aboutsummaryrefslogtreecommitdiffstats
path: root/lib/ssl
diff options
context:
space:
mode:
Diffstat (limited to 'lib/ssl')
-rw-r--r--lib/ssl/doc/src/notes.xml75
-rw-r--r--lib/ssl/src/tls_connection.erl14
-rw-r--r--lib/ssl/test/ssl_packet_SUITE.erl24
3 files changed, 96 insertions, 17 deletions
diff --git a/lib/ssl/doc/src/notes.xml b/lib/ssl/doc/src/notes.xml
index a61f52b809..8875d07535 100644
--- a/lib/ssl/doc/src/notes.xml
+++ b/lib/ssl/doc/src/notes.xml
@@ -26,7 +26,80 @@
</header>
<p>This document describes the changes made to the SSL application.</p>
- <section><title>SSL 5.2.1</title>
+ <section><title>SSL 5.3</title>
+
+ <section><title>Fixed Bugs and Malfunctions</title>
+ <list>
+ <item>
+ <p>
+ Honor the versions option to ssl:connect and ssl:listen.</p>
+ <p>
+ Own Id: OTP-10905</p>
+ </item>
+ <item>
+ <p>
+ Next protocol negotiation with reused sessions will now
+ succeed</p>
+ <p>
+ Own Id: OTP-10909</p>
+ </item>
+ </list>
+ </section>
+
+
+ <section><title>Improvements and New Features</title>
+ <list>
+ <item>
+ <p>
+ Add support for PSK (Pre Shared Key) and SRP (Secure
+ Remote Password) chipher suits, thanks to Andreas
+ Schultz.</p>
+ <p>
+ Own Id: OTP-10450 Aux Id: kunagi-269 [180] </p>
+ </item>
+ <item>
+ <p>
+ Fix SSL Next Protocol Negotiation documentation. Thanks
+ to Julien Barbot.</p>
+ <p>
+ Own Id: OTP-10955</p>
+ </item>
+ <item>
+ <p>
+ Fix ssl_connection to support reading proxy/chain
+ certificates. Thanks to Valentin Kuznetsov.</p>
+ <p>
+ Own Id: OTP-10980</p>
+ </item>
+ <item>
+ <p>
+ Integrate elliptic curve contribution from Andreas
+ Schultz </p>
+ <p>
+ In order to be able to support elliptic curve cipher
+ suites in SSL/TLS, additions to handle elliptic curve
+ infrastructure has been added to public_key and crypto.</p>
+ <p>
+ This also has resulted in a rewrite of the crypto API to
+ gain consistency and remove unnecessary overhead. All OTP
+ applications using crypto has been updated to use the new
+ API.</p>
+ <p>
+ Impact: Elliptic curve cryptography (ECC) offers
+ equivalent security with smaller key sizes than other
+ public key algorithms. Smaller key sizes result in
+ savings for power, memory, bandwidth, and computational
+ cost that make ECC especially attractive for constrained
+ environments.</p>
+ <p>
+ Own Id: OTP-11009</p>
+ </item>
+ </list>
+ </section>
+
+</section>
+
+<section><title>SSL 5.2.1</title>
<section><title>Improvements and New Features</title>
<list>
diff --git a/lib/ssl/src/tls_connection.erl b/lib/ssl/src/tls_connection.erl
index 246fecf34a..51551eab11 100644
--- a/lib/ssl/src/tls_connection.erl
+++ b/lib/ssl/src/tls_connection.erl
@@ -978,7 +978,7 @@ handle_sync_event(negotiated_next_protocol, _From, StateName, #state{next_protoc
handle_sync_event(negotiated_next_protocol, _From, StateName, #state{next_protocol = NextProtocol} = State) ->
{reply, {ok, NextProtocol}, StateName, State, get_timeout(State)};
-handle_sync_event({set_opts, Opts0}, _From, StateName,
+handle_sync_event({set_opts, Opts0}, _From, StateName0,
#state{socket_options = Opts1,
socket = Socket,
transport_cb = Transport,
@@ -987,11 +987,12 @@ handle_sync_event({set_opts, Opts0}, _From, StateName,
State1 = State0#state{socket_options = Opts},
if
Opts#socket_options.active =:= false ->
- {reply, Reply, StateName, State1, get_timeout(State1)};
+ {reply, Reply, StateName0, State1, get_timeout(State1)};
Buffer =:= <<>>, Opts1#socket_options.active =:= false ->
%% Need data, set active once
{Record, State2} = next_record_if_active(State1),
- case next_state(StateName, StateName, Record, State2) of
+ %% Note: Renogotiation may cause StateName0 =/= StateName
+ case next_state(StateName0, StateName0, Record, State2) of
{next_state, StateName, State, Timeout} ->
{reply, Reply, StateName, State, Timeout};
{stop, Reason, State} ->
@@ -999,13 +1000,14 @@ handle_sync_event({set_opts, Opts0}, _From, StateName,
end;
Buffer =:= <<>> ->
%% Active once already set
- {reply, Reply, StateName, State1, get_timeout(State1)};
+ {reply, Reply, StateName0, State1, get_timeout(State1)};
true ->
case read_application_data(<<>>, State1) of
Stop = {stop,_,_} ->
Stop;
{Record, State2} ->
- case next_state(StateName, StateName, Record, State2) of
+ %% Note: Renogotiation may cause StateName0 =/= StateName
+ case next_state(StateName0, StateName0, Record, State2) of
{next_state, StateName, State, Timeout} ->
{reply, Reply, StateName, State, Timeout};
{stop, Reason, State} ->
@@ -2458,7 +2460,7 @@ do_format_reply(list, _,_, Data) ->
binary_to_list(Data).
