Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ssl: Convey alert information to passive socket operations recv and s… #8823

Merged

Conversation

IngelaAndin
Copy link
Contributor

…etopts

If a TLS-1.3 server fails client certification the alert might arrive in the connection state and even after data has been sent. Make sure the alert information will be available in error reason returned from passive socket API functions recv and setopt.

@IngelaAndin IngelaAndin requested review from dgud and u3s September 18, 2024 14:24
@IngelaAndin IngelaAndin self-assigned this Sep 18, 2024
@IngelaAndin IngelaAndin added the team:PS Assigned to OTP team PS label Sep 18, 2024
Copy link
Contributor

github-actions bot commented Sep 18, 2024

CT Test Results

    2 files     67 suites   47m 57s ⏱️
  793 tests   749 ✅  44 💤 0 ❌
3 764 runs  2 970 ✅ 794 💤 0 ❌

Results for commit 6e08534.

♻️ This comment has been updated with latest results.

To speed up review, make sure that you have read Contributing to Erlang/OTP and that all checks pass.

See the TESTING and DEVELOPMENT HowTo guides for details about how to run test locally.

Artifacts

// Erlang/OTP Github Action Bot

@IngelaAndin IngelaAndin force-pushed the ingela/ssl/recv-setopts-alert/OTP-19236 branch from ebac4cc to 2f89b65 Compare September 18, 2024 17:59
@IngelaAndin IngelaAndin added the testing currently being tested, tag is used by OTP internal CI label Sep 19, 2024
Copy link
Contributor

@dgud dgud left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me.

lib/ssl/src/ssl_gen_statem.erl Outdated Show resolved Hide resolved
lib/ssl/test/tls_1_3_version_SUITE.erl Show resolved Hide resolved
lib/ssl/test/tls_1_3_version_SUITE.erl Show resolved Hide resolved
lib/ssl/src/tls_gen_connection.erl Outdated Show resolved Hide resolved
lib/ssl/src/ssl_gen_statem.erl Outdated Show resolved Hide resolved
@IngelaAndin IngelaAndin force-pushed the ingela/ssl/recv-setopts-alert/OTP-19236 branch from 2f89b65 to 5837926 Compare September 23, 2024 14:10
…etopts

If a TLS-1.3 server fails client certification the alert might arrive
in the connection state and even after data has been sent. Make sure
the alert information will be available in error reason returned from
passive socket API functions recv and setopt.
@IngelaAndin IngelaAndin force-pushed the ingela/ssl/recv-setopts-alert/OTP-19236 branch from 5837926 to 6e08534 Compare September 23, 2024 14:12
@IngelaAndin IngelaAndin merged commit 790765e into erlang:maint Sep 25, 2024
16 checks passed
@essen
Copy link
Contributor

essen commented Nov 6, 2024

@IngelaAndin In the Gun ticket linked just above this comment a user points out that the TLS alert may be lost in additional cases such as when calling ssl:send. The ticket has a reproducible test case. Is there something that can be done about this in OTP or is the workaround to check the mailbox for a TLS alert message the right way to go?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
team:PS Assigned to OTP team PS testing currently being tested, tag is used by OTP internal CI
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants