ssl: Add debug logging for DTLS

Change-Id: I4858972053436b05b83d72c552974fc9da3843d4

10 files changed, 113 insertions, 73 deletions

diff --git a/lib/ssl/doc/src/ssl.xml b/lib/ssl/doc/src/ssl.xml
index 3f643f32e1..dfd9ff7dfd 100644
--- a/lib/ssl/doc/src/ssl.xml
+++ b/lib/ssl/doc/src/ssl.xml
@@ -642,8 +642,8 @@ fun(srp, Username :: string(), UserState :: term()) ->
     <datatype>    
       <name name="logging_level"/> 
       <desc><p>Specifies the log level for TLS/DTLS. At verbosity level <c>notice</c> and above error reports are
-      displayed in TLS. The level <c>debug</c> triggers verbose logging of TLS protocol
-      messages and logging of ignored alerts in DTLS.</p>
+      displayed in TLS/DTLS. The level <c>debug</c> triggers verbose logging of TLS/DTLS protocol
+      messages.</p>
       </desc> 
     </datatype> 
     
diff --git a/lib/ssl/src/dtls_connection.erl b/lib/ssl/src/dtls_connection.erl
index 6b5a311efc..ed47980a69 100644
--- a/lib/ssl/src/dtls_connection.erl
+++ b/lib/ssl/src/dtls_connection.erl
@@ -250,10 +250,11 @@ handle_protocol_record(#ssl_tls{type = ?APPLICATION_DATA, fragment = Data}, Stat
 handle_protocol_record(#ssl_tls{type = ?HANDSHAKE,
 				       fragment = Data}, 
 		    StateName, 
-		    #state{protocol_buffers = Buffers0,
-			   connection_env = #connection_env{negotiated_version = Version}} = State) ->
+                       #state{protocol_buffers = Buffers0,
+                              connection_env = #connection_env{negotiated_version = Version},
+                              ssl_options = Options} = State) ->
     try
-	case dtls_handshake:get_dtls_handshake(Version, Data, Buffers0) of
+	case dtls_handshake:get_dtls_handshake(Version, Data, Buffers0, Options) of
 	    {[], Buffers} ->
 		next_event(StateName, no_record, State#state{protocol_buffers = Buffers});
 	    {Packets, Buffers} ->
@@ -308,9 +309,12 @@ queue_handshake(Handshake0, #state{handshake_env = #handshake_env{tls_handshake_
                                    connection_env = #connection_env{negotiated_version = Version},
 				   flight_buffer = #{handshakes := HsBuffer0,
 						     change_cipher_spec := undefined,
-						     next_sequence := Seq} = Flight0} = State) ->
+						     next_sequence := Seq} = Flight0,
+                                   ssl_options = SslOpts} = State) ->
     Handshake = dtls_handshake:encode_handshake(Handshake0, Version, Seq),
     Hist = update_handshake_history(Handshake0, Handshake, Hist0),
+    ssl_logger:debug(SslOpts#ssl_options.log_level, outbound, 'handshake', Handshake0),
+
     State#state{flight_buffer = Flight0#{handshakes => [Handshake | HsBuffer0],
 					 next_sequence => Seq +1},
 	handshake_env = HsEnv#handshake_env{tls_handshake_history = Hist}};
@@ -318,9 +322,12 @@ queue_handshake(Handshake0, #state{handshake_env = #handshake_env{tls_handshake_
 queue_handshake(Handshake0, #state{handshake_env = #handshake_env{tls_handshake_history = Hist0} = HsEnv, 
                                    connection_env = #connection_env{negotiated_version = Version},
 				   flight_buffer = #{handshakes_after_change_cipher_spec := Buffer0,
-						     next_sequence := Seq} = Flight0} = State) ->
+						     next_sequence := Seq} = Flight0,
+                                   ssl_options = SslOpts} = State) ->
     Handshake = dtls_handshake:encode_handshake(Handshake0, Version, Seq),
     Hist = update_handshake_history(Handshake0, Handshake, Hist0),
+    ssl_logger:debug(SslOpts#ssl_options.log_level, outbound, 'handshake', Handshake0),
+
     State#state{flight_buffer = Flight0#{handshakes_after_change_cipher_spec => [Handshake | Buffer0],
 					 next_sequence => Seq +1},
                 handshake_env = HsEnv#handshake_env{tls_handshake_history = Hist}}.
@@ -328,7 +335,7 @@ queue_handshake(Handshake0, #state{handshake_env = #handshake_env{tls_handshake_
 queue_change_cipher(ChangeCipher, #state{flight_buffer = Flight,
 					 connection_states = ConnectionStates0} = State) -> 
     ConnectionStates = 
-	dtls_record:next_epoch(ConnectionStates0, write), 
+	dtls_record:next_epoch(ConnectionStates0, write),
     State#state{flight_buffer = Flight#{change_cipher_spec => ChangeCipher},
 		connection_states = ConnectionStates}.
 
