aboutsummaryrefslogtreecommitdiffstats
path: root/lib/ssl/src/dtls_connection.erl
AgeCommit message (Collapse)Author
2018-12-14Merge branch 'maint'Ingela Anderton Andin
Conflicts: lib/ssl/src/dtls_connection.erl lib/ssl/src/ssl_connection.erl lib/ssl/src/ssl_connection.hrl lib/ssl/src/tls_connection.erl lib/ssl/src/tls_record.erl
2018-12-13ssl: Remove no longer needed functionsIngela Anderton Andin
As the stop wrapper functions are no longer needed after tls_sender that altered the behaviour of the TLS distribution code.
2018-12-12ssl: Remove unnecessary internal eventIngela Anderton Andin
2018-12-12ssl: Clean codeIngela Anderton Andin
Rename Connection:handle_common_event Connection:handle_protocol_record removing use of unnecessary argument and making code easier to understand.
2018-12-12ssl: Add static_env recordIngela Anderton Andin
State values created at init
2018-12-04Merge branch 'maint'Ingela Anderton Andin
Conflicts: lib/ssl/src/dtls_connection.erl lib/ssl/src/ssl_connection.erl lib/ssl/src/tls_connection.erl
2018-12-03ssl: Fix error handling in function passive_receiveIngela Anderton Andin
Also avoid code duplication Conflicts: lib/ssl/src/dtls_connection.erl lib/ssl/src/tls_connection.erl
2018-12-03ssl: Internaly use {active, N}Ingela Anderton Andin
Make next_record an internal help function to next_event and avoid duplicate calls to tls_socket:setopts for setting the active option.
2018-09-27ssl: Generalize extensions handlingIngela Anderton Andin
As TLS 1.3 introduces more extensions in other places than in hello messages we like to have generalize extension handling encode/decode with some hello wrappers. Also extend property tests of handshake encod/decode
2018-08-30Merge branch 'maint'Ingela Anderton Andin
Conflicts: lib/ssl/src/ssl_connection.erl lib/ssl/src/tls_connection.erl
2018-08-27ssl: Add new sender process for TLS state machineIngela Anderton Andin
Separate sending and receiving when using TCP as transport as prim_inet:send may block which in turn may result in a deadlock between two Erlang processes communicating over TLS, this is especially likely to happen when running Erlang distribution over TLS.
2018-07-11Merge branch 'maint'Ingela Anderton Andin
2018-07-09ssl: Improve error handlingIngela Anderton Andin
When doing ssl:controlling_process on a ssl socket that has not performed the TLS/DTLS handshake that call will succeed even though the documentation stated otherwise. However if some other ssl option was incorrect the call would hang. Now {error, closed} will be returned in the latter case, which is logical independent on if it should succeed or not in the former case. The former case will continue to succeed, as it is not dependent of the TLS/DTLS connection being established, and the documentation is altered slightly to not explicitly disallow it. If the TLS/DTLS connection later fails and the socket mode is active, the new controlling process will be notified as expected.
2018-07-02ssl: Add support for stateful loggingPéter Dimitrov
- Introduce stateful logging levels to the ssl application: The SSL option 'log_alert' sets log level to notice/warning if it is set to true/false. Default log level is notice. - Add new SSL option 'log_level' that overrides the value of 'log_alert'. Default value is notice. - 'log_level' debug triggers verbose logging of TLS protocol messages and logging of ignored alerts in DTLS. Change-Id: I28d3f4029a5d504ec612abe4b9ae0b7d9b115197
2018-06-20ssl: Use logger API instead of legacy error_loggerPéter Dimitrov
Change-Id: I04cb8e4c09b05fc9d7ead0dfae0d83286decdb74
2018-06-18Update copyright yearHenrik Nord
2018-05-23ssl: Generalize DTLS packet multiplexingIngela Anderton Andin
We want to prepare the code for more advanced DTLS usage and possibility to run over SCTP. First assumption was that the demultiplexer process "dtls listener" was needed for UDP only and SCTP could be made more TLS like. However the assumption seems not to hold. This commit prepares for customization possibilities.
2018-04-27Merge branch 'ingela/dtls/abbreviated'Ingela Anderton Andin
* ingela/dtls/abbreviated: dtls: Trigger resend in abbreviated handshake if change_cipher_spec is received to early.
2018-04-27dtls: Trigger resend in abbreviated handshake if change_cipher_specIngela Anderton Andin
is received to early.
2018-04-24ssl: Add new API functionsIngela Anderton Andin
2018-04-24ssl: Prepare to replace ssl:ssl_accept with ssl:handshakeIngela Anderton Andin
2018-03-09ssl: Remove interoperability option v2_hello_compatibleIngela Anderton Andin
2018-01-24Merge branch 'maint'Ingela Anderton Andin
2018-01-23ssl: Add record version sanity checkIngela Anderton Andin
2017-12-20Merge branch 'maint'Ingela Anderton Andin
2017-12-20dtls: Add handling of lost key exchange in cipher stateIngela Anderton Andin
2017-12-20ssl: Correct DTLS client close handlingIngela Anderton Andin
2017-12-20Merge branch 'maint'Ingela Anderton Andin
2017-12-18dtls: Use repeat_state to make sure retransmission timer is resetIngela Anderton Andin
2017-12-04Polish SSL distributionRaimo Niskanen
2017-11-24ssl: Add gracefullness to dtls codeIngela Anderton Andin
Also make tls code a little more direct for easier uderstanding
2017-11-24ssl: Use genstamtem properlyIngela Anderton Andin
2017-11-24ssl: Fix incorrect merge conflict resolutionIngela Anderton Andin
When handling merging of back ported Counter measurements for Bleichenbacher attack a line from DTLS was accidentally lost.
