mirror of
https://git.suyu.dev/suyu/mbedtls.git
synced 2026-01-01 12:15:48 +01:00
Merge branch 'development' into iotssl-1251-2.7
Conflict resolution: * ChangeLog: put the new entries in their rightful place. * library/x509write_crt.c: the change in development was whitespace only, so use the one from the iotssl-1251 feature branch.
This commit is contained in:
Gilles Peskine
commit
d91f2a26cb
270 changed files with 12457 additions and 2565 deletions
219
ChangeLog
219
ChangeLog
|
|
@ -1,16 +1,56 @@
|
|||
mbed TLS ChangeLog (Sorted per branch, date)
|
||||
|
||||
= mbed TLS x.x.x released xxxx-xx-xx
|
||||
= mbed TLS x.x.x branch released xxxx-xx-xx
|
||||
|
||||
Bugfix
|
||||
* Fix the entropy.c module to not call mbedtls_sha256_starts() or
|
||||
mbedtls_sha512_starts() in the mbedtls_entropy_init() function.
|
||||
* Fix the entropy.c module to ensure that mbedtls_sha256_init() or
|
||||
mbedtls_sha512_init() is called before operating on the relevant context
|
||||
structure. Also, ensure that message digest contexts are freed when
|
||||
calling mbedtls_entropy_free().
|
||||
Security
|
||||
* Fix a potential heap buffer overflow in mbedtls_ssl_write. When the (by
|
||||
default enabled) maximum fragment length extension is disabled in the
|
||||
config and the application data buffer passed to mbedtls_ssl_write
|
||||
is larger than the internal message buffer (16384 bytes by default), the
|
||||
latter overflows. The exploitability of this issue depends on whether the
|
||||
application layer can be forced into sending such large packets. The issue
|
||||
was independently reported by Tim Nordell via e-mail and by Florin Petriuc
|
||||
and sjorsdewit on GitHub. Fix proposed by Florin Petriuc in #1022. Fixes #707.
|
||||
|
||||
Features
|
||||
* Allow comments in test data files.
|
||||
* The selftest program can execute a subset of the tests based on command
|
||||
line arguments.
|
||||
* New unit tests for timing. Improve the self-test to be more robust
|
||||
when run on a heavily-loaded machine.
|
||||
* Add alternative implementation support for CCM and CMAC (MBEDTLS_CCM_ALT,
|
||||
MBEDTLS_CMAC_ALT). Submitted by Steve Cooreman, Silicon Labs.
|
||||
* Add support for alternative implementations of GCM, selected by the
|
||||
configuration flag MBEDTLS_GCM_ALT.
|
||||
* Add support for alternative implementations for ECDSA, controlled by new
|
||||
configuration flags MBEDTLS_ECDSA_SIGN_ALT, MBEDTLS_ECDSA_VERIFY_ALT and
|
||||
MBEDTLS_ECDSDA_GENKEY_AT in config.h.
|
||||
The following functions from the ECDSA module can be replaced
|
||||
with alternative implementation:
|
||||
mbedtls_ecdsa_sign(), mbedtls_ecdsa_verify() and mbedtls_ecdsa_genkey().
|
||||
* Add support for alternative implementation for ECDH, controlled by new
|
||||
configuration flags MBEDTLS_ECDH_COMPUTE_SHARED_ALT and
|
||||
MBEDTLS_ECDH_GEN_PUBLIC_ALT in config.h.
|
||||
The following functions from the ECDH module can be replaced
|
||||
with an alternative implementation:
|
||||
mbedtls_ecdh_gen_public() and mbedtls_ecdh_compute_shared().
|
||||
|
||||
New deprecations
|
||||
* Deprecate usage of RSA primitives with non-matching key-type
|
||||
(e.g., signing with a public key).
|
||||
* Direct manipulation of structure fields of RSA contexts is deprecated.
|
||||
Users are advised to use the extended RSA API instead.
