public_key: Add missing macros #9865

IngelaAndin · 2025-05-22T14:36:53Z

closes #9857

github-actions · 2025-05-22T14:37:45Z

CT Test Results

2 files 17 suites 4m 46s ⏱️
285 tests 281 ✅ 4 💤 0 ❌
301 runs 297 ✅ 4 💤 0 ❌

Results for commit b50e148.

♻️ This comment has been updated with latest results.

To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass.

See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally.

Artifacts

// Erlang/OTP Github Action Bot

lib/public_key/src/public_key.erl

CLAassistant · 2025-05-28T14:55:38Z

All committers have signed the CLA.

lib/public_key/src/public_key.erl

voltone · 2025-05-30T11:28:51Z

lib/public_key/src/public_key.erl

 get_asn1_module('Certificate') -> 'PKIX1Explicit-2009';
+get_asn1_module('SubjectAltName') -> 'PKIX1Implicit-2009';


So this would be nice: to be able to call public_key:der_encode('SubjectAltName', SANExtension). I use that to include a SubjectAltName extension in a CSR extensionRequest.

Unfortunately PKIX1Implicit-2009 does not define the necessary enc_SubjectAltName/2 function, so this fails with {:error, {:asn1, {{:undefined_type, :SubjectAltName}, ...}. There is enc_ext-SubjectAltName/2, though.

There seem to be some inconsistencies in this respect for various certificate extensions. For example, AuthorityKeyIdentifier and SubjectKeyIdentifier do expose enc_Xxx and dec_Xxx functions.

Humm I will consult my co-worker about why asn1 functions have ended up like that now, and see what we can do next week sometime. Will be busy with Code BEAM Stockholm on Monday.

IngelaAndin · 2025-06-09T07:56:30Z

@voltone Please try again, I hope this should also be fixed now.

voltone · 2025-06-09T10:30:28Z

Thanks @IngelaAndin! I had to replace 'OTPExtensions' with 'Extensions' in a few places and then those tests that previously failed on 'SubjectAltName' passed.

But I now get errors (that I didn't think I got before) on encoding CRL distribution point into certificates. I'm trying to get to the bottom of that one, but today's a holiday here so I can't give it my full attention. I will update you once I know more.

IngelaAndin · 2025-06-09T10:44:46Z

@voltone One thing that I changed back is that CRLDistributionPoints extension is not decoded until later if you use the pkix_decode_cert(Der, otp) option as that lets you workaround some certs that do not specify CRLDistributionPoints but wrongly encodes them as asn1 NULL. But that should only affect you if you try to encode it back without decoding it first.

voltone · 2025-06-09T10:51:01Z

The issue happens when I call public_key:pkix_sign/2 with a certificate that has a CRL distribution point in the extensions.

The exception and stack trace (in Elixir syntax):

     ** (FunctionClauseError) no function clause matching in :"PKIX1Implicit-2009".enc_CRLDistributionPoints_components/3

     The following arguments were given to :"PKIX1Implicit-2009".enc_CRLDistributionPoints_components/3:

         # 1
         <<48, 46, 48, 44, 160, 42, 160, 40, 134, 38, 104, 116, 116, 112, 58, 47, 47, 108, 111, 99, 97, 108, 104, 111, 115, 116, 58, 53, 53, 51, 48, 49, 47, 114, 115, 97, 47, 114, 111, 111, 116, 95, 99, 97, 46, 99, 114, 108>>

         # 2
         []

         # 3
         0

     stacktrace:
       (public_key 1.18) ../src/PKIX1Implicit-2009.erl:1980: :"PKIX1Implicit-2009".enc_CRLDistributionPoints_components/3
       (public_key 1.18) ../src/PKIX1Implicit-2009.erl:1977: :"PKIX1Implicit-2009".enc_CRLDistributionPoints/2
       (public_key 1.18) pubkey_cert_records.erl:475: anonymous fn/1 in :pubkey_cert_records.encode_extensions/1
       (stdlib 7.0) lists.erl:2390: :lists.map_1/2
       (stdlib 7.0) lists.erl:2390: :lists.map_1/2
       (stdlib 7.0) lists.erl:2385: :lists.map/2
       (public_key 1.18) pubkey_cert_records.erl:80: :pubkey_cert_records.enc_transform/1
       (public_key 1.18) public_key.erl:908: :public_key.pkix_encode/3
       (public_key 1.18) public_key.erl:1461: :public_key.pkix_sign/2
       (x509 0.8.10) lib/x509/certificate.ex:86: X509.Certificate.new/5
       (x509 0.8.10) lib/x509/test/suite.ex:155: X509.Test.Suite.new/1
       test/x509/test/server_test.exs:884: X509.Test.ServerTest.new_suite/3
       X509.Test.ServerTest.__ex_unit_describe_0/1

