tls: load all CRLs from a PEM bundle

AddCRL() read a single PEM block and returned, so a crl option holding
several concatenated CRLs only ever got its first entry into the store.
Any certificate whose issuer's CRL came later in the bundle then failed
with UNABLE_TO_GET_CRL.

Read in a loop until the BIO is exhausted, the way AddCACertificates()
right above it already does for ca bundles.

Signed-off-by: Lazizbek Ergashev <lazerg2@gmail.com>

Author: lazerg

src/crypto/crypto_tls_certificates.cc

@@ -57,16 +57,20 @@ bool AddCRL(Environment* env,
             X509_STORE** cache) {
   if (!bio) return false;
 
-  DeleteFnPtr<X509_CRL, X509_CRL_free> crl(
-      PEM_read_bio_X509_CRL(bio.get(), nullptr, NoPasswordCallback, nullptr));
-  if (!crl) return false;
-
-  X509_STORE* cert_store = GetOrCreateOwnedCertStore(env, ctx, cache);
-  CHECK_EQ(1, X509_STORE_add_crl(cert_store, crl.get()));
-  CHECK_EQ(1,
-           X509_STORE_set_flags(
-               cert_store, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL));
-  return true;
+  using CRLPointer = DeleteFnPtr<X509_CRL, X509_CRL_free>;
+
+  bool added = false;
+  while (CRLPointer crl = CRLPointer(PEM_read_bio_X509_CRL(
+             bio.get(), nullptr, NoPasswordCallback, nullptr))) {
+    X509_STORE* cert_store = GetOrCreateOwnedCertStore(env, ctx, cache);
+    CHECK_EQ(1, X509_STORE_add_crl(cert_store, crl.get()));
+    CHECK_EQ(
+        1,
+        X509_STORE_set_flags(
+            cert_store, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL));
+    added = true;
+  }
+  return added;
 }
 
 PrivateKeyResult UsePrivateKey(SSL_CTX* ctx,

src/crypto/crypto_tls_certificates.h

@@ -30,7 +30,8 @@ size_t AddCACertificates(Environment* env,
                          const ncrypto::BIOPointer& bio,
                          X509_STORE** cache = nullptr);
 
-// Add one PEM CRL and enable CRL checking.
+// Add every PEM CRL in |bio| to the context's certificate store and enable CRL
+// checking. Returns false if no CRL was read.
 bool AddCRL(Environment* env,
             SSL_CTX* ctx,
             const ncrypto::BIOPointer& bio,

test/parallel/test-tls-crl-bundle.js

@@ -0,0 +1,29 @@
+'use strict';
+const common = require('../common');
+
+// Verify that every CRL in a concatenated PEM bundle is loaded, not just the
+// first one. agent3 is revoked by ca2-crl-agent3.pem, but not by ca2-crl.pem.
+
+const fixtures = require('../common/fixtures');
+const {
+  assert, connect, keys
+} = require(fixtures.path('tls-connect'));
+
+const crl = fixtures.readKey('ca2-crl.pem') +
+            fixtures.readKey('ca2-crl-agent3.pem');
+
+connect({
+  client: {
+    servername: 'agent3',
+    ca: keys.agent3.ca,
+    crl,
+  },
+  server: {
+    cert: keys.agent3.cert,
+    key: keys.agent3.key,
+  },
+}, common.mustCall((err, pair, cleanup) => {
+  assert(err);
+  assert.strictEqual(err.code, 'CERT_REVOKED');
+  return cleanup();
+}));