Ingela/ssl/crl cache/otp 19712 - #10049
Closed
IngelaAndin wants to merge 3 commits into
Closed
Conversation
IngelaAndin
force-pushed
the
ingela/ssl/crl-cache/OTP-19712
branch
from
July 16, 2025 10:27
7f81454 to
27092e4
Compare
Contributor
CT Test Results 2 files 66 suites 27m 6s ⏱️ Results for commit c9244d1. ♻️ This comment has been updated with latest results. To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass. See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally. Artifacts
// Erlang/OTP Github Action Bot |
IngelaAndin
added
team:PS
IngelaAndin
force-pushed
the
ingela/ssl/crl-cache/OTP-19712
branch
2 times, most recently
from
July 16, 2025 11:25
f937d96 to
451b8ba
Compare
There was a problem hiding this comment.
Pull Request Overview
This PR refactors duplicate internal_active_n logic, adds configurable CRL cache eviction in the PKIX database, and updates related modules and documentation.
- Refactor internal_active_n to centralize its implementation in ssl_config.
- Introduce a max_crl_cache setting and eviction logic in ssl_pkix_db.
- Wire the new configuration through ssl_manager, ssl_crl_cache, and docs, and remove unused defines.
Reviewed Changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| tls_gen_connection_1_3.erl | Refactored internal_active_n to use ssl_config |
| ssl_pkix_db.erl | Added add_crls/4 with cache size check and eviction logic |
| ssl_manager.erl | Propagate max_crl_db_entries and updated add_crls calls |
| ssl_internal.hrl | Removed duplicate INTERNAL_ACTIVE_N define |
| ssl_crl_cache.erl | Enabled cache insert on HTTP success |
| ssl_config.erl | Added DEFAULT_MAX_CRL_CACHE, get_max_crl_cache, and moved INTERNAL_ACTIVE_N |
| dtls_server_session_cache_sup.erl | Removed unused DEFAULT_MAX_SESSION_CACHE define |
| dtls_packet_demux.erl | Switched to ssl_config:get_internal_active_n |
| ssl_app.md | Documented the new max_crl_cache option |
Comments suppressed due to low confidence (2)
lib/ssl/doc/ssl_app.md:68
- Documented option name does not match the configuration function 'get_max_crl_cache' and expected env var 'max_crl_cache'. Please align the doc with the code.
- **`max_crl_cacche = pos_integer() <optional>`** - Sets the
lib/ssl/src/ssl_pkix_db.erl:381
- There are no tests covering the new CRL cache eviction behavior. Consider adding tests to validate that entries are evicted when the cache size exceeds the limit.
add_crls([_,_,_, {Cache, _} | _]= DB, Path, CRLs, MaxSize) ->
IngelaAndin
force-pushed
the
ingela/ssl/crl-cache/OTP-19712
branch
from
July 16, 2025 12:55
451b8ba to
4a9a18e
Compare
IngelaAndin
force-pushed
the
ingela/ssl/crl-cache/OTP-19712
branch
from
April 8, 2026 08:10
4a9a18e to
ad6b484
Compare
IngelaAndin
force-pushed
the
ingela/ssl/crl-cache/OTP-19712
branch
from
April 8, 2026 08:49
ad6b484 to
375a481
Compare
dgud
previously approved these changes
Apr 8, 2026
Comment on lines
+150
to
+151
| case application:get_env(ssl, max_crl_cache) of | ||
| {ok, Size} when is_integer(Size) -> |
Contributor
There was a problem hiding this comment.
Suggested change
| case application:get_env(ssl, max_crl_cache) of | |
| {ok, Size} when is_integer(Size) -> | |
| application_int(max_crl_cache, ?DEFAULT_MAX_CRL_CACHE) |
Contributor
|
should target branch be maint? |
u3s
reviewed
Apr 9, 2026
IngelaAndin
force-pushed
the
ingela/ssl/crl-cache/OTP-19712
branch
from
April 9, 2026 15:15
375a481 to
c9244d1
Compare
Contributor
Author
We decided not to, but it was when it was started. |
Contributor
Author
|
Closes in favour of hardening commit on #11478 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Improve CRL caching. Also include a code health commit that avoids some code duplication.