This document describes the changes made to the SSL application.
Extend check for undelivered data at closing, could under some circumstances fail to deliverd all data that was acctualy recivied.
Own Id: OTP-15412
Correct handling of empty server SNI extension
Own Id: OTP-15168
Correct cipher suite handling for ECDHE_*, the incorrect handling could cause an incorrrect suite to be selected and most likly fail the handshake.
Own Id: OTP-15203
Improve cipher suite handling correcting ECC and TLS-1.2 requierments. Backport of solution for ERL-641
Own Id: OTP-15178
Option keyfile defaults to certfile and should be trumped with key. This failed for engine keys.
Own Id: OTP-15193
Proper handling of clients that choose to send an empty answer to a certificate request
Own Id: OTP-15050
Fix filter function to not incorrectly exclude AEAD cipher suites
Own Id: OTP-14981
Optimization of bad merge conflict resolution causing dubble decode
Own Id: OTP-14843
Restore error propagation to OTP-19.3 behaviour, in OTP-20.2 implementation adjustments to gen_statem needed some further adjustments to avoid a race condition. This could cause a TLS server to not always report file path errors correctly.
Own Id: OTP-14852
Corrected RC4 suites listing function to regard TLS version
Own Id: OTP-14871
Fix alert handling so that unexpected messages are logged and alerted correctly
Own Id: OTP-14919
Correct handling of anonymous cipher suites
Own Id: OTP-14952
Added new API functions to facilitate cipher suite handling
Own Id: OTP-14760
Correct TLS_FALLBACK_SCSV handling so that this special flag suite is always placed last in the cipher suite list in accordance with the specs. Also make sure this functionality is used in DTLS.
Own Id: OTP-14828
Add TLS record version sanity check for early as possible error detection and consistency in ALERT codes generated
Own Id: OTP-14892
Packet options cannot be supported for unreliable transports, that is, packet option for DTLS over udp will not be supported.
Own Id: OTP-14664
Ensure data delivery before close if possible. This fix is related to fix in PR-1479.
Own Id: OTP-14794
The crypto API is extended to use private/public keys stored in an Engine for sign/verify or encrypt/decrypt operations.
The ssl application provides an API to use this new engine concept in TLS.
Own Id: OTP-14448
Implemented renegotiation for DTLS
Own Id: OTP-14563
A new command line option
Own Id: OTP-14657
TLS sessions must be registered with SNI if provided, so that sessions where client hostname verification would fail can not connect reusing a session created when the server name verification succeeded.
Own Id: OTP-14632
An erlang TLS server configured with cipher suites
using rsa key exchange, may be vulnerable to an Adaptive
Chosen Ciphertext attack (AKA Bleichenbacher attack)
against RSA, which when exploited, may result in
plaintext recovery of encrypted messages and/or a
Man-in-the-middle (MiTM) attack, despite the attacker not
having gained access to the server’s private key
itself.
Exploiting this vulnerability to perform plaintext recovery of encrypted messages will, in most practical cases, allow an attacker to read the plaintext only after the session has completed. Only TLS sessions established using RSA key exchange are vulnerable to this attack.
Exploiting this vulnerability to conduct a MiTM attack requires the attacker to complete the initial attack, which may require thousands of server requests, during the handshake phase of the targeted session within the window of the configured handshake timeout. This attack may be conducted against any TLS session using RSA signatures, but only if cipher suites using RSA key exchange are also enabled on the server. The limited window of opportunity, limitations in bandwidth, and latency make this attack significantly more difficult to execute.
RSA key exchange is enabled by default although least prioritized if server order is honored. For such a cipher suite to be chosen it must also be supported by the client and probably the only shared cipher suite.
Captured TLS sessions encrypted with ephemeral cipher suites (DHE or ECDHE) are not at risk for subsequent decryption due to this vulnerability.
As a workaround if default cipher suite configuration was used you can configure the server to not use vulnerable suites with the ciphers option like this:
that is your code will look somethingh like this:
Thanks to Hanno Böck, Juraj Somorovsky and Craig Young for reporting this vulnerability.
Own Id: OTP-14748
If no SNI is available and the hostname is an IP-address also check for IP-address match. This check is not as good as a DNS hostname check and certificates using IP-address are not recommended.
Own Id: OTP-14655
Max session table works correctly again
Own Id: OTP-14556
Customize alert handling for DTLS over UDP to mitigate DoS attacks
Own Id: OTP-14078
Improved error propagation and reports
Own Id: OTP-14236
ECDH-ECDSA key exchange supported, was accidently dismissed in earlier versions.
Own Id: OTP-14421
Correct close semantics for active once connections. This was a timing dependent bug the resulted in the close message not always reaching the ssl user process.
Own Id: OTP-14443
TLS-1.2 clients will now always send hello messages on its own format, as opposed to earlier versions that will send the hello on the lowest supported version, this is a change supported by the latest RFC.
This will make interoperability with some newer servers smoother. Potentially, but unlikely, this could cause a problem with older servers if they do not adhere to the RFC and ignore unknown extensions.
*** POTENTIAL INCOMPATIBILITY ***
Own Id: OTP-13820
Allow Erlang/OTP to use OpenSSL in FIPS-140 mode, in order to satisfy specific security requirements (mostly by different parts of the US federal government).