@@ -368,11 +375,14 @@ encode_alert(#alert{} = Alert, Version, ConnectionStates) ->
 
 send_alert(Alert, #state{static_env = #static_env{socket = Socket,
                                                   transport_cb = Transport},
+
                          connection_env = #connection_env{negotiated_version = Version},
-			 connection_states = ConnectionStates0} = State0) ->
+			 connection_states = ConnectionStates0,
+                         ssl_options = SslOpts} = State0) ->
     {BinMsg, ConnectionStates} =
 	encode_alert(Alert, Version, ConnectionStates0),
     send(Transport, Socket, BinMsg),
+    ssl_logger:debug(SslOpts#ssl_options.log_level, outbound, 'record', BinMsg),
     State0#state{connection_states = ConnectionStates}.
 
 send_alert_in_connection(Alert, State) ->
@@ -815,10 +825,11 @@ initial_flight_state(_) ->
 
 next_dtls_record(Data, StateName, #state{protocol_buffers = #protocol_buffers{
 						   dtls_record_buffer = Buf0,
-						   dtls_cipher_texts = CT0} = Buffers} = State0) ->
+						   dtls_cipher_texts = CT0} = Buffers,
+                                         ssl_options = SslOpts} = State0) ->
     case dtls_record:get_dtls_records(Data,
                                       acceptable_record_versions(StateName, State0), 
-                                      Buf0) of
+                                      Buf0, SslOpts) of
 	{Records, Buf1} ->
 	    CT1 = CT0 ++ Records,
 	    next_record(State0#state{protocol_buffers =
@@ -1074,11 +1085,14 @@ send_handshake_flight(#state{static_env = #static_env{socket = Socket,
                              connection_env = #connection_env{negotiated_version = Version},
                              flight_buffer = #{handshakes := Flight,
 					       change_cipher_spec := undefined},
-			     connection_states = ConnectionStates0} = State0, Epoch) ->
+			     connection_states = ConnectionStates0,
+                             ssl_options = #ssl_options{log_level = LogLevel}} = State0,
+                      Epoch) ->
     %% TODO remove hardcoded Max size
     {Encoded, ConnectionStates} =
 	encode_handshake_flight(lists:reverse(Flight), Version, 1400, Epoch, ConnectionStates0),
-    send(Transport, Socket, Encoded), 
+    send(Transport, Socket, Encoded),
+    ssl_logger:debug(LogLevel, outbound, 'record', Encoded),
    {State0#state{connection_states = ConnectionStates}, []};
 
 send_handshake_flight(#state{static_env = #static_env{socket = Socket,
@@ -1087,12 +1101,16 @@ send_handshake_flight(#state{static_env = #static_env{socket = Socket,
 			     flight_buffer = #{handshakes := [_|_] = Flight0,
 					       change_cipher_spec := ChangeCipher,
 					       handshakes_after_change_cipher_spec := []},
-			     connection_states = ConnectionStates0} = State0, Epoch) ->      
+			     connection_states = ConnectionStates0,
+                             ssl_options = #ssl_options{log_level = LogLevel}} = State0,
+                      Epoch) ->
     {HsBefore, ConnectionStates1} =
 	encode_handshake_flight(lists:reverse(Flight0), Version, 1400, Epoch, ConnectionStates0),
     {EncChangeCipher, ConnectionStates} = encode_change_cipher(ChangeCipher, Version, Epoch, ConnectionStates1),
 
     send(Transport, Socket, [HsBefore, EncChangeCipher]),
+    ssl_logger:debug(LogLevel, outbound, 'record', [HsBefore]),
+    ssl_logger:debug(LogLevel, outbound, 'record', [EncChangeCipher]),
     {State0#state{connection_states = ConnectionStates}, []};
 
