| Age | Commit message (Collapse) | Author | |
|---|---|---|---|
| 2026-08-14 | Restored TLS 1.2 RSA signature fallback (#419) | Frédéric Desbiens | |
| Advertise RSA-PSS for TLS 1.3 and the corresponding RSA PKCS#1 schemes for TLS 1.2 fallback. Precompute the exact extension length and cover the wire format and buffer boundaries with a focused regression test. Assisted-by: Codex (gpt-5.6-sol) <[email protected]> | |||
| 2026-08-13 | Fixed TLS 1.3 record de-padding in _nx_secure_tls_process_record (RFC 8446 ↵ | Edouard Malot | |
| §5.4) (#401) * Fix TLS 1.3 record padding strip in _nx_secure_tls_process_record (RFC 8446 §5.4) The inner content type was read as the literal last byte of the decrypted plaintext. Per RFC 8446 §5.4 that byte is followed by an arbitrary-length zero padding, so the receiver must scan back from the end skipping zeros to find it. Without this, any client that pads its TLS 1.3 records gets a fatal `unexpected_message` alert on its first record. Java JDK HttpClient pads by default since 11 (traffic-analysis resistance), so every Java HTTPS client tripped on this. Reproducible with OpenSSL using `-record_padding N`. * Move scan_offset to top-of-function locals, drop scoped block Follow the existing style of nx_secure_tls_process_record.c: all locals declared alongside message_length and bytes_copied at the top of the function, no nested scope just to introduce one variable. Trim the TLS 1.3 de-padding comment to say what the code does now — the history of why the previous version was wrong lives in the previous commit message and PR description. * Return unexpected_message when the plaintext has no inner content type RFC 8446 §5.4 requires "unexpected_message" when a decrypted record contains only padding. NX_SECURE_TLS_UNEXPECTED_MESSAGE already maps to the correct alert (10, fatal) in nx_secure_tls_map_error_to_alert.c; NX_SECURE_TLS_INVALID_PACKET fell through to internal_error, which misidentified a peer protocol violation as our own bug. The extract-failure path just above still returns INVALID_PACKET — that one really is a local packet-handling error and internal_error is the honest signal. * Scan the plaintext directly instead of calling extract per byte nx_packet_data_extract_offset() walks the packet chain from the head on every call. Since the de-padding scan starts at the end of the record, each call traversed the whole chain to reach the last fragment before copying a single byte — one full walk per byte examined. On a maximally padded 16 KB record that is on the order of 16 000 chain walks handed to the peer, which the RFC lets it perform arbitrarily. Walk the fragments once, remember the offset of the last non-zero byte. The traversal always visits every plaintext byte so the cost no longer depends on the amount of padding, which matches the stance the neighbouring TLS 1.2 path already takes on padding-related timing channels (see the MAC-check comment a few lines below). The extract-failure branch disappears with the extract call, so the remaining error path is exactly the peer protocol violation (all-zero plaintext) reporting unexpected_message. * Add regression tests for the TLS 1.3 record de-padding Cover the four cases that matter for the §5.4 fix: 1. Padded record — inner type recovered, length excludes both the type byte and the padding. 2. All-zero plaintext — rejected with unexpected_message. 