User's Guide
Reference Manual
Release Notes
PDF
Top

Secure Socket Layer
Release Notes
Version 5.3.4

Expand All
Contract All

Chapters

- SSL Release Notes
  - Top of chapter
  - SSL 5.3.4
  - SSL 5.3.3
  - SSL 5.3.2
  - SSL 5.3.1
  - SSL 5.3
  - SSL 5.2.1
  - SSL 5.1.2.1
  - SSL 5.2
  - SSL 5.1.2
  - SSL 5.1.1
  - SSL 5.1
  - SSL 5.0.1
  - SSL 5.0
  - SSL 4.1.6
  - SSL 4.1.5
  - SSL 4.1.3
  - SSL 4.1.2
  - SSL 4.1.1
  - SSL 4.1
  - SSL 4.0.1
  - SSL 4.0

# 1 SSL Release Notes

This document describes the changes made to the SSL application.

### 1.1 SSL 5.3.4

#### Fixed Bugs and Malfunctions

- Fix incorrect dialyzer spec and types, also enhance documentation.

  Thanks to Ayaz Tuncer.

  Own Id: OTP-11627

- Fix possible mismatch between SSL/TLS version and default ciphers. Could happen when you specified SSL/TLS-version in optionlist to listen or accept.

  Own Id: OTP-11712

- Application upgrade (appup) files are corrected for the following applications:

  asn1, common_test, compiler, crypto, debugger, dialyzer, edoc, eldap, erl_docgen, et, eunit, gs, hipe, inets, observer, odbc, os_mon, otp_mibs, parsetools, percept, public_key, reltool, runtime_tools, ssh, syntax_tools, test_server, tools, typer, webtool, wx, xmerl

  A new test utility for testing appup files is added to test_server. This is now used by most applications in OTP.

  (Thanks to Tobias Schlager)

  Own Id: OTP-11744

#### Improvements and New Features

- Moved elliptic curve definition from the crypto NIF/OpenSSL into Erlang code, adds the RFC-5639 brainpool curves and makes TLS use them (RFC-7027).

  Thanks to Andreas Schultz

  Own Id: OTP-11578

- Unicode adaptations

  Own Id: OTP-11620

- Added option honor_cipher_order. This instructs the server to prefer its own cipher ordering rather than the client's and can help protect against things like BEAST while maintaining compatability with clients which only support older ciphers.

  Thanks to Andrew Thompson for the implementation, and Andreas Schultz for the test cases.

  Own Id: OTP-11621

- Replace boolean checking in validate_option with is_boolean guard.

  Thanks to Andreas Schultz.

  Own Id: OTP-11634

- Some function specs are corrected or moved and some edoc comments are corrected in order to allow use of edoc. (Thanks to Pierre Fenoll)

  Own Id: OTP-11702

- Correct clean up of certificate database when certs are inputed in pure DER format.The incorrect code could cause a memory leek when certs where inputed in DER. Thanks to Bernard Duggan for reporting this.

  Own Id: OTP-11733

- Improved documentation of the cacertfile option

  Own Id: OTP-11759 Aux Id: seq12535

- Avoid next protocol negotiation failure due to incorrect option format.

  Own Id: OTP-11760

- Handle v1 CRLs, with no extensions and fixes issues with IDP (Issuing Distribution Point) comparison during CRL validation.

  Thanks to Andrew Thompson

  Own Id: OTP-11761

- Server now ignores client ECC curves that it does not support instead of crashing.

  Thanks to Danil Zagoskin for reporting the issue and suggesting a solution.

  Own Id: OTP-11780

- Handle SNI (Server Name Indication) alert unrecognized_name and gracefully deal with unexpected alerts.

  Thanks to Masatake Daimon for reporting this.

  Own Id: OTP-11815

- Add possibility to specify ssl options when calling ssl:ssl_accept

  Own Id: OTP-11837

### 1.2 SSL 5.3.3

#### Fixed Bugs and Malfunctions

- Add missing validation of the server_name_indication option and test for its explicit use. It was not possible to set or disable the default server_name_indication as the validation of the option was missing.