The extension list in the certificate passed to public_key:pkix_sign/2 is:

[{crl_distribution_point,
     {'Extension',
         {2,5,29,31},
         false,
         [{'DistributionPoint',
              {fullName,
                  [{uniformResourceIdentifier,
                       "http://localhost:55550/rsa/root_ca.crl"}]},
              asn1_NOVALUE,asn1_NOVALUE}]}}]

voltone · 2025-06-09T10:53:46Z

Ah, wait, it is DER encoded in the TBSCertificate record, so:

{'OTPTBSCertificate',v3,16734941980052244352,
    {'SignatureAlgorithm',{1,2,840,10045,4,3,2},asn1_NOVALUE},
    {rdnSequence,
        [[{'AttributeTypeAndValue',
              {2,5,4,10},
              {utf8String,<<"Elixir.X509.Test.Suite">>}}],
         [{'AttributeTypeAndValue',{2,5,4,3},{utf8String,<<"Root CA">>}}]]},
    {'Validity',{utcTime,"250609104751Z"},{utcTime,"350609105251Z"}},
    {rdnSequence,
        [[{'AttributeTypeAndValue',
              {2,5,4,10},
              {utf8String,<<"Elixir.X509.Test.Suite">>}}],
         [{'AttributeTypeAndValue',
              {2,5,4,3},
              {utf8String,<<"Intermediate CA">>}}]]},
    {'OTPSubjectPublicKeyInfo',
        {'PublicKeyAlgorithm',
            {1,2,840,10045,2,1},
            {namedCurve,{1,2,840,10045,3,1,7}}},
        {'ECPoint',
            <<4,129,171,34,28,246,230,27,120,167,14,244,21,107,217,251,244,
              32,90,182,201,233,16,163,42,181,193,114,139,106,232,158,252,
              182,83,129,163,51,213,239,49,58,55,149,161,50,21,186,3,22,203,
              42,172,26,0,58,179,119,10,224,233,219,183,19,240>>}},
    asn1_NOVALUE,asn1_NOVALUE,
    [{'Extension',{2,5,29,19},true,{'BasicConstraints',true,0}},
     {'Extension',{2,5,29,15},true,[digitalSignature,keyCertSign,cRLSign]},
     {'Extension',{2,5,29,37},false,[{1,3,6,1,5,5,7,3,1},{1,3,6,1,5,5,7,3,2}]},
     {'Extension',
         {2,5,29,14},
         false,
         <<204,251,70,82,43,99,219,198,5,27,79,187,9,121,196,247,70,57,116,162>>},
     {'Extension',
         {2,5,29,35},
         false,
         {'AuthorityKeyIdentifier',
             <<69,194,3,82,159,15,122,2,1,233,40,32,160,45,63,120,184,251,193,
               253>>,
             asn1_NOVALUE,asn1_NOVALUE}},
     {'Extension',
         {2,5,29,31},
         false,
         <<48,48,48,46,160,44,160,42,134,40,104,116,116,112,58,47,47,108,
           111,99,97,108,104,111,115,116,58,53,53,53,55,54,47,101,99,100,
           115,97,47,114,111,111,116,95,99,97,46,99,114,108>>}]}

voltone · 2025-06-09T10:54:32Z

It's the last extension, with oid {2,5,29,31}.

Should I be passing it differently to public_key:pkix_sign/2?

IngelaAndin · 2025-06-09T11:01:20Z

Well I guess as we allow partial decode, that is CRLDistributionPoints will be decode later when used in CRL verification procedure if enabled, we should add a encode clause to handle it is already encoded.

IngelaAndin · 2025-06-09T11:08:27Z

@voltone Try again

voltone · 2025-06-09T11:13:01Z

Yes, working now, thanks @IngelaAndin! I will review a few more things before I approve the PR, ok? Or are you in a rush to release 8.0.1?

IngelaAndin · 2025-06-09T11:17:37Z

@voltone that is a relative question. We want it to be part of the upcoming patch but that depends on other things that this PR. But I think this will be merged at latest tomorrow to not potentially slow things down.

closes erlang#9857 erlang#9880

voltone

This addresses all the issues I ran into. Some things are a bit different than in prior OTP versions, and therefore require conditional code that takes into account the public_key application version, but in the end all functionality I depend on can be made to work with this PR. Thanks!

