public_key: Move decode of CRLDistributionPoints extension #6883
Conversation
As different solutions of verifying certificate revocation exists move the decode of 'CRLDistributionPoints' so that it will only be decode when it is actually used in the verification process. This would enable interoperability with systems that use certificates with an invalid empty CRLDistributionPoints extension that they want to ignore and make verification by other means. Closes erlang#6402
CT Test Results 2 files 15 suites 5m 1s ⏱️ Results for commit a893290. ♻️ This comment has been updated with latest results. To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass. See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally. Artifacts// Erlang/OTP Github Action Bot |
| select_extension(Id, [#'Extension'{extnID = ?'id-ce-cRLDistributionPoints' = Id, | ||
| extnValue = Value} = Extension | _]) when is_binary(Value) -> | ||
| Extension#'Extension'{extnValue = public_key:der_decode('CRLDistributionPoints', Value)}; | ||
| select_extension(Id, [#'Extension'{extnID = Id} = Extension | _]) -> | ||
| Extension; |
There was a problem hiding this comment.
Why is it only the extension ?id-ce-cRLDistributionPoints that is decoded here? Could there not be other extensions as well that is not decoded until used?
Would a test of is_binary(Value) imply that the extension needs to be decoded here?
There was a problem hiding this comment.
This CRL extension is not decode initially but then decode later when used by public_key functions. Other possibly unencoded extensions are not know by public key and handled totally by some other code that will have to do the decoding. We could possible find a reason to add more known public_key extensions here later, but I do not think there is an obvious one at the moment. Yes is_binary implies that the value is DER encoded.
As different solutions of verifying certificate revocation exists move the decode of 'CRLDistributionPoints' so that it will only be decode when it is actually used in the verification process. This would enable interoperability with systems that use certificates with an invalid empty CRLDistributionPoints extension that they want to ignore and make verification by other means.
Closes #6402