  Own Id: OTP-11567

- Elliptic curve selection in server mode now properly selects a curve suggested by the client, if possible, and the fallback alternative is changed to a more widely supported curve.

  Own Id: OTP-11575

- Bug in the TLS hello extension handling caused the server to behave as it did not understand secure renegotiation.

  Own Id: OTP-11595

### 1.3 SSL 5.3.2

#### Fixed Bugs and Malfunctions

- Honors the clients advertised support of elliptic curves and no longer sends incorrect elliptic curve extension in server hello.

  Own Id: OTP-11370

- Fix initialization of DTLS fragment reassembler, in previously contributed code, for future support of DTLS . Thanks to Andreas Schultz.

  Own Id: OTP-11376

- Corrected type error in client_preferred_next_protocols documentation. Thanks to Julien Barbot.

  Own Id: OTP-11457

#### Improvements and New Features

- TLS code has been refactored to prepare for future DTLS support. Also some DTLS code is in place but not yet runnable, some of it contributed by Andreas Schultz and some of it written by the OTP team. Thanks to to Andreas for his participation.

  Own Id: OTP-11292

- Remove extraneous dev debug code left in the close function. Thanks to Ken Key.

  Own Id: OTP-11447

- Add SSL Server Name Indication (SNI) client support. Thanks to Julien Barbot.

  Own Id: OTP-11460

### 1.4 SSL 5.3.1

#### Fixed Bugs and Malfunctions

- Setopts during renegotiation caused the renegotiation to be unsuccessful.

  If calling setopts during a renegotiation the FSM state might change during the handling of the setopts messages, this is now handled correctly.

  Own Id: OTP-11228

- Now handles signature_algorithm field in digitally_signed properly with proper defaults. Prior to this change some elliptic curve cipher suites could fail reporting the error "bad certificate".

  Own Id: OTP-11229

- The code emulating the inet header option was changed in the belief that it made it inet compatible. However the testing is a bit hairy as the inet option is actually broken, now the tests are corrected and the header option should work in the same broken way as inet again, preferably use the bitsyntax instead.

  Own Id: OTP-11230

#### Improvements and New Features

- Make the ssl manager name for erlang distribution over SSL/TLS relative to the module name of the ssl_manager.

  This can be beneficial when making tools that rename modules for internal processing in the tool.

  Own Id: OTP-11255

- Add documentation regarding log_alert option.

  Own Id: OTP-11271

### 1.5 SSL 5.3

#### Fixed Bugs and Malfunctions

- Honor the versions option to ssl:connect and ssl:listen.

  Own Id: OTP-10905

- Next protocol negotiation with reused sessions will now succeed

  Own Id: OTP-10909

#### Improvements and New Features

- Add support for PSK (Pre Shared Key) and SRP (Secure Remote Password) chipher suits, thanks to Andreas Schultz.

  Own Id: OTP-10450 Aux Id: kunagi-269 [180]

- Fix SSL Next Protocol Negotiation documentation. Thanks to Julien Barbot.

  Own Id: OTP-10955

- Fix ssl_connection to support reading proxy/chain certificates. Thanks to Valentin Kuznetsov.

  Own Id: OTP-10980

- Integrate elliptic curve contribution from Andreas Schultz

  In order to be able to support elliptic curve cipher suites in SSL/TLS, additions to handle elliptic curve infrastructure has been added to public_key and crypto.

  This also has resulted in a rewrite of the crypto API to gain consistency and remove unnecessary overhead. All OTP applications using crypto has been updated to use the new API.

  Impact: Elliptic curve cryptography (ECC) offers equivalent security with smaller key sizes than other public key algorithms. Smaller key sizes result in savings for power, memory, bandwidth, and computational cost that make ECC especially attractive for constrained environments.

  Own Id: OTP-11009

### 1.6 SSL 5.2.1

#### Improvements and New Features

- Transport callback handling is changed so that gen_tcp is treated as a special case where inet will be called directly for functions such as setopts, as gen_tcp does not have its own setopts. This will enable users to use the transport callback for other customizations such as websockets.

