summaryrefslogtreecommitdiff
path: root/nx_secure/src
AgeCommit message (Collapse)Author
2026-05-28Added support for parsing ASN.1 GeneralizedTime in X509 Certificates (#267)Simon Scurrell
* add support for parsing ASN.1 GeneralizedTime * fix validity format field error * changed CertMsg notBefore format to be in GeneralizedTime format * changed notBefore time to be in GeneralizedTime format * changed notAfter time to be in GeneralizedTime format * expand tests for invalid date format * update function comments * update function comments --------- Co-authored-by: Frédéric Desbiens <[email protected]>
2026-05-28Fixed issues in the PSK implementation (#386)Frédéric Desbiens
* Fixed server PSK identity selection for ECDHE-PSK * Fixed selected client PSK identity preservation Implemented logic to cache the PSK store entry selected by the server identity hint so ClientKeyExchange emits the matching identity when clients use the PSK store path. Cast the ECC supported-group test value to USHORT so the PSK identity regression builds cleanly with -Werror on Linux. Assisted-By: Codex (OpenAI GPT-5.5) <[email protected]>
2026-05-21Added RSA-PSS signature verification support (TLS 1.3 with RSA cert) (#377)Edouard Malot
* Add RSA-PSS * Fix SHA-384/512 transcript hash truncation and add MGF1 bounds check Address review feedback on RSA-PSS PR: - Resize handshake_hash buffer from 130 to 162 bytes (64+34+64) in both nx_secure_tls_process_certificate_verify.c and nx_secure_tls_send_certificate_verify.c to fit SHA-512 transcript. - Replace hardcoded 32-byte transcript hash copy with dynamic length derived from hash_method->nx_crypto_ICV_size_in_bits. - Add bounds check in _nx_crypto_rsa_pss_mgf1 to reject hash_method whose output exceeds the local hash_buf size. * Fix RSA-PSS verify in TLS 1.2 ServerKeyExchange Extend RSA-PSS support to TLS 1.2 ServerKeyExchange signature verify: - nx_secure_process_server_key_exchange.c: detect RSA-PSS wire codes (0x0804/0805/0806) and dispatch to _nx_crypto_rsa_pss_verify after RSA decrypt; PKCS#1 v1.5 path kept for non-PSS signatures. - nx_secure_tls_process_clienthello_extensions.c: map RSA-PSS wire codes to the existing RSA SHA-256/384/512 internal IDs so the certificate cipher table lookup finds the right hash method.
2026-03-07Updated copyright headers and version strings. Removed version historyFrédéric Desbiens
2026-03-06Fixed ServerKeyExchange processing for PSK and non-PSK ciphersuites in nx_secureFrédéric Desbiens
2026-03-06Fixed build issue affecting nx_secureFrédéric Desbiens
2025-10-01Fixed ECDHE_PSK cipher suites implementation. (#342)Frédéric Desbiens
* Restored ECC_CIPHERSUITE ifdef code. * Added ifdefs to exclude PSK code when build options require it.
2025-09-29Merge commit from forkFrédéric Desbiens
Fixed issue in _nx_secure_tls_process_clienthello()
2025-09-29Merge commit from forkFrédéric Desbiens
Fix length checking in supported version extension, add test
2025-09-29Merge commit from forkFrédéric Desbiens
Fix PSK extension length checking, add tests for such
2025-09-29Merge commit from forkFrédéric Desbiens
Fixes an issue in nx_secure_tls_psk_identity_find()
2025-06-12Generate pre master secret according to ECDHE_PSKIgor Tomiatti
2025-06-12Generate client key exchange according to ECDHE_PSKIgor Tomiatti
2025-06-12Support for ECDHE_PSK in process server key exchangeIgor Tomiatti
2025-05-27patch for GHSA-8h38-qjhh-mf2hcypherbridge
edited by inspection not compiled or run-time tested
2025-05-27patch for GHSA-5vrv-8j5h-h6h6cypherbridge
edited by inspection not compiled or run-time tested
2025-05-22Add length check for supported versions extension and regression testHuan Nguyen
2025-05-22Move empty packet check in nx_secure_tls_session_sendHuan Nguyen
It was causing some tests to hang forever because they were expecting different errors to be returned. We do want to keep the check for empty packets as the netx_web_invalid_release_test expects that sending an empty packet fails. Note that the test also tests HTTPS, which will technically send a non-empty packet because the empty packet will be modified to include the TLS data. However, the empty packet check in nx_secure_tls_session_send will fulfill the same role as the check in nx_tcp_socket_send.c, checking for an empty packet prior to the modification of the packet to include TLS data. This gets the tests passing again.