 send_handshake_flight(#state{static_env = #static_env{socket = Socket,
@@ -1101,7 +1119,9 @@ send_handshake_flight(#state{static_env = #static_env{socket = Socket,
 			     flight_buffer = #{handshakes := [_|_] = Flight0,
 					       change_cipher_spec := ChangeCipher,
 					       handshakes_after_change_cipher_spec := Flight1},
-			     connection_states = ConnectionStates0} = State0, Epoch) ->      
+			     connection_states = ConnectionStates0,
+                             ssl_options = #ssl_options{log_level = LogLevel}} = State0,
+                      Epoch) ->
     {HsBefore, ConnectionStates1} =
 	encode_handshake_flight(lists:reverse(Flight0), Version, 1400, Epoch-1, ConnectionStates0),
     {EncChangeCipher, ConnectionStates2} = 
@@ -1109,6 +1129,9 @@ send_handshake_flight(#state{static_env = #static_env{socket = Socket,
     {HsAfter, ConnectionStates} =
 	encode_handshake_flight(lists:reverse(Flight1), Version, 1400, Epoch, ConnectionStates2),
     send(Transport, Socket, [HsBefore, EncChangeCipher, HsAfter]),
+    ssl_logger:debug(LogLevel, outbound, 'record', [HsBefore]),
+    ssl_logger:debug(LogLevel, outbound, 'record', [EncChangeCipher]),
+    ssl_logger:debug(LogLevel, outbound, 'record', [HsAfter]),
     {State0#state{connection_states = ConnectionStates}, []};
 
 send_handshake_flight(#state{static_env = #static_env{socket = Socket,
@@ -1117,12 +1140,16 @@ send_handshake_flight(#state{static_env = #static_env{socket = Socket,
 			     flight_buffer = #{handshakes := [],
 					       change_cipher_spec := ChangeCipher,
 					       handshakes_after_change_cipher_spec := Flight1},
-			     connection_states = ConnectionStates0} = State0, Epoch) ->
+			     connection_states = ConnectionStates0,
+                             ssl_options = #ssl_options{log_level = LogLevel}} = State0,
+                      Epoch) ->
     {EncChangeCipher, ConnectionStates1} = 
 	encode_change_cipher(ChangeCipher, Version, Epoch-1, ConnectionStates0),
     {HsAfter, ConnectionStates} =
 	encode_handshake_flight(lists:reverse(Flight1), Version, 1400, Epoch, ConnectionStates1),
     send(Transport, Socket, [EncChangeCipher, HsAfter]),
+    ssl_logger:debug(LogLevel, outbound, 'record', [EncChangeCipher]),
+    ssl_logger:debug(LogLevel, outbound, 'record', [HsAfter]),
     {State0#state{connection_states = ConnectionStates}, []}.
 
 retransmit_epoch(_StateName, #state{connection_states = ConnectionStates}) ->
@@ -1174,7 +1201,8 @@ send_application_data(Data, From, _StateName,
                              connection_env = #connection_env{negotiated_version = Version},
                              handshake_env = HsEnv,
                              connection_states = ConnectionStates0,
-                             ssl_options = #ssl_options{renegotiate_at = RenegotiateAt}} = State0) ->
+                             ssl_options = #ssl_options{renegotiate_at = RenegotiateAt,
+                                                        log_level = LogLevel}} = State0) ->
        
     case time_to_renegotiate(Data, ConnectionStates0, RenegotiateAt) of
 	true ->
@@ -1186,6 +1214,7 @@ send_application_data(Data, From, _StateName,
             State = State0#state{connection_states = ConnectionStates},
 	    case send(Transport, Socket, Msgs) of
                 ok ->
+                    ssl_logger:debug(LogLevel, outbound, 'record', Msgs),
                     ssl_connection:hibernate_after(connection, State, [{reply, From, ok}]);
                 Result ->
                     ssl_connection:hibernate_after(connection, State, [{reply, From, Result}])
diff --git a/lib/ssl/src/dtls_handshake.erl b/lib/ssl/src/dtls_handshake.erl
index 8e749e65b8..46e8348ce0 100644
--- a/lib/ssl/src/dtls_handshake.erl
+++ b/lib/ssl/src/dtls_handshake.erl
@@ -37,7 +37,7 @@
 -export([fragment_handshake/2, encode_handshake/3]).
 
 %% Handshake decodeing
--export([get_dtls_handshake/3]). 
+-export([get_dtls_handshake/4]).
 