2017-11-23Merge branch 'maint-20' into maintIngela Anderton Andin
* maint-20: Updated OTP version Update release notes Update version numbers public_key: verify ip (both v4 and v6) public_key: Added IP4 address checks to hostname_verification tests ssl: Fix test cases to work on all test platforms public_key: Fix dialyzer spec ssl: Sessions must be registered with SNI if exists ssl: Extend hostname check to fallback to checking IP-address public_key, ssl: Handles keys so that APIs are preserved correctly ssl: Use ?FUNCTION_NAME ssl: Prepare for release ssl: Countermeasurements for Bleichenbacher attack Conflicts: lib/public_key/doc/src/public_key.xml lib/public_key/test/public_key_SUITE.erl lib/public_key/test/public_key_SUITE_data/pkix_verify_hostname_subjAltName_IP.pem lib/public_key/test/public_key_SUITE_data/verify_hostname_ip.conf lib/ssl/src/dtls_connection.erl lib/ssl/src/ssl_connection.erl lib/ssl/src/ssl_handshake.erl
2017-11-22Merge branch ↵Erlang/OTP
'ingela/maint-20/ssl/extend-hostname-check/OTP-14632/OTP-14655/OTP-14766' into maint-20 * ingela/maint-20/ssl/extend-hostname-check/OTP-14632/OTP-14655/OTP-14766: ssl: Fix test cases to work on all test platforms public_key: Fix dialyzer spec ssl: Sessions must be registered with SNI if exists ssl: Extend hostname check to fallback to checking IP-address public_key, ssl: Handles keys so that APIs are preserved correctly ssl: Use ?FUNCTION_NAME
2017-11-16ssl: Align code of main modules implementing the gen_statem behaviourIngela Anderton Andin
2017-11-16dtls: Add state specIngela Anderton Andin
2017-11-09 ssl: Use ?FUNCTION_NAMEIngela Anderton Andin
Use ?FUNCTION_NAME macro to enhance code as we will not back-port this version of the ssl application to versions pre OTP 19.
2017-11-09ssl: Countermeasurements for Bleichenbacher attackIngela Anderton Andin
2017-10-16 ssl: Use ?FUNCTION_NAMEIngela Anderton Andin
Use ?FUNCTION_NAME macro to enhance code as we will not back-port this version of the ssl application to versions pre OTP 19.
2017-09-30dtls: Compleate DTLS renegotiate implementationIngela Anderton Andin
2017-08-14dtls: Customize alert handling for DTLS over UDPIngela Anderton Andin
From RFC 6347: 4.1.2.7. Handling Invalid Records Unlike TLS, DTLS is resilient in the face of invalid records (e.g., invalid formatting, length, MAC, etc.). In general, invalid records SHOULD be silently discarded, thus preserving the association; however, an error MAY be logged for diagnostic purposes. Implementations which choose to generate an alert instead, MUST generate fatal level alerts to avoid attacks where the attacker repeatedly probes the implementation to see how it responds to various types of error. Note that if DTLS is run over UDP, then any implementation which does this will be extremely susceptible to denial-of-service (DoS) attacks because UDP forgery is so easy. Thus, this practice is NOT RECOMMENDED for such transports.
2017-07-07ssl: Enhance error loggingIngela Anderton Andin
2017-06-14Merge remote-tracking branch 'ingela/ingela/dtls/client-hello-verify/ERL-434'Hans Nilsson
2017-06-13dtls: Make HelloVerifyRequest version adhere to RFCIngela Anderton Andin
ERL-434 RFC6347 says about hello_verify_request version field as follow https://tools.ietf.org/html/rfc6347#page-16 The server_version field has the same syntax as in TLS. However, in order to avoid the requirement to do version negotiation in the initial handshake, DTLS 1.2 server implementations SHOULD use DTLS version 1.0 regardless of the version of TLS that is expected to be negotiated. But current DTLS server responses DTLS1.2 instead of DTLS1.0.
2017-06-13ssl: Correct epoch handlingIngela Anderton Andin
Consideration of which Epoch a message belongs to is needed in the dtls_connection:next_record function too.
2017-06-07dtls: Fetch next DTLS record when dropping resent handshake dataIngela Anderton Andin
2017-06-07dtls: Use enter actionsIngela Anderton Andin
Using enter actions for retransmission timers makes the code easier to understand. Previously the retransmission timer was incorrectly started in the connection state. Using enter actions feels like a cleaner approach than bloating the state with more flags.
2017-05-23dtls: Check for retransmitted changes_cipher_spec messagesIngela Anderton Andin
Make sure to use current epoch as input to send_handshake_flight.
2017-05-23dtls: Ask for next DTLS record when disregarding future packetIngela Anderton Andin
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-26 07:51:24 +0000