Merge branch 'raimo/better-TLS-distribution/OTP-14969'

* raimo/better-TLS-distribution/OTP-14969:
  Fix distro CRL test cases short vs long names
  Allow check for node name
  Move check ip to before SSL handshake
  Check client IP from server
  Parse cert primarily for host names
  Open for host and node allow list
  Create plug-in for distro cert nodes
  Rewrite TLS dist to handle node names in certs
  Improve node allowed check

3 files changed, 85 insertions, 26 deletions

diff --git a/lib/ssl/test/make_certs.erl b/lib/ssl/test/make_certs.erl
index ecbacc1590..8fe7c54549 100644
--- a/lib/ssl/test/make_certs.erl
+++ b/lib/ssl/test/make_certs.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %% 
-%% Copyright Ericsson AB 2007-2017. All Rights Reserved.
+%% Copyright Ericsson AB 2007-2018. All Rights Reserved.
 %% 
 %% Licensed under the Apache License, Version 2.0 (the "License");
 %% you may not use this file except in compliance with the License.
@@ -19,7 +19,7 @@
 %%
 
 -module(make_certs).
--compile([export_all]).
+-compile([export_all, nowarn_export_all]).
 
 %-export([all/1, all/2, rootCA/2, intermediateCA/3, endusers/3, enduser/3, revoke/3, gencrl/2, verify/3]).
 
@@ -34,14 +34,15 @@
 	     ecc_certs = false,
 	     issuing_distribution_point = false,
 	     crl_port = 8000,
-	     openssl_cmd = "openssl"}).
+             openssl_cmd = "openssl",
+             hostname = "host.example.com"}).
 
 
 default_config() ->
-    #config{}.
+    #config{hostname = net_adm:localhost()}.
 
 make_config(Args) ->
-    make_config(Args, #config{}).
+    make_config(Args, default_config()).
 
 make_config([], C) ->
     C;
@@ -66,7 +67,9 @@ make_config([{ecc_certs, Bool}|T], C) when is_boolean(Bool) ->
 make_config([{issuing_distribution_point, Bool}|T], C) when is_boolean(Bool) ->
     make_config(T, C#config{issuing_distribution_point = Bool});
 make_config([{openssl_cmd, Cmd}|T], C) when is_list(Cmd) ->
-    make_config(T, C#config{openssl_cmd = Cmd}).
+    make_config(T, C#config{openssl_cmd = Cmd});
+make_config([{hostname, Hostname}|T], C) when is_list(Hostname) ->
+    make_config(T, C#config{hostname = Hostname}).
 
 
 all([DataDir, PrivDir]) ->
@@ -384,8 +387,11 @@ req_cnf(Root, C) ->
      "subjectKeyIdentifier = hash\n"
      "subjectAltName	= email:copy\n"].
 
-ca_cnf(Root, C = #config{issuing_distribution_point = true}) ->
-    Hostname = net_adm:localhost(),		    
+ca_cnf(
+  Root,
+  #config{
+     issuing_distribution_point = true,
+     hostname = Hostname} = C) ->
     ["# Purpose: Configuration for CAs.\n"
      "\n"
      "ROOTDIR	       = " ++ Root ++ "\n"
@@ -464,8 +470,12 @@ ca_cnf(Root, C = #config{issuing_distribution_point = true}) ->
      "crlDistributionPoints=@crl_section\n"
     ];
 
-ca_cnf(Root, C = #config{issuing_distribution_point = false}) ->
-  Hostname = net_adm:localhost(),	     
+ca_cnf(
+  Root,
+  #config{
+     issuing_distribution_point = false,
+     hostname = Hostname
+    } = C) ->
     ["# Purpose: Configuration for CAs.\n"
      "\n"
      "ROOTDIR	          = " ++ Root ++ "\n"
diff --git a/lib/ssl/test/ssl_dist_SUITE.erl b/lib/ssl/test/ssl_dist_SUITE.erl
index c822a52d1f..003e1fc448 100644
--- a/lib/ssl/test/ssl_dist_SUITE.erl
+++ b/lib/ssl/test/ssl_dist_SUITE.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2007-2017. All Rights Reserved.
+%% Copyright Ericsson AB 2007-2018. All Rights Reserved.
 %%
 %% Licensed under the Apache License, Version 2.0 (the "License");
 %% you may not use this file except in compliance with the License.
@@ -25,7 +25,7 @@
 -include("ssl_dist_test_lib.hrl").
 
