Merge pull request #6491 from IngelaAndin/ingela/public_key/ldap-vs-http-uri/GH-6363/OTP-18333

public_key: Disregard unexpected URI

Author: IngelaAndin

lib/public_key/src/pubkey_cert.erl

@@ -1027,6 +1027,8 @@ is_permitted_ip([CandidatIp | CandidatIpRest],
 mask_cmp(Canditate, Permitted, Mask) ->
     (Canditate band Mask) == Permitted.
 
+is_valid_host_or_domain([], _) ->
+    false; %% Can happen if URI was not a HTTP URI
 is_valid_host_or_domain(Canditate, [$.|_] = Permitted) ->
     is_suffix(Permitted, Canditate);
 is_valid_host_or_domain(Canditate, Permitted) ->

lib/public_key/test/public_key_SUITE.erl

@@ -97,6 +97,8 @@
          pkix_verify_hostname_subjAltName/1,
          pkix_verify_hostname_options/1,
          pkix_verify_hostname_subjAltName_IP/1,
+         pkix_dist_point_uri/0,
+         pkix_dist_point_uri/1,
          pkix_iso_rsa_oid/0,
          pkix_iso_rsa_oid/1,
          pkix_iso_dsa_oid/0,
@@ -159,6 +161,7 @@ all() ->
      pkix_verify_hostname_subjAltName,
      pkix_verify_hostname_subjAltName_IP,
      pkix_verify_hostname_options,
+     pkix_dist_point_uri,
      pkix_test_data_all_default,
      pkix_test_data,
      short_cert_issuer_hash, 
@@ -1080,7 +1083,27 @@ pkix_verify_hostname_subjAltName_IP(Config) ->
     true  =  public_key:pkix_verify_hostname(Cert, [{ip, {10,67,16,75}}]),
     false =  public_key:pkix_verify_hostname(Cert, [{ip, {1,2,3,4}}]),
     false =  public_key:pkix_verify_hostname(Cert, [{ip, {10,11,12,13}}]).
+
+
+%%--------------------------------------------------------------------
+
+pkix_dist_point_uri() ->
+ [{doc, "Disregard ldap URIs in code path handling HTTP URIs"}].
+pkix_dist_point_uri(Config) when is_list(Config) ->
+    Datadir = proplists:get_value(data_dir, Config),
+    {ok, PemCert} = file:read_file(filename:join(Datadir, "ldap_uri_cert.pem")),
+    [{_, Cert, _}] = public_key:pem_decode(PemCert),
+    #'OTPCertificate'{tbsCertificate = TBSCert} = public_key:pkix_decode_cert(Cert, otp),
+
+    Extensions = pubkey_cert:extensions_list(TBSCert#'OTPTBSCertificate'.extensions),
+    DpExt = pubkey_cert:select_extension(?'id-ce-cRLDistributionPoints', Extensions),
+    #'Extension'{extnValue = DPs} = DpExt,
+    [#'DistributionPoint'{distributionPoint = {fullName, DPNames}}|_] = DPs,
+    ct:pal("~p", [DPNames]),
+    true = pubkey_crl:match_one(DPNames, [{uniformResourceIdentifier, "http://ca.eait.uq.edu.au/crl/labs-LILY-CA"}]).
+
 %%--------------------------------------------------------------------
+
 pkix_iso_rsa_oid() ->
  [{doc, "Test workaround for supporting certs that use ISO oids"
    " 1.3.14.3.2.29 instead of PKIX/PKCS oid"}].
@@ -1499,7 +1522,8 @@ crypto_supported_curve(Curve, _Curves) ->
     catch
         _:_-> false
     end.
-        
+
+
 incorrect_countryname_pkix_cert() ->
     <<48,130,5,186,48,130,4,162,160,3,2,1,2,2,7,7,250,61,63,6,140,137,48,13,6,9,42, 134,72,134,247,13,1,1,5,5,0,48,129,220,49,11,48,9,6,3,85,4,6,19,2,85,83,49, 16,48,14,6,3,85,4,8,19,7,65,114,105,122,111,110,97,49,19,48,17,6,3,85,4,7,19, 10,83,99,111,116,116,115,100,97,108,101,49,37,48,35,6,3,85,4,10,19,28,83,116, 97,114,102,105,101,108,100,32,84,101,99,104,110,111,108,111,103,105,101,115, 44,32,73,110,99,46,49,57,48,55,6,3,85,4,11,19,48,104,116,116,112,58,47,47,99, 101,114,116,105,102,105,99,97,116,101,115,46,115,116,97,114,102,105,101,108, 100,116,101,99,104,46,99,111,109,47,114,101,112,111,115,105,116,111,114,121, 49,49,48,47,6,3,85,4,3,19,40,83,116,97,114,102,105,101,108,100,32,83,101,99, 117,114,101,32,67,101,114,116,105,102,105,99,97,116,105,111,110,32,65,117, 116,104,111,114,105,116,121,49,17,48,15,6,3,85,4,5,19,8,49,48,54,56,56,52,51, 53,48,30,23,13,49,48,49,48,50,51,48,49,51,50,48,53,90,23,13,49,50,49,48,50, 51,48,49,51,50,48,53,90,48,122,49,11,48,9,6,3,85,4,6,12,2,85,83,49,11,48,9,6, 3,85,4,8,12,2,65,90,49,19,48,17,6,3,85,4,7,12,10,83,99,111,116,116,115,100, 