Age | Commit message (Collapse) | Author |
|
|
|
* ingela/ssl/DH/OTP-13636:
ssl: Stronger default DH prime
|
|
* legoscia/ssl/tls-dist-more-opts/PR-956/OTP-13429:
Quote curly brackets in command line options
Avoid disappearing ETS tables in ssl_dist_SUITE
Fix db handle for TLS distribution crl_cache opts
Fix ssl_dist_SUITE logging on Windows
More logging in ssl_dist_SUITE
TLS distribution: crl_check and crl_cache options
Allow passing verify_fun for TLS distribution
More informative malformed_ssl_dist_opt error
|
|
|
|
|
|
|
|
The selection of CA cert files in ssl_ECC_SUITE and ssl_test_lib
ought to be refactored, it is quite confusing.
But use this workaround until we get time to make a refactor.
|
|
* joedevivo/ssl/PR-1063/OTP-13635:
ssl:recv timeout() can be 0
|
|
Some shells i.e the bash emulating sh regard curly brackets
as special characters so e.g {a,b,{}} is expanded to a b {} which
is by erlang regarded as 3 arguments instead of a 3-tuple.
Other shells e.g Bourne classic /bin/sh, the ash/dash variants
and public domain Korn shell all avoid this surprise.
|
|
* ingela/ssl/test-timeouts:
ssl: Increase timeouts due to slow test machines
|
|
|
|
gen_tcp:recv allows this, and if you're doing something like
Transport:recv(Socket, 0, 0), TCP will work and SSL will exit with
function_clause
There were other cases of this throughout the module. This PR cleans
them all up.
|
|
We do not want error reports that can leek secret information
into the logs.
|
|
|
|
There are a lot of cases where `ssl` application just returns unhelpful
`handshake failure` or `internal error`. This patch tries to provide
better diagnostics so operator can debug his SSL misconfiguration
without doing hardcore erlang debugging.
Here is an example escript that incorrectly uses server certificate as a
client one:
https://gist.github.com/binarin/35c34c2df7556bf04c8a878682ef3d67
With the patch it is properly reported as an error in "extended key
usage".
|
|
|
|
* ingela/ssl/doc-enhancment/ERL-131:
ssl: Add default values and clarifications
|
|
|
|
* kennethlakin/beast-mitigation-options/PR-1041/OTP-13629:
ssl: Add BEAST mitigation selection option
|
|
Some legacy TLS 1.0 software does not tolerate the 1/n-1 content
split BEAST mitigation technique. This commit adds a beast_mitigation
SSL option (defaulting to one_n_minus_one) to select or disable the
BEAST mitigation technique.
Valid option values are (one_n_minus_one | zero_n | disabled).
|
|
If the -epmd_module flag has been specified on the command line, use
that module to register and look up node names instead of the default,
erl_epmd.
Also document this option.
|
|
* ingela/ssl-httpc/ERL-144:
ssl: Send correct close message
|
|
|
|
We want to avoid tests timeing out regularly on slow test machines.
|
|
|
|
We are working on including DTLS support. And we want to include
the contributed tests now before making planned enhancements to the
test suits.
|
|
Consolidate code that logs TLS/DTLS version during testing
into ssl_test_lib.
|
|
|
|
LibreSSL doesn't like it when we pass a negative number for the
-crlhours argument. I'm not sure if there is another way to make it
generate a CRL with expiry date in the past, so let's skip that test
in this case.
|
|
|
|
* ingela/ssl/cipher-suites-refactor:
ssl: Refactor to make code easier to understand
|
|
|
|
This reverts commit bd64ad8e15d66e48b36dbe3584315dd5cfc8b59a.
|
|
|
|
|
|
Turns out we can not count on the "hashsigns" sent by the client and
the supported "hashigns" sets to have required properties of ordsets.
|
|
* ingela/ssl/prepare-for-release:
ssl: Prepare for release
Conflicts:
lib/ssl/vsn.mk
|
|
* kennethlakin/tls-use-negotiated-prf/PR-1042/OTP-13546:
ssl: Use cipher suite's PRF in prf/5
|
|
|
|
Use the negotiated cipher suite's PRF algorithm in calls to
ssl:prf/5, rather than a hard-coded one.
For TLS 1.0 the PRF algorithm was hard-coded to MD5/SHA1. This
was correct 100% of the time.
For TLS 1.1 and 1.2 the PRF algorithm was hard-coded to SHA256.
This was correct only some of the time for TLS 1.2 and none of the
time for TLS 1.1. Because the TLS handshake code calls tls_v1:prf/5
through another path, the handshaking process used the negotiated
PRF and did not encounter this bug.
A new test (prf) has been added to ssl_basic_SUITE to guard against future
breakage.
|
|
Conflicts:
OTP_VERSION
lib/common_test/test/ct_hooks_SUITE_data/cth/tests/ct_update_config_SUITE.erl
lib/common_test/vsn.mk
|
|
* ingela/ssl-gen-statem/OTP-13464:
ssl: Adapt DTLS to gen_statem
ssl: Use gen_statem instead of gen_fsm
|
|
Active option was not handled correctly in all places. Dead code has
been removed.
|
|
DTLS is not in working mode yet, but the gen_statem rewrite should make
completion easier.
|
|
Also reduce timing issues in tests
|
|
|
|
* ingela/ssl-max-session-table/OTP-13490:
ssl: Adjust max table to work as expected from documentation
|
|
* ingela/ssl/signature_algs_bug:
ssl: Correct guard expression
|
|
* ingela/ssl/cipher_suites:
ssl: Correct cipher suites conversion
|
|
The guard should check that the TLS version is at least TLS-1.2.
|