From 911ab85688b21832c13d686d44c6b9064e9604a5 Mon Sep 17 00:00:00 2001
From: Fred Hebert <mononcqc@ferd.ca>
Date: Mon, 22 Aug 2016 09:57:57 -0400
Subject: Fixing CRL searching in cache bypass

---
 lib/ssl/src/ssl_crl.erl | 28 ++++++++++++++++++++--------
 1 file changed, 20 insertions(+), 8 deletions(-)

(limited to 'lib/ssl/src/ssl_crl.erl')

diff --git a/lib/ssl/src/ssl_crl.erl b/lib/ssl/src/ssl_crl.erl
index d9f21e04ac..01be1fb9ab 100644
--- a/lib/ssl/src/ssl_crl.erl
+++ b/lib/ssl/src/ssl_crl.erl
@@ -47,7 +47,7 @@ trusted_cert_and_path(CRL, issuer_not_found, {Db, DbRef} = DbHandle) ->
 	    {ok, unknown_crl_ca, []}
     end.
 
-find_issuer(CRL, {Db,_}) ->
+find_issuer(CRL, {Db,DbRef}) ->
     Issuer = public_key:pkix_normalize_name(public_key:pkix_crl_issuer(CRL)),
     IsIssuerFun =
 	fun({_Key, {_Der,ErlCertCandidate}}, Acc) ->
@@ -55,15 +55,27 @@ find_issuer(CRL, {Db,_}) ->
 	   (_, Acc) ->
 		Acc
 	end,
-    
-    try ssl_pkix_db:foldl(IsIssuerFun, issuer_not_found, Db) of
-	issuer_not_found ->
-	    {error, issuer_not_found}
-    catch 
-	{ok, _} = Result ->
-	    Result
+    if is_reference(DbRef) -> % actual DB exists
+	try ssl_pkix_db:foldl(IsIssuerFun, issuer_not_found, Db) of
+	    issuer_not_found ->
+		{error, issuer_not_found}
+	catch
+	    {ok, _} = Result ->
+		Result
+	end;
+       is_tuple(DbRef), element(1,DbRef) =:= extracted -> % cache bypass byproduct
+	{extracted, CertsData} = DbRef,
+	Certs = [Entry || {decoded, Entry} <- CertsData],
+	try lists:foldl(IsIssuerFun, issuer_not_found, Certs) of
+	    issuer_not_found ->
+		{error, issuer_not_found}
+	catch
+	    {ok, _} = Result ->
+		Result
+	end
     end.
 
+
 verify_crl_issuer(CRL, ErlCertCandidate, Issuer, NotIssuer) ->
     TBSCert =  ErlCertCandidate#'OTPCertificate'.tbsCertificate,
     case public_key:pkix_normalize_name(TBSCert#'OTPTBSCertificate'.subject) of
-- 
cgit v1.2.3