[erlang-questions] Erlang R12B3 inet_ssl_dist (SSL distribution) with ssl-3.9?
Kenji Rikitake
with ssl-3.9, which hasn't been successful. I'm running Erlang VM on
FreeBSD 6.3-RELEASE. The
erl -boot /my-path-to/start_ssl
says:
1> whereis(ssl_server).
undefined
Please let me know how to start the SSL distribution on R12B3.
Regards,
Kenji Rikitake
_______________________________________________
erlang-questions mailing list
erlang-q...@erlang.org
http://www.erlang.org/mailman/listinfo/erlang-questions
Kenji Rikitake
with ssl-3.9, which hasn't been successful.
I'm running Erlang VM on FreeBSD 6.3-RELEASE.
*** Problems:
* 0. ssl-3.9 manual Chapter 5 does not represent the latest
implementation.
* 1. In creating start_ssl.boot as described in ssl-3.9 manual section
5.2, two warnings remain:
content of the start_ssl.rel file:
-- begin --
{release, {"OTP APN 181 01","R12B"}, {erts, "5.6.3"},
[{kernel,"2.12.3"},
{stdlib,"1.15.3"},
{ssl,"3.9"}]}.
-- end --
after invoking erl (with no option):
-- begin --
Erlang (BEAM) emulator version 5.6.3 [source] [smp:2] [async-threads:0]
[hipe] [kernel-poll:false]
Eshell V5.6.3 (abort with ^G)
1> systools:make_script("start_ssl",[]).
*WARNING* ssl: Source code not found: ssl_pkix_oid.erl
*WARNING* ssl: Source code not found: 'OTP-PKIX'.erl
ok
2>
-- end --
To suppress the warning messages, creating symbolic links worked:
(cd $ERLANG_TOP/lib/ssl-3.9/src;
ln -s ../pkix/OTP-PKIX.erl;
ln -s ../pkix/ssk_pkix_old.erl;)
* 2. Even after the boot script is built, ssl_server is not registered,
which is supposed to be, as described in ssl manual Section 5.2.
-- start --
erl -boot /my/directory/start_ssl
Erlang (BEAM) emulator version 5.6.3 [source] [smp:2] [async-threads:0]
[hipe] [kernel-poll:false]
Eshell V5.6.3 (abort with ^G)
1> whereis(ssl_server).
undefined
2> c:regs().
** Registered procs on node nonode@nohost **
Name Pid Initial Call Reds Msgs
application_controlle <0.5.0> erlang:apply/2 710 0
code_server <0.19.0> erlang:apply/2 80684 0
erl_prim_loader <0.2.0> erlang:apply/2 67923 0
error_logger <0.4.0> gen_event:init_it/6 286 0
file_server_2 <0.18.0> file_server:init/1 17399 0
global_group <0.17.0> global_group:init/1 78 0
global_name_server <0.11.0> global:init/1 67 0
inet_db <0.15.0> inet_db:init/1 165 0
init <0.0.0> otp_ring0:start/2 3522 0
kernel_safe_sup <0.26.0> supervisor:kernel/1 63 0
kernel_sup <0.9.0> supervisor:kernel/1 1319 0
rex <0.10.0> rpc:init/1 46 0
ssl_broker_sup <0.32.0> supervisor:ssl_broker_sup 60 0
ssl_connection_sup <0.34.0> supervisor:ssl_connection 60 0
ssl_manager <0.33.0> ssl_manager:init/1 68 0
ssl_sup <0.31.0> supervisor:ssl_sup/1 265 0
user <0.22.0> group:server/3 47 0
** Registered ports on node nonode@nohost **
Name Id Command
ok
-- end --
* 3. By reading the source code, I found that ssl_server is no longer
registered in ssl-3.9 (see ssl:ensure_old_ssl_started/0).