 -type dtls_handshake() :: #client_hello{} | #hello_verify_request{} | 
 			  ssl_handshake:ssl_handshake().
@@ -151,15 +151,15 @@ encode_handshake(Handshake, Version, Seq) ->
 %%--------------------------------------------------------------------
 
 %%--------------------------------------------------------------------
--spec get_dtls_handshake(ssl_record:ssl_version(), binary(), #protocol_buffers{}) ->
+-spec get_dtls_handshake(ssl_record:ssl_version(), binary(), #protocol_buffers{}, #ssl_options{}) ->
                                 {[dtls_handshake()], #protocol_buffers{}}.                
 %%
 %% Description:  Given buffered and new data from dtls_record, collects
 %% and returns it as a list of handshake messages, also returns 
 %% possible leftover data in the new "protocol_buffers".
 %%--------------------------------------------------------------------
-get_dtls_handshake(Version, Fragment, ProtocolBuffers) ->
-    handle_fragments(Version, Fragment, ProtocolBuffers, []).
+get_dtls_handshake(Version, Fragment, ProtocolBuffers, Options) ->
+    handle_fragments(Version, Fragment, ProtocolBuffers, Options, []).
 
 %%--------------------------------------------------------------------
 %%% Internal functions
@@ -310,20 +310,21 @@ address_to_bin({A,B,C,D,E,F,G,H}, Port) ->
 
 %%--------------------------------------------------------------------
 
-handle_fragments(Version, FragmentData, Buffers0, Acc) ->
+handle_fragments(Version, FragmentData, Buffers0, Options, Acc) ->
     Fragments = decode_handshake_fragments(FragmentData),
-    do_handle_fragments(Version, Fragments, Buffers0, Acc).
+    do_handle_fragments(Version, Fragments, Buffers0, Options, Acc).
 
-do_handle_fragments(_, [], Buffers, Acc) ->
+do_handle_fragments(_, [], Buffers, _Options, Acc) ->
     {lists:reverse(Acc), Buffers};
-do_handle_fragments(Version, [Fragment | Fragments], Buffers0, Acc) ->
+do_handle_fragments(Version, [Fragment | Fragments], Buffers0, Options, Acc) ->
     case reassemble(Version, Fragment, Buffers0) of
 	{more_data, Buffers} when Fragments == [] ->
 	    {lists:reverse(Acc), Buffers};
 	{more_data, Buffers} ->
-	    do_handle_fragments(Version, Fragments, Buffers, Acc);
-	{HsPacket, Buffers} ->
-	    do_handle_fragments(Version, Fragments, Buffers, [HsPacket | Acc])
+	    do_handle_fragments(Version, Fragments, Buffers, Options, Acc);
+	{{Handshake, _} = HsPacket, Buffers} ->
+            ssl_logger:debug(Options#ssl_options.log_level, inbound, 'handshake', Handshake),
+	    do_handle_fragments(Version, Fragments, Buffers, Options, [HsPacket | Acc])
     end.
 
 decode_handshake(Version, <<?BYTE(Type), Bin/binary>>) ->
@@ -363,9 +364,9 @@ decode_handshake(_Version, ?HELLO_VERIFY_REQUEST, <<?UINT24(_), ?UINT16(_),
 decode_handshake(Version, Tag,  <<?UINT24(_), ?UINT16(_),
 				  ?UINT24(_),  ?UINT24(_), Msg/binary>>) -> 
     %% DTLS specifics stripped
-    decode_tls_thandshake(Version, Tag, Msg).
+    decode_tls_handshake(Version, Tag, Msg).
 
-decode_tls_thandshake(Version, Tag, Msg) ->
+decode_tls_handshake(Version, Tag, Msg) ->
     TLSVersion = dtls_v1:corresponding_tls_version(Version),
     ssl_handshake:decode_handshake(TLSVersion, Tag, Msg).
 
diff --git a/lib/ssl/src/dtls_handshake.hrl b/lib/ssl/src/dtls_handshake.hrl
index dab4038762..de2be1daeb 100644
--- a/lib/ssl/src/dtls_handshake.hrl
+++ b/lib/ssl/src/dtls_handshake.hrl
@@ -26,23 +26,13 @@
 -ifndef(dtls_handshake).
 -define(dtls_handshake, true).
 
+-include("tls_handshake.hrl"). %% Common TLS and DTLS records and Constantes
 -include("ssl_handshake.hrl"). %% Common TLS and DTLS records and Constantes
 -include("ssl_api.hrl").
 
 -define(HELLO_VERIFY_REQUEST, 3).
 -define(HELLO_VERIFY_REQUEST_VERSION, {254, 255}).
 