3. Unpadded record — behaviour matches the pre-fix arithmetic (length - 1). This is the regression-risk assertion for existing traffic that never triggered the bug. 4. Chained-packet plaintext — the scan walks through NX_PACKET fragments, not just the head. Forced by using a plaintext larger than a single pool packet. Requires exposing the de-padding scan as _nx_secure_tls_1_3_strip_padding so the test can drive it directly without standing up a full TLS 1.3 AEAD session. _nx_secure_tls_process_record now delegates to the same helper, so the behaviour under test is identical to the production path. * Declared the TLS 1.3 de-padding helper in the header, as its siblings are _nx_secure_tls_1_3_strip_padding had external linkage but no declaration in any header: it was forward declared in nx_secure_tls_process_record.c and declared again with extern in the test that calls it. That is the one shape this tree does not use. nx_secure_tls.h already carries 135 internal _nx_secure_* prototypes, including a run of _nx_secure_tls_1_3_* functions, while the other internal function in this same source file, _nx_secure_tls_packet_trim, is static because nothing outside needs it. So an internal function is either declared in the header or static, and this one is used from outside its translation unit. Declare it in nx_secure_tls.h beside _nx_secure_tls_1_3_crypto_init, and drop both duplicate declarations. No behaviour change, and it removes a MISRA 8.7 deviation that would otherwise have to be documented rather than avoided. Verified by rebuilding nx_secure_tls_process_record_test against the header instead of the extern: it links, and all four de-padding cases pass. --------- Co-authored-by: Frédéric Desbiens <[email protected]> Assisted-by: Claude Code (Opus 5) <[email protected]> | |||
| 2026-05-28 | Added support for parsing ASN.1 GeneralizedTime in X509 Certificates (#267) | Simon Scurrell | |
| * add support for parsing ASN.1 GeneralizedTime * fix validity format field error * changed CertMsg notBefore format to be in GeneralizedTime format * changed notBefore time to be in GeneralizedTime format * changed notAfter time to be in GeneralizedTime format * expand tests for invalid date format * update function comments * update function comments --------- Co-authored-by: Frédéric Desbiens <[email protected]> | |||
| 2026-03-07 | Updated copyright headers and version strings. Removed version history | Frédéric Desbiens | |
| 2025-06-12 | Added the cipher suites: TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA and ↵ | Igor Tomiatti | |
| TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA | |||
| 2025-03-18 | Fixed a typo in the version number comment. | Frédéric Desbiens | |
| 2025-03-18 | Updated version numbers to 6.4.3 | Frédéric Desbiens | |
| 2025-02-20 | Updates the version to v6.4.2 | Frédéric Desbiens | |
| 2024-02-27 | Update version number to 6.4.1 | TiejunZhou | |
| 2024-01-29 | Update copyright. | Bo Chen (from Dev Box) | |
| 2023-12-28 | Updated version and date for 6.4.0 (#229)v6.4.0_rel | Bo Chen | |
| 2023-10-23 | Update on 23 Oct 2023. Expand to see details.v6.3.0_rel | Tiejun Zhou | |
| 002a5890e Generated rtxp demo in netxduo/samples folder. c09d9da51 Add function header in .h for RTP and RTSP f5a96f35b Update function header and version for 6.3.0 0ff7a6809 Correct dhcpv6 server for ignoring lifetime fields in client request 9a2129c35 Fixed dhcpv6 server not update client record issue e59d2b5f1 Fix dhcp coverage test compile wanrning d00655d71 Fix infinite loop issue in TCP & UDP free port find function c194c74ca Optimize rtp_sender and fix pipeline reported issues b6df8dea0 Add RTxP feature 38e57e633 Added test case for _nx_snmp_utility_object_id_get(). 321c88bd9 Added check for pdu length. 36ffb7c39 Fixed packet double release. 92166d736 Fixed SNMP test cases for v4_small_build 67f071552 Improved buffer length verification for padding. 30cc5d8b2 Fix wait option used in FTP test case 098a97213 Avoid duplicate packet release when DTLS send fails 15313e868 Improved buffer length verification for _nx_snmp_utility_object_id_set(). ecd3904d3 Fixed MSRC 81018 caa004007 Fix the logic of handling close notify packet from peer 2b8c87685 Removed main.c into netxduo/samples folder, then all addons can use it. c72c66cdc Fixed MSARC 81019 and MSRC 81079 8169be7a6 Fixed MSRC81005 and MSRC81020 41389b76b Fixed packet double release issue in _nx_ftp_client_file_write 19348e408 Combined the functions of processing snmp v1 and v2. 