aboutsummaryrefslogtreecommitdiffstats
path: root/lib/ssl/test
AgeCommit message (Collapse)Author
2015-03-20Merge branch 'ia/ssl/cuddle-openssl'Ingela Anderton Andin
* ia/ssl/cuddle-openssl: Add workaround for problems with s_client defaults
2015-03-19Add workaround for problems with s_client defaultsIngela Anderton Andin
2015-03-17ssl: Add TLS-ALPN supportLoïc Hoguin
This commit adds support for RFC7301, application-layer protocol negotiation. ALPN is the standard based approach to the NPN extension, and is required for HTTP/2. ALPN lives side by side with NPN and provides an equivalent feature but in this case it is the server that decides what protocol to use, not the client. When both ALPN and NPN are sent by a client, and the server is configured with both ALPN and NPN options, ALPN will always take precedence. This behavior can also be found in the OpenSSL implementation of ALPN. ALPN and NPN share the ssl:negotiated_protocol/1 function for retrieving the negotiated protocol. The previously existing function ssl:negotiated_next_protocol/1 still exists, but has been deprecated and removed from the documentation. The tests against OpenSSL require OpenSSL version 1.0.2+.
2015-03-09ssl: fix white box testsIngela Anderton Andin
2015-03-09ssl: Integrate public_key CRL verification with the ssl applicationIngela Anderton Andin
2015-03-09Merge branch 'ia/ssl/soft-upgrade-test-server-bug-workaround'Ingela Anderton Andin
* ia/ssl/soft-upgrade-test-server-bug-workaround: ssl: Workaround test server halfwordemulator bug
2015-03-06ssl: Workaround test server halfwordemulator bugIngela Anderton Andin
As the halfwordemulator is deprecated just skip the test case during the circumstances that provokes the bug.
2015-03-05Merge branch 'maint'Ingela Anderton Andin
Conflicts: lib/ssl/src/ssl_cipher.erl lib/ssl/test/ssl_basic_SUITE.erl
2015-03-02ssl: Implement support for TLS_FALLBACK_SCSVIngela Anderton Andin
2015-02-17Merge branch 'ia/ssl/soft-upgrade-test'Ingela Anderton Andin
* ia/ssl/soft-upgrade-test: ssl: Prepare for 18 ssl: Add soft upgrade test suite
2015-02-17Merge branch 'maint'Ingela Anderton Andin
2015-02-17ssl: erlang:timestamp -> os:timestampIngela Anderton Andin
Complements commit 450773958165539951cd431a9233ce7666ec20e2
2015-02-13ssl: Add soft upgrade test suiteIngela Anderton Andin
2015-02-06Merge branch 'maint'Ingela Anderton Andin
Conflicts: lib/ssl/doc/src/ssl_app.xml lib/ssl/src/ssl_manager.erl
2015-02-06ssl: Improve PEM cache by validating entriesIngela Anderton Andin
The PEM cache is now validated by a background process, instead of always keeping it if it is small enough and clearing it otherwhiss. That strategy required that small caches where cleared by API function if a file changes on disk. However document the clearing API function as it can still be usefull.
2015-02-02Merge branch 'maint'Ingela Anderton Andin
2015-01-30ssl: Remove selfsigned anchor certificate from the certificate chainIngela Anderton Andin
A selfsigned trusted anchor should not be in the certifcate chain passed to the certificate path validation. Conflicts: lib/ssl/src/ssl_certificate.erl
2015-01-23ssl: Remove default support for RC4 ciphersIngela Anderton Andin
2015-01-23ssl: Reenable padding check for TLS-1.0 and provide backwards compatibleIngela Anderton Andin
disable option
2015-01-23ssl: Remove sslv3 from the default supported protocol versionsIngela Anderton Andin
2015-01-23ssl: Reenable padding check for TLS-1.0 and provide backwards compatibleIngela Anderton Andin
disable option Conflicts: lib/ssl/src/ssl_cipher.erl lib/ssl/src/ssl_record.erl lib/ssl/src/tls_record.erl lib/ssl/test/ssl_cipher_SUITE.erl
2014-12-29Merge branch 'lemenkov/use_os_getenv_2'Marcus Arendt
* lemenkov/use_os_getenv_2: fix missing include Start using os:getenv/2 fun Introduce os:getenv/2
2014-12-15Start using os:getenv/2 funPeter Lemenkov
See #535 Signed-off-by: Peter Lemenkov <[email protected]>
2014-10-13Merge branch 'ia/ssl/seperate-clinet-server-session-table/OTP-11365'Ingela Anderton Andin
* ia/ssl/seperate-clinet-server-session-table/OTP-11365: ssl: Separate session cache for client and server
2014-10-13ssl: Separate session cache for client and serverIngela Anderton Andin
Even though in the most common case an erlang node will not be both client and server, it may happen (for instance when running the erlang ditribution over TLS). Also try to mitigate the affect of dumb clients that could cause a very lagre session cache on the client side that can cause long delays in the client. The server will have other means to handle a large session table and will not do any select operations on it anyhow.
