Merge changes in preparation of the v6.4.4.202503 release. #343
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…potential buffer overflow due to incorrect pointer being passed to HMAC cleanup if NetX is build with NX_SECURE_KEY_CLEAR defined.
It was causing some tests to hang forever because they were expecting different errors to be returned. We do want to keep the check for empty packets as the netx_web_invalid_release_test expects that sending an empty packet fails. Note that the test also tests HTTPS, which will technically send a non-empty packet because the empty packet will be modified to include the TLS data. However, the empty packet check in nx_secure_tls_session_send will fulfill the same role as the check in nx_tcp_socket_send.c, checking for an empty packet prior to the modification of the packet to include TLS data. This gets the tests passing again.
The check is in the function _nx_secure_tls_process_clienthello_psk_extension and was reported as a vulnerability.
It was causing some tests to hang forever because they were expecting different errors to be returned. We do want to keep the check for empty packets as the netx_web_invalid_release_test expects that sending an empty packet fails. Note that the test also tests HTTPS, which will technically send a non-empty packet because the empty packet will be modified to include the TLS data. However, the empty packet check in nx_secure_tls_session_send will fulfill the same role as the check in nx_tcp_socket_send.c, checking for an empty packet prior to the modification of the packet to include TLS data. This gets the tests passing again.
edited by inspection not compiled or run-time tested
edited by inspection not compiled or run-time tested
edited by inspection not compiled or run-time tested
…CDHE_PSK_WITH_AES_256_CBC_SHA
The header Sec-WebSocket-Protocol is optional in both the request and the response from the server. Signed-off-by: Joel Guittet <[email protected]>
The Authorization: Bearer header allow to perform authentication providing a token. It is optional. Signed-off-by: Joel Guittet <[email protected]>
Signed-off-by: Frédéric Desbiens <[email protected]>
Websocket improvement headers.
Implementation of ECDHE_PSK cipher suites
Fixes an issue in nx_secure_tls_psk_identity_find()
Fix multiple NextX Duo vulnerabilities.
Fix PSK extension length checking, add tests for such
Fix length checking in supported version extension, add test
Fixed issue in _nx_secure_tls_process_clienthello()
Insert a remaining buffer length check before dereferencing the pointer
Added buffer length check
Insert a index position check before getting bytes
Insert a buffer_ptr position check before getting bytes
#312 Handle HTTP code 429
Fix HKDF implementation to prevent buffer overrun when compiled with NX_SECURE_KEY_CLEAR
* Restored ECC_CIPHERSUITE ifdef code. * Added ifdefs to exclude PSK code when build options require it.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.