9174b6457 Fixed icmpv6 ra buffer overwrite test case. 6bdc703d9 Fixed packet double release issue in _nx_nat_process_packet 403ecd128 Set nx_smtp_server_packet to NULL to avoided duplicate packet release in _nx_smtp_utility_read_server_code af5dd00c6 Disable FTP server MSS test case when packet chain is disabled beadbce12 Enable weekly pipeline build to avoid CodeQL expiration 5a3d88f97 Fixed MSRC 81528 df6a1fc57 unify the code. 18c13bfdb Fixed MSRC 80745. 2cce43f48 Fixed bug in utility/iperf/nx_iperf.c pointer used before set its value. 2477fb81c Update product owners 2f5734ada Fixed MSRC 80686 34e713e26 Fixed data length underflow when TCP MSS is less than 255 7097a7859 Improved the test cases for packet chain. 1ffa13cfa Fixed MSRC 80685 97e2b8d8e Set packet pointer to NULL after released to fix duplicate packet release issue c1e47efa7 Fix ICMPv6 NS buffer overwrite issue. c2770ea68 Add ICMPv6 NA buffer overwrite test case. 36bb05f85 Validated TCP header buffer to avoid span in multiple packets 84070bb2a Correct the length of packet buffer to avoid write overflow 5b3b3a10b Dropped packet chain for SNTP data to avoid write overflow 82699872d Onebranch build Image Update: Move pipelines to supported and compliant OneBranch container images a30171f93 Add a test case to demonstrate IGMP override caused by IP assembly. 72472ff4b Fix MSRC 80746 5d9f1266a Corrected the acked packet count when out of order is enabled b113ebdc9 Fixed DHCP server local variable type issue b70863299 Enable codeql in onebranch pipeline | |||
| 2023-03-08 | Release 6.2.1 on 08 Mar 2023. Expand to see details.v6.2.1_rel | Tiejun Zhou | |
| 29eee6fe8 Update function header and version to 6.2.1 e22a02169 Fix compile errors in TLS 3e0a14c1c Fix network driver for regression test. 442f3adfa Fix compiler warnings in NetXDuo | |||
| 2023-02-27 | Update on 27 Feb 2023. Expand to see details. | Tiejun Zhou | |
| 1c87864dc [SNTP & TELNET] Clear the client ID in delete function for SNTP and TELNET. 1a957bf48 Reported ADU agent state as IDLE to server after receiving cancel command. d648902b2 [BSD] Corrected the result of FIONREAD when using TCP socket. 494f0016f create netxduo cmsis-pack c5519bdf8 Add ADU version string f52279c97 Include TLS port header in nx_secure_x509.h cf753549b Fix packet leak in TLS 1.3 be8943659 Update PnP interface to use ADU GA model 17e601544 Fix the logic to cleanup key material 11e65bacd Initialize metadata for certificate using packet buffer 7ff1841ac Fix conditional build check for TLS 1.3 | |||
| 2022-10-26 | Release 6.2.0 | Tiejun Zhou | |
| 2022-07-26 | Release 6.1.12v6.1.12_rel | Yuxin Zhou | |
| 2022-04-20 | Release 6.1.11v6.1.11_rel | Yuxin Zhou | |
| 2022-01-26 | Release 6.1.10v6.1.10_rel | Yuxin Zhou | |
| 2021-10-13 | Release 6.1.9v6.1.9_rel | Yuxin Zhou | |
| 2021-07-28 | Release 6.1.8v6.1.8_rel | Yuxin Zhou | |
| 2021-06-02 | Release 6.1.7v6.1.7_rel | Bo Chen | |
| 2021-04-03 | Release 6.1.6v6.1.6_rel | Yuxin Zhou | |
| 2021-02-28 | Release 6.1.5 | Yuxin Zhou | |
| 2021-02-02 | Release 6.1.4v6.1.4_rel | Yuxin Zhou | |
| 2021-01-07 | update to v6.1.3 | Scott Larson | |
| 2020-10-09 | 6.1 Release | Scott Larson | |
| 2020-08-14 | apply 6.0.2 patchv6.0.2_rel | Scott Larson | |
| 2020-07-13 | updated to 6.0.1 and added additional processors/toolchainsv6.0.1_rel | Scott Larson | |
| 2020-05-12 | RC2 updates | PProvost | |
| 2020-05-11 | Initial commit | PProvost | |
 |
index : netxduo.git | |
| Unnamed repository; edit this file 'description' to name the repository. |
| summaryrefslogtreecommitdiff |