summaryrefslogtreecommitdiff
path: root/lib/ssl/src/dtls_connection.erl
Commit message (Collapse)AuthorAgeFilesLines
* ssl: Fix that users can send data during renegotiationDan Gudmundsson2023-04-271-5/+4
| | | | | A timing issue was found during testing of the previous commit. Users should be allowed to send data during the renegotiation.
* Merge pull request #7033 from u3s/kuba/ssl/exp_ocsp_refactorJakub Witczak2023-03-281-4/+3
|\ | | | | Kuba/ssl/exp ocsp refactor
| * ssl: update OCSP options handling (internal map representation)Jakub Witczak2023-03-211-4/+3
| |
* | ssl: Change client default verifyIngela Anderton Andin2023-03-171-7/+7
|/ | | | | | Closes #5899 Whitebox option tests need to be fixed before OTP-26 (but we want the change in RC2).
* ssl, public_key: code formattingJakub Witczak2023-03-061-17/+16
|
* Update copyright yearErlang/OTP2023-02-141-1/+1
|
* Merge branch 'maint'Dan Gudmundsson2023-01-171-12/+25
|\ | | | | | | | | | | | | * maint: ssl: dtls let new accept process handle new connections Refactor, remove client set Fix version test
| * ssl: dtls let new accept process handle new connectionsDan Gudmundsson2023-01-171-12/+25
| | | | | | | | | | | | | | | | If a user process is listening for new connections let that handle the "new" connection instead of re-useing the old one. If the new connection is successfully connected, bring down the old connection.
* | ssl: ssl_trace updatesJakub Witczak2023-01-071-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | - add tc_check_profiles test to ssl_trace_SUITE - return ok tuple from ssl_trace:start - OCSP, cert trace profiles - key update trace profile - ssl_trace:write/2 - no more budget message - add tls_sender:init to rle trace profile - hibernate trace profile - ssn trace profile
* | Merge branch 'dgud/ssl/log-abort-crash' into dgud/ssl/master/log-abort-crashDan Gudmundsson2022-11-211-7/+10
|\ \ | |/ | | | | | | * dgud/ssl/log-abort-crash: ssl: Add debug logging on error cases
| * ssl: Add debug logging on error casesDan Gudmundsson2022-11-211-7/+10
| | | | | | | | | | | | | | | | | | To ease the debugging add info/debug logs whenever an error is caught so that is easy to find out what happened. Also set the default debug level per connection to the application level, or rather the module ssl level since the application level is not stored.
* | ssl: Refactor handle_optionsDan Gudmundsson2022-10-201-5/+3
|/ | | | | | | | | | | | | | | | | Split clauses to be seperate functions. Rename expand_options/2 to split_options/2 which is more what it does. Remove some already removed (deprecated) options which is handled earlier. Explicit order and initilize options that other options are dependent on. Collect functionality (mostly) in one place to make it easier to overview. This commit have changed error messages for a couple of error cases, and is also more restrict with checking the options. {options, incompatible, a, b} => {options, incompatible, [a,b]} {options, dependency, a,b} => {options, incompatible, [a,^b]} {conflict_options, a, b} => {options, incompatible, [a,b]}
* Merge branch 'ingela/ssl/client-certification/OTP-18145' into maintIngela Anderton Andin2022-06-211-2/+23
|\ | | | | | | | | * ingela/ssl/client-certification/OTP-18145: ssl: Enhanch handling of unexpected messages
| * ssl: Enhanch handling of unexpected messagesIngela Anderton Andin2022-06-171-2/+23
| | | | | | | | Make better use of gen_statem. Rename flag and values to better names.
* | Merge branch 'ingela/ssl/protocol-version-TLS-1.3/GH-5950/OTP-18129' into maintIngela Anderton Andin2022-06-081-14/+7
|\ \ | | | | | | | | | | | | * ingela/ssl/protocol-version-TLS-1.3/GH-5950/OTP-18129: ssl: Reject unsupported previous version with protocol alert
| * | ssl: Reject unsupported previous version with protocol alertIngela Anderton Andin2022-06-071-14/+7
| |/ | | | | | | | | | | | | Change implementation use gen_statem postpone for hello message when users want to pause handshake instead of legacy "reimplementation" of postpone Closes #5950
| * Update copyright yearErlang/OTP2022-03-091-1/+1
| |
* | ssl: Enable certs_keys configIngela Anderton Andin2022-04-071-4/+6
| | | | | | | | Closes GH-4143
* | Merge branch 'maint'Ingela Anderton Andin2022-02-281-14/+13
|\ \ | |/
| * ssl: Prepare code to have several certificate key pairs to choose fromIngela Anderton Andin2022-02-281-14/+13
| |
* | Update copyright yearErlang/OTP2022-02-151-1/+1
|/
* Merge branch 'dgud/ssl/dtls-reneg' into maintDan Gudmundsson2022-01-121-8/+10
|\
| * ssl: Re-use cookie when renegotiating dtlsDan Gudmundsson2022-01-111-8/+10
| | | | | | | | | | Renegotiating with an Openssl server does not work if the cookie is not sent.
* | ssl: Handle SNI earlierIngela Anderton Andin2021-12-221-2/+2
|/ | | | | | | | The SNI (Server Name Indication) is a special hello extension that needs to be processed first as it can change the servers options available for the connection. Closes #5341
* Update copyright yearRickard Green2021-12-131-1/+1
|
* ssl: Enable data receiving earlierDan Gudmundsson2021-10-221-2/+9
| | | | | Set active earlier reduce latency, and avoid that the process is scheduled out before activating.
* ssl: send fragmented dtls packets separatelyDan Gudmundsson2021-10-221-1/+9
| | | | Do not undo the fragmentation already done.
