nodename,
-    Name2 = lists:takewhile(fun(C) -> C =/= $@ end, atom_to_list(Node2)),
-    {ok, NodesPorts2} = apply_on_ssl_node(NH2, fun net_adm:names/0),
-    {Name2, Port2} = lists:keyfind(Name2, 1, NodesPorts2),
-
-    %% The new port should be higher:
-    if Port2 > Port1 ->
-	    ok;
-       true ->
-	    error({port, Port2, not_higher_than, Port1})
+    
+    try 
+	Node2 = NH2#node_handle.nodename,
+	Name2 = lists:takewhile(fun(C) -> C =/= $@ end, atom_to_list(Node2)),
+	{ok, NodesPorts2} = apply_on_ssl_node(NH2, fun net_adm:names/0),
+	{Name2, Port2} = lists:keyfind(Name2, 1, NodesPorts2),
+	
+	%% The new port should be higher:
+	if Port2 > Port1 ->
+		ok;
+	   true ->
+		error({port, Port2, not_higher_than, Port1})
+	end
+    catch
+	_:Reason ->
+	    stop_ssl_node(NH2),
+	    ct:fail(Reason)
     end,
-
-    stop_ssl_node(NH1),
     stop_ssl_node(NH2),
     success(Config).
+
 %%--------------------------------------------------------------------
 listen_options() ->
     [{doc, "Test inet_dist_listen_options"}].
@@ -329,28 +328,25 @@ do_listen_options(Prio, Config) ->
 	end,
 
     Options = "-kernel inet_dist_listen_options " ++ PriorityString,
-
-    NH1 = start_ssl_node([{additional_dist_opts, Options} | Config]),
-    NH2 = start_ssl_node([{additional_dist_opts, Options} | Config]),
-    Node2 = NH2#node_handle.nodename,
-    
+    gen_dist_test(listen_options_test, [{prio, Prio}, {additional_dist_opts, Options} | Config]).
+	
+listen_options_test(NH1, NH2, Config) ->
+    Prio = proplists:get_value(prio, Config),
+    Node2 = NH2#node_handle.nodename,    
     pong = apply_on_ssl_node(NH1, fun () -> net_adm:ping(Node2) end),
 
     PrioritiesNode1 =
 	apply_on_ssl_node(NH1, fun get_socket_priorities/0),
     PrioritiesNode2 =
 	apply_on_ssl_node(NH2, fun get_socket_priorities/0),
-
+    
     Elevated1 = [P || P <- PrioritiesNode1, P =:= Prio],
-    ?t:format("Elevated1: ~p~n", [Elevated1]),
+    ct:pal("Elevated1: ~p~n", [Elevated1]),
     Elevated2 = [P || P <- PrioritiesNode2, P =:= Prio],
-    ?t:format("Elevated2: ~p~n", [Elevated2]),
+    ct:pal("Elevated2: ~p~n", [Elevated2]),
     [_|_] = Elevated1,
-    [_|_] = Elevated2,
+    [_|_] = Elevated2.
 
-    stop_ssl_node(NH1),
-    stop_ssl_node(NH2),
-    success(Config).
 %%--------------------------------------------------------------------
 connect_options() ->
     [{doc, "Test inet_dist_connect_options"}].
@@ -369,9 +365,11 @@ do_connect_options(Prio, Config) ->
 	end,
 
     Options = "-kernel inet_dist_connect_options " ++ PriorityString,
+    gen_dist_test(connect_options_test, 
+		  [{prio, Prio}, {additional_dist_opts, Options} | Config]).
 
-    NH1 = start_ssl_node([{additional_dist_opts, Options} | Config]),
-    NH2 = start_ssl_node([{additional_dist_opts, Options} | Config]),
+connect_options_test(NH1, NH2, Config) ->
+    Prio = proplists:get_value(prio, Config),
     Node2 = NH2#node_handle.nodename,
     
     pong = apply_on_ssl_node(NH1, fun () -> net_adm:ping(Node2) end),
@@ -382,17 +380,14 @@ do_connect_options(Prio, Config) ->
 	apply_on_ssl_node(NH2, fun get_socket_priorities/0),
 
     Elevated1 = [P || P <- PrioritiesNode1, P =:= Prio],
-    ?t:format("Elevated1: ~p~n", [Elevated1]),
+    ct:pal("Elevated1: ~p~n", [Elevated1]),
     Elevated2 = [P || P <- PrioritiesNode2, P =:= Prio],
-    ?t:format("Elevated2: ~p~n", [Elevated2]),
+    ct:pal("Elevated2: ~p~n", [Elevated2]),
     %% Node 1 will have a socket with elevated priority.
     [_|_] = Elevated1,
     %% Node 2 will not, since it only applies to outbound connections.
-    [] = Elevated2,
+    [] = Elevated2.
 