--record(client_hello, {
-	  client_version,
-	  random,             
-	  session_id,          % opaque SessionID<0..32>
-	  cookie,              % opaque<2..2^16-1>
-	  cipher_suites,       % cipher_suites<2..2^16-1>
-	  compression_methods, % compression_methods<1..2^8-1>,
-	  %% Extensions
-	  extensions
-	 }).
-
 -record(hello_verify_request, {
 	  protocol_version,
 	  cookie
diff --git a/lib/ssl/src/dtls_record.erl b/lib/ssl/src/dtls_record.erl
index 2fe875da31..a4846f42c5 100644
--- a/lib/ssl/src/dtls_record.erl
+++ b/lib/ssl/src/dtls_record.erl
@@ -30,7 +30,7 @@
 -include("ssl_cipher.hrl").
 
 %% Handling of incoming data
--export([get_dtls_records/3,  init_connection_states/2, empty_connection_state/1]).
+-export([get_dtls_records/4,  init_connection_states/2, empty_connection_state/1]).
 
 -export([save_current_connection_state/2, next_epoch/2, get_connection_state_by_epoch/3, replay_detect/2,
          init_connection_state_seq/2, current_connection_state_epoch/2]).
@@ -162,24 +162,25 @@ current_connection_state_epoch(#{current_write := #{epoch := Epoch}},
     Epoch.
 
 %%--------------------------------------------------------------------
--spec get_dtls_records(binary(), [ssl_record:ssl_version()], binary()) -> {[binary()], binary()} | #alert{}.
+-spec get_dtls_records(binary(), [ssl_record:ssl_version()], binary(),
+                       #ssl_options{}) -> {[binary()], binary()} | #alert{}.
 %%
 %% Description: Given old buffer and new data from UDP/SCTP, packs up a records
 %% and returns it as a list of tls_compressed binaries also returns leftover
 %% data
 %%--------------------------------------------------------------------
-get_dtls_records(Data, Versions, Buffer) ->
+get_dtls_records(Data, Versions, Buffer, SslOpts) ->
     BinData = list_to_binary([Buffer, Data]),
     case erlang:byte_size(BinData) of
         N when N >= 3 ->
             case assert_version(BinData, Versions) of
                 true ->
-                    get_dtls_records_aux(BinData, []);
+                    get_dtls_records_aux(BinData, [], SslOpts);
                 false ->
                     ?ALERT_REC(?FATAL, ?BAD_RECORD_MAC)
             end;
         _ ->
-            get_dtls_records_aux(BinData, [])
+            get_dtls_records_aux(BinData, [], SslOpts)
     end.
 
 %%====================================================================
@@ -409,42 +410,47 @@ assert_version(<<?BYTE(_), ?BYTE(MajVer), ?BYTE(MinVer), _/binary>>, Versions) -
 
