aboutsummaryrefslogtreecommitdiffstats
path: root/lib/ssl/src
AgeCommit message (Collapse)Author
2016-09-12Merge branch 'ferd/bypass-pem-cache/PR-1143/OTP-13883' into maintIngela Anderton Andin
* ferd/bypass-pem-cache/PR-1143/OTP-13883: ssl: Add documentation of bypass_pem_cache application environment configuration ssl: Add new benchmarks to skip file for normal testing Adding PEM cache bypass benchmark entries Fixing CRL searching in cache bypass Add option to bypass SSL PEM cache
2016-09-05dtls: fix encoding of client hello cookieAndreas Schultz
2016-09-05dtls: Prepare start of DTLS connection manager with SSL appAndreas Schultz
2016-09-05ssl: Refactor to use maps for the connection statesIngela Anderton Andin
2016-09-05ssl, dtls: Refactor sni handlingIngela Anderton Andin
2016-09-05dtls: Add close/5Ingela Anderton Andin
2016-09-05dtls: Add renegotiate/2Ingela Anderton Andin
2016-09-05dtls: Add protocol event handlingIngela Anderton Andin
2016-09-05ssl: Refactor code so that tls and dtls can share more codeIngela Anderton Andin
We want to share more alert and application data handling code. Some of the application data handling code, packet handling, will not be relevant for dtls, but this code can be excluded from dtls by options checking.
2016-09-05ssl, dtls: Disable V2 compatibility clause from ↵Ingela Anderton Andin
ssl_handshake:update_handshake_history This proably a much bigger problem for DTLS than TLS, but should be disabled for both unless explicitly configured for TLS.
2016-09-05ssl: Make sure common code for TLS and DTLS uses the TLS VersionIngela Anderton Andin
When protocol version is proagated from the DTLS connection processes state into general ssl functions it must be converted to the corresponding TLS version.
2016-09-05ssl: remove unused RecordCB argument from master_secretAndreas Schultz
Conflicts: lib/ssl/src/ssl_handshake.erl
2016-09-05dtls: Add reinit_handshake_data/1 to dtlsIngela Anderton Andin
The callback is invoke before entering state 'connection'. It allows a connection module to remove data from the connection state that is no longer needed (e.g. handshake history).
2016-09-05dtls: replace tls_record with RecordCB in connection_infoAndreas Schultz
Conflicts: lib/ssl/src/ssl_connection.erl
2016-09-05Fix version numbers and dependenciesRaimo Niskanen
2016-08-31Merge branch 'raimo/gen_statem-callback_mode/OTP-13752' into maintRaimo Niskanen
* raimo/gen_statem-callback_mode/OTP-13752: ssl: Upgrade suite testing skipped if stdlib upgrade is required Fix version numbers and dependencies Conflicts: lib/ssl/src/ssl.appup.src lib/ssl/vsn.mk
2016-08-31ssl: Gracefulness behaviour when receiving partially malformed messagesIngela Anderton Andin
2016-08-29ssl: Remove clause that postponed unexpected messagesIngela Anderton Andin
2016-08-25Fix version numbers and dependenciesRaimo Niskanen
2016-08-24Merge branch 'raimo/gen_statem-callback_mode/OTP-13752' into maintRaimo Niskanen
* raimo/gen_statem-callback_mode/OTP-13752: Include trap_exit in server skeletons Improve sys debug Handle exceptions in init/1 and callback_mode/0 Clarify error values Doc fixes Rewrite SSH for gen_statem M:callback_mode/0 Rewrite SSL for gen_statem M:callback_mode/0 Rewrite Tools for gen_statem M:callback_mode/0 Rewrite gen_statem docs for M:callback_mode/0 Rewrite gen_statem TCs for M:callback_mode/0 Rewrite gen_statem for M:callback_mode/0
2016-08-22Fixing CRL searching in cache bypassFred Hebert
2016-08-19Add option to bypass SSL PEM cacheFred Hebert
The current SSL implementation has a PEM cache running through the ssl manager process, whose primary role is caching CA chains from files on disk. This is intended as a way to save on disk operation when the requested certificates are often the same, and those cache values are both time-bound and reference-counted. The code path also includes caching the Erlang-formatted certificate as decoded by the public_key application The same code path is used for DER-encoded certificates, which are passed in memory and do not require file access. These certificates are cached, but not reference-counted and also not shared across connections. For heavy usage of DER-encoded certificates, the PEM cache becomes a central bottleneck for a server, forcing the decoding of every one of them individually through a single critical process. It is also not clear if the cache remains useful for disk certificates in all cases. This commit adds a configuration variable for the ssl application (bypass_pem_cache = true | false) which allows to open files and decode certificates in the calling connection process rather than the manager. When this action takes place, the operations to cache and return data are replaced to strictly return data. To provide a transparent behaviour, the 'CacheDbRef' used to keep track of the certificates in the cache is replaced by the certificates itself, and all further lookup functions or folds can be done locally. This has proven under benchmark to more than triple the performance of the SSL application under load (once the session cache had also been disabled).