-    stop_ssl_node(NH1),
-    stop_ssl_node(NH2),
-    success(Config).
 %%--------------------------------------------------------------------
 use_interface() ->
     [{doc, "Test inet_dist_use_interface"}].
@@ -403,22 +398,28 @@ use_interface(Config) when is_list(Config) ->
 
     %% Start a node, and get the port number it's listening on.
     NH1 = start_ssl_node([{additional_dist_opts, Options} | Config]),
-    Node1 = NH1#node_handle.nodename,
-    Name = lists:takewhile(fun(C) -> C =/= $@ end, atom_to_list(Node1)),
-    {ok, NodesPorts} = apply_on_ssl_node(NH1, fun net_adm:names/0),
-    {Name, Port} = lists:keyfind(Name, 1, NodesPorts),
-    
-    %% Now find the socket listening on that port, and check its sockname.
-    Sockets = apply_on_ssl_node(
-		NH1,
-		fun() ->
-			[inet:sockname(P) ||
-			    P <- inet_ports(),
-			    {ok, Port} =:= (catch inet:port(P))]
-		end),
-    %% And check that it's actually listening on localhost.
-    [{ok,{{127,0,0,1},Port}}] = Sockets,
-
+  
+    try
+	Node1 = NH1#node_handle.nodename,
+	Name = lists:takewhile(fun(C) -> C =/= $@ end, atom_to_list(Node1)),
+	{ok, NodesPorts} = apply_on_ssl_node(NH1, fun net_adm:names/0),
+	{Name, Port} = lists:keyfind(Name, 1, NodesPorts),
+	
+	%% Now find the socket listening on that port, and check its sockname.
+	Sockets = apply_on_ssl_node(
+		    NH1,
+		    fun() ->
+			    [inet:sockname(P) ||
+				P <- inet_ports(),
+				{ok, Port} =:= (catch inet:port(P))]
+		    end),
+	%% And check that it's actually listening on localhost.
+	[{ok,{{127,0,0,1},Port}}] = Sockets
+    catch 
+	_:Reason ->
+	    stop_ssl_node(NH1),
+	    ct:fail(Reason)
+    end,
     stop_ssl_node(NH1),
     success(Config).
 %%--------------------------------------------------------------------
@@ -430,11 +431,11 @@ verify_fun_fail(Config) when is_list(Config) ->
 	"\"{ssl_dist_SUITE,verify_fail_always,{}}\" "
         "client_verify verify_peer client_verify_fun "
 	"\"{ssl_dist_SUITE,verify_fail_always,{}}\" ",
+    gen_dist_test(verify_fun_fail_test, [{additional_dist_opts, DistOpts} | Config]).
 
-    NH1 = start_ssl_node([{additional_dist_opts, DistOpts} | Config]),
-    NH2 = start_ssl_node([{additional_dist_opts, DistOpts} | Config]),
+verify_fun_fail_test(NH1, NH2, _) ->
     Node2 = NH2#node_handle.nodename,
-
+    
     pang = apply_on_ssl_node(NH1, fun () -> net_adm:ping(Node2) end),
 
     [] = apply_on_ssl_node(NH1, fun () -> nodes() end),
@@ -446,25 +447,9 @@ verify_fun_fail(Config) when is_list(Config) ->
     %% On the server node, it wouldn't run, because the server didn't
     %% request a certificate from the client.
     undefined =
-        apply_on_ssl_node(NH2, fun () -> ets:info(verify_fun_ran) end),
+        apply_on_ssl_node(NH2, fun () -> ets:info(verify_fun_ran) end).
 
-    stop_ssl_node(NH1),
-    stop_ssl_node(NH2),
-    success(Config).
 