 get_dtls_records_aux(<<?BYTE(?APPLICATION_DATA),?BYTE(MajVer),?BYTE(MinVer),
 		       ?UINT16(Epoch), ?UINT48(SequenceNumber),
-		       ?UINT16(Length), Data:Length/binary, Rest/binary>>,
-		     Acc) ->
+		       ?UINT16(Length), Data:Length/binary, Rest/binary>> = RawDTLSRecord,
+		     Acc, SslOpts) ->
+    ssl_logger:debug(SslOpts#ssl_options.log_level, inbound, 'record', [RawDTLSRecord]),
     get_dtls_records_aux(Rest, [#ssl_tls{type = ?APPLICATION_DATA,
 					 version = {MajVer, MinVer},
 					 epoch = Epoch, sequence_number = SequenceNumber,
-					 fragment = Data} | Acc]);
+					 fragment = Data} | Acc], SslOpts);
 get_dtls_records_aux(<<?BYTE(?HANDSHAKE),?BYTE(MajVer),?BYTE(MinVer),
 		       ?UINT16(Epoch), ?UINT48(SequenceNumber),
 		       ?UINT16(Length),
-		       Data:Length/binary, Rest/binary>>, Acc) when MajVer >= 128 ->
+		       Data:Length/binary, Rest/binary>> = RawDTLSRecord,
+                     Acc, SslOpts) when MajVer >= 128 ->
+    ssl_logger:debug(SslOpts#ssl_options.log_level, inbound, 'record', [RawDTLSRecord]),
     get_dtls_records_aux(Rest, [#ssl_tls{type = ?HANDSHAKE,
 					 version = {MajVer, MinVer},
 					 epoch = Epoch, sequence_number = SequenceNumber,
-					 fragment = Data} | Acc]);
+					 fragment = Data} | Acc], SslOpts);
 get_dtls_records_aux(<<?BYTE(?ALERT),?BYTE(MajVer),?BYTE(MinVer),
 		       ?UINT16(Epoch), ?UINT48(SequenceNumber),
 		       ?UINT16(Length), Data:Length/binary,
-		       Rest/binary>>, Acc) ->
+		       Rest/binary>> = RawDTLSRecord, Acc, SslOpts) ->
+    ssl_logger:debug(SslOpts#ssl_options.log_level, inbound, 'record', [RawDTLSRecord]),
     get_dtls_records_aux(Rest, [#ssl_tls{type = ?ALERT,
 					 version = {MajVer, MinVer},
 					 epoch = Epoch, sequence_number = SequenceNumber,
-					 fragment = Data} | Acc]);
+					 fragment = Data} | Acc], SslOpts);
 get_dtls_records_aux(<<?BYTE(?CHANGE_CIPHER_SPEC),?BYTE(MajVer),?BYTE(MinVer),
 		       ?UINT16(Epoch), ?UINT48(SequenceNumber),
-		       ?UINT16(Length), Data:Length/binary, Rest/binary>>,
-		     Acc) ->
+		       ?UINT16(Length), Data:Length/binary, Rest/binary>> = RawDTLSRecord,
+		     Acc, SslOpts) ->
+    ssl_logger:debug(SslOpts#ssl_options.log_level, inbound, 'record', [RawDTLSRecord]),
     get_dtls_records_aux(Rest, [#ssl_tls{type = ?CHANGE_CIPHER_SPEC,
 					 version = {MajVer, MinVer},
 					 epoch = Epoch, sequence_number = SequenceNumber,
-					 fragment = Data} | Acc]);
+					 fragment = Data} | Acc], SslOpts);
 get_dtls_records_aux(<<?BYTE(_), ?BYTE(_MajVer), ?BYTE(_MinVer),
 		       ?UINT16(Length), _/binary>>,
-		     _Acc) when Length > ?MAX_CIPHER_TEXT_LENGTH ->
+		     _Acc, _) when Length > ?MAX_CIPHER_TEXT_LENGTH ->
     ?ALERT_REC(?FATAL, ?RECORD_OVERFLOW);
 
-get_dtls_records_aux(Data, Acc) ->
+get_dtls_records_aux(Data, Acc, _) ->
     case size(Data) =< ?MAX_CIPHER_TEXT_LENGTH + ?INITIAL_BYTES of
 	true ->
 	    {lists:reverse(Acc), Data};
diff --git a/lib/ssl/src/ssl_logger.erl b/lib/ssl/src/ssl_logger.erl
index d59a0dfda2..b82b3937a1 100644
--- a/lib/ssl/src/ssl_logger.erl
+++ b/lib/ssl/src/ssl_logger.erl
@@ -35,6 +35,7 @@
 -include("ssl_cipher.hrl").
 -include("ssl_internal.hrl").
 -include("tls_handshake.hrl").
+-include("dtls_handshake.hrl").
 -include("tls_handshake_1_3.hrl").
 -include_lib("kernel/include/logger.hrl").
 
@@ -48,7 +49,7 @@ format(#{level:= _Level, msg:= {report, Msg}, meta:= _Meta}, _Config0) ->
        protocol := Protocol,
        message := Content} = Msg,
     case Protocol of
-        'tls_record' ->
+        'record' ->
             BinMsg =
                 case Content of
                     #ssl_tls{} ->
@@ -66,7 +67,7 @@ format(#{level:= _Level, msg:= {report, Msg}, meta:= _Meta}, _Config0) ->
 %% Stateful logging
 debug(Level, Direction, Protocol, Message)
   when (Direction =:= inbound orelse Direction =:= outbound) andalso
-       (Protocol =:= 'tls_record' orelse Protocol =:= 'handshake') ->
+       (Protocol =:= 'record' orelse Protocol =:= 'handshake') ->
     case logger:compare_levels(Level, debug) of
         lt ->
             ?LOG_DEBUG(#{direction => Direction,
@@ -130,6 +131,11 @@ parse_handshake(Direction, #server_hello{
                             [?rec_info(server_hello,
                                        ServerHello#server_hello{cipher_suite = CipherSuite})]),
     {Header, Message};
+parse_handshake(Direction, #hello_verify_request{} = HelloVerifyRequest) ->
+    Header = io_lib:format("~s Handshake, HelloVerifyRequest",
+                           [header_prefix(Direction)]),
+    Message = io_lib:format("~p", [?rec_info(hello_verify_request, HelloVerifyRequest)]),
+    {Header, Message};
 parse_handshake(Direction, #certificate{} = Certificate) ->
     Header = io_lib:format("~s Handshake, Certificate",
                            [header_prefix(Direction)]),
@@ -228,9 +234,12 @@ version({3,1}) ->
     "TLS 1.0";
 version({3,0}) ->
     "SSL 3.0";
+version({254,253}) ->
+    "DTLS 1.2";
+version({254,255}) ->
+    "DTLS 1.0";
 version({M,N}) ->
-    io_lib:format("TLS [0x0~B0~B]", [M,N]).
-
+    io_lib:format("TLS/DTLS [0x0~B0~B]", [M,N]).
 
