| Age | Commit message (Collapse) | Author |
|---|
|
Authenticate zero-length application records through the normal MAC verification path and preserve record offsets when an empty record ends at a TCP packet boundary.
Added regression coverage for valid and modified MACs, coalesced records, and split TCP packets.
Assisted-by: Codex (gpt-5.6-sol) <[email protected]>
|
|
Advertise RSA-PSS for TLS 1.3 and the corresponding RSA PKCS#1 schemes for TLS 1.2 fallback. Precompute the exact extension length and cover the wire format and buffer boundaries with a focused regression test.
Assisted-by: Codex (gpt-5.6-sol) <[email protected]>
|
|
* Fix TLS 1.3 CertificateVerify transcript hash length (use ciphersuite hash)
Per RFC 8446 §4.4.3 the CertificateVerify content embeds
Transcript-Hash(Handshake Context), whose length is fixed by the
negotiated ciphersuite's hash — not by the signature scheme's hash.
The dynamic length introduced during the #377 review keyed it to the
signature scheme's hash; the two differ whenever the peer signs with
a hash other than the suite's, e.g. an ECDSA P-384 certificate
(ecdsa_secp384r1_sha384) with TLS_AES_128_GCM_SHA256 — the only TLS 1.3
suite currently enabled. In that case 48 bytes were copied from a
32-byte transcript hash slot, corrupting the signed content on the send
side and rejecting valid peer signatures on the verify side.
Key the transcript length to the session ciphersuite hash (with the
same SHA-256 fallback as _nx_secure_tls_1_3_transcript_hash_save); the
signature scheme's hash still digests the assembled content and
parameterizes RSA-PSS.
* Add a regression test for the TLS 1.3 CertificateVerify transcript hash length
Calls _nx_secure_tls_send_certificate_verify and
_nx_secure_tls_process_certificate_verify directly with a signature-scheme
hash (SHA-384) that differs from the ciphersuite hash (SHA-256), and
captures via a spy hash method the exact byte count copied into the
CertificateVerify content. Asserts 32 bytes (the ciphersuite's SHA-256,
correct per RFC 8446 §4.4.3), not 48 (the signature scheme's SHA-384,
what the bug copied).
* Documented why the SHA-384 test case cannot run end to end
---------
Co-authored-by: Claude Fable 5 <[email protected]>
|
|
_nx_secure_x509_asn1_tlv_block_parse() loaded buffer[0] into current_tag
one statement before testing *buffer_length < 1, so every caller that runs
out of data read one byte past the end of the buffer it was given.
It is reachable from the wire. A certificate two bytes long reaches it
through _nx_secure_x509_certificate_parse(), and so does the issuer walk
in the certificate store, which calls the parser repeatedly as it consumes
a chain and hands it whatever remains.
Found by a fuzz driver over _nx_secure_tls_process_remote_certificate()
with a real DER corpus, and confirmed under AddressSanitizer.
The read is moved below the guard. The guard already returned the right
status; only the load was in the wrong place.
|
|
* Fix TLS 1.3 server: don't send NewSessionTicket (resumption is unsupported)
_nx_secure_tls_1_3_server_handshake.c sent a NewSessionTicket after every
Client Finished, advertising session resumption to the client. But
_nx_secure_tls_process_clienthello_psk_extension explicitly rejects any
PSK with age != 0 (i.e. every real resumption attempt) with
NX_SECURE_TLS_BAD_CLIENTHELLO_PSK_EXTENSION — the existing implementation
only supports external PSKs.
Net effect on clients that act on the advertised ticket (Java JSSE in
particular): every other handshake fails. Conn N succeeds + caches the
ticket; conn N+1 replays the ticket → server sends Alert(internal_error)
→ JSSE invalidates the cache; conn N+2 succeeds; loop.
Fix: skip the NewSessionTicket send. The PSK consumer code stays as-is
so any future external-PSK use case is unaffected.
* Trim the source comment left by the NewSessionTicket removal
The comment that replaced the removed block ended up carrying the
whole incident story: the JSSE trigger, the alert path, why the stub
was harmful. That belongs in the commit that made the change, not in
a comment future readers will hit out of context.