2025-05-22Fix broken bounds check and add regression testHuan Nguyen
The check is in the function _nx_secure_tls_process_clienthello_psk_extension and was reported as a vulnerability.
2025-05-22Move empty packet check in nx_secure_tls_session_sendHuan Nguyen
It was causing some tests to hang forever because they were expecting different errors to be returned. We do want to keep the check for empty packets as the netx_web_invalid_release_test expects that sending an empty packet fails. Note that the test also tests HTTPS, which will technically send a non-empty packet because the empty packet will be modified to include the TLS data. However, the empty packet check in nx_secure_tls_session_send will fulfill the same role as the check in nx_tcp_socket_send.c, checking for an empty packet prior to the modification of the packet to include TLS data. This gets the tests passing again.
2025-03-18Updated version numbers to 6.4.3Frédéric Desbiens
2025-02-11Forbid empty packets in TLS sending, remove debug prints and commented notesHuan Nguyen
Signed-off-by: Frédéric Desbiens <[email protected]>
2025-02-11Add debugging prints and commented notesHuan Nguyen
Signed-off-by: Frédéric Desbiens <[email protected]>
2024-01-29Update copyright.Bo Chen (from Dev Box)
2023-10-23Update on 23 Oct 2023. Expand to see details.v6.3.0_relTiejun Zhou
002a5890e Generated rtxp demo in netxduo/samples folder. c09d9da51 Add function header in .h for RTP and RTSP f5a96f35b Update function header and version for 6.3.0 0ff7a6809 Correct dhcpv6 server for ignoring lifetime fields in client request 9a2129c35 Fixed dhcpv6 server not update client record issue e59d2b5f1 Fix dhcp coverage test compile wanrning d00655d71 Fix infinite loop issue in TCP & UDP free port find function c194c74ca Optimize rtp_sender and fix pipeline reported issues b6df8dea0 Add RTxP feature 38e57e633 Added test case for _nx_snmp_utility_object_id_get(). 321c88bd9 Added check for pdu length. 36ffb7c39 Fixed packet double release. 92166d736 Fixed SNMP test cases for v4_small_build 67f071552 Improved buffer length verification for padding. 30cc5d8b2 Fix wait option used in FTP test case 098a97213 Avoid duplicate packet release when DTLS send fails 15313e868 Improved buffer length verification for _nx_snmp_utility_object_id_set(). ecd3904d3 Fixed MSRC 81018 caa004007 Fix the logic of handling close notify packet from peer 2b8c87685 Removed main.c into netxduo/samples folder, then all addons can use it. c72c66cdc Fixed MSARC 81019 and MSRC 81079 8169be7a6 Fixed MSRC81005 and MSRC81020 41389b76b Fixed packet double release issue in _nx_ftp_client_file_write 19348e408 Combined the functions of processing snmp v1 and v2. 9174b6457 Fixed icmpv6 ra buffer overwrite test case. 6bdc703d9 Fixed packet double release issue in _nx_nat_process_packet 403ecd128 Set nx_smtp_server_packet to NULL to avoided duplicate packet release in _nx_smtp_utility_read_server_code af5dd00c6 Disable FTP server MSS test case when packet chain is disabled beadbce12 Enable weekly pipeline build to avoid CodeQL expiration 5a3d88f97 Fixed MSRC 81528 df6a1fc57 unify the code. 18c13bfdb Fixed MSRC 80745. 2cce43f48 Fixed bug in utility/iperf/nx_iperf.c pointer used before set its value. 2477fb81c Update product owners 2f5734ada Fixed MSRC 80686 34e713e26 Fixed data length underflow when TCP MSS is less than 255 7097a7859 Improved the test cases for packet chain. 1ffa13cfa Fixed MSRC 80685 97e2b8d8e Set packet pointer to NULL after released to fix duplicate packet release issue c1e47efa7 Fix ICMPv6 NS buffer overwrite issue. c2770ea68 Add ICMPv6 NA buffer overwrite test case. 36bb05f85 Validated TCP header buffer to avoid span in multiple packets 84070bb2a Correct the length of packet buffer to avoid write overflow 5b3b3a10b Dropped packet chain for SNTP data to avoid write overflow 82699872d Onebranch build Image Update: Move pipelines to supported and compliant OneBranch container images a30171f93 Add a test case to demonstrate IGMP override caused by IP assembly. 72472ff4b Fix MSRC 80746 5d9f1266a Corrected the acked packet count when out of order is enabled b113ebdc9 Fixed DHCP server local variable type issue b70863299 Enable codeql in onebranch pipeline
2023-06-30Update on 30 Jun 2023. Expand to see details.Tiejun Zhou
06cb10f01 Fix typo in NetXDuo Crypto 996dd14fc BSD functions overriding option 3b756c219 Fix mqtt interoperability issue when upgrade to ubuntu 20.04 01ca51021 Added support for skipping failed step 3e3a15e79 Add record length checking in nxe_secure_tls_session_send. ec617d178 Fix demo_netx_secure_tls test link issue under nightly build a934cb718 Fix pipeline libgcc issue in nx_secure_interoperability test f08024578 Fix illegal access when NXD_MQTT_OVER_WEBSOCKET enabled 9798e2b89 Corrected the mDNS symbols check 456007dd1 Fixed multiple proxy update issue cf0bf15b5 Add TLS sample demo_netx_secure_tls.c. 87ea505bf Add sha256 in driver preprocess command for ADU 7e1b9686a Add pnp check for ADU ef78d336d Improved the code to ignore null file url.