-verify_fail_always(_Certificate, _Event, _State) ->
-    %% Create an ETS table, to record the fact that the verify function ran.
-    %% Spawn a new process, to avoid the ETS table disappearing.
-    Parent = self(),
-    spawn(
-      fun() ->
-	      ets:new(verify_fun_ran, [public, named_table]),
-	      ets:insert(verify_fun_ran, {verify_fail_always_ran, true}),
-	      Parent ! go_ahead,
-	      timer:sleep(infinity)
-      end),
-    receive go_ahead -> ok end,
-    {fail, bad_certificate}.
 
 %%--------------------------------------------------------------------
 verify_fun_pass() ->
@@ -476,10 +461,10 @@ verify_fun_pass(Config) when is_list(Config) ->
         "server_fail_if_no_peer_cert true "
         "client_verify verify_peer client_verify_fun "
 	"\"{ssl_dist_SUITE,verify_pass_always,{}}\" ",
+    gen_dist_test(verify_fun_pass_test, [{additional_dist_opts, DistOpts} | Config]).
 
-    NH1 = start_ssl_node([{additional_dist_opts, DistOpts} | Config]),
+verify_fun_pass_test(NH1, NH2, _) ->
     Node1 = NH1#node_handle.nodename,
-    NH2 = start_ssl_node([{additional_dist_opts, DistOpts} | Config]),
     Node2 = NH2#node_handle.nodename,
 
     pong = apply_on_ssl_node(NH1, fun () -> net_adm:ping(Node2) end),
@@ -494,25 +479,8 @@ verify_fun_pass(Config) when is_list(Config) ->
     %% requested and verified the client's certificate because we
     %% passed fail_if_no_peer_cert.
     [{verify_pass_always_ran, true}] =
-        apply_on_ssl_node(NH2, fun () -> ets:tab2list(verify_fun_ran) end),
+        apply_on_ssl_node(NH2, fun () -> ets:tab2list(verify_fun_ran) end).
 
-    stop_ssl_node(NH1),
-    stop_ssl_node(NH2),
-    success(Config).
-
-verify_pass_always(_Certificate, _Event, State) ->
-    %% Create an ETS table, to record the fact that the verify function ran.
-    %% Spawn a new process, to avoid the ETS table disappearing.
-    Parent = self(),
-    spawn(
-      fun() ->
-	      ets:new(verify_fun_ran, [public, named_table]),
-	      ets:insert(verify_fun_ran, {verify_pass_always_ran, true}),
-	      Parent ! go_ahead,
-	      timer:sleep(infinity)
-      end),
-    receive go_ahead -> ok end,
-    {valid, State}.
 %%--------------------------------------------------------------------
 crl_check_pass() ->
     [{doc,"Test crl_check with non-revoked certificate"}].
@@ -520,10 +488,10 @@ crl_check_pass(Config) when is_list(Config) ->
     DistOpts = "-ssl_dist_opt client_crl_check true",
     NewConfig =
         [{many_verify_opts, true}, {additional_dist_opts, DistOpts}] ++ Config,
+    gen_dist_test(crl_check_pass_test, NewConfig).
 
-    NH1 = start_ssl_node(NewConfig),
+crl_check_pass_test(NH1, NH2, Config) ->
     Node1 = NH1#node_handle.nodename,
-    NH2 = start_ssl_node(NewConfig),
     Node2 = NH2#node_handle.nodename,
 
     PrivDir = ?config(priv_dir, Config),
@@ -533,11 +501,7 @@ crl_check_pass(Config) when is_list(Config) ->
     pong = apply_on_ssl_node(NH1, fun () -> net_adm:ping(Node2) end),
 
     [Node2] = apply_on_ssl_node(NH1, fun () -> nodes() end),
-    [Node1] = apply_on_ssl_node(NH2, fun () -> nodes() end),
-
-    stop_ssl_node(NH1),
-    stop_ssl_node(NH2),
-    success(Config).
+    [Node1] = apply_on_ssl_node(NH2, fun () -> nodes() end).
 
 %%--------------------------------------------------------------------
 crl_check_fail() ->
@@ -549,10 +513,9 @@ crl_check_fail(Config) when is_list(Config) ->
          %% The server uses a revoked certificate.
          {server_cert_dir, "revoked"},
          {additional_dist_opts, DistOpts}] ++ Config,
+    gen_dist_test(crl_check_fail_test, NewConfig).
 