Keep only what the code is now. No ticket is sent because resumption
is not implemented. RFC 8446 §4.6.1 makes the message optional. The
PSK extension handler is the place resumption would also need to
change.
* Document why send_newsessionticket is now uncalled
After the previous fix, this function has no callers in the library.
That is deliberate: it stays as a starting point for real TLS 1.3
session resumption when someone gets to it. Without a note, the next
dead-code sweep will find an unreferenced global and reasonably
propose deleting it.
Add a NOTE in the header block spelling out three things. The
function is kept on purpose, not by accident. The ticket it builds
is a placeholder — no server state, fixed identity string — so it
cannot be used as is. And the reasoning for not calling it lives in
the server handshake, with the RFC 8446 pointer for the fact that
the message is optional.
CALLED BY is updated to match.
* Exclude send_newsessionticket from coverage reports
The previous fix left this file with no callers. Under any coverage
config that compiles TLS 1.3 — tls_1_3_enable_build_coverage and
sesip_build_coverage — it now reports 0% across the board. CI does
not enforce a threshold, so nothing fails, but the project aims for
100% and a file going to zero is not the shape we want.
Add a small common exclude list, applied to every coverage run,
containing just this file. The reason it is dead is documented in
its own header block, and referencing that keeps the two pieces of
information in sync. The default_build_coverage block is unchanged.
* Add regression test asserting no NewSessionTicket after handshake
Locks in the previous fix. The test completes a full TLS 1.3
handshake between a NetX client and a NetX server, gives the server
one periodic tick to flush anything queued after client Finished,
then peeks the client's raw TCP receive queue with NX_NO_WAIT. In
the fixed server nothing arrives. In the pre-fix server the stub
NewSessionTicket record lands there and the peek returns NX_SUCCESS
instead of NX_NO_PACKET.
The peek runs on the raw socket rather than through
nx_secure_tls_session_receive, because the TLS layer would consume a
post-handshake NewSessionTicket silently and we could not tell the
difference. A semaphore holds the server side open until the client
has done its check, so the server's close_notify does not pollute
the peek.
The half of the maintainer's ask that needs a crafted PSK-carrying
ClientHello is left for the PSK-handler follow-up, per the review.
|
|
§5.4) (#401)
* Fix TLS 1.3 record padding strip in _nx_secure_tls_process_record (RFC 8446 §5.4)
The inner content type was read as the literal last byte of the
decrypted plaintext. Per RFC 8446 §5.4 that byte is followed by an
arbitrary-length zero padding, so the receiver must scan back from
the end skipping zeros to find it.
Without this, any client that pads its TLS 1.3 records gets a fatal
`unexpected_message` alert on its first record. Java JDK HttpClient
pads by default since 11 (traffic-analysis resistance), so every Java
HTTPS client tripped on this. Reproducible with OpenSSL using
`-record_padding N`.
* Move scan_offset to top-of-function locals, drop scoped block
Follow the existing style of nx_secure_tls_process_record.c: all locals
declared alongside message_length and bytes_copied at the top of the
function, no nested scope just to introduce one variable. Trim the
TLS 1.3 de-padding comment to say what the code does now — the history
of why the previous version was wrong lives in the previous commit
message and PR description.
* Return unexpected_message when the plaintext has no inner content type
RFC 8446 §5.4 requires "unexpected_message" when a decrypted record
contains only padding. NX_SECURE_TLS_UNEXPECTED_MESSAGE already maps
to the correct alert (10, fatal) in nx_secure_tls_map_error_to_alert.c;
NX_SECURE_TLS_INVALID_PACKET fell through to internal_error, which
misidentified a peer protocol violation as our own bug.
The extract-failure path just above still returns INVALID_PACKET —
that one really is a local packet-handling error and internal_error
is the honest signal.
* Scan the plaintext directly instead of calling extract per byte
nx_packet_data_extract_offset() walks the packet chain from the head on
every call. Since the de-padding scan starts at the end of the record,
each call traversed the whole chain to reach the last fragment before
copying a single byte — one full walk per byte examined. On a maximally
padded 16 KB record that is on the order of 16 000 chain walks handed
to the peer, which the RFC lets it perform arbitrarily.