2014-09-25Merge branch 'maint'Ingela Anderton Andin
2014-09-24ssl: Servers may include an empty SNI-extensionIngela Anderton Andin
2014-09-10Merge branch 'maint'Ingela Anderton Andin
2014-09-10ssl: One more workaround as tcp has no delivery gurantee on application levelIngela Anderton Andin
2014-09-09ssl, public_key: Add new option partial_chainIngela Anderton Andin
Check that the certificate chain ends with a trusted ROOT CA e.i. a self-signed certificate, but provide an option partial_chain to enable the application to define an intermediat CA as trusted. TLS RFC says: "unknown_ca A valid certificate chain or partial chain was received, but the certificate was not accepted because the CA certificate could not be located or couldn't be matched with a known, trusted CA. This message is always fatal." and also states: "certificate_list This is a sequence (chain) of certificates. The sender's certificate MUST come first in the list. Each following certificate MUST directly certify the one preceding it. Because certificate validation requires that root keys be distributed independently, the self-signed certificate that specifies the root certificate authority MAY be omitted from the chain, under the assumption that the remote end must already possess it in order to validate it in any case." X509 RFC says: "The selection of a trust anchor is a matter of policy: it could be the top CA in a hierarchical PKI, the CA that issued the verifier's own certificate(s), or any other CA in a network PKI. The path validation procedure is the same regardless of the choice of trust anchor. In addition, different applications may rely on different trust anchors, or may accept paths that begin with any of a set of trust anchors."
2014-09-03ssl: fix OpenSSL name filter in ssl testsAndreas Schultz
The OpenSSL name filter would fail for cipher suites that do not have an offcial OpenSSL name yet.
2014-09-03ssl: add PSK-GCM suitesAndreas Schultz
2014-09-03ssl: implement AES128-GCM suitesAndreas Schultz
2014-08-14Merge remote-tracking branch 'upstream/maint'Ingela Anderton Andin
2014-08-11ssl: Test ECDSA and improve test suite maintainabilityIngela Anderton Andin
Use generated certs instead of hard coded
2014-07-09Merge branch 'dgud/ssl/simple-bench'Dan Gudmundsson
* dgud/ssl/simple-bench: ssl: Bench use two nodes ssl: Add simple benchmarks
2014-07-07Merge branch 'dnet/parse_sni' into maintBruce Yinhe
* dnet/parse_sni: added SNI decode test to SSL handshake suite ssl: parse SNI in received client hello records OTP-12048
2014-07-01ssl: Bench use two nodesDan Gudmundsson
2014-06-12ssl: Test case stabilityIngela Anderton Andin
2014-06-05added SNI decode test to SSL handshake suiteAndrás Veres-Szentkirályi
2014-06-05ssl: Add simple benchmarksDan Gudmundsson
2014-06-04Merge branch 'RoadRunnr/ssl/fix-tests' into maintMarcus Arendt
* RoadRunnr/ssl/fix-tests: SSL: fix OpenSSL known renegotiation bug detection SSL: in tests, filter ssl client ciphers for version compatibility
2014-06-03SSL: always filter the full list of supported ciphers against the supported ↵Andreas Schultz
algorithms With the addition of more ciphers that are not supported in all configurations, using a manually prefiltered cipher list (e.g. EC vs. non-EC ciphers) becomes to complex. Replace the manual split with ssl_cipher:filter_suites/1 in all places. Conflicts: lib/ssl/src/ssl.erl lib/ssl/src/tls_v1.erl
2014-05-28SSL: fix OpenSSL known renegotiation bug detectionAndreas Schultz
The OpenSSL detection match would actually consider all 1.0.1 versions as affected when really only 1.0.1 - 1.0.1c are.
2014-05-28SSL: in tests, filter ssl client ciphers for version compatibilityAndreas Schultz
Some psk and some not yet supported anonymous suites are only supported with TLS version >= 1.2. This adds them to the tests and makes sure that they are not tested on TLS versions that do not support them.
2014-05-27ssl: Correct test SUITEIngela Anderton Andin
2014-05-26ssl: Add ssl options to listen options trackerIngela Anderton Andin
2014-05-12Merge branch 'ia/ssl/inherit/OTP-11897' into maintIngela Anderton Andin
* ia/ssl/inherit/OTP-11897: ssl: Handle socket option inheritance when pooling of accept sockets is used
2014-05-09ssl: Handle socket option inheritance when pooling of accept sockets is usedIngela Anderton Andin
Implement a listen socket tracker process that holds the emulated socket options so that it is possible to implement a destructive ssl:setopts on SSL/TLS listen sockets without changing the options of the internal socket as we want that socket to have the internal socket option values.
2014-05-07ssl: SSL/TLS version input list shall not be order dependentIngela Anderton Andin