 header_prefix(inbound) ->
     "<<<";
@@ -264,8 +273,12 @@ tls_record_version([<<?BYTE(B),?BYTE(3),?BYTE(1),_/binary>>|_]) ->
     io_lib:format("TLS 1.0 Record Protocol, ~s", [msg_type(B)]);
 tls_record_version([<<?BYTE(B),?BYTE(3),?BYTE(0),_/binary>>|_]) ->
     io_lib:format("SSL 3.0 Record Protocol, ~s", [msg_type(B)]);
+tls_record_version([<<?BYTE(B),?BYTE(254),?BYTE(253),_/binary>>|_]) ->
+    io_lib:format("DTLS 1.2 Record Protocol, ~s", [msg_type(B)]);
+tls_record_version([<<?BYTE(B),?BYTE(254),?BYTE(255),_/binary>>|_]) ->
+    io_lib:format("DTLS 1.0 Record Protocol, ~s", [msg_type(B)]);
 tls_record_version([<<?BYTE(B),?BYTE(M),?BYTE(N),_/binary>>|_]) ->
-    io_lib:format("TLS [0x0~B0~B] Record Protocol, ~s", [M, N, msg_type(B)]).
+    io_lib:format("TLS/DTLS [0x0~B0~B] Record Protocol, ~s", [M, N, msg_type(B)]).
 
 
 msg_type(20) -> "change_cipher_spec";
@@ -346,12 +359,12 @@ convert_to_hex(P, [H|T], Row, Acc, C) when is_integer(H) ->
                    C + 1).
 
 
-row_prefix(tls_record, N) ->
+row_prefix(_ , N) ->
     S = string:pad(string:to_lower(erlang:integer_to_list(N, 16)),4,leading,$0),
     lists:reverse(lists:flatten(S ++ " - ")).
 
 
-end_row(tls_record, Row) ->
+end_row(_, Row) ->
     Row ++ "  ".
 
 
diff --git a/lib/ssl/src/tls_connection.erl b/lib/ssl/src/tls_connection.erl
index 39b0b3e53a..dfaa65fa13 100644
--- a/lib/ssl/src/tls_connection.erl
+++ b/lib/ssl/src/tls_connection.erl
@@ -364,7 +364,7 @@ queue_handshake(Handshake, #state{handshake_env = #handshake_env{tls_handshake_h
     {BinHandshake, ConnectionStates, Hist} =
 	encode_handshake(Handshake, Version, ConnectionStates0, Hist0),
     ssl_logger:debug(SslOpts#ssl_options.log_level, outbound, 'handshake', Handshake),
-    ssl_logger:debug(SslOpts#ssl_options.log_level, outbound, 'tls_record', BinHandshake),
+    ssl_logger:debug(SslOpts#ssl_options.log_level, outbound, 'record', BinHandshake),
 
     State0#state{connection_states = ConnectionStates,
                  handshake_env = HsEnv#handshake_env{tls_handshake_history = Hist},
@@ -383,7 +383,7 @@ queue_change_cipher(Msg, #state{connection_env = #connection_env{negotiated_vers
                                 connection_states = ConnectionStates0} = State0) ->
     {BinChangeCipher, ConnectionStates} =
 	encode_change_cipher(Msg, Version, ConnectionStates0),
-    ssl_logger:debug(SslOpts#ssl_options.log_level, outbound, 'tls_record', BinChangeCipher),
+    ssl_logger:debug(SslOpts#ssl_options.log_level, outbound, 'record', BinChangeCipher),
     State0#state{connection_states = ConnectionStates,
 		 flight_buffer = Flight0 ++ [BinChangeCipher]}.
 