Walk the fragments once, remember the offset of the last non-zero byte.
The traversal always visits every plaintext byte so the cost no longer
depends on the amount of padding, which matches the stance the
neighbouring TLS 1.2 path already takes on padding-related timing
channels (see the MAC-check comment a few lines below).
The extract-failure branch disappears with the extract call, so the
remaining error path is exactly the peer protocol violation
(all-zero plaintext) reporting unexpected_message.
* Add regression tests for the TLS 1.3 record de-padding
Cover the four cases that matter for the §5.4 fix:
1. Padded record — inner type recovered, length excludes both the
type byte and the padding.
2. All-zero plaintext — rejected with unexpected_message.
3. Unpadded record — behaviour matches the pre-fix arithmetic
(length - 1). This is the regression-risk assertion for existing
traffic that never triggered the bug.
4. Chained-packet plaintext — the scan walks through NX_PACKET
fragments, not just the head. Forced by using a plaintext larger
than a single pool packet.
Requires exposing the de-padding scan as _nx_secure_tls_1_3_strip_padding
so the test can drive it directly without standing up a full TLS 1.3
AEAD session. _nx_secure_tls_process_record now delegates to the same
helper, so the behaviour under test is identical to the production path.
* Declared the TLS 1.3 de-padding helper in the header, as its siblings are
_nx_secure_tls_1_3_strip_padding had external linkage but no declaration in any
header: it was forward declared in nx_secure_tls_process_record.c and declared
again with extern in the test that calls it. That is the one shape this tree does
not use. nx_secure_tls.h already carries 135 internal _nx_secure_* prototypes,
including a run of _nx_secure_tls_1_3_* functions, while the other internal
function in this same source file, _nx_secure_tls_packet_trim, is static because
nothing outside needs it. So an internal function is either declared in the
header or static, and this one is used from outside its translation unit.
Declare it in nx_secure_tls.h beside _nx_secure_tls_1_3_crypto_init, and drop
both duplicate declarations. No behaviour change, and it removes a MISRA 8.7
deviation that would otherwise have to be documented rather than avoided.
Verified by rebuilding nx_secure_tls_process_record_test against the header
instead of the extern: it links, and all four de-padding cases pass.
---------
Co-authored-by: Frédéric Desbiens <[email protected]>
Assisted-by: Claude Code (Opus 5) <[email protected]>
|
|
* add support for parsing ASN.1 GeneralizedTime
* fix validity format field error
* changed CertMsg notBefore format to be in GeneralizedTime format
* changed notBefore time to be in GeneralizedTime format
* changed notAfter time to be in GeneralizedTime format
* expand tests for invalid date format
* update function comments
* update function comments
---------
Co-authored-by: Frédéric Desbiens <[email protected]>
|
|
* Fixed server PSK identity selection for ECDHE-PSK
* Fixed selected client PSK identity preservation
Implemented logic to cache the PSK store entry selected by the server identity hint so ClientKeyExchange emits the matching identity when clients use the PSK store path.
Cast the ECC supported-group test value to USHORT so the PSK identity regression builds cleanly with -Werror on Linux.
Assisted-By: Codex (OpenAI GPT-5.5) <[email protected]>
|
|
* Add RSA-PSS
* Fix SHA-384/512 transcript hash truncation and add MGF1 bounds check
Address review feedback on RSA-PSS PR:
- Resize handshake_hash buffer from 130 to 162 bytes (64+34+64) in
both nx_secure_tls_process_certificate_verify.c and
nx_secure_tls_send_certificate_verify.c to fit SHA-512 transcript.
- Replace hardcoded 32-byte transcript hash copy with dynamic length
derived from hash_method->nx_crypto_ICV_size_in_bits.
- Add bounds check in _nx_crypto_rsa_pss_mgf1 to reject hash_method
whose output exceeds the local hash_buf size.
* Fix RSA-PSS verify in TLS 1.2 ServerKeyExchange
Extend RSA-PSS support to TLS 1.2 ServerKeyExchange signature verify:
- nx_secure_process_server_key_exchange.c: detect RSA-PSS wire codes
(0x0804/0805/0806) and dispatch to _nx_crypto_rsa_pss_verify after
RSA decrypt; PKCS#1 v1.5 path kept for non-PSS signatures.