See the new crypto users guide "FIPS mode" chapter about building and using the FIPS support which is disabled by default.
(Thanks to dszoboszlay and legoscia)
Own Id: OTP-13921 Aux Id: PR-1180
Implemented DTLS cookie generation, required by spec, instead of using a hardcoded value.
Own Id: OTP-14076
Implement sliding window replay protection of DTLS records.
Own Id: OTP-14077
TLS client processes will by default call public_key:pkix_verify_hostname/2 to verify the hostname of the connection with the server certificates specified hostname during certificate path validation. The user may explicitly disables it. Also if the hostname can not be derived from the first argument to connect or is not supplied by the server name indication option, the check will not be performed.
Own Id: OTP-14197
Extend connection_information/[1,2] . The values session_id, master_secret, client_random and server_random can no be accessed by connection_information/2. Note only session_id will be added to connection_information/1. The rational is that values concerning the connection security should have to be explicitly requested.
Own Id: OTP-14291
Chacha cipher suites are currently not tested enough to be most preferred ones
Own Id: OTP-14382
Basic support for DTLS that been tested together with OpenSSL.
Test by providing the option {protocol, dtls} to the ssl API functions connect and listen.
Own Id: OTP-14388
Fix alert handling so that unexpected messages are logged and alerted correctly
Own Id: OTP-14929
An erlang TLS server configured with cipher suites
using rsa key exchange, may be vulnerable to an Adaptive
Chosen Ciphertext attack (AKA Bleichenbacher attack)
against RSA, which when exploited, may result in
plaintext recovery of encrypted messages and/or a
Man-in-the-middle (MiTM) attack, despite the attacker not
having gained access to the server’s private key
itself.
Exploiting this vulnerability to perform plaintext recovery of encrypted messages will, in most practical cases, allow an attacker to read the plaintext only after the session has completed. Only TLS sessions established using RSA key exchange are vulnerable to this attack.
Exploiting this vulnerability to conduct a MiTM attack requires the attacker to complete the initial attack, which may require thousands of server requests, during the handshake phase of the targeted session within the window of the configured handshake timeout. This attack may be conducted against any TLS session using RSA signatures, but only if cipher suites using RSA key exchange are also enabled on the server. The limited window of opportunity, limitations in bandwidth, and latency make this attack significantly more difficult to execute.
RSA key exchange is enabled by default although least prioritized if server order is honored. For such a cipher suite to be chosen it must also be supported by the client and probably the only shared cipher suite.
Captured TLS sessions encrypted with ephemeral cipher suites (DHE or ECDHE) are not at risk for subsequent decryption due to this vulnerability.
As a workaround if default cipher suite configuration was used you can configure the server to not use vulnerable suites with the ciphers option like this:
that is your code will look somethingh like this:
Thanks to Hanno Böck, Juraj Somorovsky and Craig Young for reporting this vulnerability.
Own Id: OTP-14748
Remove debug printout
Own Id: OTP-14396
Correct active once emulation, for TLS. Now all data received by the connection process will be delivered through active once, even when the active once arrives after that the gen_tcp socket is closed by the peer.
Own Id: OTP-14300
Corrected termination behavior, that caused a PEM cache bug and sometimes resulted in connection failures.
Own Id: OTP-14100
Fix bug that could hang ssl connection processes when failing to require more data for very large handshake packages. Add option max_handshake_size to mitigate DoS attacks.
Own Id: OTP-14138
Improved support for CRL handling that could fail to work as intended when an id-ce-extKeyUsage was present in the certificate. Also improvements where needed to distributionpoint handling so that all revocations actually are found and not deemed to be not determinable.
Own Id: OTP-14141
A TLS handshake might accidentally match old sslv2 format and ssl application would incorrectly aborted TLS handshake with ssl_v2_client_hello_no_supported. Parsing was altered to avoid this problem.
Own Id: OTP-14222
Correct default cipher list to prefer AES 128 before 3DES
Own Id: OTP-14235
Move PEM cache to a dedicated process, to avoid making the SSL manager process a bottleneck. This improves scalability of TLS connections.
Own Id: OTP-13874
List of possible anonymous suites, never supported by default, where incorrect for some TLS versions.
Own Id: OTP-13926
Experimental version of DTLS. It is runnable but not complete and cannot be considered reliable for production usage.
Own Id: OTP-12982
Add API options to handle ECC curve selection.
Own Id: OTP-13959
A timing related bug in event handling could cause interoperability problems between an erlang TLS server and some TLS clients, especially noticed with Firefox as TLS client.
Own Id: OTP-13917
Correct ECC curve selection, the error could cause the default to always be selected.
Own Id: OTP-13918
Correctly formed handshake messages received out of order will now correctly fail the connection with unexpected message.
Own Id: OTP-13853
Correct handling of signature algorithm selection
Own Id: OTP-13711
ssl application now behaves gracefully also on partially incorrect input from peer.
Own Id: OTP-13834
Add application environment configuration bypass_pem_cache. This can be used as a workaround for the current implementation of the PEM-cache that has proven to be a bottleneck.