IngelaAndin self-assigned this May 23, 2025

IngelaAndin added team:PS Assigned to OTP team PS testing currently being tested, tag is used by OTP internal CI labels May 23, 2025

IngelaAndin requested a review from dgud May 23, 2025 07:18

dgud previously approved these changes May 23, 2025

View reviewed changes

voltone mentioned this pull request May 23, 2025

escda-with-SHA-224 OID definition missing from header files. #9857

Closed

IngelaAndin mentioned this pull request May 27, 2025

public_key: Missing support for encoding/decoding ASN.1 structures #9880

Closed

IngelaAndin dismissed dgud’s stale review via fd7eed4 May 27, 2025 08:15

IngelaAndin force-pushed the ingela/public_key/macros/OTP-19644 branch from af8629b to fd7eed4 Compare May 27, 2025 08:15

IngelaAndin requested a review from dgud May 27, 2025 08:49

dgud reviewed May 27, 2025

View reviewed changes

lib/public_key/src/public_key.erl Outdated Show resolved Hide resolved

IngelaAndin force-pushed the ingela/public_key/macros/OTP-19644 branch 2 times, most recently from d7e729b to 64c3a55 Compare May 27, 2025 11:42

IngelaAndin requested a review from dgud May 27, 2025 11:43

IngelaAndin force-pushed the ingela/public_key/macros/OTP-19644 branch 2 times, most recently from 5b84b31 to 17a932a Compare May 28, 2025 14:55

IngelaAndin force-pushed the ingela/public_key/macros/OTP-19644 branch from 17a932a to 8445094 Compare May 28, 2025 15:03

voltone reviewed May 30, 2025

View reviewed changes

lib/public_key/src/public_key.erl Outdated Show resolved Hide resolved

voltone reviewed May 30, 2025

View reviewed changes

This was referenced May 30, 2025

Incompatible with Erlang 28.0 voltone/x509#86

Closed

Support OTP 28 voltone/x509#90

Merged

IngelaAndin force-pushed the ingela/public_key/macros/OTP-19644 branch 3 times, most recently from 30e9e31 to 51f41b6 Compare June 4, 2025 06:54

badlop mentioned this pull request Jun 4, 2025

Crash in Erlang/OTP 28: {function_clause, [{public_key,get_asn1_module, ['ExtensionRequest'] processone/p1_acme#4

Closed

IngelaAndin force-pushed the ingela/public_key/macros/OTP-19644 branch from 51f41b6 to 2218246 Compare June 9, 2025 07:55

IngelaAndin requested a review from voltone June 9, 2025 10:15

IngelaAndin force-pushed the ingela/public_key/macros/OTP-19644 branch from 2218246 to 1039144 Compare June 9, 2025 11:08

public_key: Add missing macros and definitions

b50e148

closes erlang#9857 erlang#9880

IngelaAndin force-pushed the ingela/public_key/macros/OTP-19644 branch from 1039144 to b50e148 Compare June 9, 2025 11:37

voltone approved these changes Jun 9, 2025

View reviewed changes

dgud approved these changes Jun 9, 2025

View reviewed changes

IngelaAndin merged commit fbda369 into erlang:maint Jun 11, 2025
26 checks passed

k-asm mentioned this pull request Jul 2, 2025

FunctionClauseError raised by JOSE.JWK.to_map/1 for EC keys on OTP 28.0.1 potatosalad/erlang-jose#179

Open

		get_asn1_module('Certificate') -> 'PKIX1Explicit-2009';
		get_asn1_module('SubjectAltName') -> 'PKIX1Implicit-2009';

public_key: Add missing macros #9865

public_key: Add missing macros #9865

Uh oh!

Conversation

IngelaAndin commented May 22, 2025

Uh oh!

github-actions bot commented May 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CT Test Results

Artifacts

Uh oh!

Uh oh!

CLAassistant commented May 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

voltone May 30, 2025

Choose a reason for hiding this comment

Uh oh!

IngelaAndin May 31, 2025

Choose a reason for hiding this comment

Uh oh!

IngelaAndin commented Jun 9, 2025

Uh oh!

voltone commented Jun 9, 2025

Uh oh!

IngelaAndin commented Jun 9, 2025

Uh oh!

voltone commented Jun 9, 2025

Uh oh!

voltone commented Jun 9, 2025

Uh oh!

voltone commented Jun 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

IngelaAndin commented Jun 9, 2025

Uh oh!

IngelaAndin commented Jun 9, 2025

Uh oh!

voltone commented Jun 9, 2025

Uh oh!

IngelaAndin commented Jun 9, 2025

Uh oh!

voltone left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

github-actions bot commented May 22, 2025 •

edited

Loading

CLAassistant commented May 28, 2025 •

edited

Loading

voltone commented Jun 9, 2025 •

edited

Loading