  Own Id: OTP-10847

- Follow up to OTP-10451 solved in ssl-5.2 R16A. Make sure format_error return good strings. Replace confusing legacy atoms with more descriptive atoms.

  Own Id: OTP-10864

### 1.7 SSL 5.1.2.1

#### Improvements and New Features

- Make log_alert configurable as option in ssl, SSLLogLevel added as option to inets conf file

  Own Id: OTP-11259

### 1.8 SSL 5.2

#### Fixed Bugs and Malfunctions

- SSL: TLS 1.2, advertise sha224 support, thanks to Andreas Schultz.

  Own Id: OTP-10586

- If an ssl server is restarted with new options and a client tries to reuse a session the server must make sure that it complies to the new options before agreeing to reuse it.

  Own Id: OTP-10595

- Now handles cleaning of CA-certificate database correctly so that there will be no memory leek, bug was introduced in ssl- 5.1 when changing implementation to increase parallel execution.

  Impact: Improved memory usage, especially if you have many different certificates and upgrade tcp-connections to TLS-connections.

  Own Id: OTP-10710

#### Improvements and New Features

- Support Next Protocol Negotiation in TLS, thanks to Ben Murphy for the contribution.

  Impact: Could give performance benefit if used as it saves a round trip.

  Own Id: OTP-10361 Aux Id: kunagi-214 [125]

- TLS 1.2 will now be the default TLS version if sufficient crypto support is available otherwise TLS 1.1 will be default.

  Impact: A default TLS connection will have higher security and hence it may be perceived as slower then before.

  Own Id: OTP-10425 Aux Id: kunagi-275 [186]

- It is now possible to call controlling_process on a listen socket, same as in gen_tcp.

  Own Id: OTP-10447

- Remove filter mechanisms that made error messages backwards compatible with old ssl but hid information about what actually happened.

  This does not break the documented API however other reason terms may be returned, so code that matches on the reason part of {error, Reason} may fail.

  *** POTENTIAL INCOMPATIBILITY ***

  Own Id: OTP-10451 Aux Id: kunagi-270 [181]

- Added missing dependencies to Makefile

  Own Id: OTP-10594

- Removed deprecated function ssl:pid/0, it has been pointless since R14 but has been keep for backwards compatibility.

  *** POTENTIAL INCOMPATIBILITY ***

  Own Id: OTP-10613 Aux Id: kunagi-331 [242]

- Refactor to simplify addition of key exchange methods, thanks to Andreas Schultz.

  Own Id: OTP-10709

### 1.9 SSL 5.1.2

#### Fixed Bugs and Malfunctions

- ssl:ssl_accept/2 timeout is no longer ignored

  Own Id: OTP-10600

### 1.10 SSL 5.1.1

#### Fixed Bugs and Malfunctions

- ssl:recv/3 could "loose" data when the timeout occurs. If the timout in ssl:connect or ssl:ssl_accept expired the ssl connection process was not terminated as it should, this due to gen_fsm:send_all_state_event timout is a client side time out. These timouts are now handled by the gen_fsm-procss instead.

  Own Id: OTP-10569

#### Improvements and New Features

- Better termination handling that avoids hanging.

  Own Id: OTP-10574

### 1.11 SSL 5.1

#### Fixed Bugs and Malfunctions

- Sometimes the client process could receive an extra {error, closed} message after ssl:recv had returned {error, closed}.

  Own Id: OTP-10118

- ssl v3 alert number 41 (no_certificate_RESERVED) is now recognized

  Own Id: OTP-10196

#### Improvements and New Features

- Experimental support for TLS 1.1 is now available, will be officially supported from OTP-R16. Thanks to Andreas Schultz for implementing the first version.

  Own Id: OTP-8871

- Experimental support for TLS 1.2 is now available, will be officially supported from OTP-R16. Thanks to Andreas Schultz for implementing the first version.

  Own Id: OTP-8872

- Removed some bottlenecks increasing the applications parallelism especially for the client side.

  Own Id: OTP-10113

- Workaround for handling certificates that wrongly encode X509countryname in utf-8 when the actual value is a valid ASCCI value of length 2. Such certificates are accepted by many browsers such as Chrome and Fierfox so for interoperability reasons we will too.

