| Age | Commit message (Collapse) | Author |
|---|
|
The server code erroneously took the list of curves supported by the
client from it's own hello extension, effectively breaking curve
selection all together.
Also the default fallback secp256k1 curve is not supported by
all clients. secp256r1 is recommended as part of the NIST Suite B
cryptographic suites. The chances are much better that all clients
support it, so use that as fallback.
|
|
|
|
|
|
|
|
|
|
|
|
Also phase in tls module as main API instead of ssl. To
make API clearer. As TLS is the new protocol name.
Maybe keep some API functions in ssl
|
|
Conflicts:
lib/ssl/src/ssl.app.src
lib/ssl/src/ssl_manager.erl
|
|
As the file 'lib/ssl/src/ssl_srp_primes.hrl' only contains a
specification of a `srp_parameters` type that isn't exported and also
isn't referenced anywhere (neither in the code nor in the
documentation), the type specification (and hence the file as well) can
be removed.
|
|
|
|
|
|
|
|
|
|
|
|
Change API so public_key:generate_key/compute_key are
only called with "public_key arguments" otherwhise crypto functions
can be called explicitly.
|
|
Avoid unneccessary conversion as the input format is an oid (according
to ASN1 spec) we do not need to handle it as an atom in ssl.
|
|
|
|
|
|
|
|
This problem was not caught by the test suites since all PSK and SRP
suites where always tested with certificates. Split those tests into
test with and without certificates.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
follow up enhancments done in commit
e56167dd6ca8d37d26ea7f19933691a3bda41113
Make sure format_error return good strings. Replace confusing legacy atoms
with more descriptive atoms.
|
|
|
|
|
|
* ia/ssl/incompatible-error-msg/OTP-10451:
ssl: Enhance error handling
|
|
Remove filter mechanisms that made error messages backwards compatible
with old ssl but hid information about what actually happened.
This does not break the documented API however other reason
terms may be returned, so code that matches on the reason part of
{error, Reason} may fail.
|
|
server key encoding depends to the negotiated key exchange. Before
the encoding was limited to diffie-hellman keys. This changes allows
to select the key structure to decode and verify. It also consolidates
the transport encoding of the parameters into one place.
|
|
ssl_handshake and ssl_connection where doing essentially the same when
checking a public key signature. This unify both into a single function
|
|
Conflicts:
erts/emulator/sys/vxworks/sys.c
erts/vsn.mk
lib/ssl/src/ssl_connection.erl
lib/ssl/test/ssl_basic_SUITE.erl
|
|
|
|
Reset state so that "recv data" is not sent as "active data" after a recv
timed out and no new recv has been called.
|
|
ssl:ssl_accept/[2,3] or ssl:connect/[3,4] timeout expires.
Add missing function clause to handle timeout during handshake.
The missing clause had the effect that the timeout was wrongly
discarded. Also add an extra test case for the recv timeout
in addition to the one in ssl_packet_SUITE.
The missing functions clause was introduced in 8a789189.
This commit changed the timeout implementation, the previous implememtation
could cause other type of problems as the timeout was client side.
|
|
|
|
Code should handle case the there is some undelivered data
left on the socket when peer close signal is received. It is
unlikely that this happens during normal testing.
|
|
Conflicts:
lib/ssl/src/ssl_connection.erl
|
|
function.
Avoid doing gen_tcp/inet socket operations in terminate if socket
is already closed. Call gen_tcp:recv/3 in the "data delivery workaround"
to avoid hanging.
|
|
* upstream/maint:
ssl: Do not use gen_fsm:sync_send_all_state_event/3 timeout
|
|
The gen_fsm:sync_send_all_state_event/3 timout is a client side timeout.
If timeouts are needed we want them to be server side timeouts.
|
|
A #sslsocket{} contains the fsm pid and value that was previously set to
old_ssl or new_ssl to make the transition period smoother. Now that old
ssl is not supported any more we use this field to store the inet socket
reference instead. This enables some API functions to return quicker
as they do not need to communicate with the fsm-process.
|
|
Types in a record where wrongly type specified, did not include
undefined. Make them comments for now, maybe we will specify internal
records with dialyzer types later, but as the other record fields are
not specified at the moment, with dialyzer types, make the code
consistent.
|
|
* http://technotes.googlecode.com/git/nextprotoneg.html
|
|
|
