aboutsummaryrefslogtreecommitdiffstats
path: root/lib/ssl/src
AgeCommit message (Collapse)Author
2010-09-06Handling of path validation errors by the applicationIngela Anderton Andin
Changed the behavior of the verify_fun option so that the application can be responsible for handling path validation errors even on the server side. Also replaced the not yet documented validate_extensions_fun to be handled by the verify_fun instead. If the verify callback fun returns {fail, Reason}, the verification process is immediately stopped and an alert is sent to the peer and the TLS/SSL handshake is terminated. If the verify callback fun returns {valid, UserState}, the verification process is continued. If the verify callback fun always returns {valid, UserState}, the TLS/SSL handshake will not be terminated with respect to verification failures and the connection will be established. The verify callback fun will also be able to verify application specific extensions.
2010-09-03DER format in APIIngela Anderton Andin
Added support for inputing certificates and keys directly in DER format these options will override the pem-file options if specified.
2010-09-01Correction due to failure of inets tests.Ingela Anderton Andin
2010-09-01Empty certificate chainIngela Anderton Andin
Handling of unkown CA certificats was changed in ssl and public_key to work as intended. In the process of doing this some test cases has been corrected as they where wrong but happened to work together with the incorrect unknown CA handling.
2010-08-31Merge branch 'dgud/ssl/handskake_client_key/OTP-8793' into devDan Gudmundsson
* dgud/ssl/handskake_client_key/OTP-8793: Fix handshake problem with multiple messages in one packet
2010-08-27Fix receiving empty packets.Dan Gudmundsson
Empty packets where not delivered from ssl, it incorrectly assumed there was no data.
2010-08-26Fix handshake problem with multiple messages in one packetDan Gudmundsson
If hello and client_key_exchange message is sent together in the same packet, ssl can't handle it and closes the connection. Also fixed compiler warning.
2010-08-24Handling of {mode, list}Ingela Anderton Andin
Fixed handling of the option {mode, list} that was broken for some packet types for instance line.
2010-08-24Correct behaviour if {packet, line} and mode list are givenThomas Lachmann
This corrects the returned data to be in list format, not binary if both {packet, line} and list are set as option.
2010-08-24Merge branch 'ia/ssl-interop/OTP-8740' into devIngela Anderton Andin
* ia/ssl-interop/OTP-8740: Do not check the padding for TLS 1.0
2010-08-24Merge branch 'ia/public_key_api/OTP-8722' into devIngela Anderton Andin
* ia/public_key_api/OTP-8722: Revise the public_key API Resolved, version is now 0.8. Conflicts: lib/public_key/vsn.mk
2010-08-23Revise the public_key APIIngela Anderton Andin
Cleaned up and documented the public_key API to make it useful for general use.
2010-08-18Fix bug in ssl handshake protocol related to the choice of cipher suitesPaul Guyot
in client hello message when a client certificate is used The client hello message now always include ALL available cipher suites (or those specified by the ciphers option). Previous implementation would filter them based on the client certificate key usage extension (such filtering only makes sense for the server certificate).
2010-08-18Do not check the padding for TLS 1.0Ingela Anderton Andin
For interoperability reasons we do not check the padding in TLS 1.0 as it is not strictly required and breaks interopability with for instance Google.
2010-06-29The server now verifies the client certificate verify message correctly, ↵Ingela Anderton Andin
instead of causing a case-clause.
2010-06-23Added more specs and changed from using own min/2 funtion to erlang:min/2.Ingela Anderton Andin
2010-06-22Added more -spec definitions.Ingela Anderton Andin
2010-06-22Refreshed documentation to reflect the change of default implementation.Ingela Anderton Andin
Started to improve code documentation by using -spec directive, and some small refactorings to avoid ugly code.
2010-06-14OTP-8695 New ssl defaultIngela Anderton Andin
Ssl has now switched default implementation and removed deprecated certificate handling. All certificate handling is done by the public_key application.
2010-06-11OTP-8695 New ssl defaultIngela Anderton Andin
Ssl has now switched default implementation and removed deprecated certificate handling. All certificate handling is done by the public_key application.
2010-06-08Move dsa ticket to r14a releaseIngela Anderton Andin
(This is the merge of r13 version to r14_dev)
2010-06-07OTP-8587 DSA key supportIngela Anderton Andin
New ssl now support client/server-certificates signed by dsa keys.
2010-06-04Fixed handling of several ssl/tls packets arriving at the same time.Ingela Anderton Andin
This was broken during a refactoring of the code.
2010-05-28Cleaned codeIngela Anderton Andin
2010-05-28Hoops too quick to check in previous version, changed . to ;, compiled inIngela Anderton Andin
wrong shell!
2010-05-28Added misssing version check for client.Ingela Anderton Andin
2010-05-28Added missing padding check.Ingela Anderton Andin
2010-05-28Added missing Mac check.Ingela Anderton Andin
2010-05-28Added code to handle own alert in case MAC or padding check fails.Ingela Anderton Andin
2010-05-27Moved nodelay workaround for linux, as it seems to only work if you doIngela Anderton Andin
it before sending the fatal alert, even though documentation suggests the socket will be flushed on linux as an effect of setting the nodelay option.
2010-05-26Seems we need "nodelay socket flush" on some linux platforms after all.Ingela Anderton Andin
2010-05-26Added option list argument to the init function in ssl_session_cache_api.Ingela Anderton Andin
2010-05-25Enhancements and fixes due to coverage investegation.Ingela Anderton Andin
2010-05-25Enhanced protocol version handling.Ingela Anderton Andin
2010-05-24Fixed session validation bug thanks to cover.Ingela Anderton Andin
2010-05-21Clean up of codeIngela Anderton Andin
2010-05-21Decision not to support export cipher suites.Ingela Anderton Andin
2010-05-21Decision not to support DH and export cipher suites.Ingela Anderton Andin
2010-05-21Decision not to support DH and export cipher suites and clean up.Ingela Anderton Andin
2010-05-20Honor internal APIIngela Anderton Andin
2010-05-20Fixed internal APIIngela Anderton Andin
2010-05-18Commented out currently unsupported code. To be supported or removed in the ↵Ingela Anderton Andin
future.
2010-05-17Removed/commented out currently dead code.Ingela Anderton Andin
2010-05-11OTP-8568 RFC -5746Ingela Anderton Andin
New ssl now supports secure renegotiation as described by RFC 5746.
2010-04-29OTP-8588 Alert and packet handling improvmentIngela Anderton Andin
Alert handling has been improved to better handle unexpected but valid messages and the implementation is also changed to avoid timing related issues that could cause different error messages depending on network latency. Packet handling was sort of broken but would mostly work as expected when socket was in binary mode. This has now been fixed.
2010-04-19Prepare for releaseDan Gudmundsson
2010-04-17Reset inet optionsDan Gudmundsson
Temporary set the inet options on listen socket before doing accept so that the correct options will be inherited by the accept socket. Reset the options afterwards so that repeated use of listen socket get user set values.
2010-04-16Avoid race condition of early handshake messages, when socket is active mode ↵Dan Gudmundsson
is not false.
2010-04-14Enhanced error handlingIngela Anderton Andin
2010-04-13We currently do not support fixed DH. Removal of dead code.Ingela Anderton Andin
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-06 08:43:52 +0000