aboutsummaryrefslogtreecommitdiffstats
path: root/lib/ssl
AgeCommit message (Collapse)Author
2018-07-19ssl: Update hello state (TLS 1.3)Péter Dimitrov
Update hello state to handle the "supported_versions" extension defined by TLS 1.3: - If "supported_versions" is present in ServerHello, the client will aboirt the handshake with an "illegal_parameter" alert. - If "supported_versions" is present in ClientHello, the server will select a version from "supported_versions" and ignore ClientHello.legacy_version. If it only supports versions greater than "supported_versions", the server aborts the handshake with a "protocol_version" alert. - If "supported_versions" is absent in ClientHello, the server negotiates the minimum of ClientHello.legacy_version and TLS 1.2. If it only supports version greater than ClientHello.legacy_version, the server aborts the handshake with a "protocol_version" alert. Change-Id: I16eef15d77bf21209c6cc103546ddddca518483b
2018-07-19ssl: Implement 'supported_versions' extensionPéter Dimitrov
Change-Id: I8bb015e97ab4c317ef380123cf94350ed509c36f
2018-07-19ssl: Sort supported versions in handle_optionsPéter Dimitrov
Sort supported versions (highest first) in handle options to reflect the order expected by TLS 1.3. Change-Id: I06bb43ac81eeaca681c122d815a024c8444e3726
2018-07-19ssl: Add experimental version 'tlsv1.3'Péter Dimitrov
- Add 'tlsv1.3' to the available versions. It can be used to trigger experimental behavior while implementing TLS 1.3. - Add dummy clauses for handling version {3,4} of TLS. - Update ssl_logger to handle unknown versions of TLS. Change-Id: I564ffa47dca18b59f0dc16c9809dfd7adaf2d333
2018-07-11Merge branch 'maint'Ingela Anderton Andin
2018-07-11Merge pull request #1869 from ↵Ingela Andin
IngelaAndin/ingela/ssl/unexpected-call/ERL-664/OTP-15174 ssl: Improve error handling
2018-07-10ssl: Make sure tls_ssl_accept_timeout has a clean startIngela Anderton Andin
2018-07-09ssl: Improve error handlingIngela Anderton Andin
When doing ssl:controlling_process on a ssl socket that has not performed the TLS/DTLS handshake that call will succeed even though the documentation stated otherwise. However if some other ssl option was incorrect the call would hang. Now {error, closed} will be returned in the latter case, which is logical independent on if it should succeed or not in the former case. The former case will continue to succeed, as it is not dependent of the TLS/DTLS connection being established, and the documentation is altered slightly to not explicitly disallow it. If the TLS/DTLS connection later fails and the socket mode is active, the new controlling process will be notified as expected.
2018-07-06Merge branch 'maint'Ingela Anderton Andin
2018-07-06Merge pull request #1867 from ↵Ingela Andin
IngelaAndin/ingela/ssl/no-ca-sign-restriction-TLS-1.2/ERL-381/OTP-15173 Ingela/ssl/no ca sign restriction tls 1.2/erl 381/otp 15173
2018-07-05Merge branch 'maint'Ingela Anderton Andin
2018-07-05ssl: Fix test case to only check relevant info for the testIngela Anderton Andin
2018-07-05ssl: Correct connection_information on ECC-curvesIngela Anderton Andin
2018-07-05ssl: No cipher suite sign restriction in TLS-1.2Ingela Anderton Andin
2018-07-05Merge branch 'maint'Ingela Anderton Andin
2018-07-04ssl: Do not use legacy formatIngela Anderton Andin
2018-07-04ssl: Add connection information on new cipher_suite formatIngela Anderton Andin
2018-07-04ssl: Add psk as anonymous key exchange in ssl_handshake:select_hashsign/5Ingela Anderton Andin
Failing to recognize psk as an anonymous key exchange would fail the connection when trying to decode an undefined certificate.