2016-08-09ssl: Conform to dialyzer specIngela Anderton Andin
2016-08-09Merge branch 'maint-19' into maintLukas Larsson
Conflicts: lib/ssl/src/ssl.appup.src
2016-08-02Rewrite SSL for gen_statem M:callback_mode/0Raimo Niskanen
2016-07-26Merge branch 'lemenkov/kernel/fix-register_ipv6_epmd/PR-1129/OTP-13770' into ↵Björn-Egil Dahlberg
maint * lemenkov/kernel/fix-register_ipv6_epmd/PR-1129/OTP-13770: Respect -proto_dist switch while connection to EPMD
2016-07-25Merge branch 'maint-18' into maintRaimo Niskanen
Conflicts: OTP_VERSION erts/doc/src/notes.xml erts/vsn.mk lib/common_test/doc/src/notes.xml lib/common_test/vsn.mk lib/ssl/doc/src/notes.xml lib/ssl/src/ssl.appup.src lib/ssl/vsn.mk lib/stdlib/test/ets_SUITE.erl otp_versions.table
2016-07-21Merge branch 'raimo/ssl/version-selection/maint-18/OTP-13753' into ↵Raimo Niskanen
raimo/ssl/version-selection/maint-19/OTP-13753 Conflicts: lib/ssl/vsn.mk lib/ssl/src/ssl.appup.src
2016-07-21Improve version selectionRaimo Niskanen
Use the list of versions that the server allows and among those choose the highest version that is not higher than the client's version. Note that this chosen version might be lower than the client's version, but is used to improve interoperability. Patch suggested by Dimitry Borisov refering to RFC 5246 appendix E.1.
2016-07-17Respect -proto_dist switch while connection to EPMDPeter Lemenkov
Signed-off-by: Peter Lemenkov <[email protected]>
2016-07-08ssl: Correct handling of signature algorithm selectionIngela Anderton Andin
In TLS-1.2 the selection of the servers algorithms and the the possible selection of algorithms for the client certificate verify message have different requirements.
2016-06-16ssl: Add new public_key to runtime dependenciesIngela Anderton Andin
Due to 5268c7b957c30c31e551f197463cdd55a792ea69
2016-06-15Merge branch 'ingela/ssl/dtls-next-step-flights/OTP-13678'Ingela Anderton Andin
* ingela/ssl/dtls-next-step-flights/OTP-13678: dtls: Avoid dialyzer errors dtls: add implementation for msg sequence dtls: Remove TODO dtls: sync dtls_record DTLS version and crypto handling with TLS dtls: handle Hello and HelloVerify's in dtls_handshake dtls: rework/simplify DTLS fragment decoder dtls: add support first packet and HelloVerifyRequest dtls: sync handle_info for connection close with TLS dtls: sync handling of ClientHello with TLS dtls: rework handshake flight encodeing dtls: implement next_tls_record dtls: sync init and initial_state with tls_connection dtls: update start_fsm for new ssl_connection API ssl: introduce the notion of flights for dtls and tls ssl: move available_signature_algs to ssl_handshake
2016-06-14Merge branch 'legoscia/ssl_crl_hash_dir-bis/PR-982/OTP-13530'Ingela Anderton Andin
* legoscia/ssl_crl_hash_dir-bis/PR-982/OTP-13530: Skip crl_hash_dir_expired test for LibreSSL Add ssl_crl_hash_dir module Function for generating OpenSSL-style name hashes Add public_key:pkix_match_dist_point Improve formatting for crl_{check,cache} options Add issuer arg to ssl_crl_cache_api lookup callback Conflicts: lib/public_key/test/public_key_SUITE.erl
2016-06-13dtls: Avoid dialyzer errorsIngela Anderton Andin
Make real solution later. For now we want to move forward without dialyzer errors.
