<div dir="ltr">Yes, I have reproduced a crash in handshake parsing.<div>Pull Request with test case is available at <a href="https://github.com/erlang/otp/pull/286">https://github.com/erlang/otp/pull/286</a></div><div><br>
</div><div>By the way, there is another crash when talking to security scanner — badarg at crypto:rsa_sign_nif:<br><div>** Reason for termination =</div><div>** {badarg,[{crypto,rsa_sign_nif,</div><div> [md5sha,</div>
<div> {digest,<<124,187,138,41,125,55,222,61,16,209,73,157,86,</div><div> 21,130,223,96,214,189,59,0,64,136,130,168,238,</div><div> 245,220,105,191,145,194,112,201,251,184>>},</div>
<div> _LARGE_IOLIST_HERE_ ],</div><div> []},</div><div> {crypto,sign,4,[{file,"crypto.erl"},{line,467}]},</div><div> {ssl_handshake,enc_server_key_exchange,6,</div>
<div> [{file,"ssl_handshake.erl"},{line,660}]},</div><div> {tls_connection,key_exchange,1,</div><div> [{file,"tls_connection.erl"},{line,1661}]},</div>
<div> {tls_connection,server_certify_and_key_exchange,1,</div><div> [{file,"tls_connection.erl"},{line,1553}]},</div><div> {tls_connection,new_server_hello,2,</div>
<div> [{file,"tls_connection.erl"},{line,1470}]},</div><div> {tls_connection,next_state,4,</div><div> [{file,"tls_connection.erl"},{line,2548}]},</div>
<div> {gen_fsm,handle_msg,7,[{file,"gen_fsm.erl"},{line,505}]}]}</div></div><div><br></div><div>I'll look at this later.</div><div><br></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">
2014-03-09 20:11 GMT+04:00 Andreas Schultz <span dir="ltr"><<a href="mailto:aschultz@tpip.net" target="_blank">aschultz@tpip.net</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi,<br>
<div class=""><br>
----- Original Message -----<br>
> I've investigated this case a bit and it seems to me that ECC handshake<br>
> implementation has a bug:<br>
> As fas as I understand RFC 4492 (<br>
</div>> <a href="https://tools.ietf.org/html/rfc4492#section-5.1" target="_blank">https://tools.ietf.org/html/rfc4492#section-5.1</a> ), it tells that it's OK for<br>
<div class="">> server to not support all curves supported by client if there are enough<br>
> curves supported by both of them.<br>
> So if I'm correct, the tls_v1:enum_to_oid/1 function should have a default<br>
> clause returning some magic value ('unsupported_curve' ?) which should be<br>
> filtered out from EllipticCurves list in ?ELLIPTIC_CURVES_EXT clause of<br>
> ssl_handshake:dec_hello_extensions/2 (line 1654).<br>
<br>
</div>There have been several changes that went into R16B03 and R17 concerning<br>
the curve selection. Did you check if your problem also occurs with those<br>
releases?<br>
<br>
Andreas<br>
<div><div class="h5"><br>
><br>
> I hope to fix it today.<br>
><br>
><br>
> 2014-03-09 1:49 GMT+04:00 Ingela Andin < <a href="mailto:ingela.andin@gmail.com">ingela.andin@gmail.com</a> > :<br>
><br>
><br>
><br>
> Hi!<br>
><br>
> 2014-03-07 11:14 GMT+01:00 Danil Zagoskin < <a href="mailto:z@gosk.in">z@gosk.in</a> > :<br>
><br>
><br>
><br>
><br>
> Thank you!<br>
><br>
> May I help you? Test case, pull request, etc?<br>
><br>
><br>
> You are always welcome to make a pull request which, if you follow the guide<br>
> lines, should include a test case.<br>
><br>
><br>
> Regards Ingela Erlang/OTP team - Ericsson AB<br>
><br>
><br>
><br>
><br>
><br>
> 2014-03-07 1:39 GMT+04:00 Ingela Andin < <a href="mailto:ingela.andin@gmail.com">ingela.andin@gmail.com</a> > :<br>
><br>
><br>
><br>
> Hi!<br>
><br>