 %% Note: This directive should only be used in test suites.
--compile(export_all).
+-compile([export_all, nowarn_export_all]).
 
 -define(DEFAULT_TIMETRAP_SECS, 240).
 
@@ -724,7 +724,8 @@ setup_certs(Config) ->
     ok = file:make_dir(NodeDir),
     ok = file:make_dir(RGenDir),
     make_randfile(RGenDir),
-    {ok, _} = make_certs:all(RGenDir, NodeDir),
+    [Hostname|_] = string:split(net_adm:localhost(), ".", all),
+    {ok, _} = make_certs:all(RGenDir, NodeDir, [{hostname,Hostname}]),
     SDir = filename:join([NodeDir, "server"]),
     SC = filename:join([SDir, "cert.pem"]),
     SK = filename:join([SDir, "key.pem"]),
diff --git a/lib/ssl/test/ssl_dist_bench_SUITE.erl b/lib/ssl/test/ssl_dist_bench_SUITE.erl
index 4d27564319..f827ea12bb 100644
--- a/lib/ssl/test/ssl_dist_bench_SUITE.erl
+++ b/lib/ssl/test/ssl_dist_bench_SUITE.erl
@@ -1,7 +1,7 @@
 %%%-------------------------------------------------------------------
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2017. All Rights Reserved.
+%% Copyright Ericsson AB 2017-2018. All Rights Reserved.
 %%
 %% Licensed under the Apache License, Version 2.0 (the "License");
 %% you may not use this file except in compliance with the License.
@@ -77,6 +77,7 @@ init_per_suite(Config) ->
     try
         Node =/= nonode@nohost orelse
             throw({skipped,"Node not distributed"}),
+        verify_node_src_addr(),
         {supported, SSLVersions} =
             lists:keyfind(supported, 1, ssl:versions()),
         lists:member(TLSVersion, SSLVersions) orelse
@@ -95,14 +96,14 @@ init_per_suite(Config) ->
         _ ->
             PrivDir = proplists:get_value(priv_dir, Config),
             %%
-            [_, HostA] = string:split(atom_to_list(Node), "@"),
+            [_, HostA] = split_node(Node),
             NodeAName = ?MODULE_STRING ++ "_node_a",
             NodeAString = NodeAName ++ "@" ++ HostA,
             NodeAConfFile = filename:join(PrivDir, NodeAString ++ ".conf"),
             NodeA = list_to_atom(NodeAString),
             %%
             ServerNode = ssl_bench_test_lib:setup(dist_server),
-            [_, HostB] = string:split(atom_to_list(ServerNode), "@"),
+            [_, HostB] = split_node(ServerNode),
             NodeBName = ?MODULE_STRING ++ "_node_b",
             NodeBString = NodeBName ++ "@" ++ HostB,
             NodeBConfFile = filename:join(PrivDir, NodeBString ++ ".conf"),
@@ -116,16 +117,25 @@ init_per_suite(Config) ->
                   ?MODULE_STRING ++ " ROOT CA", CertOptions),
             SSLConf =
                 [{verify, verify_peer},
+                 {fail_if_no_peer_cert, true},
                  {versions, [TLSVersion]},
                  {ciphers, [TLSCipher]}],
+            ServerConf =
+                [{verify_fun,
+                  {fun inet_tls_dist:verify_client/3,
+                   fun inet_tls_dist:cert_nodes/1}}
+                 | SSLConf],
+            ClientConf =
+                [{verify_fun,
+                  {fun inet_tls_dist:verify_server/3,
+                   fun inet_tls_dist:cert_nodes/1}}
+                 | SSLConf],
             %%
             write_node_conf(
-              NodeAConfFile, NodeA,
-              [{fail_if_no_peer_cert, true} | SSLConf], SSLConf,
+              NodeAConfFile, NodeA, ServerConf, ClientConf,
               CertOptions, RootCert),
             write_node_conf(
-              NodeBConfFile, NodeB,
-              [{fail_if_no_peer_cert, true} | SSLConf], SSLConf,
+              NodeBConfFile, NodeB, ServerConf, ClientConf,
               CertOptions, RootCert),
             %%
             [{node_a_name, NodeAName},
@@ -170,17 +180,53 @@ end_per_testcase(_Func, _Conf) ->
 %%%-------------------------------------------------------------------
 %%% CommonTest API helpers
 