2018-07-02ssl: Prepare for releasePéter Dimitrov
Change-Id: I40b13b3dce5c70b65cb0963c6ce4175268174e02
2018-07-02ssl: Add documentation to the log_level optionPéter Dimitrov
Change-Id: Ibbb66f62c122cac2b1b6bd7f09cdaede4a86bd97
2018-07-02ssl: Add support for stateful loggingPéter Dimitrov
- Introduce stateful logging levels to the ssl application: The SSL option 'log_alert' sets log level to notice/warning if it is set to true/false. Default log level is notice. - Add new SSL option 'log_level' that overrides the value of 'log_alert'. Default value is notice. - 'log_level' debug triggers verbose logging of TLS protocol messages and logging of ignored alerts in DTLS. Change-Id: I28d3f4029a5d504ec612abe4b9ae0b7d9b115197
2018-06-20ssl: Add set_log_level/1Péter Dimitrov
- Add utility function for setting log level of ssl application modules. Change-Id: Iee278ada17b4d872a9891094b96ce5343bf0ade4
2018-06-20ssl: Rename logger_ssl_formatter to ssl_loggerPéter Dimitrov
Change-Id: I4aff56c95d7ea8c46db40b0fa0f6f9b43f00bf8a
2018-06-20ssl: Update domain filter, use log macrosPéter Dimitrov
Change-Id: Id52990a105c81373c7c6034df9a2675f9d0e429a
2018-06-20ssl: Add logging for TLS Handshake ProtocolPéter Dimitrov
- Add logging for TLS Handshake messages. - Remove version from the input map used in format/2. Change-Id: I1a8a3dbe5854d3b25cca33e9a6634ac9a53d5867
2018-06-20ssl: Add logging for TLS record protocolPéter Dimitrov
Change-Id: I18786a9a8523d0ec3d9ca37ad5b2284721c5c4a1
2018-06-20ssl: Use logger API instead of legacy error_loggerPéter Dimitrov
Change-Id: I04cb8e4c09b05fc9d7ead0dfae0d83286decdb74
2018-06-20ssl: Add initial ssl log formatterPéter Dimitrov
Change-Id: I649a686ee72fa8bbe1e1dbc44ed5ec2df9662b10
2018-06-20ssl: Define VSN macro in sourcePéter Dimitrov
Define VSN macro in source to remove syntax errors while editing the code. Change-Id: I508d16641cb65ec954fc3fcae90183fa297770da
2018-06-19Prepare releaseErlang/OTP
2018-06-18Merge remote-tracking branch 'origin/henrik/Update-copyright'Henrik Nord
* origin/henrik/Update-copyright: Update copyright year
2018-06-18Update copyright yearHenrik Nord
2018-06-18ssl: Document enhancementsIngela Anderton Andin
2018-06-14Merge branch 'ingela/ssl/21-enhanchment'Ingela Anderton Andin
* ingela/ssl/21-enhanchment: ssl: Add handle_continue/2 and document enhancements
2018-06-14ssl: Add handle_continue/2 and document enhancementsIngela Anderton Andin
* deprecation of ssl:ssl_accept/[1,2,3] * deprecation of ssl:cipher_suites/[0,1] * More consistent naming
2018-06-14Merge branch 'ingela/ssl/test-ecdh-check'Ingela Anderton Andin
* ingela/ssl/test-ecdh-check: ssl: Update interop conditions
2018-06-13ssl: Update interop conditionsIngela Anderton Andin
2018-06-12Merge branch 'peterdmv/ssl/suite_to_str/ERL-600/OTP-15106'Péter Dimitrov
* peterdmv/ssl/suite_to_str/ERL-600/OTP-15106: ssl: Add new API function suite_to_str/1 Change-Id: Icf214ece4e1d281da12b02dadc63d4a2ca346563
2018-06-11ssl: Add new API function suite_to_str/1Péter Dimitrov
Add new API function for converting cipher suite maps to their textual representation. Change-Id: I43681930b38e0f3bdb4dfccbf9e8895aa2d6a281
2018-06-11Merge branch 'raimo/better-TLS-distribution/OTP-15058'Raimo Niskanen
* raimo/better-TLS-distribution/OTP-15058: Test nodename whitelist Use public_key to verify client hostname
2018-06-08Test nodename whitelistRaimo Niskanen
2018-06-08Use public_key to verify client hostnameRaimo Niskanen
2018-06-08ssl: Add option customize_hostname_checkIngela Anderton Andin
2018-05-29Revert "Prepare release"Henrik
This reverts commit fd8e49b5bddceaae803670121b603b5eee8c5c08.
2018-05-25Prepare releaseErlang/OTP
2018-05-24Merge pull request #1821 from IngelaAndin/ingela/ssl/DTLS-transparancyIngela Andin
ssl: Generalize DTLS packet multiplexing OTP-14888
2018-05-23ssl: Generalize DTLS packet multiplexingIngela Anderton Andin
We want to prepare the code for more advanced DTLS usage and possibility to run over SCTP. First assumption was that the demultiplexer process "dtls listener" was needed for UDP only and SCTP could be made more TLS like. However the assumption seems not to hold. This commit prepares for customization possibilities.
2018-05-23Merge branch 'ingela/ssl/openssl-test-cuddle'Ingela Anderton Andin
* ingela/ssl/openssl-test-cuddle: ssl: anon test should use dh or ecdh anon keyexchange ssl: Cuddle no delivery guarantee at application level ssl: Cuddle timeout ssl: Correct option handling to OpenSSL
2018-05-21Merge branch 'lukas/ssl/fix_erl_epmd_usage/OTP-15086'Lukas Larsson
* lukas/ssl/fix_erl_epmd_usage/OTP-15086: ssl: Fix usage of erl_epmd in tls dist
2018-05-21ssl: Fix usage of erl_epmd in tls distLukas Larsson
Fixes: 662f3c7ba50ff8ec13d8
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-20 18:38:22 +0000