DER format in API

Added support for inputing certificates and keys directly in DER format
these options will override the pem-file options if specified.

6 files changed, 128 insertions, 43 deletions

diff --git a/lib/ssl/src/ssl.erl b/lib/ssl/src/ssl.erl
index 6e26f05c3d..90bb50fdcb 100644
--- a/lib/ssl/src/ssl.erl
+++ b/lib/ssl/src/ssl.erl
@@ -80,6 +80,7 @@ stop() ->
 -spec connect(host() | port(), list()) -> {ok, #sslsocket{}}.
 -spec connect(host() | port(), list() | port_num(), timeout() | list()) -> {ok, #sslsocket{}}.
 -spec connect(host() | port(), port_num(), list(), timeout()) -> {ok, #sslsocket{}}.      
+
 %%
 %% Description: Connect to a ssl server.
 %%--------------------------------------------------------------------
@@ -375,7 +376,7 @@ cipher_suites(openssl) ->
     [ssl_cipher:openssl_suite_name(S) || S <- ssl_cipher:suites(Version)].
 
 %%--------------------------------------------------------------------
--spec getopts(#sslsocket{}, [atom()]) -> {ok, [{atom(), term()}]}| {error, reason()}.		     
+-spec getopts(#sslsocket{}, [atom()]) -> {ok, [{atom(), term()}]}| {error, reason()}.
 %% 
 %% Description:
 %%--------------------------------------------------------------------
@@ -542,20 +543,22 @@ handle_options(Opts0, Role) ->
 
     UserFailIfNoPeerCert = validate_option(fail_if_no_peer_cert, 
 					   proplists:get_value(fail_if_no_peer_cert, Opts, false)),
+    CaCerts = handle_option(cacerts, Opts, undefined),
 
     {Verify, FailIfNoPeerCert, CaCertDefault} = 
 	%% Handle 0, 1, 2 for backwards compatibility
 	case proplists:get_value(verify, Opts, verify_none) of
 	    0 ->
-		{verify_none, false, ca_cert_default(verify_none, Role)};
+		{verify_none, false, ca_cert_default(verify_none, Role, CaCerts)};
 	    1  ->
-		{verify_peer, false, ca_cert_default(verify_peer, Role)};
+		{verify_peer, false, ca_cert_default(verify_peer, Role, CaCerts)};
 	    2 ->
-		{verify_peer, true,  ca_cert_default(verify_peer, Role)};
+		{verify_peer, true,  ca_cert_default(verify_peer, Role, CaCerts)};
 	    verify_none ->
-		{verify_none, false, ca_cert_default(verify_none, Role)};
+		{verify_none, false, ca_cert_default(verify_none, Role, CaCerts)};
 	    verify_peer ->
-		{verify_peer, UserFailIfNoPeerCert, ca_cert_default(verify_peer, Role)};
+		{verify_peer, UserFailIfNoPeerCert,
+		 ca_cert_default(verify_peer, Role, CaCerts)};
 	    Value ->
 		throw({error, {eoptions, {verify, Value}}})
 	end,   
@@ -570,10 +573,12 @@ handle_options(Opts0, Role) ->
       verify_client_once =  handle_option(verify_client_once, Opts, false),
       validate_extensions_fun = handle_option(validate_extensions_fun, Opts, undefined),
       depth      = handle_option(depth,  Opts, 1),
+      cert       = handle_option(cert, Opts, undefined),
       certfile   = CertFile,
-      keyfile    = handle_option(keyfile,  Opts, CertFile),
       key        = handle_option(key, Opts, undefined),
+      keyfile    = handle_option(keyfile,  Opts, CertFile),
       password   = handle_option(password, Opts, ""),
+      cacerts    = CaCerts,
       cacertfile = handle_option(cacertfile, Opts, CaCertDefault),
       dhfile     = handle_option(dhfile, Opts, undefined),
       ciphers    = handle_option(ciphers, Opts, []),
@@ -588,8 +593,8 @@ handle_options(Opts0, Role) ->
     CbInfo  = proplists:get_value(cb_info, Opts, {gen_tcp, tcp, tcp_closed, tcp_error}),    
     SslOptions = [versions, verify, verify_fun, validate_extensions_fun, 
 		  fail_if_no_peer_cert, verify_client_once,
-		  depth, certfile, keyfile,
-		  key, password, cacertfile, dhfile, ciphers,
+		  depth, cert, certfile, key, keyfile,
+		  password, cacerts, cacertfile, dhfile, ciphers,
 		  debug, reuse_session, reuse_sessions, ssl_imp,
 		  cb_info, renegotiate_at, secure_renegotiate],
     
