| Age | Commit message (Collapse) | Author |
|---|
|
Add test that checks that the option inet_dist_listen_options is used
when starting a node with TLS distribution.
This test was adapted from inet_dist_options_options in
erl_distribution_SUITE.
|
|
Add test that checks that the options inet_dist_listen_min and
inet_dist_listen_max are used when starting a node with TLS
distribution.
|
|
The inet_dist_ options, such as min/max port numbers aren't used
with TLS distribution. This commits uses those settings in the
same way as they're used in inet_tcp_dist.erl
|
|
|
|
* legoscia/tls-dist-shutdown:
Adjust shutdown strategies for distribution over TLS
OTP-13134
|
|
|
|
willing to support
Refactor highest_protocol_version so that code is symmetrical with lowest_protocol_version. For clarity and possible future use cases of highest_protocol_version/2
|
|
Needed after the fix in 120975c4fcb57ecd14031ac046f483e56a3daa4d.
|
|
Run the 'basic' test with dist_nodelay set to false.
|
|
As described in the comments in the patch, doing a TLS handshake
requires the crypto module to be loaded. The crypto module needs the
code server to find its NIF library. However, there is a time window
between opening the listening ports for distribution and starting the
code server, and if we get an incoming connection in that time window,
the node would believe that it's alive, but it wouldn't actually
accept any more connections.
|
|
If ssl:ssl_accept/2 returns an error related to options, it's most
likely something we want to log. In particular, if the specified
certificate file doesn't exist, this is where the error ends up, so we
shouldn't just throw the error away.
|
|
Starting an SSL connection with a nonexistent keyfile will obviously
return an error:
> ssl:connect("www.google.com", 443, [{keyfile, "nonexistent"}]).
{error,{options,{keyfile,"nonexistent",{error,enoent}}}}
But it also generates an error report with the following backtrace:
** Reason for termination =
** {badarg,[{ets,select_delete,
[undefined,[{{{undefined,'_','_'},'_'},[],[true]}]],
[]},
{ets,match_delete,2,[{file,"ets.erl"},{line,700}]},
{ssl_pkix_db,remove_certs,2,[{file,"ssl_pkix_db.erl"},{line,243}]},
{ssl_connection,terminate,3,
[{file,"ssl_connection.erl"},{line,941}]},
{tls_connection,terminate,3,
[{file,"tls_connection.erl"},{line,335}]},
{gen_fsm,terminate,7,[{file,"gen_fsm.erl"},{line,610}]},
{gen_fsm,handle_msg,7,[{file,"gen_fsm.erl"},{line,532}]},
{proc_lib,init_p_do_apply,3,[{file,"proc_lib.erl"},{line,240}]}]}
This happens because the ssl_connection process receives its cert_db
while handling the {start, Timeout} message, but if the handshake
fails, the cert_db will never be inserted into the state data, and the
terminate function will use 'undefined' as an ETS table name.
Avoid this by checking for 'undefined' in the handle_trusted_certs_db
function.
|
|
The duplicate_name error returned from erl_epmd:register_node elicits a
particularly precise error message from net_kernel, so let's pass it
along to our caller.
Not doing this for the other things that could go wrong here, since for
those having the line number will likely aid debugging.
|
|
The previous commit - 7b93f5d8a224a0a076a420294c95a666a763ee60 fixed the macro
only in one place.
|
|
Change ssl_dist_sup to be considered as a supervisor with infinite
shutdown time.
Change the ssl_connection_dist instance of tls_connection_sup to have
infinite shutdown time.
This avoids spurious error messages when shutting down a node that
uses distribution over TLS.
|
|
Record field types have been modified due to commit 8ce35b2:
"Take out automatic insertion of 'undefined' from typed record fields".
|
|
In Erlang R16B03-1, I've been passing raw options to ssl:listen as
follows, and it's been working fine:
% The constants are defined elsewhere.