  Own Id: OTP-10222

### 1.12 SSL 5.0.1

#### Fixed Bugs and Malfunctions

- Robustness and improvement to distribution over SSL

  Fix a bug where ssl_tls_dist_proxy would crash at caller timeout. Fix a bug where a timeout from the SSL layer would block the distribution indefinately. Run the proxy exclusively on the loopback interface. (Thanks to Paul Guyot)

  Own Id: OTP-9915

- Fix setup loop of SSL TLS dist proxy

  Fix potential leak of processes waiting indefinately for data from closed sockets during socket setup phase. (Thanks to Paul Guyot)

  Own Id: OTP-9916

- Correct spelling of registered (Thanks to Richard Carlsson)

  Own Id: OTP-9925

- Added TLS PRF function to the SSL API for generation of additional key material from a TLS session. (Thanks to Andreas Schultz)

  Own Id: OTP-10024

### 1.13 SSL 5.0

#### Fixed Bugs and Malfunctions

- Invalidation handling of sessions could cause the time_stamp field in the session record to be set to undefined crashing the session clean up process. This did not affect the connections but would result in that the session table would grow.

  Own Id: OTP-9696 Aux Id: seq11947

- Changed code to use ets:foldl and throw instead of ets:next traversal, avoiding the need to explicitly call ets:safe_fixtable. It was possible to get a badarg-crash under special circumstances.

  Own Id: OTP-9703 Aux Id: seq11947

- Send ssl_closed notification to active ssl user when a tcp error occurs.

  Own Id: OTP-9734 Aux Id: seq11946

- If a passive receive was ongoing during a renegotiation the process evaluating ssl:recv could be left hanging for ever.

  Own Id: OTP-9744

#### Improvements and New Features

- Support for the old ssl implementation is dropped and the code is removed.

  Own Id: OTP-7048

- The erlang distribution can now be run over the new ssl implementation. All options can currently not be set but it is enough to replace to old ssl implementation.

  Own Id: OTP-7053

- public_key, ssl and crypto now supports PKCS-8

  Own Id: OTP-9312

- Implements a CBC timing attack counter measure. Thanks to Andreas Schultz for providing the patch.

  Own Id: OTP-9683

- Mitigates an SSL/TLS Computational DoS attack by disallowing the client to renegotiate many times in a row in a short time interval, thanks to Tuncer Ayaz for alerting us about this.

  Own Id: OTP-9739

- Implements the 1/n-1 splitting countermeasure to the Rizzo Duong BEAST attack, affects SSL 3.0 and TLS 1.0. Thanks to Tuncer Ayaz for alerting us about this.

  Own Id: OTP-9750

### 1.14 SSL 4.1.6

#### Fixed Bugs and Malfunctions

- replace "a ssl" with "an ssl" reindent pkix_path_validation/3 Trivial documentation fixes (Thanks to Christian von Roques )

  Own Id: OTP-9464

#### Improvements and New Features

- Adds function clause to avoid denial of service attack. Thanks to Vinod for reporting this vulnerability.

  Own Id: OTP-9364

- Error handling code now takes care of inet:getopts/2 and inets:setopts/2 crashes. Thanks to Richard Jones for reporting this.

  Own Id: OTP-9382

- Support explicit use of packet option httph and httph_bin

  Own Id: OTP-9461

- Decoding of hello extensions could fail to come to the correct conclusion due to an error in a binary match pattern. Thanks to Ben Murphy.

  Own Id: OTP-9589

### 1.15 SSL 4.1.5

#### Improvements and New Features

- Calling gen_tcp:connect with option {ip, {127,0,0,1}} results in an exit with reason badarg. Neither SSL nor INETS This was not catched, resulting in crashes with incomprehensible reasons.

  Own Id: OTP-9289 Aux Id: seq11845

### 1.16 SSL 4.1.3

#### Fixed Bugs and Malfunctions

- Fixed error in cache-handling fix from ssl-4.1.2

  Own Id: OTP-9018 Aux Id: seq11739

- Verification of a critical extended_key_usage-extension corrected

  Own Id: OTP-9029 Aux Id: seq11541

### 1.17 SSL 4.1.2

#### Fixed Bugs and Malfunctions

- The ssl application caches certificate files, it will now invalidate cache entries if the diskfile is changed.