|
||||
|
||||
API Changes
|
||||
* Extend RSA interface by multiple functions allowing structure-
|
||||
independent setup and export of RSA contexts. Most notably,
|
||||
mbedtls_rsa_import and mbedtls_rsa_complete are introduced for setting
|
||||
up RSA contexts from partial key material and having them completed to the
|
||||
needs of the implementation automatically. This allows to setup private RSA
|
||||
contexts from keys consisting of N,D,E only, even if P,Q are needed for the
|
||||
purpose or CRT and/or blinding.
|
||||
* The configuration option MBEDTLS_RSA_ALT can be used to define alternative
|
||||
implementations of the RSA interface declared in rsa.h.
|
||||
* The following functions in the MD2, MD4, MD5, SHA1, SHA256 and SHA512
|
||||
modules have been deprecated and replaced as shown below. The new
|
||||
functions change the return type from void to int to allow returning error
|
||||
|
|
@ -25,6 +65,150 @@ API Changes
|
|||
codes are checked for error after every usage, except in the ssl_tls.c
|
||||
module.
|
||||
|
||||
Bugfix
|
||||
* Fix ssl_parse_record_header() to silently discard invalid DTLS records
|
||||
as recommended in RFC 6347 Section 4.1.2.7.
|
||||
* Fix memory leak in mbedtls_ssl_set_hostname() when called multiple times.
|
||||
Found by projectgus and jethrogb, #836.
|
||||
* Fix usage help in ssl_server2 example. Found and fixed by Bei Lin.
|
||||
* Parse signature algorithm extension when renegotiating. Previously,
|
||||
renegotiated handshakes would only accept signatures using SHA-1
|
||||
regardless of the peer's preferences, or fail if SHA-1 was disabled.
|
||||
* Fix leap year calculation in x509_date_is_valid() to ensure that invalid
|
||||
dates on leap years with 100 and 400 intervals are handled correctly. Found
|
||||
by Nicholas Wilson. #694
|
||||
* Fix out-of-memory problem when parsing 4096-bit PKCS8-encrypted RSA keys.
|
||||
Found independently by Florian in the mbed TLS forum and by Mishamax.
|
||||
#878, #1019.
|
||||
* Fix variable used before assignment compilation warnings with IAR
|
||||
toolchain. Found by gkerrien38.
|
||||
* Fix unchecked return codes from AES, DES and 3DES functions in
|
||||
pem_aes_decrypt(), pem_des_decrypt() and pem_des3_decrypt() respectively.
|
||||
If a call to one of the functions of the cryptographic primitive modules
|
||||
failed, the error may not be noticed by the function
|
||||
mbedtls_pem_read_buffer() causing it to return invalid values. Found by
|
||||
Guido Vranken. #756
|
||||
* Include configuration file in md.h, to fix compilation warnings.
|
||||
Reported by aaronmdjones in #1001
|
||||
* Correct extraction of signature-type from PK instance in X.509 CRT and CSR
|
||||
writing routines that prevented these functions to work with alternative
|
||||
RSA implementations. Raised by J.B. in the Mbed TLS forum. Fixes #1011.
|
||||
* Don't print X.509 version tag for v1 CRT's, and omit extensions for
|
||||
non-v3 CRT's.
|
||||
* Fix bugs in RSA test suite under MBEDTLS_NO_PLATFORM_ENTROPY. #1023 #1024
|
||||
* Fix net_would_block to avoid modification by errno through fcntl call.
|
||||
Found by nkolban. Fixes #845.
|
||||
* Fix handling of handshake messages in mbedtls_ssl_read in case
|
||||
MBEDTLS_SSL_RENEGOTIATION is disabled. Found by erja-gp.
|
||||
* Add a check for invalid private parameters in mbedtls_ecdsa_sign.
|
||||
Reported by Yolan Romailler.
|
||||
* Fix word size check in in pk.c to not depend on MBEDTLS_HAVE_INT64.
|
||||
* Fix incorrect unit in benchmark output. #850
|
||||
* Fix crash when calling mbedtls_ssl_cache_free() twice. Found by
|
||||
MilenkoMitrovic, #1104
|
||||
* Fix mbedtls_timing_alarm(0) on Unix.