2016-06-13dtls: add implementation for msg sequenceAndreas Schultz
Conflicts: lib/ssl/src/dtls_connection.erl lib/ssl/src/ssl_record.erl
2016-06-13dtls: Remove TODOIngela Anderton Andin
2016-06-13dtls: sync dtls_record DTLS version and crypto handling with TLSAndreas Schultz
2016-06-13dtls: handle Hello and HelloVerify's in dtls_handshakeAndreas Schultz
2016-06-13dtls: rework/simplify DTLS fragment decoderAndreas Schultz
changed: * initialize deocder state when needed * remove retransmission indicator support
2016-06-13dtls: add support first packet and HelloVerifyRequestAndreas Schultz
The actual user of this API is the UDP socket multiplexer which will be added later. Conflicts: lib/ssl/src/dtls_connection.erl
2016-06-13dtls: sync handle_info for connection close with TLSAndreas Schultz
2016-06-13dtls: sync handling of ClientHello with TLSAndreas Schultz
2016-06-13dtls: rework handshake flight encodeingAndreas Schultz
The MSS might change between sending the a flight and possible resend. We therefore have to be able to fragment the records differently for resent. Encoding and fragmenting of handshake record therefor needs to be done independently. With this change the handshake is encoded to it's full length first, then queued to a flight. The fragmentation is handled during assembly of the flights datagram. Conflicts: lib/ssl/src/dtls_connection.erl
2016-06-13dtls: implement next_tls_recordAndreas Schultz
Conflicts: lib/ssl/src/dtls_connection.erl
2016-06-13dtls: sync init and initial_state with tls_connectionAndreas Schultz
Sync initial_state overall functionality with TLS and add a few DTLS specific initalizers. Conflicts: lib/ssl/src/dtls_connection.erl
2016-06-13dtls: update start_fsm for new ssl_connection APIAndreas Schultz
2016-06-13ssl: introduce the notion of flights for dtls and tlsAndreas Schultz
The flight concept was introduced by DTLS (RFC 4347) to optimize the packing of DTLS records into UDP packets. This change implments the flight concept in the the generic SSL connection logic and add the queue logic to the TLS and DTLS stack. The DTLS required resend handling is not implemented yet. While the flight handling is only required for DTSL, it turns out that the same mechanism can be usefull to TCP based TLS as well. With the current scheme each TLS record will be mapped into a separate TCP frame. This causes more TCP frames to be generate that necessary. On fast network this will have no impact, but reducing the number of frames and thereby the number of round trips can result in significant speedups on slow and unreliable networks. Conflicts: lib/ssl/src/tls_connection.erl
2016-06-13ssl: move available_signature_algs to ssl_handshakeAndreas Schultz
available_signature_algs is also needed for DTLS, move it into a shared place and export it. Conflicts: lib/ssl/src/tls_handshake.erl
2016-06-13Merge branch 'ingela/maint/ssl/max-session-table/OTP-13490' into maint-18Erlang/OTP
* ingela/maint/ssl/max-session-table/OTP-13490: ssl: Mitigate load increase when the whole session table is invalidated
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-06 04:39:36 +0000