1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
|
<?xml version="1.0" encoding="latin1" ?>
<!DOCTYPE chapter SYSTEM "chapter.dtd">
<chapter>
<header>
<copyright>
<year>2003</year><year>2009</year>
<holder>Ericsson AB. All Rights Reserved.</holder>
</copyright>
<legalnotice>
The contents of this file are subject to the Erlang Public License,
Version 1.1, (the "License"); you may not use this file except in
compliance with the License. You should have received a copy of the
Erlang Public License along with this software. If not, it can be
retrieved online at http://www.erlang.org/.
Software distributed under the License is distributed on an "AS IS"
basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
the License for the specific language governing rights and limitations
under the License.
</legalnotice>
<title>Using the SSL API</title>
<file>using_ssl.xml</file>
</header>
<section>
<title>General information</title>
<p>To see relevant version information for ssl you can
call ssl:versions/0</p>
<p>To see all supported cipher suites
call ssl:cipher_suites/0. Note that available cipher suites
for a connection will depend on your certificate. It is also
possible to specify a specific cipher suite(s) that you
want your connection to use. Default is to use the strongest
available.</p>
</section>
<section>
<title>Setting up connections</title>
<p>Here follows some small example of how to set up client/server connections
using the erlang shell. The returned value of the sslsocket has been abbreviated with
<c>[...]</c> as it can be fairly large and is opaque.</p>
<section>
<title>Minmal example</title>
<note><p> The minimal setup is not the most secure setup of ssl.</p>
</note>
<p> Start server side</p>
<code type="erl">1 server> ssl:start().
ok</code>
<p>Create a ssl listen socket</p>
<code type="erl">2 server> {ok, ListenSocket} =
ssl:listen(9999, [{certfile, "cert.pem"}, {keyfile, "key.pem"},{reuseaddr, true}]).
{ok,{sslsocket, [...]}}</code>
<p>Do a transport accept on the ssl listen socket</p>
<code type="erl">3 server> {ok, Socket} = ssl:transport_accept(ListenSocket).
{ok,{sslsocket, [...]}}</code>
<p>Start client side</p>
<code type="erl">1 client> ssl:start().
ok</code>
<code type="erl">2 client> {ok, Socket} = ssl:connect("localhost", 9999, [], infinity).
{ok,{sslsocket, [...]}}</code>
<p>Do the ssl handshake</p>
<code type="erl">4 server> ok = ssl:ssl_accept(Socket).
ok</code>
<p>Send a messag over ssl</p>
<code type="erl">5 server> ssl:send(Socket, "foo").
ok</code>
<p>Flush the shell message queue to see that we got the message
sent on the server side</p>
<code type="erl">3 client> flush().
Shell got {ssl,{sslsocket,[...]},"foo"}
ok</code>
</section>
<section>
<title>Upgrade example</title>
<note><p> To upgrade a TCP/IP connection to a ssl connection the
client and server have to aggre to do so. Agreement
may be accompliced by using a protocol such the one used by HTTP
specified in RFC 2817.</p> </note>
<p>Start server side</p>
<code type="erl">1 server> ssl:start().
ok</code>
<p>Create a normal tcp listen socket</p>
<code type="erl">2 server> {ok, ListenSocket} = gen_tcp:listen(9999, [{reuseaddr, true}]).
{ok, #Port<0.475>}</code>
<p>Accept client connection</p>
<code type="erl">3 server> {ok, Socket} = gen_tcp:accept(ListenSocket).
{ok, #Port<0.476>}</code>
<p>Start client side</p>
<code type="erl">1 client> ssl:start().
ok</code>
<code type="erl">2 client> {ok, Socket} = gen_tcp:connect("localhost", 9999, [], infinity).</code>
<p>Make sure active is set to false before trying
to upgrade a connection to a ssl connection, otherwhise
ssl handshake messages may be deliverd to the wrong process.</p>
<code type="erl">4 server> inet:setopts(Socket, [{active, false}]).
ok</code>
<p>Do the ssl handshake.</p>
<code type="erl">5 server> {ok, SSLSocket} = ssl:ssl_accept(Socket, [{cacertfile, "cacerts.pem"},
{certfile, "cert.pem"}, {keyfile, "key.pem"}]).
{ok,{sslsocket,[...]}}</code>
<p> Upgrade to a ssl connection. Note that the client and server
must agree upon the upgrade and the server must call
ssl:accept/2 before the client calls ssl:connect/3.</p>
<code type="erl">3 client>{ok, SSLSocket} = ssl:connect(Socket, [{cacertfile, "cacerts.pem"},
{certfile, "cert.pem"}, {keyfile, "key.pem"}], infinity).
{ok,{sslsocket,[...]}}</code>
<p>Send a messag over ssl</p>
<code type="erl">4 client> ssl:send(SSLSocket, "foo").
ok</code>
<p>Set active true on the ssl socket</p>
<code type="erl">4 server> ssl:setopts(SSLSocket, [{active, true}]).
ok</code>
<p>Flush the shell message queue to see that we got the message
sent on the client side</p>
<code type="erl">5 server> flush().
Shell got {ssl,{sslsocket,[...]},"foo"}
ok</code>
</section>
</section>
</chapter>
|