@@ -627,17 +632,26 @@ validate_option(validate_extensions_fun, Value) when Value == undefined; is_func
 validate_option(depth, Value) when is_integer(Value), 
                                    Value >= 0, Value =< 255->
     Value;
+validate_option(cert, Value) when Value == undefined;
+                                 is_binary(Value) ->
+    Value;
 validate_option(certfile, Value) when is_list(Value) ->
     Value;
+
+validate_option(key, undefined) ->
+    undefined;
+validate_option(key, {KeyType, Value}) when is_binary(Value),
+					    KeyType == rsa;
+					    KeyType == dsa ->
+    {KeyType, Value};
 validate_option(keyfile, Value) when is_list(Value) ->
     Value;
-validate_option(key, Value) when Value == undefined;
-                                 is_tuple(Value) ->
-    %% element(1, Value)=='RSAPrivateKey' ->
-    Value;
 validate_option(password, Value) when is_list(Value) ->
     Value;
 
+validate_option(cacerts, Value) when Value == undefined;
+				     is_list(Value) ->
+    Value;
 %% certfile must be present in some cases otherwhise it can be set
 %% to the empty string.
 validate_option(cacertfile, undefined) ->
@@ -701,14 +715,17 @@ validate_inet_option(active, Value)
 validate_inet_option(_, _) ->
     ok.
 
-ca_cert_default(verify_none, _) ->
+%% The option cacerts overrides cacertsfile
+ca_cert_default(_,_, [_|_]) ->
+    undefined;
+ca_cert_default(verify_none, _, _) ->
     undefined;
 %% Client may leave verification up to the user
-ca_cert_default(verify_peer, client) ->
+ca_cert_default(verify_peer, client,_) ->
     undefined;
 %% Server that wants to verify_peer must have
 %% some trusted certs.
-ca_cert_default(verify_peer, server) ->
+ca_cert_default(verify_peer, server, _) ->
     "".
 
 emulated_options() ->
diff --git a/lib/ssl/src/ssl_certificate_db.erl b/lib/ssl/src/ssl_certificate_db.erl
index 00d3079cb3..86477f369d 100644
--- a/lib/ssl/src/ssl_certificate_db.erl
+++ b/lib/ssl/src/ssl_certificate_db.erl
@@ -74,12 +74,16 @@ lookup_cached_certs(File) ->
     ets:lookup(certificate_db_name(), {file, File}).
 
 %%--------------------------------------------------------------------
--spec add_trusted_certs(pid(), string(), certdb_ref()) -> {ok, certdb_ref()}.			       
+-spec add_trusted_certs(pid(), string() | {der, list()}, certdb_ref()) -> {ok, certdb_ref()}.
 %%
 %% Description: Adds the trusted certificates from file <File> to the
 %% runtime database. Returns Ref that should be handed to lookup_trusted_cert
 %% together with the cert serialnumber and issuer.
 %%--------------------------------------------------------------------
+add_trusted_certs(_Pid, {der, DerList}, [CerDb, _,_]) ->
+    NewRef = make_ref(),
+    add_certs_from_der(DerList, NewRef, CerDb),
+    {ok, NewRef};
 add_trusted_certs(Pid, File, [CertsDb, FileToRefDb, PidToFileDb]) ->
     Ref = case lookup(File, FileToRefDb) of
 	      undefined ->
@@ -93,7 +97,6 @@ add_trusted_certs(Pid, File, [CertsDb, FileToRefDb, PidToFileDb]) ->
 	  end,
     insert(Pid, File, PidToFileDb),
     {ok, Ref}.
-
 %%--------------------------------------------------------------------
 -spec cache_pem_file(pid(), string(), certdb_ref()) -> term().
 %%
@@ -202,16 +205,20 @@ lookup(Key, Db) ->
 remove_certs(Ref, CertsDb) ->
     ets:match_delete(CertsDb, {{Ref, '_', '_'}, '_'}).
 