Own Id: OTP-13883
The TLS/SSL protocol version selection for the SSL server has been corrected to follow RFC 5246 Appendix E.1 especially in case where the list of supported versions has gaps. Now the server selects the highest protocol version it supports that is not higher than what the client supports.
Own Id: OTP-13753 Aux Id: seq13150
Server now rejects, a not requested client cert, as an incorrect handshake message and ends the connection.
Own Id: OTP-13651
Remove default support for DES cipher suites
*** POTENTIAL INCOMPATIBILITY ***
Own Id: OTP-13195
Deprecate the function
Own Id: OTP-13214
Better error handling of user error during TLS upgrade. ERL-69 is solved by gen_statem rewrite of ssl application.
Own Id: OTP-13255
Provide user friendly error message when crypto rejects a key
Own Id: OTP-13256
Add ssl:getstat/1 and ssl:getstat/2
Own Id: OTP-13415
TLS distribution connections now allow specifying the
options
Own Id: OTP-13429 Aux Id: Pull#956
Remove confusing error message when closing a distributed erlang node running over TLS
Own Id: OTP-13431
Remove default support for use of md5 in TLS 1.2 signature algorithms
Own Id: OTP-13463
ssl now uses gen_statem instead of gen_fsm to implement the ssl connection process, this solves some timing issues in addition to making the code more intuitive as the behaviour can be used cleanly instead of having a lot of workaround for shortcomings of the behaviour.
Own Id: OTP-13464
Phase out interoperability with clients that offer SSLv2. By default they are no longer supported, but an option to provide interoperability is offered.
*** POTENTIAL INCOMPATIBILITY ***
Own Id: OTP-13465
OpenSSL has functions to generate short (eight hex digits) hashes of issuers of certificates and CRLs. These hashes are used by the "c_rehash" script to populate directories of CA certificates and CRLs, e.g. in the Apache web server. Add functionality to let an Erlang program find the right CRL for a given certificate in such a directory.
Own Id: OTP-13530
Some legacy TLS 1.0 software does not tolerate the 1/n-1 content split BEAST mitigation technique. Add a beast_mitigation SSL option (defaulting to one_n_minus_one) to select or disable the BEAST mitigation technique.
Own Id: OTP-13629
Enhance error log messages to facilitate for users to understand the error
Own Id: OTP-13632
Increased default DH params to 2048-bit
Own Id: OTP-13636
Propagate CRL unknown CA error so that public_key validation process continues correctly and determines what should happen.
Own Id: OTP-13656
Introduce a flight concept for handshake packages. This is a preparation for enabling DTLS, however it can also have a positive effects for TLS on slow and unreliable networks.
Own Id: OTP-13678
An erlang TLS server configured with cipher suites
using rsa key exchange, may be vulnerable to an Adaptive
Chosen Ciphertext attack (AKA Bleichenbacher attack)
against RSA, which when exploited, may result in
plaintext recovery of encrypted messages and/or a
Man-in-the-middle (MiTM) attack, despite the attacker not
having gained access to the server’s private key
itself.
Exploiting this vulnerability to perform plaintext recovery of encrypted messages will, in most practical cases, allow an attacker to read the plaintext only after the session has completed. Only TLS sessions established using RSA key exchange are vulnerable to this attack.
Exploiting this vulnerability to conduct a MiTM attack requires the attacker to complete the initial attack, which may require thousands of server requests, during the handshake phase of the targeted session within the window of the configured handshake timeout. This attack may be conducted against any TLS session using RSA signatures, but only if cipher suites using RSA key exchange are also enabled on the server. The limited window of opportunity, limitations in bandwidth, and latency make this attack significantly more difficult to execute.
RSA key exchange is enabled by default although least prioritized if server order is honored. For such a cipher suite to be chosen it must also be supported by the client and probably the only shared cipher suite.
Captured TLS sessions encrypted with ephemeral cipher suites (DHE or ECDHE) are not at risk for subsequent decryption due to this vulnerability.
As a workaround if default cipher suite configuration was used you can configure the server to not use vulnerable suites with the ciphers option like this:
that is your code will look somethingh like this:
Thanks to Hanno Böck, Juraj Somorovsky and Craig Young for reporting this vulnerability.
Own Id: OTP-14748
Correct ssl:prf/5 to use the negotiated cipher suite's prf function in ssl:prf/5 instead of the default prf.
Own Id: OTP-13546
Timeouts may have the value 0, guards have been corrected to allow this
Own Id: OTP-13635
Change of internal handling of hash sign pairs as the used one enforced to much restrictions making some valid combinations unavailable.
Own Id: OTP-13670
An erlang TLS server configured with cipher suites
using rsa key exchange, may be vulnerable to an Adaptive
Chosen Ciphertext attack (AKA Bleichenbacher attack)
against RSA, which when exploited, may result in
plaintext recovery of encrypted messages and/or a
Man-in-the-middle (MiTM) attack, despite the attacker not
having gained access to the server’s private key
itself.
Exploiting this vulnerability to perform plaintext recovery of encrypted messages will, in most practical cases, allow an attacker to read the plaintext only after the session has completed. Only TLS sessions established using RSA key exchange are vulnerable to this attack.