97,108,101,49,38,48,36,6,3,85,4,10,12,29,83,112,101,99,105,97,108,32,68,111, 109,97,105,110,32,83,101,114,118,105,99,101,115,44,32,73,110,99,46,49,33,48, 31,6,3,85,4,3,12,24,42,46,108,111,103,105,110,46,115,101,99,117,114,101,115, 101,114,118,101,114,46,110,101,116,48,130,1,34,48,13,6,9,42,134,72,134,247, 13,1,1,1,5,0,3,130,1,15,0,48,130,1,10,2,130,1,1,0,185,136,240,80,141,36,124, 245,182,130,73,19,188,74,166,117,72,228,185,209,43,129,244,40,44,193,231,11, 209,12,234,88,43,142,1,162,48,122,17,95,230,105,171,131,12,147,46,204,36,80, 250,171,33,253,35,62,83,22,71,212,186,141,14,198,89,89,121,204,224,122,246, 127,110,188,229,162,67,95,6,74,231,127,99,131,7,240,85,102,203,251,50,58,58, 104,245,103,181,183,134,32,203,121,232,54,32,188,139,136,112,166,126,14,91, 223,153,172,164,14,61,38,163,208,215,186,210,136,213,143,70,147,173,109,217, 250,169,108,31,211,104,238,103,93,182,59,165,43,196,189,218,241,30,148,240, 109,90,69,176,194,52,116,173,151,135,239,10,209,179,129,192,102,75,11,25,168, 223,32,174,84,223,134,70,167,55,172,143,27,130,123,226,226,7,34,142,166,39, 48,246,96,231,150,84,220,106,133,193,55,95,159,227,24,249,64,36,1,142,171,16, 202,55,126,7,156,15,194,22,116,53,113,174,104,239,203,120,45,131,57,87,84, 163,184,27,83,57,199,91,200,34,43,98,61,180,144,76,65,170,177,2,3,1,0,1,163, 130,1,224,48,130,1,220,48,15,6,3,85,29,19,1,1,255,4,5,48,3,1,1,0,48,29,6,3, 85,29,37,4,22,48,20,6,8,43,6,1,5,5,7,3,1,6,8,43,6,1,5,5,7,3,2,48,14,6,3,85, 29,15,1,1,255,4,4,3,2,5,160,48,56,6,3,85,29,31,4,49,48,47,48,45,160,43,160, 41,134,39,104,116,116,112,58,47,47,99,114,108,46,115,116,97,114,102,105,101, 108,100,116,101,99,104,46,99,111,109,47,115,102,115,50,45,48,46,99,114,108, 48,83,6,3,85,29,32,4,76,48,74,48,72,6,11,96,134,72,1,134,253,110,1,7,23,2,48, 57,48,55,6,8,43,6,1,5,5,7,2,1,22,43,104,116,116,112,115,58,47,47,99,101,114, 116,115,46,115,116,97,114,102,105,101,108,100,116,101,99,104,46,99,111,109, 47,114,101,112,111,115,105,116,111,114,121,47,48,129,141,6,8,43,6,1,5,5,7,1, 1,4,129,128,48,126,48,42,6,8,43,6,1,5,5,7,48,1,134,30,104,116,116,112,58,47, 47,111,99,115,112,46,115,116,97,114,102,105,101,108,100,116,101,99,104,46,99, 111,109,47,48,80,6,8,43,6,1,5,5,7,48,2,134,68,104,116,116,112,58,47,47,99, 101,114,116,105,102,105,99,97,116,101,115,46,115,116,97,114,102,105,101,108, 100,116,101,99,104,46,99,111,109,47,114,101,112,111,115,105,116,111,114,121, 47,115,102,95,105,110,116,101,114,109,101,100,105,97,116,101,46,99,114,116, 48,31,6,3,85,29,35,4,24,48,22,128,20,73,75,82,39,209,27,188,242,161,33,106, 98,123,81,66,122,138,215,213,86,48,59,6,3,85,29,17,4,52,48,50,130,24,42,46, 108,111,103,105,110,46,115,101,99,117,114,101,115,101,114,118,101,114,46,110, 101,116,130,22,108,111,103,105,110,46,115,101,99,117,114,101,115,101,114,118, 101,114,46,110,101,116,48,29,6,3,85,29,14,4,22,4,20,138,233,191,208,157,203, 249,85,242,239,20,195,48,10,148,49,144,101,255,116,48,13,6,9,42,134,72,134, 247,13,1,1,5,5,0,3,130,1,1,0,82,31,121,162,49,50,143,26,167,202,143,61,71, 189,201,199,57,81,122,116,90,192,88,24,102,194,174,48,157,74,27,87,210,223, 253,93,3,91,150,109,120,1,110,27,11,200,198,141,222,246,14,200,71,105,41,138, 13,114,122,106,63,17,197,181,234,121,61,89,74,65,41,231,248,219,129,83,176, 219,55,107,55,211,112,98,38,49,69,77,96,221,108,123,152,12,210,159,157,141, 43,226,55,187,129,3,82,49,136,66,81,196,91,234,196,10,82,48,6,80,163,83,71, 127,102,177,93,209,129,26,104,2,84,24,255,248,161,3,244,169,234,92,122,110, 43,4,17,113,185,235,108,219,210,236,132,216,177,227,17,169,58,162,159,182, 162,93,160,229,200,9,163,229,110,121,240,168,232,14,91,214,188,196,109,210, 164,222,0,109,139,132,113,91,16,118,173,178,176,80,132,34,41,199,51,206,250, 224,132,60,115,192,94,107,163,219,212,226,225,65,169,148,108,213,46,174,173, 103,110,189,229,166,149,254,31,51,44,144,108,187,182,11,251,201,206,86,138, 208,59,51,86,132,235,81,225,88,34,190,8,184>>.
 