@@ -432,7 +432,7 @@ send_alert(Alert, #state{static_env = #static_env{socket = Socket,
     {BinMsg, ConnectionStates} =
         encode_alert(Alert, Version, ConnectionStates0),
     tls_socket:send(Transport, Socket, BinMsg),
-    ssl_logger:debug(SslOpts#ssl_options.log_level, outbound, 'tls_record', BinMsg),
+    ssl_logger:debug(SslOpts#ssl_options.log_level, outbound, 'record', BinMsg),
     StateData0#state{connection_states = ConnectionStates}.
 
 %% If an ALERT sent in the connection state, should cause the TLS
@@ -529,7 +529,7 @@ init({call, From}, {start, Timeout},
         encode_handshake(Hello,  HelloVersion, ConnectionStates0, Handshake0),
     tls_socket:send(Transport, Socket, BinMsg),
     ssl_logger:debug(SslOpts#ssl_options.log_level, outbound, 'handshake', Hello),
-    ssl_logger:debug(SslOpts#ssl_options.log_level, outbound, 'tls_record', BinMsg),
+    ssl_logger:debug(SslOpts#ssl_options.log_level, outbound, 'record', BinMsg),
 
     State = State0#state{connection_states = ConnectionStates,
                          connection_env = CEnv#connection_env{negotiated_version = HelloVersion}, %% Requested version
diff --git a/lib/ssl/src/tls_handshake.hrl b/lib/ssl/src/tls_handshake.hrl
index f6644f64af..fc67bb61fd 100644
--- a/lib/ssl/src/tls_handshake.hrl
+++ b/lib/ssl/src/tls_handshake.hrl
@@ -32,6 +32,7 @@
 	  client_version,
 	  random,             
 	  session_id,          % opaque SessionID<0..32>
+	  cookie,              % opaque<2..2^16-1>
 	  cipher_suites,       % cipher_suites<2..2^16-1>
 	  compression_methods, % compression_methods<1..2^8-1>,
 	  %% Extensions
diff --git a/lib/ssl/src/tls_record.erl b/lib/ssl/src/tls_record.erl
index 94506b8edc..9f0c588cb6 100644
--- a/lib/ssl/src/tls_record.erl
+++ b/lib/ssl/src/tls_record.erl
@@ -503,7 +503,7 @@ validate_tls_record_length(Versions, {_,Size0,_} = Q0, SslOpts, Acc, Type, Versi
                     %% Complete record
                     {Fragment, Q} = binary_from_front(Length, Q0),
                     Record = #ssl_tls{type = Type, version = Version, fragment = Fragment},
-                    ssl_logger:debug(SslOpts#ssl_options.log_level, inbound, 'tls_record', Record),
+                    ssl_logger:debug(SslOpts#ssl_options.log_level, inbound, 'record', Record),
                     decode_tls_records(Versions, Q, SslOpts, [Record|Acc], undefined, undefined, undefined);
                 true ->
                     {lists:reverse(Acc),
diff --git a/lib/ssl/src/tls_sender.erl b/lib/ssl/src/tls_sender.erl
index ba73eddf0b..d0604565e3 100644
--- a/lib/ssl/src/tls_sender.erl
+++ b/lib/ssl/src/tls_sender.erl
@@ -415,7 +415,7 @@ send_tls_alert(#alert{} = Alert,
     {BinMsg, ConnectionStates} =
 	tls_record:encode_alert_record(Alert, Version, ConnectionStates0),
     tls_socket:send(Transport, Socket, BinMsg),
-    ssl_logger:debug(LogLevel, outbound, 'tls_record', BinMsg),
+    ssl_logger:debug(LogLevel, outbound, 'record', BinMsg),
     StateData0#data{connection_states = ConnectionStates}.
 
 send_application_data(Data, From, StateName,
@@ -437,12 +437,12 @@ send_application_data(Data, From, StateName,
             StateData = StateData0#data{connection_states = ConnectionStates},
 	    case tls_socket:send(Transport, Socket, Msgs) of
                 ok when DistHandle =/=  undefined ->
-                    ssl_logger:debug(LogLevel, outbound, 'tls_record', Msgs),
+                    ssl_logger:debug(LogLevel, outbound, 'record', Msgs),
                     {next_state, StateName, StateData, []};
                 Reason when DistHandle =/= undefined ->
                     {next_state, death_row, StateData, [{state_timeout, 5000, Reason}]};
                 ok ->
-                    ssl_logger:debug(LogLevel, outbound, 'tls_record', Msgs),
+                    ssl_logger:debug(LogLevel, outbound, 'record', Msgs),
                     {next_state, StateName, StateData,  [{reply, From, ok}]};
                 Result ->
                     {next_state, StateName, StateData,  [{reply, From, Result}]}