+verify_node_src_addr() ->
+    Msg = "Hello, world!",
+    {ok,Host} = inet:gethostname(),
+    {ok,DstAddr} = inet:getaddr(Host, inet),
+    {ok,Socket} = gen_udp:open(0, [{active,false}]),
+    {ok,Port} = inet:port(Socket),
+    ok = gen_udp:send(Socket, DstAddr, Port, Msg),
+    case gen_udp:recv(Socket, length(Msg) + 1, 1000) of
+        {ok,{DstAddr,Port,Msg}} ->
+            ok;
+        {ok,{SrcAddr,Port,Msg}} ->
+            throw({skipped,
+                   "Src and dst address mismatch: " ++
+                       term_to_string(SrcAddr) ++ " =:= " ++
+                       term_to_string(DstAddr)});
+        Weird ->
+            error(Weird)
+    end.
+
 write_node_conf(
   ConfFile, Node, ServerConf, ClientConf, CertOptions, RootCert) ->
+    [Name,Host] = split_node(Node),
     Conf =
         public_key:pkix_test_data(
           #{root => RootCert,
             peer =>
                 [{extensions,
-                  [#'Extension'{
+                  [
+                   #'Extension'{
+                      extnID = ?'id-ce-subjectAltName',
+                      extnValue = [{dNSName, Host}],
+                      critical = true},
+                   #'Extension'{
                       extnID = ?'id-ce-subjectAltName',
-                      extnValue = [{dNSName, atom_to_list(Node)}],
-                      critical = false}]} | CertOptions]}),
+                      extnValue =
+                          [{directoryName,
+                            {rdnSequence,
+                             [[#'AttributeTypeAndValue'{
+                                  type = ?'id-at-commonName',
+                                  value =
+                                      {utf8String,
+                                       unicode:characters_to_binary(
+                                         Name, utf8)
+                                      }
+                                 }]]}}],
+                      critical = true}
+                  ]} | CertOptions]}),
     NodeConf =
         [{server, ServerConf ++ Conf}, {client, ClientConf ++ Conf}],
     {ok, Fd} = file:open(ConfFile, [write]),
@@ -188,6 +234,8 @@ write_node_conf(
     io:format(Fd, "~p.~n", [NodeConf]),
     ok = file:close(Fd).
 
+split_node(Node) ->
+    string:split(atom_to_list(Node), "@").
 
 %%%-------------------------------------------------------------------
 %%% Test cases
@@ -199,7 +247,7 @@ setup(Config) ->
     run_nodepair_test(fun setup/5, Config).
 
 setup(A, B, Prefix, HA, HB) ->
-    Rounds = 10,
+    Rounds = 50,
     [] = ssl_apply(HA, erlang, nodes, []),
     [] = ssl_apply(HB, erlang, nodes, []),
     {SetupTime, CycleTime} =
@@ -221,9 +269,9 @@ setup_loop(_A, _B, T, 0) ->
     T;
 setup_loop(A, B, T, N) ->
     StartTime = start_time(),
-    [A] = rpc:block_call(B, erlang, nodes, []),
+    [N,A] = [N|rpc:block_call(B, erlang, nodes, [])],
     Time = elapsed_time(StartTime),
-    [B] = erlang:nodes(),
+    [N,B] = [N|erlang:nodes()],
     Mref = erlang:monitor(process, {rex,B}),
     true = net_kernel:disconnect(B),
     receive