@@ -1543,7 +1567,7 @@ hardcode_rsa_key(3) ->
        exponent2 = 137572620950115585809189662580789132500998007785886619351549079675566218169991569609420548245479957900898715184664311515467504676010484619686391036071176762179044243478326713135456833024206699951987873470661533079532774988581535389682358631768109586527575902839864474036157372334443583670210960715165278974609,
        coefficient = 15068630434698373319269196003209754243798959461311186548759287649485250508074064775263867418602372588394608558985183294561315208336731894947137343239541687540387209051236354318837334154993136528453613256169847839789803932725339395739618592522865156272771578671216082079933457043120923342632744996962853951612,
        otherPrimeInfos = asn1_NOVALUE};
-hardcode_rsa_key(4) -> 
+hardcode_rsa_key(4) ->
     #'RSAPrivateKey'{
        version ='two-prime',
        modulus = 28617237755030755643854803617273584643843067580642149032833640135949799721163782522787597288521902619948688786051081993247908700824196122780349730169173433743054172191054872553484065655968335396052034378669869864779940355219732200954630251223541048434478476115391643898092650304645086338265930608997389611376417609043761464100338332976874588396803891301015812818307951159858145399281035705713082131199940309445719678087542976246147777388465712394062188801177717719764254900022006288880246925156931391594131839991579403409541227225173269459173129377291869028712271737734702830877034334838181789916127814298794576266389,
@@ -1564,4 +1588,3 @@ pss_params(sha256) ->
                                              },
        saltLength = 32,
        trailerField = 1}.
-   