- nx_secure_tls_process_clienthello_extensions.c: map RSA-PSS wire
codes to the existing RSA SHA-256/384/512 internal IDs so the
certificate cipher table lookup finds the right hash method.
|
|
|
|
|
|
|
|
* Restored ECC_CIPHERSUITE ifdef code.
* Added ifdefs to exclude PSK code when build options require it.
|
|
Fixed issue in _nx_secure_tls_process_clienthello()
|
|
Fix length checking in supported version extension, add test
|
|
Fix PSK extension length checking, add tests for such
|
|
Fixes an issue in nx_secure_tls_psk_identity_find()
|
|
TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA
|
|
|
|
|
|
|
|
edited by inspection not compiled or run-time tested
|
|
edited by inspection not compiled or run-time tested
|
|
|
|
It was causing some tests to hang forever because they were expecting
different errors to be returned. We do want to keep the check for
empty packets as the netx_web_invalid_release_test expects that
sending an empty packet fails. Note that the test also tests HTTPS,
which will technically send a non-empty packet because the empty
packet will be modified to include the TLS data. However, the
empty packet check in nx_secure_tls_session_send will fulfill the
same role as the check in nx_tcp_socket_send.c, checking for
an empty packet prior to the modification of the packet to include
TLS data.
This gets the tests passing again.
|
|
The check is in the function
_nx_secure_tls_process_clienthello_psk_extension and was reported
as a vulnerability.
|
|
It was causing some tests to hang forever because they were expecting
different errors to be returned. We do want to keep the check for
empty packets as the netx_web_invalid_release_test expects that
sending an empty packet fails. Note that the test also tests HTTPS,
which will technically send a non-empty packet because the empty
packet will be modified to include the TLS data. However, the
empty packet check in nx_secure_tls_session_send will fulfill the
same role as the check in nx_tcp_socket_send.c, checking for
an empty packet prior to the modification of the packet to include
TLS data.
This gets the tests passing again.
|
|
|
|
|
|
Version 6.4.2
|
|
|
|
Signed-off-by: Frédéric Desbiens <[email protected]>
|
|
Signed-off-by: Frédéric Desbiens <[email protected]>
|
|
|
|
|
|
|
|
|
|
002a5890e Generated rtxp demo in netxduo/samples folder.
c09d9da51 Add function header in .h for RTP and RTSP
f5a96f35b Update function header and version for 6.3.0
0ff7a6809 Correct dhcpv6 server for ignoring lifetime fields in client request
9a2129c35 Fixed dhcpv6 server not update client record issue
e59d2b5f1 Fix dhcp coverage test compile wanrning
d00655d71 Fix infinite loop issue in TCP & UDP free port find function
c194c74ca Optimize rtp_sender and fix pipeline reported issues
b6df8dea0 Add RTxP feature
38e57e633 Added test case for _nx_snmp_utility_object_id_get().
321c88bd9 Added check for pdu length.
36ffb7c39 Fixed packet double release.
92166d736 Fixed SNMP test cases for v4_small_build
67f071552 Improved buffer length verification for padding.
30cc5d8b2 Fix wait option used in FTP test case
098a97213 Avoid duplicate packet release when DTLS send fails
15313e868 Improved buffer length verification for _nx_snmp_utility_object_id_set().
ecd3904d3 Fixed MSRC 81018
caa004007 Fix the logic of handling close notify packet from peer
2b8c87685 Removed main.c into netxduo/samples folder, then all addons can use it.
c72c66cdc Fixed MSARC 81019 and MSRC 81079
8169be7a6 Fixed MSRC81005 and MSRC81020
41389b76b Fixed packet double release issue in _nx_ftp_client_file_write
19348e408 Combined the functions of processing snmp v1 and v2.
9174b6457 Fixed icmpv6 ra buffer overwrite test case.