Exploiting this vulnerability to conduct a MiTM attack requires the attacker to complete the initial attack, which may require thousands of server requests, during the handshake phase of the targeted session within the window of the configured handshake timeout. This attack may be conducted against any TLS session using RSA signatures, but only if cipher suites using RSA key exchange are also enabled on the server. The limited window of opportunity, limitations in bandwidth, and latency make this attack significantly more difficult to execute.
RSA key exchange is enabled by default although least prioritized if server order is honored. For such a cipher suite to be chosen it must also be supported by the client and probably the only shared cipher suite.
Captured TLS sessions encrypted with ephemeral cipher suites (DHE or ECDHE) are not at risk for subsequent decryption due to this vulnerability.
As a workaround if default cipher suite configuration was used you can configure the server to not use vulnerable suites with the ciphers option like this:
that is your code will look somethingh like this:
Thanks to Hanno Böck, Juraj Somorovsky and Craig Young for reporting this vulnerability.
Own Id: OTP-14748
Create a little randomness in sending of session invalidation messages, to mitigate load when whole table is invalidated.
Own Id: OTP-13490
Correct cipher suites conversion and gaurd expression. Caused problems with GCM cipher suites and client side option to set signature_algorithms extention values.
Own Id: OTP-13525
Corrections to cipher suite handling using the 3 and 4 tuple format in addition to commit 89d7e21cf4ae988c57c8ef047bfe85127875c70c
Own Id: OTP-13511
Make values for the TLS-1.2 signature_algorithms extension configurable
Own Id: OTP-13261
Make sure there is only one poller validator at a time for validating the session cache.
Own Id: OTP-13185
A timing related issue could cause ssl to hang, especially happened with newer versions of OpenSSL in combination with ECC ciphers.
Own Id: OTP-13253
Work around a race condition in the TLS distribution start.
Own Id: OTP-13268
Big handshake messages are now correctly fragmented in the TLS record layer.
Own Id: OTP-13306
Improve portability of ECC tests in Crypto and SSL for "exotic" OpenSSL versions.
Own Id: OTP-13311
Certificate extensions marked as critical are ignored when using verify_none
Own Id: OTP-13377
If a certificate doesn't contain a CRL Distribution
Points extension, and the relevant CRL is not in the
cache, and the
Own Id: OTP-13378
Enable TLS distribution over IPv6
Own Id: OTP-13391
Improve error reporting for TLS distribution
Own Id: OTP-13219
Include options from connect, listen and accept in
Own Id: OTP-13232
Allow adding extra options for outgoing TLS distribution connections, as supported for plain TCP connections.
Own Id: OTP-13285
Use loopback as server option in TLS-distribution module
Own Id: OTP-13300
Verify certificate signature against original certificate binary.
This avoids bugs due to encoding errors when re-encoding a decode certificate. As there exists several decode step and using of different ASN.1 specification this is a risk worth avoiding.
Own Id: OTP-13334
Use
Own Id: OTP-13363
Honor distribution port range options
Own Id: OTP-12838
Correct supervisor specification in TLS distribution.
Own Id: OTP-13134
Correct cache timeout
Own Id: OTP-13141
Avoid crash and restart of ssl process when key file does not exist.
Own Id: OTP-13144
Enable passing of raw socket options on the format {raw,_,_,_} to the underlying socket.
Own Id: OTP-13166
Hibernation with small or a zero timeout will now work as expected
Own Id: OTP-13189
Add upper limit for session cache, configurable on ssl application level.
If upper limit is reached, invalidate the current cache entries, e.i the session lifetime is the max time a session will be keept, but it may be invalidated earlier if the max limit for the table is reached. This will keep the ssl manager process well behaved, not exhusting memeory. Invalidating the entries will incrementally empty the cache to make room for fresh sessions entries.
Own Id: OTP-12392
Use new time functions to measure passed time.
Own Id: OTP-12457
Improved error handling in TLS distribution
Own Id: OTP-13142
Distribution over TLS now honors the nodelay distribution flag
Own Id: OTP-13143
Add DER encoded ECPrivateKey as valid input format for key option.
Own Id: OTP-12974
Correct return value of default session callback module
This error had the symptom that the client check for unique session would always fail, potentially making the client session table grow a lot and causing long setup times.
Own Id: OTP-12980
Add possibility to downgrade an SSL/TLS connection to a tcp connection, and give back the socket control to a user process.
This also adds the possibility to specify a timeout to the ssl:close function.
Own Id: OTP-11397
Add application setting to be able to change fatal alert shutdown timeout, also shorten the default timeout. The fatal alert timeout is the number of milliseconds between sending of a fatal alert and closing the connection. Waiting a little while improves the peers chances to properly receiving the alert so it may shutdown gracefully.
Own Id: OTP-12832
Ignore signature_algorithm (TLS 1.2 extension) sent to TLS 1.0 or TLS 1.1 server
Own Id: OTP-12670
Improve error handling in TLS distribution module to avoid lingering sockets.
Own Id: OTP-12799 Aux Id: Tom Briden
Add option {client_renegotiation, boolean()} option to the server-side of the SSL application.
Own Id: OTP-12815
Add new API functions to handle CRL-verification
Own Id: OTP-10362 Aux Id: kunagi-215 [126]
Remove default support for SSL-3.0, due to Poodle vunrability in protocol specification.