lib/public_key/test/public_key_SUITE_data/ldap_uri_cert.pem

@@ -0,0 +1,35 @@
+-----BEGIN CERTIFICATE-----
+MIIGIjCCBQqgAwIBAgITWwAAByiISJBWTJahTQAAAAAHKDANBgkqhkiG9w0BAQsF
+ADCBgDESMBAGCgmSJomT8ixkARkWAmF1MRMwEQYKCZImiZPyLGQBGRYDZWR1MRIw
+EAYKCZImiZPyLGQBGRYCdXExFDASBgoJkiaJk/IsZAEZFgRlYWl0MRQwEgYKCZIm
+iZPyLGQBGRYEbGFiczEVMBMGA1UEAwwMbGFicy1MSUxZLUNBMB4XDTIyMTAxMjIz
+MjgwNVoXDTIyMTEwOTIzMjgwNVowKTEnMCUGA1UEAxMeZ3M0MzItODEyNS5sYWJz
+LmVhaXQudXEuZWR1LmF1MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA
+wuWgx3RlNrtapvbXc5RBroyCbXGu1Zefmq70PUiHrxHQIhmExjN4sdBd7Q5biKY4
+lr++4I49Z8FbOLw+MypmK0SG6BqYtrL+1Y/GMqAmeox6RbWVkIfLTJHqxdvmTjEX
+Kr9KbL7/5JOMSyDLv9ygqE5GS3IAjaDvwP6BeU3yJDkeSPotiCK2Pxm0Owo9g0a7
+C4UACCn2wzdo5g1xIeWoSejNC2ZMec8Ug1NWiuUq7FVw5+UzUkf4mqajndO6xJVi
+EGOaW59197iqj/vz3Rl58Gr7pKQHyE3TtZI8Jt+PrRuUD68JEnpR7ZX3HEERnczD
+2fejPM0v4AX725vuwCtkPQIDAQABo4IC6TCCAuUwHQYJKwYBBAGCNxQCBBAeDgBN
+AGEAYwBoAGkAbgBlMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDATAOBgNV
+HQ8BAf8EBAMCBaAwHQYDVR0OBBYEFNh+7KXQHE7Sxaze06Wna9IHRWIWMB8GA1Ud
+IwQYMBaAFOoq6NmbC3CwMRapHGF6uqpJiKzvMIIBAwYDVR0fBIH7MIH4MIH1oIHy
+oIHvhoHBbGRhcDovLy9DTj1sYWJzLUxJTFktQ0EsQ049bGlseSxDTj1DRFAsQ049
+UHVibGljJTIwS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29uZmlndXJh
+dGlvbixEQz1sYWJzLERDPWVhaXQsREM9dXEsREM9ZWR1LERDPWF1P2NlcnRpZmlj
+YXRlUmV2b2NhdGlvbkxpc3Q/YmFzZT9vYmplY3RDbGFzcz1jUkxEaXN0cmlidXRp
+b25Qb2ludIYpaHR0cDovL2NhLmVhaXQudXEuZWR1LmF1L2NybC9sYWJzLUxJTFkt
+Q0Ewgc8GCCsGAQUFBwEBBIHCMIG/MIG8BggrBgEFBQcwAoaBr2xkYXA6Ly8vQ049
+bGFicy1MSUxZLUNBLENOPUFJQSxDTj1QdWJsaWMlMjBLZXklMjBTZXJ2aWNlcyxD
+Tj1TZXJ2aWNlcyxDTj1Db25maWd1cmF0aW9uLERDPWxhYnMsREM9ZWFpdCxEQz11
+cSxEQz1lZHUsREM9YXU/Y0FDZXJ0aWZpY2F0ZT9iYXNlP29iamVjdENsYXNzPWNl
+cnRpZmljYXRpb25BdXRob3JpdHkwKQYDVR0RBCIwIIIeZ3M0MzItODEyNS5sYWJz
+LmVhaXQudXEuZWR1LmF1MFEGCSsGAQQBgjcZAgREMEKgQAYKKwYBBAGCNxkCAaAy
+BDBTLTEtNS0yMS0xOTc2MTAwMzA2LTE3MzE1MDIwOTctMzk0MjQwMTc2Ni0xMjMy
+MDcwDQYJKoZIhvcNAQELBQADggEBAMDVF3QK4Tgz2cu+UNbEnIQVDK9mx07kNDMO
+X0SUD8SNEP5LWhpLZoltInJ0s3ID8T7Rjf0bFw+eykp4/prVqENuDNj6lYxY/2ho
+WgJ7FKSqCNvkFzR2Bln20p6HFq8Jgz1R3uO3bVZ0RGUebUoT3PvF5t0d+xUg1Es9
+kYNxTRvNsFDvwpHg583R3bgO6Bqsi6ohTEW0/Xc3+d99dA+1F8So3DgXFnrb1wyT
+/D+xxIqq/BTAO771oxiujzlBYUewkjf2+JMQTc/mCJHHwCZxC4kgxqS9T2vuk2Hv
+CBsqnxGzixobGISmglAKAJvfckzWcF4iYwGPK9sSBkXSIAT5OOU=
+-----END CERTIFICATE-----