+add_certs_from_der(DerList, Ref, CertsDb) ->
+    Add = fun(Cert) -> add_certs(Cert, Ref, CertsDb) end,
+     [Add(Cert) || Cert <- DerList].
+
 add_certs_from_file(File, Ref, CertsDb) ->   
-    Add = fun(Cert) ->
-		     ErlCert = public_key:pkix_decode_cert(Cert, otp),
-		     TBSCertificate = ErlCert#'OTPCertificate'.tbsCertificate,
-		     SerialNumber = TBSCertificate#'OTPTBSCertificate'.serialNumber,
-		     Issuer = public_key:pkix_normalize_name(
-				TBSCertificate#'OTPTBSCertificate'.issuer),
-		     insert({Ref, SerialNumber, Issuer}, {Cert,ErlCert}, CertsDb)
-	     end,
+    Add = fun(Cert) -> add_certs(Cert, Ref, CertsDb) end,
     {ok, PemBin} = file:read_file(File),
     PemEntries = public_key:pem_decode(PemBin),
     [Add(Cert) || {'Certificate', Cert, not_encrypted} <- PemEntries].
     
+add_certs(Cert, Ref, CertsDb) ->
+    ErlCert = public_key:pkix_decode_cert(Cert, otp),
+    TBSCertificate = ErlCert#'OTPCertificate'.tbsCertificate,
+    SerialNumber = TBSCertificate#'OTPTBSCertificate'.serialNumber,
+    Issuer = public_key:pkix_normalize_name(
+	       TBSCertificate#'OTPTBSCertificate'.issuer),
+    insert({Ref, SerialNumber, Issuer}, {Cert,ErlCert}, CertsDb).
diff --git a/lib/ssl/src/ssl_connection.erl b/lib/ssl/src/ssl_connection.erl
index dd8f77a0ca..c004effb85 100644
--- a/lib/ssl/src/ssl_connection.erl
+++ b/lib/ssl/src/ssl_connection.erl
@@ -1038,20 +1038,29 @@ ssl_init(SslOpts, Role) ->
     DHParams = init_diffie_hellman(SslOpts#ssl_options.dhfile, Role),
     {ok, CertDbRef, CacheRef, OwnCert, PrivateKey, DHParams}.
 
-init_certificates(#ssl_options{cacertfile = CACertFile,
-			       certfile = CertFile}, Role) ->
+
+init_certificates(#ssl_options{cacerts = CaCerts,
+			       cacertfile = CACertFile,
+			       certfile = CertFile,
+			       cert = Cert}, Role) ->
     {ok, CertDbRef, CacheRef} = 
 	try 
-	    {ok, _, _} = ssl_manager:connection_init(CACertFile, Role)
+	    Certs = case CaCerts of
+			undefined ->
+			    CACertFile;
+			_ ->
+			    {der, CaCerts}
+		    end,
+	    {ok, _, _} = ssl_manager:connection_init(Certs, Role)
 	catch
 	    Error:Reason ->
 		handle_file_error(?LINE, Error, Reason, CACertFile, ecacertfile,
 				  erlang:get_stacktrace())
 	end,
-    init_certificates(CertDbRef, CacheRef, CertFile, Role).
+    init_certificates(Cert, CertDbRef, CacheRef, CertFile, Role).
 