Add padding check for TLS-1.0 to remove Poodle vunrability from TLS 1.0, also add the option padding_check. This option only affects TLS-1.0 connections and if set to false it disables the block cipher padding check to be able to interoperate with legacy software.
Remove default support for RC4 cipher suites, as they are consider too weak.
*** POTENTIAL INCOMPATIBILITY ***
Own Id: OTP-12390
Add support for TLS ALPN (Application-Layer Protocol Negotiation) extension.
Own Id: OTP-12580
Add SNI (Server Name Indication) support for the server side.
Own Id: OTP-12736
Gracefully ignore proprietary hash_sign algorithms
Own Id: OTP-12829
Terminate gracefully when receving bad input to premaster secret calculation
Own Id: OTP-12783
Exclude self-signed trusted anchor certificates from certificate prospective certification path according to RFC 3280.
This will avoid some unnecessary certificate processing.
Own Id: OTP-12449
Separate client and server session cache internally.
Avoid session table growth when client starts many connections in such a manner that many connections are started before session reuse is possible. Only save a new session in client if there is no equivalent session already stored.
Own Id: OTP-11365
The PEM cache is now validated by a background process, instead of always keeping it if it is small enough and clearing it otherwise. That strategy required that small caches where cleared by API function if a file changes on disk.
However export the API function to clear the cache as it may still be useful.
Own Id: OTP-12391
Add padding check for TLS-1.0 to remove Poodle vulnerability from TLS 1.0, also add the option padding_check. This option only affects TLS-1.0 connections and if set to false it disables the block cipher padding check to be able to interoperate with legacy software.
*** POTENTIAL INCOMPATIBILITY ***
Own Id: OTP-12420
Add support for TLS_FALLBACK_SCSV used to prevent undesired TLS version downgrades. If used by a client that is vulnerable to the POODLE attack, and the server also supports TLS_FALLBACK_SCSV, the attack can be prevented.
Own Id: OTP-12458
Make sure the clean rule for ssh, ssl, eunit and otp_mibs actually removes generated files.
Own Id: OTP-12200
Change code to reflect that state data may be secret to avoid breaking dialyzer contracts.
Own Id: OTP-12341
Handle the fact that servers may send an empty SNI extension to the client.
Own Id: OTP-12198
Corrected handling of ECC certificates, there where several small issues with the handling of such certificates in the ssl and public_key application. Now ECC signed ECC certificates shall work and not only RSA signed ECC certificates.
Own Id: OTP-12026
Check that the certificate chain ends with a trusted ROOT CA e.i. a self-signed certificate, but provide an option partial_chain to enable the application to define an intermediat CA as trusted.
Own Id: OTP-12149
Add decode functions for SNI (Server Name Indication)
Own Id: OTP-12048
ssl:recv now returns {error, einval} if applied to a non passive socket, the same as gen_tcp:recv.
Thanks to Danil Zagoskin for reporting this issue
Own Id: OTP-11878
Corrected handling of default values for signature_algorithms extension in TLS-1.2 and corresponding values used in previous versions that does not support this extension.
Thanks to Danil Zagoskin
Own Id: OTP-11886
Handle socket option inheritance when pooling of accept sockets is used
Own Id: OTP-11897
Make sure that the list of versions, possibly supplied in the versions option, is not order dependent.
Thanks to Ransom Richardson for reporting this issue
Own Id: OTP-11912
Reject connection if the next_protocol message is sent twice.
Own Id: OTP-11926
Correct options handling when ssl:ssl_accept/3 is called with new ssl options after calling ssl:listen/2
Own Id: OTP-11950
Gracefully handle unknown alerts
Thanks to Atul Atri for reporting this issue
Own Id: OTP-11874
Gracefully ignore cipher suites sent by client not supported by the SSL/TLS version that the client has negotiated.
Thanks to Danil Zagoskin for reporting this issue
Own Id: OTP-11875
Gracefully handle structured garbage, i.e a client sends some garbage in a ssl record instead of a valid fragment.
Thanks to Danil Zagoskin
Own Id: OTP-11880
Gracefully handle invalid alerts
Own Id: OTP-11890
Generalize handling of default ciphers
Thanks to Andreas Schultz
Own Id: OTP-11966
Make sure change cipher spec is correctly handled
Own Id: OTP-11975
Fix incorrect dialyzer spec and types, also enhance documentation.
Thanks to Ayaz Tuncer.
Own Id: OTP-11627
Fix possible mismatch between SSL/TLS version and default ciphers. Could happen when you specified SSL/TLS-version in optionlist to listen or accept.
Own Id: OTP-11712
Application upgrade (appup) files are corrected for the following applications:
A new test utility for testing appup files is added to test_server. This is now used by most applications in OTP.
(Thanks to Tobias Schlager)
Own Id: OTP-11744
Moved elliptic curve definition from the crypto NIF/OpenSSL into Erlang code, adds the RFC-5639 brainpool curves and makes TLS use them (RFC-7027).
Thanks to Andreas Schultz
Own Id: OTP-11578
Unicode adaptations
Own Id: OTP-11620
Added option honor_cipher_order. This instructs the server to prefer its own cipher ordering rather than the client's and can help protect against things like BEAST while maintaining compatability with clients which only support older ciphers.