* ssl: Initialize countersDan Gudmundsson2021-10-111-8/+7
| | | | | Alert counter handling was only initialized on the server, initialize on both sides.
* ssl: Reset to old connection stateDan Gudmundsson2021-10-081-32/+59
| | | | | | In case of fake takeover, reset connection to old working one, i.e. if any alert is generated or coming on the "new" connection, reset connection_states and state to the saved one.
* Allow re-connect on dtls socketsDan Gudmundsson2021-10-081-0/+18
| | | | | Can happen when a computer reboots and connects from the same client port without the server noticing, should be allowed according to RFC.
* ssl: Refactor alert handlingDan Gudmundsson2021-10-081-64/+64
| | | | | | | | Throw alerts in common handling, so usage can be specialized in specific modules later, we will need that in dtls. Throw of alerts have been done before but are now thrown further, this can be improved even more.
* ssl: Cleanup, remove Version argumentDan Gudmundsson2021-10-081-14/+12
| | | | Not used (and available in state if needed later).
* ssl: Add support for RSASSA-PSS in TLS-1.2Ingela Anderton Andin2021-08-201-1/+1
| | | | | | | closes #5029 Also optimizes sign/verify handling so that hash calculation can be done in same call to crypto as sign/verify when possible.
* ssl: Refactor and truly separate client and server session cachesIngela Anderton Andin2021-03-151-13/+2
|
* ssl: Continue refactorIngela Anderton Andin2020-12-071-707/+90
| | | | | | | | | | Split tls_connection to tls_connection (TLS-1.0 - TLS-1.2) and tls_gen_connection (TLS protocol version generic) used as protocol_cb. Split dtls_connection to dtls_connection (DTLS-1 - DTLS-1.2) and dtls_gen_connection (DTLS protocol version generic) used as protocol_cb. Rename ssl_connection -> tls_dtls_connection common code for pre TLS/DTLS-1.3
* ssl: Add DTLS-1 and DTLS-1.2 ASCCII pictureIngela Anderton Andin2020-12-071-0/+90
|
* ssl: Refactor to make state machine implementations clearer.Ingela Anderton Andin2020-12-071-127/+154
| | | | | | | | | | | | Create ssl_gen_statem for functionality that is protocol version independent. tls_connection and dtls_connection are gen_statem behaviour modules for TLS-1.0-TLS-1.2 and DTLS-1.0-DTLS-1.2. tls_connection_1_3 is the TLS-1.3 gen_statem behaviour module. All these state machines have a common state machine help functions in ssl_gen_statem. The pre TLS-1.3 also have common help functions in ssl_connection. Rename states init to initial_hello and error to config_error to avoid confusion with other mechanisms.
* ssl: Extend cert and certfile option to be able to include a cert chainIngela Anderton Andin2020-11-091-8/+9
| | | | | | The first cert must be the peer cert. For optimal performance the chain should be ordered. However the option will be used for testing that also unordered or chains with extraneous cert can be handled.
* ssl: Send empty SNI in EEPéter Dimitrov2020-09-151-6/+9
| | | | | Refactor handling of SNI. Implement sending of empty SNI in EE when the client's SNI is used to guide certificate selection.
* ssl: Add new session cache for TLS-1.0-TLS-1.2Ingela Anderton Andin2020-09-141-8/+7
| | | | | | | | | | | | | | | Implementation design is more like the one for TLS-1.3 session tickets that is the new mechanism in in TLS-1.3 that replaces the previous session reuse machanism. This make the size of the session table more manageble as we do not need to relie on adpatation over time mechanism. There is also a session ticket extension for pre TLS-1.3 also that is diffrent and not implemented by us.
* ssl, public_key: Refactor to use existing designpatternsIngela Anderton Andin2020-08-171-36/+20
| | | | | | | | | | | | | | | Use gen_statem postpone pre TLS-1.3 to handle that ocsp response info is recived after the certificates but is needed before handling the certificates. Pre TLS-1.3 (mainly TLS-1.2) only stapling of the peer cert is supported, as the extended mechanism to support the whole chain before TLS-1.3 has been deprecated. For the verify_fun point of view make pre TLS-1.3 stapling and TLS-1.3 stapling look the same. In public-key avoid loops to look for issuer cert that can be provided as input. Add only one API function to support the validation of the OCSP response.
* ssl: Adjust implementation for diffrent TLS/DTLS protocol versionsAo Song2020-08-171-7/+46
|
* ssl: Prototype client OCSP supportAo Song2020-08-171-3/+4
|
* Implement RFC 6066 extension max_fragment_lengthSimon Cornish2020-04-271-8/+23
|
* Update copyright yearRickard Green2020-03-131-1/+1
|
* ssl: Enhance alert loggingIngela Anderton Andin2020-01-231-5/+9
|
* ssl: Improve logger usageIngela Anderton Andin2019-10-101-6/+7
| | | | | | | Let logger format the logs. Do not log conditions that are not errors of the ssl application as errors.
* ssl: Improve session handlingIngela Anderton Andin2019-09-201-19/+13
| | | | | | | | | | | Due to legacy reasons cleaning of the session handling table was complex and needed to be delayed. However the implementation evolved many times since and this commit removes the need for the delay. Hopefully this will also remove the problem with server session tables that grow quicker than they can shrink under a heavy load. This also fixes TLS-1.3 compatibility with pre TLS-1.3 sessions.
* ssl: Change internal #ssl_options{} to mapPéter Dimitrov2019-08-281-27/+29
|
* ssl: Change check of DTLS record versionIngela Anderton Andin2019-05-291-5/+4
| | | | | | Retransmissions mechanism for upd makes it possible for handshakes and possible alerts to have another record version then the negotiated one in the states certify and abbreviated without beeing invalid messages.
View Lorry Controller Status