-    NH1 = start_ssl_node(NewConfig),
-    %%Node1 = NH1#node_handle.nodename,
-    NH2 = start_ssl_node(NewConfig),
+crl_check_fail_test(NH1, NH2, Config) ->
     Node2 = NH2#node_handle.nodename,
 
     PrivDir = ?config(priv_dir, Config),
@@ -562,11 +525,7 @@ crl_check_fail(Config) when is_list(Config) ->
     pang = apply_on_ssl_node(NH1, fun () -> net_adm:ping(Node2) end),
 
     [] = apply_on_ssl_node(NH1, fun () -> nodes() end),
-    [] = apply_on_ssl_node(NH2, fun () -> nodes() end),
-
-    stop_ssl_node(NH1),
-    stop_ssl_node(NH2),
-    success(Config).
+    [] = apply_on_ssl_node(NH2, fun () -> nodes() end).
 
 %%--------------------------------------------------------------------
 crl_check_best_effort() ->
@@ -576,22 +535,18 @@ crl_check_best_effort(Config) when is_list(Config) ->
         "server_verify verify_peer server_crl_check best_effort",
     NewConfig =
         [{many_verify_opts, true}, {additional_dist_opts, DistOpts}] ++ Config,
+   gen_dist_test(crl_check_best_effort_test, NewConfig).
 
+crl_check_best_effort_test(NH1, NH2, _Config) ->
     %% We don't have the correct CRL at hand, but since crl_check is
     %% best_effort, we accept it anyway.
-    NH1 = start_ssl_node(NewConfig),
     Node1 = NH1#node_handle.nodename,
-    NH2 = start_ssl_node(NewConfig),
     Node2 = NH2#node_handle.nodename,
 
     pong = apply_on_ssl_node(NH1, fun () -> net_adm:ping(Node2) end),
 
     [Node2] = apply_on_ssl_node(NH1, fun () -> nodes() end),
-    [Node1] = apply_on_ssl_node(NH2, fun () -> nodes() end),
-
-    stop_ssl_node(NH1),
-    stop_ssl_node(NH2),
-    success(Config).
+    [Node1] = apply_on_ssl_node(NH2, fun () -> nodes() end).
 
 %%--------------------------------------------------------------------
 crl_cache_check_pass() ->
@@ -605,20 +560,16 @@ crl_cache_check_pass(Config) when is_list(Config) ->
 	"\"{ssl_dist_SUITE,{\\\"" ++ NodeDir ++ "\\\",[]}}\"",
     NewConfig =
         [{many_verify_opts, true}, {additional_dist_opts, DistOpts}] ++ Config,
+    gen_dist_test(crl_cache_check_pass_test, NewConfig).
 
-    NH1 = start_ssl_node(NewConfig),
+crl_cache_check_pass_test(NH1, NH2, _) ->
     Node1 = NH1#node_handle.nodename,
-    NH2 = start_ssl_node(NewConfig),
     Node2 = NH2#node_handle.nodename,
 
     pong = apply_on_ssl_node(NH1, fun () -> net_adm:ping(Node2) end),
 
     [Node2] = apply_on_ssl_node(NH1, fun () -> nodes() end),
-    [Node1] = apply_on_ssl_node(NH2, fun () -> nodes() end),
-
-    stop_ssl_node(NH1),
-    stop_ssl_node(NH2),
-    success(Config).
+    [Node1] = apply_on_ssl_node(NH2, fun () -> nodes() end).
 
 %%--------------------------------------------------------------------
 crl_cache_check_fail() ->
@@ -636,44 +587,31 @@ crl_cache_check_fail(Config) when is_list(Config) ->
          {server_cert_dir, "revoked"},
          {additional_dist_opts, DistOpts}] ++ Config,
 
-    NH1 = start_ssl_node(NewConfig),
-    NH2 = start_ssl_node(NewConfig),
-    Node2 = NH2#node_handle.nodename,
+    gen_dist_test(crl_cache_check_fail_test, NewConfig).
 