Thanks to Andrew Thompson for the implementation, and Andreas Schultz for the test cases.
Own Id: OTP-11621
Replace boolean checking in validate_option with is_boolean guard.
Thanks to Andreas Schultz.
Own Id: OTP-11634
Some function specs are corrected or moved and some edoc comments are corrected in order to allow use of edoc. (Thanks to Pierre Fenoll)
Own Id: OTP-11702
Correct clean up of certificate database when certs are inputed in pure DER format.The incorrect code could cause a memory leek when certs where inputed in DER. Thanks to Bernard Duggan for reporting this.
Own Id: OTP-11733
Improved documentation of the cacertfile option
Own Id: OTP-11759 Aux Id: seq12535
Avoid next protocol negotiation failure due to incorrect option format.
Own Id: OTP-11760
Handle v1 CRLs, with no extensions and fixes issues with IDP (Issuing Distribution Point) comparison during CRL validation.
Thanks to Andrew Thompson
Own Id: OTP-11761
Server now ignores client ECC curves that it does not support instead of crashing.
Thanks to Danil Zagoskin for reporting the issue and suggesting a solution.
Own Id: OTP-11780
Handle SNI (Server Name Indication) alert unrecognized_name and gracefully deal with unexpected alerts.
Thanks to Masatake Daimon for reporting this.
Own Id: OTP-11815
Add possibility to specify ssl options when calling ssl:ssl_accept
Own Id: OTP-11837
Add missing validation of the server_name_indication option and test for its explicit use. It was not possible to set or disable the default server_name_indication as the validation of the option was missing.
Own Id: OTP-11567
Elliptic curve selection in server mode now properly selects a curve suggested by the client, if possible, and the fallback alternative is changed to a more widely supported curve.
Own Id: OTP-11575
Bug in the TLS hello extension handling caused the server to behave as it did not understand secure renegotiation.
Own Id: OTP-11595
Honors the clients advertised support of elliptic curves and no longer sends incorrect elliptic curve extension in server hello.
Own Id: OTP-11370
Fix initialization of DTLS fragment reassembler, in previously contributed code, for future support of DTLS . Thanks to Andreas Schultz.
Own Id: OTP-11376
Corrected type error in client_preferred_next_protocols documentation. Thanks to Julien Barbot.
Own Id: OTP-11457
TLS code has been refactored to prepare for future DTLS support. Also some DTLS code is in place but not yet runnable, some of it contributed by Andreas Schultz and some of it written by the OTP team. Thanks to to Andreas for his participation.
Own Id: OTP-11292
Remove extraneous dev debug code left in the close function. Thanks to Ken Key.
Own Id: OTP-11447
Add SSL Server Name Indication (SNI) client support. Thanks to Julien Barbot.
Own Id: OTP-11460
Setopts during renegotiation caused the renegotiation to be unsuccessful.
If calling setopts during a renegotiation the FSM state might change during the handling of the setopts messages, this is now handled correctly.
Own Id: OTP-11228
Now handles signature_algorithm field in digitally_signed properly with proper defaults. Prior to this change some elliptic curve cipher suites could fail reporting the error "bad certificate".
Own Id: OTP-11229
The code emulating the inet header option was changed in the belief that it made it inet compatible. However the testing is a bit hairy as the inet option is actually broken, now the tests are corrected and the header option should work in the same broken way as inet again, preferably use the bitsyntax instead.
Own Id: OTP-11230
Make the ssl manager name for erlang distribution over SSL/TLS relative to the module name of the ssl_manager.
This can be beneficial when making tools that rename modules for internal processing in the tool.
Own Id: OTP-11255
Add documentation regarding log_alert option.
Own Id: OTP-11271
Honor the versions option to ssl:connect and ssl:listen.
Own Id: OTP-10905
Next protocol negotiation with reused sessions will now succeed
Own Id: OTP-10909
Add support for PSK (Pre Shared Key) and SRP (Secure Remote Password) chipher suits, thanks to Andreas Schultz.
Own Id: OTP-10450 Aux Id: kunagi-269 [180]
Fix SSL Next Protocol Negotiation documentation. Thanks to Julien Barbot.
Own Id: OTP-10955
Fix ssl_connection to support reading proxy/chain certificates. Thanks to Valentin Kuznetsov.
Own Id: OTP-10980
Integrate elliptic curve contribution from Andreas Schultz
In order to be able to support elliptic curve cipher suites in SSL/TLS, additions to handle elliptic curve infrastructure has been added to public_key and crypto.
This also has resulted in a rewrite of the crypto API to gain consistency and remove unnecessary overhead. All OTP applications using crypto has been updated to use the new API.
Impact: Elliptic curve cryptography (ECC) offers equivalent security with smaller key sizes than other public key algorithms. Smaller key sizes result in savings for power, memory, bandwidth, and computational cost that make ECC especially attractive for constrained environments.
Own Id: OTP-11009
Transport callback handling is changed so that gen_tcp is treated as a special case where inet will be called directly for functions such as setopts, as gen_tcp does not have its own setopts. This will enable users to use the transport callback for other customizations such as websockets.