> 2014-03-06 11:50 GMT+01:00 Danil Zagoskin < <a href="mailto:z@gosk.in">z@gosk.in</a> > :<br>
><br>
><br>
><br>
><br>
> Hello!<br>
><br>
> My application is listening SSL port using ssl:listen, ssl:transport_accept<br>
> and ssl:ssl_accept (indeed it uses some old patched mochiweb).<br>
> Erlang/OTP release is R16B02.<br>
> I use SASL for error logging.<br>
><br>
> Due to existence of network scanners, network errors and buggy clients some<br>
> of connections fail to negotiate. This leads to two kind of log entries:<br>
> 1. "insufficient security", etc.<br>
> 2. Crash reports due to a function_clause error in tls_v1:enum_to_oid(0)<br>
> (this may be not the only one, but definitely the most popular)<br>
><br>
> First one seems to be fixed by {log_alert, false} ssl option.<br>
> Second one keeps flooding logs with huge state printouts.<br>
><br>
> So, my question is: How to make all SSL-related troubles not to generate<br>
> error reports? Simple {error, handshake_failed} returned by one of accepting<br>
> functions would be enough.<br>
><br>
><br>
><br>
><br>
> The first option should logically be enough. I think the problem is that<br>
> tls_v1:enum_to_oid<br>
> should have a try and throw a handshake alert if it fails or be ignored,<br>
> depending on situation, i.e. be an expected error instead of an unexpected<br>
> error. I will create an issue to handle that.<br>
><br>
> Regards Ingela Erlang/OTP team - Ericsson AB<br>
><br>
> _______________________________________________<br>
> erlang-questions mailing list<br>
> <a href="mailto:erlang-questions@erlang.org">erlang-questions@erlang.org</a><br>
> <a href="http://erlang.org/mailman/listinfo/erlang-questions" target="_blank">http://erlang.org/mailman/listinfo/erlang-questions</a><br>
><br>
><br>
><br>
><br>
> --<br>
> ---------------------------------------------<br>
> Данил Загоскин | +7 906 064 20 47 | <a href="mailto:z@gosk.in">z@gosk.in</a><br>
><br>
><br>
><br>
><br>
> --<br>
> ---------------------------------------------<br>
> Данил Загоскин | +7 906 064 20 47 | <a href="mailto:z@gosk.in">z@gosk.in</a><br>
><br>
> _______________________________________________<br>
> erlang-questions mailing list<br>
> <a href="mailto:erlang-questions@erlang.org">erlang-questions@erlang.org</a><br>
> <a href="http://erlang.org/mailman/listinfo/erlang-questions" target="_blank">http://erlang.org/mailman/listinfo/erlang-questions</a><br>
><br>
<br>
--<br>
--<br>
</div></div>Dipl. Inform.<br>
Andreas Schultz<br>
<br>
email: <a href="mailto:as@travelping.com">as@travelping.com</a><br>
phone: +49-391-819099-224<br>
mobil: +49-170-2226073<br>
<br>
------------------- enabling your networks -------------------<br>
<br>
Travelping GmbH phone: +49-391-819099229<br>
Roentgenstr. 13 fax: +49-391-819099299<br>
D-39108 Magdeburg email: <a href="mailto:info@travelping.com">info@travelping.com</a><br>
GERMANY web: <a href="http://www.travelping.com" target="_blank">http://www.travelping.com</a><br>
<br>
Company Registration: Amtsgericht Stendal Reg No.: HRB 10578<br>
Geschaeftsfuehrer: Holger Winkelmann | VAT ID No.: DE236673780<br>
--------------------------------------------------------------<br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br><font face="'courier new', monospace">---------------------------------------------</font><div><font face="'courier new', monospace">Данил Загоскин | +7 906 064 20 47 | <a href="mailto:z@gosk.in" target="_blank">z@gosk.in</a></font></div>
</div>