aboutsummaryrefslogtreecommitdiffstats
path: root/lib/ssl/src/ssl_connection.erl
AgeCommit message (Collapse)Author
2012-12-06Merge branch 'maint'Ingela Anderton Andin
Conflicts: erts/emulator/sys/vxworks/sys.c erts/vsn.mk lib/ssl/src/ssl_connection.erl lib/ssl/test/ssl_basic_SUITE.erl
2012-12-06ssl: Cancel non expired timersIngela Anderton Andin
2012-12-06ssl: Fix recv after timeout expiredIngela Anderton Andin
Reset state so that "recv data" is not sent as "active data" after a recv timed out and no new recv has been called.
2012-12-06ssl: Timeout handling changed so that the fsm-process will terminate if the ↵Ingela Anderton Andin
ssl:ssl_accept/[2,3] or ssl:connect/[3,4] timeout expires. Add missing function clause to handle timeout during handshake. The missing clause had the effect that the timeout was wrongly discarded. Also add an extra test case for the recv timeout in addition to the one in ssl_packet_SUITE. The missing functions clause was introduced in 8a789189. This commit changed the timeout implementation, the previous implememtation could cause other type of problems as the timeout was client side.
2012-11-19Merge remote branch 'upstream/maint'Ingela Anderton Andin
2012-11-19ssl: Fix bug in match expression found by DialyzerIngela Anderton Andin
Code should handle case the there is some undelivered data left on the socket when peer close signal is received. It is unlikely that this happens during normal testing.
2012-11-14Merge remote branch 'upstream/maint'Ingela Anderton Andin
Conflicts: lib/ssl/src/ssl_connection.erl
2012-11-13ssl: Make sure that the ssl connection process will not hang in terminate ↵Ingela Anderton Andin
function. Avoid doing gen_tcp/inet socket operations in terminate if socket is already closed. Call gen_tcp:recv/3 in the "data delivery workaround" to avoid hanging.
2012-11-09Merge remote branch 'upstream/maint'Ingela Anderton Andin
* upstream/maint: ssl: Do not use gen_fsm:sync_send_all_state_event/3 timeout
2012-11-09ssl: Do not use gen_fsm:sync_send_all_state_event/3 timeoutIngela Anderton Andin
The gen_fsm:sync_send_all_state_event/3 timout is a client side timeout. If timeouts are needed we want them to be server side timeouts.
2012-10-01ssl: Improve #sslsocket{} APIIngela Anderton Andin
A #sslsocket{} contains the fsm pid and value that was previously set to old_ssl or new_ssl to make the transition period smoother. Now that old ssl is not supported any more we use this field to store the inet socket reference instead. This enables some API functions to return quicker as they do not need to communicate with the fsm-process.
2012-09-20ssl: Dialyzer fixes and code cleaningIngela Anderton Andin
Types in a record where wrongly type specified, did not include undefined. Make them comments for now, maybe we will specify internal records with dialyzer types later, but as the other record fields are not specified at the moment, with dialyzer types, make the code consistent.
2012-09-20ssl: Support for SSL Next Protocol NegotiationBen Murphy
* http://technotes.googlecode.com/git/nextprotoneg.html
2012-08-23ssl: Clean up of code thanks to dialyzerIngela Anderton Andin
2012-08-22ssl: Use crypto:strong_rand_bytes if possibleIngela Anderton Andin
2012-08-22ssl & public_key: Add use of more "sha-rsa oids"Ingela Anderton Andin
2012-08-22ssl: Fix inet header option to behave as in inetIngela Anderton Andin
This options is useless and should be deprecated. But we behave as inet does for now!
2012-08-22ssl: TLS 1.2: fix hash and signature handlingAndreas Schultz
with TLS 1.2 the hash and signature on a certify message can differ from the defaults. So we have to make sure to always use the hash and signature algorithm indicated in the handshake message
2012-08-22ssl: Add Signature Algorithms hello extension from TLS 1.2Andreas Schultz
This is also avoids triggering some bugs in OpenSSL.
2012-08-22ssl: Signture type bugIngela Anderton Andin
2012-08-22ssl: Make signature handling version dependantAndreas Schultz
TLS 1.2 introduces changes on how signatures are calculate and encoded. This makes the signature handling version aware
2012-08-22ssl: Fix PRF logicIngela Anderton Andin
2012-08-22ssl: make PRF function selectableAndreas Schultz
TLS 1.2 allows to negotiate the used PRF, additional the default PRF uses a different hash. This change make the PRF selectable and hardwires the PRF for TLS < 1.2
2012-08-22ssl: Add TLS version paramter to verify_dh_paramsAndreas Schultz
dh parameter verification is done differently with TLS 1.2. Prepare for that by passing the verion to verify_dh_params.
2012-08-22ssl: Add TLS version to dec_hs/2Andreas Schultz
TLS 1.2 changes the layout of several handshake records. This adds the TLS version to dec_hs/2 so it can decode those.
2012-08-22ssl: Add TLS version to ssl_handshake:key_exchange/3Andreas Schultz
TLS 1.2 changed the way digital signatures are done. key_exchange/3 needs to pass the version to it.
2012-08-22ssl: Calculate handshake hash only when neededAndreas Schultz
TLS/SSL version before 1.2 always used a MD5/SHA combination for the handshake hashes. With TLS 1.2 the default hash is SHA256 and it is possible to negotiate a different hash. This change delays the calculation of the handshake hashes until they are really needed. At that point the hash to use should be known. For now MD5/SHA is still hard coded.
2012-06-15ssl: Fix bug in the handling of remote connection closure of {active,false} ↵Ingela Anderton Andin
ssl sockets.
2012-06-08ssl: Avoid second bottleneck in supervisorIngela Anderton Andin
Do proc_lib:spawn_link instead of proc_lib:start_link as synchronized init is not used/needed anyway.
2012-06-08ssl: File handling optimizationIngela Anderton Andin
Avoid cach validation with file:file_info/2 as this i too expensive and causes a bottleneck in the file server. Instead we expose a new API function ssl:clear_pem_cache/0 to deal with the problem. As we think it will be of occasional use and the normal case is that the cache will be valid we think it is the right thing to do. Convert file paths to binary representation in the ssl API module to avoid uncessarry calls in file later on. Also add sanity checks for openssl versions in testsuite due to new openssl bugs.
2012-06-08ssl: Simpler PEM cacheIngela Anderton Andin
2012-06-08ssl: Refactored for readabilityIngela Anderton Andin
Instance of state variable that are "updated" in a function is called for example State0 and the last instance, that should be returned, is called State possible intermidiat versions are suffixed by increasing numbers. State0 may be rturned in error cases. Avoid nesting case statments.
2012-06-08ssl: Use md5 as file ref id instead of filenamesDan Gudmundsson
Aviods storing a lot of data
2012-06-08ssl: Renegotiate updates session id in gen_fsm stateIngela Anderton Andin
The session id keept in the connection processes state must be updated to be the id selected by ssl_handshake:client_hello, failing to do so will cause a crash if the session is not reused.
2012-06-08ssl: Move and avoid ets:select bottleneck in clientIngela Anderton Andin
Do not use ssl_manager process for selecting an id. It's unnecessary to involve the manager process at all on the client side.
2012-06-08ssl: Avoid supervior bottleneckIngela Anderton Andin
This is done by using proc_lib and gen_fsm:enter_loop so that supervisor will not have to wait for the relative long initialization of an ssl connection process before starting another connection process.
2012-03-27Corrected dialyzer specs and exported some dialyzer specsIngela Anderton Andin
2012-03-05Some protocols (e.g. EAP-PEAP, EAP-TLS, EAP-TTLS) that use TLS asAndreas Schultz
transport layer need to generate additional application specific key material. One way to generate such material is to use the TLS PRF and key material from the TLS session itself. This change makes it possible to use a TLS sessions PRF either with the session internal or caller supplied key material to generate additional key material.
2011-12-01Callback specs now handled by -callback directive in the behaviour module.Ingela Anderton Andin
2011-11-28If a passive receive was ongoing during a renegotiation the processIngela Anderton Andin
evaluating ssl:recv could be left hanging for ever.
2011-11-28Send ssl_closed notification to active ssl user when a tcp error occursIngela Anderton Andin
2011-11-23Implementation of 1/n-1 splitting countermeasure Rizzo/Duong-BeastIngela Anderton Andin
The code is refactored and improved to make it easier to insert the 1/n-1 splitting countermeasure Rizzo/Duong-Beast that is really done in one function clause in ssl:record_split_bin/3
2011-11-21Mitigate Computational DoS attackIngela Anderton Andin
2011-11-15Improved session cleanup handlingIngela Anderton Andin
Added session status "new" to mark sessions that are in the session database to reserve the session id but not resumable yet and that we want to separate from sessions that has been invalidated for further reuse.
2011-11-15Fix badarith in ssl_session:validate_session/2Ingela Anderton Andin
The time_stamp filed is now initated in the connection process init function, so that invalidations of sessions due to handshake failiures, will not cause sessions in the session table to have an uninitiated time_stamp field.
2011-11-01Added PKCS-8 support in sslIngela Anderton Andin
2011-10-06Merge branch 'ia/ssl/remove-old-ssl/OTP-7048'Ingela Anderton Andin
* ia/ssl/remove-old-ssl/OTP-7048: Remove old ssl implementation and deprecated function ssl:peercert/1 Conflicts: lib/ssl/test/Makefile
2011-09-16Remove old ssl implementation and deprecated function ssl:peercert/1Ingela Anderton Andin
2011-09-16Merge remote branch 'upstream/dev' into majorIngela Anderton Andin
* upstream/dev: Support explicit use of packet option httph and httph_bin
2011-09-16Support explicit use of packet option httph and httph_binIngela Anderton Andin