Own Id: OTP-10847
Follow up to OTP-10451 solved in ssl-5.2 R16A. Make sure format_error return good strings. Replace confusing legacy atoms with more descriptive atoms.
Own Id: OTP-10864
Make log_alert configurable as option in ssl, SSLLogLevel added as option to inets conf file
Own Id: OTP-11259
SSL: TLS 1.2, advertise sha224 support, thanks to Andreas Schultz.
Own Id: OTP-10586
If an ssl server is restarted with new options and a client tries to reuse a session the server must make sure that it complies to the new options before agreeing to reuse it.
Own Id: OTP-10595
Now handles cleaning of CA-certificate database correctly so that there will be no memory leek, bug was introduced in ssl- 5.1 when changing implementation to increase parallel execution.
Impact: Improved memory usage, especially if you have many different certificates and upgrade tcp-connections to TLS-connections.
Own Id: OTP-10710
Support Next Protocol Negotiation in TLS, thanks to Ben Murphy for the contribution.
Impact: Could give performance benefit if used as it saves a round trip.
Own Id: OTP-10361 Aux Id: kunagi-214 [125]
TLS 1.2 will now be the default TLS version if sufficient crypto support is available otherwise TLS 1.1 will be default.
Impact: A default TLS connection will have higher security and hence it may be perceived as slower then before.
Own Id: OTP-10425 Aux Id: kunagi-275 [186]
It is now possible to call controlling_process on a listen socket, same as in gen_tcp.
Own Id: OTP-10447
Remove filter mechanisms that made error messages backwards compatible with old ssl but hid information about what actually happened.
This does not break the documented API however other reason terms may be returned, so code that matches on the reason part of {error, Reason} may fail.
*** POTENTIAL INCOMPATIBILITY ***
Own Id: OTP-10451 Aux Id: kunagi-270 [181]
Added missing dependencies to Makefile
Own Id: OTP-10594
Removed deprecated function ssl:pid/0, it has been pointless since R14 but has been keep for backwards compatibility.
*** POTENTIAL INCOMPATIBILITY ***
Own Id: OTP-10613 Aux Id: kunagi-331 [242]
Refactor to simplify addition of key exchange methods, thanks to Andreas Schultz.
Own Id: OTP-10709
ssl:ssl_accept/2 timeout is no longer ignored
Own Id: OTP-10600
ssl:recv/3 could "loose" data when the timeout occurs. If the timout in ssl:connect or ssl:ssl_accept expired the ssl connection process was not terminated as it should, this due to gen_fsm:send_all_state_event timout is a client side time out. These timouts are now handled by the gen_fsm-procss instead.
Own Id: OTP-10569
Better termination handling that avoids hanging.
Own Id: OTP-10574
Sometimes the client process could receive an extra {error, closed} message after ssl:recv had returned {error, closed}.
Own Id: OTP-10118
ssl v3 alert number 41 (no_certificate_RESERVED) is now recognized
Own Id: OTP-10196
Experimental support for TLS 1.1 is now available, will be officially supported from OTP-R16. Thanks to Andreas Schultz for implementing the first version.
Own Id: OTP-8871
Experimental support for TLS 1.2 is now available, will be officially supported from OTP-R16. Thanks to Andreas Schultz for implementing the first version.
Own Id: OTP-8872
Removed some bottlenecks increasing the applications parallelism especially for the client side.
Own Id: OTP-10113
Workaround for handling certificates that wrongly encode X509countryname in utf-8 when the actual value is a valid ASCCI value of length 2. Such certificates are accepted by many browsers such as Chrome and Fierfox so for interoperability reasons we will too.
Own Id: OTP-10222
Robustness and improvement to distribution over SSL
Fix a bug where ssl_tls_dist_proxy would crash at caller timeout. Fix a bug where a timeout from the SSL layer would block the distribution indefinately. Run the proxy exclusively on the loopback interface. (Thanks to Paul Guyot)
Own Id: OTP-9915
Fix setup loop of SSL TLS dist proxy
Fix potential leak of processes waiting indefinately for data from closed sockets during socket setup phase. (Thanks to Paul Guyot)
Own Id: OTP-9916
Correct spelling of registered (Thanks to Richard Carlsson)
Own Id: OTP-9925
Added TLS PRF function to the SSL API for generation of additional key material from a TLS session. (Thanks to Andreas Schultz)
Own Id: OTP-10024
Invalidation handling of sessions could cause the time_stamp field in the session record to be set to undefined crashing the session clean up process. This did not affect the connections but would result in that the session table would grow.
Own Id: OTP-9696 Aux Id: seq11947
Changed code to use ets:foldl and throw instead of ets:next traversal, avoiding the need to explicitly call ets:safe_fixtable. It was possible to get a badarg-crash under special circumstances.
Own Id: OTP-9703 Aux Id: seq11947
Send ssl_closed notification to active ssl user when a tcp error occurs.
Own Id: OTP-9734 Aux Id: seq11946
If a passive receive was ongoing during a renegotiation the process evaluating ssl:recv could be left hanging for ever.
Own Id: OTP-9744
Support for the old ssl implementation is dropped and the code is removed.
Own Id: OTP-7048
The erlang distribution can now be run over the new ssl implementation. All options can currently not be set but it is enough to replace to old ssl implementation.