LOpts = [{raw, ?IPPROTO_TCP, ?TCP_MAXSEG, <<MSS:32/native>>} | ...],
{ok, LSocket} = ssl:listen(0, LOpts)
In Erlang 17.3, this fails with
{option_not_a_key_value_tuple,{raw,6,2,<<64,2,0,0>>}}
I originally reported this in
http://erlang.org/pipermail/erlang-questions/2014-October/081226.html
I need to pass this particular raw option to ssl:listen, because it
needs to be applied when the socket is first opened -- between inet:open
and prim_inet:listen -- it cannot be applied later by setopts. This
means that it needs to be done by inet_tcp:listen/2 -- well, actually by
inet:open/8, but...
Otherwise it's racey -- a client could connect between prim_inet:listen
and the setopts call. The MSS option is advertised in the SYN,ACK
packet, and can't be changed later.
|
|
|
|
To avoid test case failure due to test case setup timing issues.
Suspected problem is that the listen queue builds up to quickly in
client_unique_session test when running on slow computers.
|
|
=== OTP-18.1 ===
Changed Applications:
- compiler-6.0.1
- crypto-3.6.1
- debugger-4.1.1
- dialyzer-2.8.1
- diameter-1.11
- erts-7.1
- eunit-2.2.11
- hipe-3.13
- inets-6.0.1
- kernel-4.1
- mnesia-4.13.1
- odbc-2.11.1
- public_key-1.0.1
- sasl-2.6
- ssh-4.1
- ssl-7.1
- stdlib-2.6
- tools-2.8.1
- wx-1.5
Unchanged Applications:
- asn1-4.0
- common_test-1.11
- cosEvent-2.2
- cosEventDomain-1.2
- cosFileTransfer-1.2
- cosNotification-1.2
- cosProperty-1.2
- cosTime-1.2
- cosTransactions-1.3
- edoc-0.7.17
- eldap-1.2
- erl_docgen-0.4
- erl_interface-3.8
- et-1.5.1
- gs-1.6
- ic-4.4
- jinterface-1.6
- megaco-3.18
- observer-2.1
- orber-3.8
- os_mon-2.4
- ose-1.1
- otp_mibs-1.1
- parsetools-2.1
- percept-0.8.11
- reltool-0.7
- runtime_tools-1.9.1
- snmp-5.2
- syntax_tools-1.7
- test_server-3.9
- typer-0.9.9
- webtool-0.9
- xmerl-1.3.8
Conflicts:
OTP_VERSION
erts/vsn.mk
|
|
|
|
|
|
|
|
|
|
Soft upgrade test did not work as expected due to that the upgrade
frame work keeps the control of the test case process to itself,
so we need a proxy process to receive messages from ssl test framework.
|
|
|
|
|
|
|
|
We do not want ssl_soft_upgrade_SUITE to fail, but for now
we do not know the details of these changes so we use a general
fallback for now.
|
|
|
|
* ia/ssl/register-unique-session/OTP-12980:
ssl: Correct return value of default session callback module
|
|
|
|
Add possibility to downgrade an SSL/TLS connection to a tcp connection,
and give back the socket control to a user process.
Add application setting to be able to change fatal alert shutdown
timeout, also shorten the default timeout. The fatal alert timeout is
the number of milliseconds between sending of a fatal alert and
closing the connection. Waiting a little while improves the
peers chances to properly receiving the alert so it may
shutdown gracefully.
|
|
ssl_session_cache:select_session/2 returned [sesionid(), #session{}]
instead of #session{} as the API demands.
This was wrongly compensated for in the code in one place making it
look like everything was good. But the client check for unique session
would always fail, potentially making the client session table grow
a lot and causing long setup times.
|
|
|
|
* ia/pr/801/OTP-12974:
Accept 'ECPrivateKey' as a ssl key option
|
|
|
|
|
|
Correct merge that went wrong.
|
|
|
|
* ericmj/patch-1:
Fix formatting of depth option
|
|
TLS hash_sign algorithms may have proprietary values see
http://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml
We should add callbacks to let applications handle them.
But for now we do not want to crash if they are present and
let other algorithms be negotiated.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
* ia/ssl/modern-timetrap:
ssl: Make init functions fail if make_certs:all fails
ssl: Avoid sleep
ssl: modernize timetrap handling
|
|
|
