| Age | Commit message (Collapse) | Author |
|---|
|
Advertise RSA-PSS for TLS 1.3 and the corresponding RSA PKCS#1 schemes for TLS 1.2 fallback. Precompute the exact extension length and cover the wire format and buffer boundaries with a focused regression test.
Assisted-by: Codex (gpt-5.6-sol) <[email protected]>
|
|
* Fix TLS 1.3 CertificateVerify transcript hash length (use ciphersuite hash)
Per RFC 8446 §4.4.3 the CertificateVerify content embeds
Transcript-Hash(Handshake Context), whose length is fixed by the
negotiated ciphersuite's hash — not by the signature scheme's hash.
The dynamic length introduced during the #377 review keyed it to the
signature scheme's hash; the two differ whenever the peer signs with
a hash other than the suite's, e.g. an ECDSA P-384 certificate
(ecdsa_secp384r1_sha384) with TLS_AES_128_GCM_SHA256 — the only TLS 1.3
suite currently enabled. In that case 48 bytes were copied from a
32-byte transcript hash slot, corrupting the signed content on the send
side and rejecting valid peer signatures on the verify side.
Key the transcript length to the session ciphersuite hash (with the
same SHA-256 fallback as _nx_secure_tls_1_3_transcript_hash_save); the
signature scheme's hash still digests the assembled content and
parameterizes RSA-PSS.
* Add a regression test for the TLS 1.3 CertificateVerify transcript hash length
Calls _nx_secure_tls_send_certificate_verify and
_nx_secure_tls_process_certificate_verify directly with a signature-scheme
hash (SHA-384) that differs from the ciphersuite hash (SHA-256), and
captures via a spy hash method the exact byte count copied into the
CertificateVerify content. Asserts 32 bytes (the ciphersuite's SHA-256,
correct per RFC 8446 §4.4.3), not 48 (the signature scheme's SHA-384,
what the bug copied).
* Documented why the SHA-384 test case cannot run end to end
---------
Co-authored-by: Claude Fable 5 <[email protected]>
|
|
* Fix TLS 1.3 server: don't send NewSessionTicket (resumption is unsupported)
_nx_secure_tls_1_3_server_handshake.c sent a NewSessionTicket after every
Client Finished, advertising session resumption to the client. But
_nx_secure_tls_process_clienthello_psk_extension explicitly rejects any
PSK with age != 0 (i.e. every real resumption attempt) with
NX_SECURE_TLS_BAD_CLIENTHELLO_PSK_EXTENSION — the existing implementation
only supports external PSKs.
Net effect on clients that act on the advertised ticket (Java JSSE in
particular): every other handshake fails. Conn N succeeds + caches the
ticket; conn N+1 replays the ticket → server sends Alert(internal_error)
→ JSSE invalidates the cache; conn N+2 succeeds; loop.
Fix: skip the NewSessionTicket send. The PSK consumer code stays as-is
so any future external-PSK use case is unaffected.
* Trim the source comment left by the NewSessionTicket removal
The comment that replaced the removed block ended up carrying the
whole incident story: the JSSE trigger, the alert path, why the stub
was harmful. That belongs in the commit that made the change, not in
a comment future readers will hit out of context.
Keep only what the code is now. No ticket is sent because resumption
is not implemented. RFC 8446 §4.6.1 makes the message optional. The
PSK extension handler is the place resumption would also need to
change.
* Document why send_newsessionticket is now uncalled
After the previous fix, this function has no callers in the library.
That is deliberate: it stays as a starting point for real TLS 1.3
session resumption when someone gets to it. Without a note, the next
dead-code sweep will find an unreferenced global and reasonably
propose deleting it.
Add a NOTE in the header block spelling out three things. The
function is kept on purpose, not by accident. The ticket it builds
is a placeholder — no server state, fixed identity string — so it
cannot be used as is. And the reasoning for not calling it lives in
the server handshake, with the RFC 8446 pointer for the fact that
the message is optional.
CALLED BY is updated to match.
* Exclude send_newsessionticket from coverage reports
The previous fix left this file with no callers. Under any coverage
config that compiles TLS 1.3 — tls_1_3_enable_build_coverage and
sesip_build_coverage — it now reports 0% across the board. CI does
not enforce a threshold, so nothing fails, but the project aims for
100% and a file going to zero is not the shape we want.
Add a small common exclude list, applied to every coverage run,
containing just this file. The reason it is dead is documented in
its own header block, and referencing that keeps the two pieces of
information in sync. The default_build_coverage block is unchanged.
* Add regression test asserting no NewSessionTicket after handshake
Locks in the previous fix. The test completes a full TLS 1.3
handshake between a NetX client and a NetX server, gives the server
one periodic tick to flush anything queued after client Finished,
then peeks the client's raw TCP receive queue with NX_NO_WAIT. In
the fixed server nothing arrives. In the pre-fix server the stub
NewSessionTicket record lands there and the peek returns NX_SUCCESS
instead of NX_NO_PACKET.
The peek runs on the raw socket rather than through
nx_secure_tls_session_receive, because the TLS layer would consume a
post-handshake NewSessionTicket silently and we could not tell the
difference. A semaphore holds the server side open until the client
has done its check, so the server's close_notify does not pollute
the peek.
The half of the maintainer's ask that needs a crafted PSK-carrying
ClientHello is left for the PSK-handler follow-up, per the review.
|
|
Applied the standard MIT license header to all project-owned C, header,
assembly, shell, and Python files that were missing a copyright notice.
Third-party, toolchain startup, and auto-generated files were excluded.
Co-authored-by: Copilot <[email protected]>
|
|
* Fixed server PSK identity selection for ECDHE-PSK
* Fixed selected client PSK identity preservation
Implemented logic to cache the PSK store entry selected by the server identity hint so ClientKeyExchange emits the matching identity when clients use the PSK store path.
Cast the ECC supported-group test value to USHORT so the PSK identity regression builds cleanly with -Werror on Linux.
Assisted-By: Codex (OpenAI GPT-5.5) <[email protected]>
|
|
|
|
A common error condition is that the user cloned the repo
without the --recursive option. We'll try to get the
submodules for them.
We remove the git clone command because the submodule update
should fix the issue.
|
|
|
|
|
|
|
|
|
