aboutsummaryrefslogtreecommitdiffstats
path: root/lib/ssl
AgeCommit message (Collapse)Author
2010-12-20Merge branch 'maint-r14' into devIngela Anderton Andin
2010-12-17Update release notesErlang/OTP
2010-12-17Cleaned up meaningless code discovered thanks to coverIngela Anderton Andin
2010-12-16Prepare for releaseIngela Anderton Andin
2010-12-16Cache invalidation and consistent user closingIngela Anderton Andin
Added cache invalidation control of ssl certificates so that sessions will not be reused if file content is changed. There was a glitch in ssl:close that made it possible to to get eaddrinuse even though reuseadder-option was used. Also improved tests for better user-close handling.
2010-12-16Cache invaldation first version does not break old test casesIngela Anderton Andin
2010-12-06Prepare releaseErlang/OTP
2010-12-02Prepare for releaseIngela Anderton Andin
2010-12-01Merge branch 'ia/ssl/test-improvments' into devIngela Anderton Andin
2010-11-30Updated tests to avoid test case failure for non interesting reasonsIngela Anderton Andin
Such reason is that pulic key generation or mnesia:stop might occasionally take very long time.
2010-11-30Fixed guard and test caseIngela Anderton Andin
Data to sign and verify should be inputed as binaries. Also cleaned up and moved some dialyzer specs.
2010-11-29Fixed broken links in the documentation and dialyzer warningsIngela Anderton Andin
2010-11-18Added alert in stream cipher case.Ingela Anderton Andin
Also changed alert to BAD_RECORD_MAC as: "differentiating between bad_record_mac and decryption_failed alerts may permit certain attacks against CBC mode as used in TLS [CBCATT]. It is preferable to uniformly use the bad_record_mac alert to hide the specific type of the error." Also cleaned up the code and changed a few other alert reasons in according to alert descriptions in the TLS RFC 4346. And added function terminate_alert/3 so that we can differentiate between a crash in ssl (a bug in our code) and a crash in the application using ssl.
2010-11-10Added "DECRYPTION_FAILED ALERT" for block decipher failure.Ingela Anderton Andin
Also fixed incorrect dialyzer spec.
2010-10-21Merge branch 'ia/ssl/certificate-verify/wrong-key-method/OTP-8897' into devBjörn Gustavsson
* ia/ssl/certificate-verify/wrong-key-method/OTP-8897: Correct handling of client certificate verify message Conflicts: lib/ssl/src/ssl_handshake.erl
2010-10-20Correct handling of client certificate verify messageIngela Anderton Andin
When checking the client certificate verify message the server used the wrong algorithm identifier to determine the signing algorithm, causing a function clause error in the public_key application when the key-exchange algorithm and the public key algorithm of the client certificate happen to differ.
2010-10-07Anonymous cipher suitesIngela Anderton Andin
For testing purposes ssl now also support some anonymous cipher suites when explicitly configured to do so. Also moved session cache tests to its own suite, so that timeout of end_per_testcase when the mnesia is used as session cache will not affect other test cases.
2010-10-01Merge branch 'maint-r14' into devIngela Anderton Andin
Conflicts: lib/public_key/src/pubkey_cert.erl
2010-09-29Prepare releaseErlang/OTP
2010-09-29Merge branch 'ia/ssl-and-public_key/verify_fun_peer_awarness/OTP-8873' into ↵Erlang/OTP
maint-r14 * ia/ssl-and-public_key/verify_fun_peer_awarness/OTP-8873: Peer awarness
2010-09-29Peer awarnessIngela Anderton Andin
Changed the verify fun so that it differentiate between the peer certificate and CA certificates by using valid_peer or valid as the second argument to the verify fun. It may not always be trivial or even possible to know when the peer certificate is reached otherwise.
2010-09-27Merge branch 'ia/ssl-and-public_key/backwards-compatibility/OTP-8858' into devIngela Anderton Andin
* ia/ssl-and-public_key/backwards-compatibility/OTP-8858: Backwards compatibility Conflicts: lib/ssl/src/ssl_certificate_db.erl Use short INFO-message. Debugging information can be fairly easily recreated so we do not want to clutter the logs.
2010-09-24Backwards compatibilityIngela Anderton Andin
Changed implementation to retain backwards compatibility for old option {verify, 0} that shall be equivalent to {verify, verify_none}, also separate the cases unknown CA and selfsigned peer cert, and restored return value of deprecated function public_key:pem_to_der/1.
2010-09-21Handling of DSA key parametersIngela Anderton Andin
DSS-Params may be null in a certificate as it can inherit the parameters. Also ignore CA-certs that do not follow ASN-1 spec in RFC 5280.