So I tested as follows:
erl -boot /my/directory/start_ssl -proto_dist inet_ssl
1: ssl:version()
-> {ok,{"3.9","OpenSSL 0.9.7e-p1 25 Oct 2004",
"OpenSSL 0.9.7e-p1 25 Oct 2004"}}
2: net_kernel:start([a1])
-> {error,{shutdown,{child,undefined,net_sup_dynamic,
{erl_distribution,start_link,[[a1]]},
permanent,1000,supervisor,
[erl_distribution]}}}
* 4. I added SASL to the boot script (after stdlib and before ssl) to
report the errors, and found:
-- begin --
Erlang (BEAM) emulator version 5.6.3 [source] [smp:2] [async-threads:0] [hipe]
[kernel-poll:false]
=PROGRESS REPORT==== 24-Aug-2008::11:38:38 ===
supervisor: {local,sasl_safe_sup}
started: [{pid,<0.33.0>},
{name,alarm_handler},
{mfa,{alarm_handler,start_link,[]}},
{restart_type,permanent},
{shutdown,2000},
{child_type,worker}]
=PROGRESS REPORT==== 24-Aug-2008::11:38:38 ===
supervisor: {local,sasl_safe_sup}
started: [{pid,<0.34.0>},
{name,overload},
{mfa,{overload,start_link,[]}},
{restart_type,permanent},
{shutdown,2000},
{child_type,worker}]
=PROGRESS REPORT==== 24-Aug-2008::11:38:38 ===
supervisor: {local,sasl_sup}
started: [{pid,<0.32.0>},
{name,sasl_safe_sup},
{mfa,
{supervisor,start_link,
[{local,sasl_safe_sup},sasl,safe]}},
{restart_type,permanent},
{shutdown,infinity},
{child_type,supervisor}]
=PROGRESS REPORT==== 24-Aug-2008::11:38:38 ===
supervisor: {local,sasl_sup}
started: [{pid,<0.35.0>},
{name,release_handler},
{mfa,{release_handler,start_link,[]}},
{restart_type,permanent},
{shutdown,2000},
{child_type,worker}]
=PROGRESS REPORT==== 24-Aug-2008::11:38:38 ===
application: sasl
started_at: nonode@nohost
=PROGRESS REPORT==== 24-Aug-2008::11:38:38 ===
supervisor: {local,ssl_sup}
started: [{pid,<0.41.0>},
{name,ssl_broker_sup},
{mfa,{ssl_broker_sup,start_link,[]}},
{restart_type,permanent},
{shutdown,2000},
{child_type,supervisor}]
=PROGRESS REPORT==== 24-Aug-2008::11:38:38 ===
supervisor: {local,ssl_sup}
started: [{pid,<0.42.0>},
{name,ssl_manager},
{mfa,{ssl_manager,start_link,[]}},
{restart_type,permanent},
{shutdown,4000},
{child_type,worker}]
=PROGRESS REPORT==== 24-Aug-2008::11:38:38 ===
supervisor: {local,ssl_sup}
started: [{pid,<0.43.0>},
{name,ssl_connection},
{mfa,{ssl_connection_sup,start_link,[]}},
{restart_type,permanent},
{shutdown,4000},
{child_type,supervisor}]
=PROGRESS REPORT==== 24-Aug-2008::11:38:38 ===
application: ssl
started_at: nonode@nohost
Eshell V5.6.3 (abort with ^G)
1> ssl:version().
{ok,{"3.9","OpenSSL 0.9.7e-p1 25 Oct 2004",
"OpenSSL 0.9.7e-p1 25 Oct 2004"}}
2>
=PROGRESS REPORT==== 24-Aug-2008::11:38:48 ===
supervisor: {local,ssl_sup}
started: [{pid,<0.48.0>},
{name,ssl_server},
{mfa,{ssl_server,start_link,[]}},
{restart_type,permanent},
{shutdown,2000},
{child_type,worker}]
2> net_kernel:start([a1,shortnames).