  Own Id: OTP-8965 Aux Id: seq11739

- Now runs the terminate function before returning from the call made by ssl:close/1, as before the caller of ssl:close/1 could get problems with the reuseaddr option.

  Own Id: OTP-8992

### 1.18 SSL 4.1.1

#### Fixed Bugs and Malfunctions

- Correct handling of client certificate verify message When checking the client certificate verify message the server used the wrong algorithm identifier to determine the signing algorithm, causing a function clause error in the public_key application when the key-exchange algorithm and the public key algorithm of the client certificate happen to differ.

  Own Id: OTP-8897

#### Improvements and New Features

- For testing purposes ssl now also support some anonymous cipher suites when explicitly configured to do so.

  Own Id: OTP-8870

- Sends an error alert instead of crashing if a crypto function for the selected cipher suite fails.

  Own Id: OTP-8930 Aux Id: seq11720

### 1.19 SSL 4.1

#### Improvements and New Features

- Updated ssl to ignore CA certs that violate the asn1-spec for a certificate, and updated public key asn1 spec to handle inherited DSS-params.

  Own Id: OTP-7884

- Changed ssl implementation to retain backwards compatibility for old option {verify, 0} that shall be equivalent to {verify, verify_none}, also separate the cases unknown ca and selfsigned peer cert, and restored return value of deprecated function public_key:pem_to_der/1.

  Own Id: OTP-8858

- Changed the verify fun so that it differentiate between the peer certificate and CA certificates by using valid_peer or valid as the second argument to the verify fun. It may not always be trivial or even possible to know when the peer certificate is reached otherwise.

  *** POTENTIAL INCOMPATIBILITY ***

  Own Id: OTP-8873

### 1.20 SSL 4.0.1

#### Fixed Bugs and Malfunctions

- The server now verifies the client certificate verify message correctly, instead of causing a case-clause.

  Own Id: OTP-8721

- The client hello message now always include ALL available cipher suites (or those specified by the ciphers option). Previous implementation would filter them based on the client certificate key usage extension (such filtering only makes sense for the server certificate).

  Own Id: OTP-8772

- Fixed handling of the option {mode, list} that was broken for some packet types for instance line.

  Own Id: OTP-8785

- Empty packets were not delivered to the client.

  Own Id: OTP-8790

- Building in a source tree without prebuilt platform independent build results failed on the SSL examples when:

  - cross building. This has been solved by not building the SSL examples during a cross build.
  - building on Windows.

  Own Id: OTP-8791

- Fixed a handshake error which occurred on some ssl implementations.

  Own Id: OTP-8793

#### Improvements and New Features

- Revise the public_key API - Cleaned up and documented the public_key API to make it useful for general use, also changed ssl to use the new API.

  Own Id: OTP-8722

- Added support for inputing certificates and keys directly in DER format these options will override the pem-file options if specified.

  Own Id: OTP-8723

- To gain interoperability ssl will not check for padding errors when using TLS 1.0. It is first in TLS 1.1 that checking the padding is an requirement.

  Own Id: OTP-8740

- Changed the semantics of the verify_fun option in the ssl-application so that it takes care of both application handling of path validation errors and verification of application specific extensions. This means that it is now possible for the server application in verify_peer mode to handle path validation errors. This change moved some functionality earlier in ssl to the public_key application.

  Own Id: OTP-8770

- Added the functionality so that the verification fun will be called when a certificate is considered valid by the path validation to allow access to each certificate in the path to the user application. Also try to verify subject-AltName, if unable to verify it let the application verify it.

  Own Id: OTP-8825

### 1.21 SSL 4.0

#### Improvements and New Features

- New ssl now support client/server-certificates signed by dsa keys.

  Own Id: OTP-8587

- Ssl has now switched default implementation and removed deprecated certificate handling. All certificate handling is done by the public_key application.

  Own Id: OTP-8695