 
-init_certificates(CertDbRef, CacheRef, CertFile, client) -> 
+init_certificates(undefined, CertDbRef, CacheRef, CertFile, client) ->
     try 
 	[OwnCert] = ssl_certificate:file_to_certificats(CertFile),
 	{ok, CertDbRef, CacheRef, OwnCert}
@@ -1059,7 +1068,7 @@ init_certificates(CertDbRef, CacheRef, CertFile, client) ->
 	    {ok, CertDbRef, CacheRef, undefined}
     end;
 
-init_certificates(CertDbRef, CacheRef, CertFile, server) ->
+init_certificates(undefined, CertDbRef, CacheRef, CertFile, server) ->
      try 
 	[OwnCert] = ssl_certificate:file_to_certificats(CertFile),
 	{ok, CertDbRef, CacheRef, OwnCert}
@@ -1067,7 +1076,9 @@ init_certificates(CertDbRef, CacheRef, CertFile, server) ->
 	 Error:Reason ->
 	     handle_file_error(?LINE, Error, Reason, CertFile, ecertfile,
 			       erlang:get_stacktrace())
-     end.
+     end;
+init_certificates(Cert, CertDbRef, CacheRef, _, _) ->
+    {ok, CertDbRef, CacheRef, Cert}.
 
 init_private_key(undefined, "", _Password, client) -> 
     undefined;
@@ -1084,8 +1095,10 @@ init_private_key(undefined, KeyFile, Password, _)  ->
 			      erlang:get_stacktrace()) 
     end;
 
-init_private_key(PrivateKey, _, _,_) ->
-    PrivateKey.
+init_private_key({rsa, PrivateKey}, _, _,_) ->
+    public_key:der_decode('RSAPrivateKey', PrivateKey);
+init_private_key({dsa, PrivateKey},_,_,_) ->
+    public_key:der_decode('DSAPrivateKey', PrivateKey).
 
 handle_file_error(Line, Error, {badmatch, Reason}, File, Throw, Stack) ->
     file_error(Line, Error, Reason, File, Throw, Stack);
diff --git a/lib/ssl/src/ssl_internal.hrl b/lib/ssl/src/ssl_internal.hrl
index 337403531e..3862dc75de 100644
--- a/lib/ssl/src/ssl_internal.hrl
+++ b/lib/ssl/src/ssl_internal.hrl
@@ -63,9 +63,11 @@
 	  validate_extensions_fun, 
 	  depth,      % integer()
 	  certfile,   % file()
+	  cert,       % der_encoded()
 	  keyfile,    % file()
-	  key,	      % 
+	  key,	      % der_encoded()
 	  password,   % 
+	  cacerts,    % [der_encoded()]
 	  cacertfile, % file()
 	  dhfile,     % file()
 	  ciphers,    % 
diff --git a/lib/ssl/src/ssl_manager.erl b/lib/ssl/src/ssl_manager.erl
index 459dcefb79..0116466677 100644
--- a/lib/ssl/src/ssl_manager.erl
+++ b/lib/ssl/src/ssl_manager.erl
@@ -69,12 +69,12 @@ start_link(Opts) ->
     gen_server:start_link({local, ?MODULE}, ?MODULE, [Opts], []).
 
 %%--------------------------------------------------------------------
--spec connection_init(string(), client | server) -> {ok, reference(), cache_ref()}.
+-spec connection_init(string()| {der, list()}, client | server) -> {ok, reference(), cache_ref()}.
 %%			     
 %% Description: Do necessary initializations for a new connection.
 %%--------------------------------------------------------------------
-connection_init(TrustedcertsFile, Role) ->
-    call({connection_init, TrustedcertsFile, Role}).
+connection_init(Trustedcerts, Role) ->
+    call({connection_init, Trustedcerts, Role}).
 %%--------------------------------------------------------------------
 -spec cache_pem_file(string()) -> {ok, term()}.	
 %%		    
@@ -185,13 +185,13 @@ handle_call({{connection_init, "", _Role}, Pid}, _From,
     Result = {ok, make_ref(), Cache},
     {reply, Result, State};
 