Own Id: OTP-7053
public_key, ssl and crypto now supports PKCS-8
Own Id: OTP-9312
Implements a CBC timing attack counter measure. Thanks to Andreas Schultz for providing the patch.
Own Id: OTP-9683
Mitigates an SSL/TLS Computational DoS attack by disallowing the client to renegotiate many times in a row in a short time interval, thanks to Tuncer Ayaz for alerting us about this.
Own Id: OTP-9739
Implements the 1/n-1 splitting countermeasure to the Rizzo Duong BEAST attack, affects SSL 3.0 and TLS 1.0. Thanks to Tuncer Ayaz for alerting us about this.
Own Id: OTP-9750
replace "a ssl" with "an ssl" reindent pkix_path_validation/3 Trivial documentation fixes (Thanks to Christian von Roques )
Own Id: OTP-9464
Adds function clause to avoid denial of service attack. Thanks to Vinod for reporting this vulnerability.
Own Id: OTP-9364
Error handling code now takes care of inet:getopts/2 and inets:setopts/2 crashes. Thanks to Richard Jones for reporting this.
Own Id: OTP-9382
Support explicit use of packet option httph and httph_bin
Own Id: OTP-9461
Decoding of hello extensions could fail to come to the correct conclusion due to an error in a binary match pattern. Thanks to Ben Murphy.
Own Id: OTP-9589
Calling gen_tcp:connect with option {ip, {127,0,0,1}} results in an exit with reason badarg. Neither SSL nor INETS This was not catched, resulting in crashes with incomprehensible reasons.
Own Id: OTP-9289 Aux Id: seq11845
Fixed error in cache-handling fix from ssl-4.1.2
Own Id: OTP-9018 Aux Id: seq11739
Verification of a critical extended_key_usage-extension corrected
Own Id: OTP-9029 Aux Id: seq11541
The ssl application caches certificate files, it will now invalidate cache entries if the diskfile is changed.
Own Id: OTP-8965 Aux Id: seq11739
Now runs the terminate function before returning from the call made by ssl:close/1, as before the caller of ssl:close/1 could get problems with the reuseaddr option.
Own Id: OTP-8992
Correct handling of client certificate verify message When checking the client certificate verify message the server used the wrong algorithm identifier to determine the signing algorithm, causing a function clause error in the public_key application when the key-exchange algorithm and the public key algorithm of the client certificate happen to differ.
Own Id: OTP-8897
For testing purposes ssl now also support some anonymous cipher suites when explicitly configured to do so.
Own Id: OTP-8870
Sends an error alert instead of crashing if a crypto function for the selected cipher suite fails.
Own Id: OTP-8930 Aux Id: seq11720
Updated ssl to ignore CA certs that violate the asn1-spec for a certificate, and updated public key asn1 spec to handle inherited DSS-params.
Own Id: OTP-7884
Changed ssl implementation to retain backwards compatibility for old option {verify, 0} that shall be equivalent to {verify, verify_none}, also separate the cases unknown ca and selfsigned peer cert, and restored return value of deprecated function public_key:pem_to_der/1.
Own Id: OTP-8858
Changed the verify fun so that it differentiate between the peer certificate and CA certificates by using valid_peer or valid as the second argument to the verify fun. It may not always be trivial or even possible to know when the peer certificate is reached otherwise.
*** POTENTIAL INCOMPATIBILITY ***
Own Id: OTP-8873
The server now verifies the client certificate verify message correctly, instead of causing a case-clause.
Own Id: OTP-8721
The client hello message now always include ALL available cipher suites (or those specified by the ciphers option). Previous implementation would filter them based on the client certificate key usage extension (such filtering only makes sense for the server certificate).
Own Id: OTP-8772
Fixed handling of the option {mode, list} that was broken for some packet types for instance line.
Own Id: OTP-8785
Empty packets were not delivered to the client.
Own Id: OTP-8790
Building in a source tree without prebuilt platform independent build results failed on the SSL examples when:
Own Id: OTP-8791
Fixed a handshake error which occurred on some ssl implementations.
Own Id: OTP-8793
Revise the public_key API - Cleaned up and documented the public_key API to make it useful for general use, also changed ssl to use the new API.
Own Id: OTP-8722
Added support for inputing certificates and keys directly in DER format these options will override the pem-file options if specified.
Own Id: OTP-8723
To gain interoperability ssl will not check for padding errors when using TLS 1.0. It is first in TLS 1.1 that checking the padding is an requirement.
Own Id: OTP-8740
Changed the semantics of the verify_fun option in the ssl-application so that it takes care of both application handling of path validation errors and verification of application specific extensions. This means that it is now possible for the server application in verify_peer mode to handle path validation errors. This change moved some functionality earlier in ssl to the public_key application.
Own Id: OTP-8770
Added the functionality so that the verification fun will be called when a certificate is considered valid by the path validation to allow access to each certificate in the path to the user application. Also try to verify subject-AltName, if unable to verify it let the application verify it.
Own Id: OTP-8825
New ssl now support client/server-certificates signed by dsa keys.
Own Id: OTP-8587
Ssl has now switched default implementation and removed deprecated certificate handling. All certificate handling is done by the public_key application.
Own Id: OTP-8695