header(0, <<>>) ->
- [];
+ <<>>;
header(_, <<>>) ->
[];
header(0, Binary) ->
diff --git a/lib/ssl/test/ssl_packet_SUITE.erl b/lib/ssl/test/ssl_packet_SUITE.erl
index 36f7af784d..d50498f547 100644
--- a/lib/ssl/test/ssl_packet_SUITE.erl
+++ b/lib/ssl/test/ssl_packet_SUITE.erl
@@ -1631,8 +1631,8 @@ header_decode_one_byte_active(Config) when is_list(Config) ->
{from, self()},
{mfa, {?MODULE, client_header_decode_active,
[Data, [11 | <<"Hello world">> ]]}},
- {options, [{active, true}, {header, 1},
- binary | ClientOpts]}]),
+ {options, [{active, true}, binary, {header, 1}
+ | ClientOpts]}]),
ssl_test_lib:check_result(Server, ok, Client, ok),
@@ -1688,7 +1688,7 @@ header_decode_two_bytes_two_sent_active(Config) when is_list(Config) ->
Server = ssl_test_lib:start_server([{node, ClientNode}, {port, 0},
{from, self()},
{mfa, {?MODULE, server_header_decode_active,
- [Data, [$H, $e]]}},
+ [Data, [$H, $e | <<>>]]}},
{options, [{active, true}, binary,
{header,2}|ServerOpts]}]),
@@ -1697,7 +1697,7 @@ header_decode_two_bytes_two_sent_active(Config) when is_list(Config) ->
{host, Hostname},
{from, self()},
{mfa, {?MODULE, client_header_decode_active,
- [Data, [$H, $e]]}},
+ [Data, [$H, $e | <<>>]]}},
{options, [{active, true}, {header, 2},
binary | ClientOpts]}]),
@@ -1765,8 +1765,8 @@ header_decode_one_byte_passive(Config) when is_list(Config) ->
{from, self()},
{mfa, {?MODULE, client_header_decode_passive,
[Data, [11 | <<"Hello world">> ]]}},
- {options, [{active, false}, {header, 1},
- binary | ClientOpts]}]),
+ {options, [{active, false}, binary, {header, 1}
+ | ClientOpts]}]),
ssl_test_lib:check_result(Server, ok, Client, ok),
@@ -1822,7 +1822,7 @@ header_decode_two_bytes_two_sent_passive(Config) when is_list(Config) ->
Server = ssl_test_lib:start_server([{node, ClientNode}, {port, 0},
{from, self()},
{mfa, {?MODULE, server_header_decode_passive,
- [Data, [$H, $e]]}},
+ [Data, [$H, $e | <<>>]]}},
{options, [{active, false}, binary,
{header,2}|ServerOpts]}]),
@@ -1831,7 +1831,7 @@ header_decode_two_bytes_two_sent_passive(Config) when is_list(Config) ->
{host, Hostname},
{from, self()},
{mfa, {?MODULE, client_header_decode_passive,
- [Data, [$H, $e]]}},
+ [Data, [$H, $e | <<>>]]}},
{options, [{active, false}, {header, 2},
binary | ClientOpts]}]),
@@ -2124,10 +2124,14 @@ client_header_decode_passive(Socket, Packet, Result) ->
%% option and the bitsynax makes it obsolete!
check_header_result([Byte1 | _], [Byte1]) ->
ok;
+check_header_result([Byte1 | _], [Byte1| <<>>]) ->
+ ok;
check_header_result([Byte1, Byte2 | _], [Byte1, Byte2]) ->
ok;
-check_header_result(_,Got) ->
- exit({?LINE, Got}).
+check_header_result([Byte1, Byte2 | _], [Byte1, Byte2 | <<>>]) ->
+ ok;
+check_header_result(Expected,Got) ->
+ exit({?LINE, {Expected, Got}}).
server_line_packet_decode(Socket, Packet) when is_binary(Packet) ->
[L1, L2] = string:tokens(binary_to_list(Packet), "\n"),
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-16 01:50:40 +0000