-handle_call({{connection_init, TrustedcertsFile, _Role}, Pid}, _From, 
+handle_call({{connection_init, Trustedcerts, _Role}, Pid}, _From,
 	    #state{certificate_db = Db,
 		   session_cache = Cache} = State) ->
     erlang:monitor(process, Pid),
     Result = 
 	try
-	    {ok, Ref} = ssl_certificate_db:add_trusted_certs(Pid, TrustedcertsFile, Db),
+	    {ok, Ref} = ssl_certificate_db:add_trusted_certs(Pid, Trustedcerts, Db),
 	    {ok, Ref, Cache}
 	catch
 	    _:Reason ->
diff --git a/lib/ssl/test/ssl_basic_SUITE.erl b/lib/ssl/test/ssl_basic_SUITE.erl
index d50b34b6ac..1013f2bb6e 100644
--- a/lib/ssl/test/ssl_basic_SUITE.erl
+++ b/lib/ssl/test/ssl_basic_SUITE.erl
@@ -235,7 +235,7 @@ all(suite) ->
      validate_extensions_fun, no_authority_key_identifier,
      invalid_signature_client, invalid_signature_server, cert_expired,
      client_with_cert_cipher_suites_handshake, unknown_server_ca_fail,
-     unknown_server_ca_accept
+     unknown_server_ca_accept, der_input
     ].
 
 %% Test cases starts here.
@@ -2749,7 +2749,7 @@ invalid_signature_client(Config) when is_list(Config) ->
     tcp_delivery_workaround(Server, {error, "bad certificate"},
 			    Client, {error,"bad certificate"}).
 
-tcp_delivery_workaround(Server, ServMsg, Client, ClientMsg) ->
+tcp_delivery_workaround(Server, ServerMsg, Client, ClientMsg) ->
     receive 
 	{Server, ServerMsg} ->
 	    receive 
@@ -2939,6 +2939,52 @@ unknown_server_ca_accept(Config) when is_list(Config) ->
     ssl_test_lib:close(Client).
 
 %%--------------------------------------------------------------------
+der_input(doc) ->
+    ["Test to input certs and key as der"];
+
+der_input(suite) ->
+    [];
+
+der_input(Config) when is_list(Config) ->
+
+    SeverVerifyOpts = ?config(server_verification_opts, Config),
+    {ServerCert, ServerKey, ServerCaCerts} = der_input_opts(SeverVerifyOpts),
+    ClientVerifyOpts = ?config(client_verification_opts, Config),
+    {ClientCert, ClientKey, ClientCaCerts} = der_input_opts(ClientVerifyOpts),
+    ServerOpts = [{verify, verify_peer}, {fail_if_no_peer_cert, true},
+		  {cert, ServerCert}, {key, ServerKey}, {cacerts, ServerCaCerts}],
+    ClientOpts = [{verify, verify_peer}, {fail_if_no_peer_cert, true},
+		  {cert, ClientCert}, {key, ClientKey}, {cacerts, ClientCaCerts}],
+    {ClientNode, ServerNode, Hostname} = ssl_test_lib:run_where(Config),
+    Server = ssl_test_lib:start_server([{node, ServerNode}, {port, 0},
+					{from, self()},
+					{mfa, {?MODULE, send_recv_result, []}},
+					{options, [{active, false} | ServerOpts]}]),
+    Port = ssl_test_lib:inet_port(Server),
+    Client = ssl_test_lib:start_client([{node, ClientNode}, {port, Port},
+					{host, Hostname},
+					{from, self()},
+					{mfa, {?MODULE, send_recv_result, []}},
+					{options, [{active, false} | ClientOpts]}]),
+
+    ssl_test_lib:check_result(Server, ok, Client, ok),
+    ssl_test_lib:close(Server),
+    ssl_test_lib:close(Client).
+
+der_input_opts(Opts) ->
+    Certfile = proplists:get_value(certfile, Opts),
+    CaCertsfile = proplists:get_value(cacertfile, Opts),
+    Keyfile = proplists:get_value(keyfile, Opts),
+    [{_, Cert, _}] = ssl_test_lib:pem_to_der(Certfile),
+    [{_, Key, _}]  = ssl_test_lib:pem_to_der(Keyfile),
+    CaCerts =
+	lists:map(fun(Entry) ->
+			  {_, CaCert, _} = Entry,
+			  CaCert
+		  end, ssl_test_lib:pem_to_der(CaCertsfile)),
+    {Cert, {rsa, Key}, CaCerts}.
+
+%%--------------------------------------------------------------------
 %%% Internal functions
 %%--------------------------------------------------------------------
 send_recv_result(Socket) ->