+crl_cache_check_fail_test(NH1, NH2, _) ->
+    Node2 = NH2#node_handle.nodename,
     pang = apply_on_ssl_node(NH1, fun () -> net_adm:ping(Node2) end),
 
     [] = apply_on_ssl_node(NH1, fun () -> nodes() end),
-    [] = apply_on_ssl_node(NH2, fun () -> nodes() end),
-
-    stop_ssl_node(NH1),
-    stop_ssl_node(NH2),
-    success(Config).
-
-%% ssl_crl_cache_api callbacks
-lookup(_DistributionPoint, _DbHandle) ->
-    not_available.
-
-select({rdnSequence, NameParts}, {NodeDir, _}) ->
-    %% Extract the CN from the issuer name...
-    [CN] = [CN ||
-               [#'AttributeTypeAndValue'{
-                   type = ?'id-at-commonName',
-                   value = <<_, _, CN/binary>>}] <- NameParts],
-    %% ...and use that as the directory name to find the CRL.
-    error_logger:info_report([{found_cn, CN}]),
-    CRLFile = filename:join([NodeDir, CN, "crl.pem"]),
-    {ok, PemBin} = file:read_file(CRLFile),
-    PemEntries = public_key:pem_decode(PemBin),
-    CRLs = [ CRL || {'CertificateList', CRL, not_encrypted} 
-                        <- PemEntries],
-    CRLs.
-
-fresh_crl(_DistributionPoint, CRL) ->
-    CRL.
-
+    [] = apply_on_ssl_node(NH2, fun () -> nodes() end).
 %%--------------------------------------------------------------------
 %%% Internal functions -----------------------------------------------
 %%--------------------------------------------------------------------
+gen_dist_test(Test, Config) ->
+    NH1 = start_ssl_node(Config),
+    NH2 = start_ssl_node(Config),
+    try 
+	?MODULE:Test(NH1, NH2, Config)
+    catch
+	_:Reason ->
+	    stop_ssl_node(NH1),
+	    stop_ssl_node(NH2),
+	    ct:fail(Reason)
+    end,
+    stop_ssl_node(NH1),
+    stop_ssl_node(NH2),	
+    success(Config).
 
 %% ssl_node side api
 %%
@@ -1226,3 +1164,53 @@ vsn(App) ->
      after
 	 application:stop(ssl)
      end.
+
+verify_fail_always(_Certificate, _Event, _State) ->
+    %% Create an ETS table, to record the fact that the verify function ran.
+    %% Spawn a new process, to avoid the ETS table disappearing.
+    Parent = self(),
+    spawn(
+      fun() ->
+	      ets:new(verify_fun_ran, [public, named_table]),
+	      ets:insert(verify_fun_ran, {verify_fail_always_ran, true}),
+	      Parent ! go_ahead,
+	      timer:sleep(infinity)
+      end),
+    receive go_ahead -> ok end,
+    {fail, bad_certificate}.
+
+verify_pass_always(_Certificate, _Event, State) ->
+    %% Create an ETS table, to record the fact that the verify function ran.
+    %% Spawn a new process, to avoid the ETS table disappearing.
+    Parent = self(),
+    spawn(
+      fun() ->
+	      ets:new(verify_fun_ran, [public, named_table]),
+	      ets:insert(verify_fun_ran, {verify_pass_always_ran, true}),
+	      Parent ! go_ahead,
+	      timer:sleep(infinity)
+      end),
+    receive go_ahead -> ok end,
+    {valid, State}.
+
+%% ssl_crl_cache_api callbacks
+lookup(_DistributionPoint, _DbHandle) ->
+    not_available.
+
+select({rdnSequence, NameParts}, {NodeDir, _}) ->
+    %% Extract the CN from the issuer name...
+    [CN] = [CN ||
+               [#'AttributeTypeAndValue'{
+                   type = ?'id-at-commonName',
+                   value = <<_, _, CN/binary>>}] <- NameParts],
+    %% ...and use that as the directory name to find the CRL.
+    error_logger:info_report([{found_cn, CN}]),
+    CRLFile = filename:join([NodeDir, CN, "crl.pem"]),
+    {ok, PemBin} = file:read_file(CRLFile),
+    PemEntries = public_key:pem_decode(PemBin),
+    CRLs = [ CRL || {'CertificateList', CRL, not_encrypted} 
+                        <- PemEntries],
+    CRLs.
+
+fresh_crl(_DistributionPoint, CRL) ->
+    CRL.