=PROGRESS REPORT==== 24-Aug-2008::11:39:07 ===
supervisor: {local,net_sup}
started: [{pid,<0.51.0>},
{name,ssl_server_prim},
{mfa,{ssl_server,start_link_prim,[]}},
{restart_type,permanent},
{shutdown,2000},
{child_type,worker}]
=PROGRESS REPORT==== 24-Aug-2008::11:39:07 ===
supervisor: {local,net_sup}
started: [{pid,<0.52.0>},
{name,erl_epmd},
{mfa,{erl_epmd,start_link,[]}},
{restart_type,permanent},
{shutdown,2000},
{child_type,worker}]
=PROGRESS REPORT==== 24-Aug-2008::11:39:07 ===
supervisor: {local,net_sup}
started: [{pid,<0.53.0>},
{name,auth},
{mfa,{auth,start_link,[]}},
{restart_type,permanent},
{shutdown,2000},
{child_type,worker}]
=INFO REPORT==== 24-Aug-2008::11:39:07 ===
Protocol: "alt_ssl": register error: {normal,
{gen_server,call,
[ssl_server_prim,
{listen,<0.54.0>,{0,0,0,0},0,[],128},
infinity]}}
{error,{shutdown,{child,undefined,net_sup_dynamic,
{erl_distribution,start_link,[[a1,shortnames]]},
permanent,1000,supervisor,
[erl_distribution]}}}
3>
=CRASH REPORT==== 24-Aug-2008::11:39:07 ===
crasher:
pid: <0.54.0>
registered_name: net_kernel
exception exit: {error,badarg}
in function gen_server:init_it/6
initial call: gen:init_it(gen_server,<0.50.0>,<0.50.0>,
{local,net_kernel},
net_kernel,
{a1,shortnames,15000},
[])
ancestors: [net_sup,kernel_sup,<0.8.0>]
messages: []
links: [<0.50.0>]
dictionary: [{longnames,false}]
trap_exit: true
status: running
heap_size: 377
stack_size: 23
reductions: 269
neighbours:
=SUPERVISOR REPORT==== 24-Aug-2008::11:39:07 ===
Supervisor: {local,net_sup}
Context: start_error
Reason: {'EXIT',nodistribution}
Offender: [{pid,undefined},
{name,net_kernel},
{mfa,{net_kernel,start_link,[[a1,shortnames]]}},
{restart_type,permanent},
{shutdown,2000},
{child_type,worker}]
=SUPERVISOR REPORT==== 24-Aug-2008::11:39:07 ===
Supervisor: {local,net_sup}
Context: shutdown_error
Reason: normal
Offender: [{pid,<0.51.0>},
{name,ssl_server_prim},
{mfa,{ssl_server,start_link_prim,[]}},
{restart_type,permanent},
{shutdown,2000},
{child_type,worker}]
3> c:regs().
** Registered procs on node nonode@nohost **
Name Pid Initial Call Reds Msgs
alarm_handler <0.33.0> gen_event:init_it/6 34 0
application_controlle <0.5.0> erlang:apply/2 920 0
code_server <0.19.0> erlang:apply/2 86519 0
erl_prim_loader <0.2.0> erlang:apply/2 76524 0
error_logger <0.4.0> gen_event:init_it/6 19948 0
file_server_2 <0.18.0> file_server:init/1 17537 0
global_group <0.17.0> global_group:init/1 78 0
global_name_server <0.11.0> global:init/1 67 0
inet_db <0.15.0> inet_db:init/1 164 0
init <0.0.0> otp_ring0:start/2 5008 0
kernel_safe_sup <0.26.0> supervisor:kernel/1 63 0
kernel_sup <0.9.0> supervisor:kernel/1 1375 0
overload <0.34.0> overload:init/1 45 0
release_handler <0.35.0> release_handler:init/1 1433 0
rex <0.10.0> rpc:init/1 46 0
sasl_safe_sup <0.32.0> supervisor:sasl/1 200 0
sasl_sup <0.31.0> supervisor:sasl/1 182 0
ssl_broker_sup <0.41.0> supervisor:ssl_broker_sup 60 0
ssl_connection_sup <0.43.0> supervisor:ssl_connection 60 0
ssl_manager <0.42.0> ssl_manager:init/1 68 0
ssl_server <0.48.0> ssl_server:init/1 1248 0
ssl_sup <0.40.0> supervisor:ssl_sup/1 344 0
user <0.22.0> group:server/3 12320 0
** Registered ports on node nonode@nohost **
Name Id Command
ok
-- end --
*** So far I can't find any workaround for this. I suspect this glitch
happened when ssl library internal structure has been changed in
ssl-3.9.