2023-05-12Update on 12 May 2023. Expand to see details.Tiejun Zhou
9d66f7f75 Fix pipeline openssl1.0 not supported in ubuntu20.04 issue 9a4eb7cbc Report the result of each step 897e7f7bf Update ubuntu version dd7fbeedd Fix packet buffer overrun when sending certificate c014cb362 Upgrade Ubuntu to 20.04 and disable e2e test case as it is not working now. 7a868800a Update CFS usage
2023-03-08Release 6.2.1 on 08 Mar 2023. Expand to see details.v6.2.1_relTiejun Zhou
29eee6fe8 Update function header and version to 6.2.1 e22a02169 Fix compile errors in TLS 3e0a14c1c Fix network driver for regression test. 442f3adfa Fix compiler warnings in NetXDuo
2023-02-27Update on 27 Feb 2023. Expand to see details.Tiejun Zhou
1c87864dc [SNTP & TELNET] Clear the client ID in delete function for SNTP and TELNET. 1a957bf48 Reported ADU agent state as IDLE to server after receiving cancel command. d648902b2 [BSD] Corrected the result of FIONREAD when using TCP socket. 494f0016f create netxduo cmsis-pack c5519bdf8 Add ADU version string f52279c97 Include TLS port header in nx_secure_x509.h cf753549b Fix packet leak in TLS 1.3 be8943659 Update PnP interface to use ADU GA model 17e601544 Fix the logic to cleanup key material 11e65bacd Initialize metadata for certificate using packet buffer 7ff1841ac Fix conditional build check for TLS 1.3
2023-01-18Update on 18 Jan 2023. Expand to see details.Tiejun Zhou
5849a60fa Fix compile errors when NX_SECURE_DISABLE_X509 is defined. 775a624ac Remove internal deprecated files. fa4680237 Clear MQTT password while X509 authentication is selected 5cb6488b4 Add a notice for not released file. 7600d5747 Upgrade to the latest Container Images. 3fdcc4420 [ADU] Add secondary root key and remove testing key.
2022-10-26Release 6.2.0Tiejun Zhou
2022-07-26Release 6.1.12v6.1.12_relYuxin Zhou
2022-04-20Release 6.1.11v6.1.11_relYuxin Zhou
2022-01-26Release 6.1.10v6.1.10_relYuxin Zhou
2021-10-13Release 6.1.9v6.1.9_relYuxin Zhou
2021-07-28Release 6.1.8v6.1.8_relYuxin Zhou
2021-06-02Release 6.1.7v6.1.7_relBo Chen
2021-04-03Release 6.1.6v6.1.6_relYuxin Zhou
2021-02-28Release 6.1.5Yuxin Zhou
2021-02-02Release 6.1.4v6.1.4_relYuxin Zhou
2021-01-07update to v6.1.3Scott Larson
2020-10-096.1 ReleaseScott Larson
2020-08-14apply 6.0.2 patchv6.0.2_relScott Larson
2020-07-13updated to 6.0.1 and added additional processors/toolchainsv6.0.1_relScott Larson
2020-05-11Initial commitPProvost
generated by cgit v1.3.1 (git 2.54.0) at 2026-08-13 12:36:22 +0000