Prepare release

3 files changed, 144 insertions, 3 deletions

diff --git a/lib/ssl/doc/src/notes.xml b/lib/ssl/doc/src/notes.xml
index a36ac8d78d..fcaa8b6246 100644
--- a/lib/ssl/doc/src/notes.xml
+++ b/lib/ssl/doc/src/notes.xml
@@ -27,6 +27,147 @@
   </header>
   <p>This document describes the changes made to the SSL application.</p>
 
+<section><title>SSL 11.0</title>
+
+    <section><title>Improvements and New Features</title>
+      <list>
+        <item>
+          <p>
+	    Improved error checking and handling of ssl options.</p>
+          <p>
+	    Own Id: OTP-15903</p>
+        </item>
+        <item>
+          <p>
+	    With this change, stateless tickets generated by server
+	    with anti_replay option enabled can be used for creating
+	    ClientHello throughout ticket lifetime. Without this
+	    change, usability was limited to WindowSize number of
+	    seconds configured for anti_replay option.</p>
+          <p>
+	    *** POTENTIAL INCOMPATIBILITY ***</p>
+          <p>
+	    Own Id: OTP-18168 Aux Id: PR-6019, GH-6014 </p>
+        </item>
+        <item>
+	    <p> Support for Kernel TLS (kTLS), has been added to the
+	    SSL application, for TLS distribution (<c>-proto_dist
+	    inet_tls</c>), the SSL option <c>{ktls, true}</c>. Using
+	    this for general SSL sockets is uncomfortable,
+	    undocumented and not recommended since it requires very
+	    platform dependent raw options. </p><p> This, for now,
+	    only works for some not too old Linux distributions.
+	    Roughly, a kernel 5.2.0 or later with support for
+	    UserLand Protocols and the kernel module <c>tls</c> is
+	    required. </p>
+          <p>
+	    Own Id: OTP-18235 Aux Id: PR-6104, PR-5840 </p>
+        </item>
+        <item>
+          <p>
+	    With this change, TLS 1.3 server can be configured to
+	    include client certificate in session ticket.</p>
+          <p>
+	    Own Id: OTP-18253</p>
+        </item>
+        <item>
+          <p>
+	    With this change, it is possible to configure encryption
+	    seed to be used with TLS1.3 stateless tickets. This
+	    enables using tickets on different server instances.</p>
+          <p>
+	    Own Id: OTP-18254 Aux Id: PR-5982 </p>
+        </item>
+        <item>
+          <p>
+	    Debugging enhancements.</p>
+          <p>
+	    Own Id: OTP-18312</p>
+        </item>
+        <item>
+          <p>
+	    With this change, maybe keyword atom is not used as
+	    function name in ssl code.</p>
+          <p>
+	    Own Id: OTP-18335</p>
+        </item>
+        <item>
+          <p>
+	    Replace size/1 with either tuple_size/1 or byte_size/1</p>
+          <p>
+	    The <c>size/1</c> BIF is not optimized by the JIT, and
+	    its use can result in worse types for Dialyzer.</p>
+          <p>
+	    When one knows that the value being tested must be a
+	    tuple, <c>tuple_size/1</c> should always be preferred.</p>
+          <p>
+	    When one knows that the value being tested must be a
+	    binary, <c>byte_size/1</c> should be preferred. However,
+	    <c>byte_size/1</c> also accepts a bitstring (rounding up
+	    size to a whole number of bytes), so one must make sure
+	    that the call to <c>byte_size/</c> is preceded by a call
+	    to <c>is_binary/1</c> to ensure that bitstrings are
+	    rejected. Note that the compiler removes redundant calls
+	    to <c>is_binary/1</c>, so if one is not sure whether
+	    previous code had made sure that the argument is a
+	    binary, it does not harm to add an <c>is_binary/1</c>
+	    test immediately before the call to <c>byte_size/1</c>.</p>
+          <p>
+	    Own Id: OTP-18405 Aux Id:
+	    GH-6672,PR-6702,PR-6768,PR-6700,PR-6769,PR-6812,PR-6814 </p>
+        </item>
+        <item>
+          <p>
+	    For security reasons remove support for SHA1 and DSA
+	    algorithms from default values.</p>
+          <p>
+	    *** POTENTIAL INCOMPATIBILITY ***</p>
+          <p>
+	    Own Id: OTP-18438 Aux Id: GH-6679 </p>
+        </item>
+        <item>
+          <p>
+	    Mitigate memory usage from large certificate chains by
+	    lowering the maximum handshake size. This should not
+	    effect the common cases, if needed it can be configured
+	    to a higher value.</p>
+          <p>
+	    Own Id: OTP-18453</p>
+        </item>
+        <item>
+          <p>
+	    Change the client default verify option to verify_peer.
+	    Note that this makes it mandatory to also supply trusted
+	    CA certificates or explicitly set verify to verify_none.
+	    This also applies when using the so called anonymous test
+	    cipher suites defined in TLS versions pre TLS-1.3.</p>
+          <p>
+	    *** POTENTIAL INCOMPATIBILITY ***</p>
+          <p>
+	    Own Id: OTP-18455 Aux Id: GH-5899 </p>
+        </item>
+        <item>
+          <p>
+	    Erlang distribution code in Kernel and SSL has been
+	    refactored a bit to facilitate debugging and
+	    re-usability, which shouldn't have any noticeable effects
+	    on behaviour or performance.</p>
+          <p>
+	    Own Id: OTP-18456</p>
+        </item>
+        <item>
+          <p>
+	    Add encoding and decoding of use_srtp hello extension to
+	    facilitate for DTLS users to implement SRTP
+	    functionality.</p>
+          <p>
+	    Own Id: OTP-18459</p>
+        </item>
+      </list>
+    </section>
+
+</section>
+
 <section><title>SSL 10.9</title>
 
     <section><title>Fixed Bugs and Malfunctions</title>
diff --git a/lib/ssl/src/ssl.app.src b/lib/ssl/src/ssl.app.src
index abc5d278a8..b9f69af6a3 100644
--- a/lib/ssl/src/ssl.app.src
+++ b/lib/ssl/src/ssl.app.src
@@ -88,6 +88,6 @@
     {applications, [crypto, public_key, kernel, stdlib]},
     {env, []},
     {mod, {ssl_app, []}},
-    {runtime_dependencies, ["stdlib-4.1","public_key-1.11.3","kernel-@OTP-18235@",
-                            "erts-@OTP-18248@","crypto-5.0", "inets-5.10.7",
+    {runtime_dependencies, ["stdlib-4.1","public_key-1.11.3","kernel-9.0",
+                            "erts-14.0","crypto-5.0", "inets-5.10.7",
                             "runtime_tools-1.15.1"]}]}.
diff --git a/lib/ssl/vsn.mk b/lib/ssl/vsn.mk
index 7b821e2bc8..de283ec08a 100644
--- a/lib/ssl/vsn.mk
+++ b/lib/ssl/vsn.mk
@@ -1 +1 @@
-SSL_VSN = 10.9
+SSL_VSN = 11.0