6bdc703d9 Fixed packet double release issue in _nx_nat_process_packet
403ecd128 Set nx_smtp_server_packet to NULL to avoided duplicate packet release in _nx_smtp_utility_read_server_code
af5dd00c6 Disable FTP server MSS test case when packet chain is disabled
beadbce12 Enable weekly pipeline build to avoid CodeQL expiration
5a3d88f97 Fixed MSRC 81528
df6a1fc57 unify the code.
18c13bfdb Fixed MSRC 80745.
2cce43f48 Fixed bug in utility/iperf/nx_iperf.c pointer used before set its value.
2477fb81c Update product owners
2f5734ada Fixed MSRC 80686
34e713e26 Fixed data length underflow when TCP MSS is less than 255
7097a7859 Improved the test cases for packet chain.
1ffa13cfa Fixed MSRC 80685
97e2b8d8e Set packet pointer to NULL after released to fix duplicate packet release issue
c1e47efa7 Fix ICMPv6 NS buffer overwrite issue.
c2770ea68 Add ICMPv6 NA buffer overwrite test case.
36bb05f85 Validated TCP header buffer to avoid span in multiple packets
84070bb2a Correct the length of packet buffer to avoid write overflow
5b3b3a10b Dropped packet chain for SNTP data to avoid write overflow
82699872d Onebranch build Image Update: Move pipelines to supported and compliant OneBranch container images
a30171f93 Add a test case to demonstrate IGMP override caused by IP assembly.
72472ff4b Fix MSRC 80746
5d9f1266a Corrected the acked packet count when out of order is enabled
b113ebdc9 Fixed DHCP server local variable type issue
b70863299 Enable codeql in onebranch pipeline
|
|
06cb10f01 Fix typo in NetXDuo Crypto
996dd14fc BSD functions overriding option
3b756c219 Fix mqtt interoperability issue when upgrade to ubuntu 20.04
01ca51021 Added support for skipping failed step
3e3a15e79 Add record length checking in nxe_secure_tls_session_send.
ec617d178 Fix demo_netx_secure_tls test link issue under nightly build
a934cb718 Fix pipeline libgcc issue in nx_secure_interoperability test
f08024578 Fix illegal access when NXD_MQTT_OVER_WEBSOCKET enabled
9798e2b89 Corrected the mDNS symbols check
456007dd1 Fixed multiple proxy update issue
cf0bf15b5 Add TLS sample demo_netx_secure_tls.c.
87ea505bf Add sha256 in driver preprocess command for ADU
7e1b9686a Add pnp check for ADU
ef78d336d Improved the code to ignore null file url.
|
|
9d66f7f75 Fix pipeline openssl1.0 not supported in ubuntu20.04 issue
9a4eb7cbc Report the result of each step
897e7f7bf Update ubuntu version
dd7fbeedd Fix packet buffer overrun when sending certificate
c014cb362 Upgrade Ubuntu to 20.04 and disable e2e test case as it is not working now.
7a868800a Update CFS usage
|
|
29eee6fe8 Update function header and version to 6.2.1
e22a02169 Fix compile errors in TLS
3e0a14c1c Fix network driver for regression test.
442f3adfa Fix compiler warnings in NetXDuo
|
|
1c87864dc [SNTP & TELNET] Clear the client ID in delete function for SNTP and TELNET.
1a957bf48 Reported ADU agent state as IDLE to server after receiving cancel command.
d648902b2 [BSD] Corrected the result of FIONREAD when using TCP socket.
494f0016f create netxduo cmsis-pack
c5519bdf8 Add ADU version string
f52279c97 Include TLS port header in nx_secure_x509.h
cf753549b Fix packet leak in TLS 1.3
be8943659 Update PnP interface to use ADU GA model
17e601544 Fix the logic to cleanup key material
11e65bacd Initialize metadata for certificate using packet buffer
7ff1841ac Fix conditional build check for TLS 1.3
|
|
5849a60fa Fix compile errors when NX_SECURE_DISABLE_X509 is defined.
775a624ac Remove internal deprecated files.
fa4680237 Clear MQTT password while X509 authentication is selected
5cb6488b4 Add a notice for not released file.
7600d5747 Upgrade to the latest Container Images.
3fdcc4420 [ADU] Add secondary root key and remove testing key.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