2010-09-17Merge branch 'ia/fix-dialyzer-specs' into devIngela Anderton Andin
* ia/fix-dialyzer-specs: Corrected and added dialyzer specs
2010-09-15Corrected and added dialyzer specsIngela Anderton Andin
2010-09-13Prepare releaseOTP_R14BErlang/OTP
2010-09-10Improved certificate extension handlingIngela Anderton Andin
Added the functionality so that the verification fun will be called when a certificate is considered valid by the path validation to allow access to eachs certificate in the path to the user application. Removed clause that only check that a extension is not critical, it does alter the verification rusult only withholds information from the application. Try to verify subject-AltName, if unable to verify it let application try.
2010-09-09Merge branch 'ia/ssl-http-error-test' into devIngela Anderton Andin
* ia/ssl-http-error-test: Add test suite for packet http_error.
2010-09-09Merge branch 'ia/ssl-4.0.1/documentation' into devIngela Anderton Andin
* ia/ssl-4.0.1/documentation: Updated documentation for ssl-4.0.1
2010-09-09Updated documentation for ssl-4.0.1Ingela Anderton Andin
2010-09-07Add test suite for packet http_error.Ingela Anderton Andin
2010-09-07Add missed DER dh option.Ingela Anderton Andin
2010-09-06Handling of path validation errors by the applicationIngela Anderton Andin
Changed the behavior of the verify_fun option so that the application can be responsible for handling path validation errors even on the server side. Also replaced the not yet documented validate_extensions_fun to be handled by the verify_fun instead. If the verify callback fun returns {fail, Reason}, the verification process is immediately stopped and an alert is sent to the peer and the TLS/SSL handshake is terminated. If the verify callback fun returns {valid, UserState}, the verification process is continued. If the verify callback fun always returns {valid, UserState}, the TLS/SSL handshake will not be terminated with respect to verification failures and the connection will be established. The verify callback fun will also be able to verify application specific extensions.
2010-09-03DER format in APIIngela Anderton Andin
Added support for inputing certificates and keys directly in DER format these options will override the pem-file options if specified.
2010-09-02Merge branch 'dgud/ssl-commit-example-certs' into devDan Gudmundsson
* dgud/ssl-commit-example-certs: Cleanup ssl configure parts Remove cert building from Makefiles Checkin example certs instead of generating them.
2010-09-01Merge branch 'maint-r13' into devBjörn Gustavsson
* maint-r13: Remove copyright headers in vsn.mk files Conflicts: lib/appmon/vsn.mk lib/erl_docgen/vsn.mk lib/inets/vsn.mk lib/kernel/vsn.mk lib/reltool/vsn.mk lib/ssl/vsn.mk lib/stdlib/vsn.mk lib/tools/vsn.mk lib/tv/vsn.mk lib/xmerl/vsn.mk
2010-09-01Remove cert building from MakefilesDan Gudmundsson
2010-09-01Remove copyright headers in vsn.mk filesBjörn Gustavsson
Copyright notices serve no useful purpose in vsn.mk files, and only complicate scripts that automatically update version numbers.
2010-09-01Checkin example certs instead of generating them.Dan Gudmundsson
Avoiding cross-compilation and other problems by keeping them in git instead of generating them each time. I think the reason to generate them was that a valid date limitation, now that we can specify the date, I have set them to be valid for 15 years.
2010-09-01Correction due to failure of inets tests.Ingela Anderton Andin
2010-09-01Empty certificate chainIngela Anderton Andin
Handling of unkown CA certificats was changed in ssl and public_key to work as intended. In the process of doing this some test cases has been corrected as they where wrong but happened to work together with the incorrect unknown CA handling.
2010-08-31Add tests for crypto RC4 bugIngela Anderton Andin
Changed test so that the test cases testing all different ciphers also sends data so that that the calls to crypto cipher functions are also tested.
2010-08-31Merge branch 'dgud/ssl/handskake_client_key/OTP-8793' into devDan Gudmundsson
* dgud/ssl/handskake_client_key/OTP-8793: Fix handshake problem with multiple messages in one packet
2010-08-31Merge branch 'dgud/ssl/empty_msg_problem/OTP-8790' into devDan Gudmundsson
* dgud/ssl/empty_msg_problem/OTP-8790: Fix receiving empty packets.
2010-08-27Fix SSL build failure when building in minimal source treeRickard Green
Building in a source tree without prebuilt platform independent build results failed on the SSL examples when building on Windows.
2010-08-27Fix receiving empty packets.Dan Gudmundsson
Empty packets where not delivered from ssl, it incorrectly assumed there was no data.
2010-08-27Fix SSL build failure when building in minimal source treeRickard Green
Building in a source tree without prebuilt platform independent build results failed on the SSL examples when cross building. This has been solved by not building the SSL examples during a cross build.
2010-08-26Fix handshake problem with multiple messages in one packetDan Gudmundsson
If hello and client_key_exchange message is sent together in the same packet, ssl can't handle it and closes the connection. Also fixed compiler warning.
2010-08-24Handling of {mode, list}Ingela Anderton Andin
Fixed handling of the option {mode, list} that was broken for some packet types for instance line.
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-09 13:14:23 +0000