Please let me know how I can start up inet_ssl_dist on R12B3.
Attila Babo
application in your .app file. Without a proper boot file just start
it like application:start(ssl). I hope this helps!
Kenji Rikitake
I've tried the application:start/1 function, but things didn't change.
The ssl-3.9/src/ssl_sup.hrl in R12B3 explicity disables the old
ssl_server in the boot-time process registration by init([]).
I also discovered ssl_esock port driver crashed with SIGSEGV on FreeBSD,
when the net_kernel:start tries to listen to an SSL port.
Testing this on WinXP SP3 hangs up the Erlang shell and no response
returned, while the Ctrl-G intervention worked.
I should conclude that at least the manual of ssl module about
inet_ssl_dist (Section 5) should be thoroughly revised. So I cross-post
this message to erlang-bugs also.
Regards,
Kenji Rikitake
In the message <597c69660808250928o169...@mail.gmail.com>
dated Mon, Aug 25, 2008 at 06:27:43PM +0200,
Kenji Rikitake
dated Sun, Aug 24, 2008 at 01:02:37PM +0900,
Kenji Rikitake <kenji.r...@acm.org> writes:
> I have been trying many times to start Erlang SSL distribution on R12B3
> with ssl-3.9, which hasn't been successful.
> I'm running Erlang VM on FreeBSD 6.3-RELEASE.
I finally found out that setting the client/server key pairs of
inet_ssl_dist solved the problem, which was written at:
http://www.trapexit.org/forum/viewtopic.php?p=22404#22404
I had to build client/server self-signed keys as written in:
http://sial.org/howto/openssl/self-signed/
So the real problems were:
* ssl-3.9 manual Chapter 5 does not represent the R12B3 implementation
difference.
In R12B3:
* In creating start_ssl.boot as described in ssl-3.9 manual section
5.2, two warnings remain:
1> systools:make_script("start_ssl",[]).
*WARNING* ssl: Source code not found: ssl_pkix_oid.erl
*WARNING* ssl: Source code not found: 'OTP-PKIX'.erl
ok
To suppress the warning messages, creating symbolic links worked:
(cd $ERLANG_TOP/lib/ssl-3.9/src;
ln -s ../pkix/OTP-PKIX.erl;
ln -s ../pkix/ssl_pkix_oid.erl;)
* Even after the boot script is built, ssl_server is not registered,
which is supposed to be, as described in ssl manual Section 5.2.
This is due to ssl-3.9 implementation; to invoke ssl_server, do
ssl:version() so that the version number tuple like following returns:
{ok,{"3.9","OpenSSL 0.9.7e-p1 25 Oct 2004",
"OpenSSL 0.9.7e-p1 25 Oct 2004"}}
* The starting sequence written in Section 5.5 is *mandatory*
to start up the Erlang Shell with inet_ssl distribution.
Specifically, the server_certfile and client_certfile options
of -ssl_dist_opt are *required*; otherwise, the shell will not
start. A startup script example is:
erl -boot /my/dir1/start_ssl \
-proto_dist inet_ssl \
-name a1 \
-ssl_dist_opt server_certfile \
/my/certs/host.pem \
-ssl_dist_opt client_certfile \
/my/certs/host.pem \
-ssl_dist_opt verify 1 depth 1
* Summary: the Section 5 of the manual of ssl-3.9 has to be fixed up-to-date
to represent the implementation difference.
(Yes, I tcpdump'ed the packets, and the exchange between two inet_ssl hosts
were actually encrypted :-))
Regards,