|
||||
* Fix use of uninitialized memory in mbedtls_timing_get_timer when reset=1.
|
||||
* Fix possible memory leaks in mbedtls_gcm_self_test().
|
||||
* Added missing return code checks in mbedtls_aes_self_test().
|
||||
* Fix issues in RSA key generation program programs/x509/rsa_genkey and the
|
||||
RSA test suite where the failure of CTR DRBG initialization lead to
|
||||
freeing an RSA context and several MPI's without proper initialization
|
||||
beforehand.
|
||||
* Fix the entropy.c module to not call mbedtls_sha256_starts() or
|
||||
mbedtls_sha512_starts() in the mbedtls_entropy_init() function.
|
||||
* Fix the entropy.c module to ensure that mbedtls_sha256_init() or
|
||||
mbedtls_sha512_init() is called before operating on the relevant context
|
||||
structure. Also, ensure that message digest contexts are freed when
|
||||
calling mbedtls_entropy_free().
|
||||
|
||||
Changes
|
||||
* Extend cert_write example program by options to set the CRT version
|
||||
and the message digest. Further, allow enabling/disabling of authority
|
||||
identifier, subject identifier and basic constraints extensions.
|
||||
* Only check for necessary RSA structure fields in `mbedtls_rsa_private`. In
|
||||
particular, don't require P,Q if neither CRT nor blinding are
|
||||
used. Reported and fix proposed independently by satur9nine and sliai
|
||||
on GitHub.
|
||||
* Only run AES-192 self-test if AES-192 is available. Fixes #963.
|
||||
* Tighten the RSA PKCS#1 v1.5 signature verification code and remove the
|
||||
undeclared dependency of the RSA module on the ASN.1 module.
|
||||
|
||||
= mbed TLS 2.6.0 branch released 2017-08-10
|
||||
|
||||
Security
|
||||
* Fix authentication bypass in SSL/TLS: when authmode is set to optional,
|
||||
mbedtls_ssl_get_verify_result() would incorrectly return 0 when the peer's
|
||||
X.509 certificate chain had more than MBEDTLS_X509_MAX_INTERMEDIATE_CA
|
||||
(default: 8) intermediates, even when it was not trusted. This could be
|
||||
triggered remotely from either side. (With authmode set to 'required'
|
||||
(the default), the handshake was correctly aborted).
|
||||
* Reliably wipe sensitive data after use in the AES example applications
|
||||
programs/aes/aescrypt2 and programs/aes/crypt_and_hash.
|
||||
Found by Laurent Simon.
|
||||
|
||||
Features
|
||||
* Add the functions mbedtls_platform_setup() and mbedtls_platform_teardown()
|
||||
and the context struct mbedtls_platform_context to perform
|
||||
platform-specific setup and teardown operations. The macro
|
||||
MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT allows the functions to be overridden
|
||||
by the user in a platform_alt.h file. These new functions are required in
|
||||
some embedded environments to provide a means of initialising underlying
|
||||
cryptographic acceleration hardware.
|
||||
|
||||
API Changes
|
||||
* Reverted API/ABI breaking changes introduced in mbed TLS 2.5.1, to make the
|
||||
API consistent with mbed TLS 2.5.0. Specifically removed the inline
|
||||
qualifier from the functions mbedtls_aes_decrypt, mbedtls_aes_encrypt,
|
||||
mbedtls_ssl_ciphersuite_uses_ec and mbedtls_ssl_ciphersuite_uses_psk. Found
|
||||
by James Cowgill. #978
|
||||
* Certificate verification functions now set flags to -1 in case the full
|
||||
chain was not verified due to an internal error (including in the verify
|
||||
callback) or chain length limitations.
|
||||
* With authmode set to optional, the TLS handshake is now aborted if the
|
||||
verification of the peer's certificate failed due to an overlong chain or
|
||||
a fatal error in the verify callback.
|
||||
|
||||
Bugfix
|
||||
* Add a check if iv_len is zero in GCM, and return an error if it is zero.
|
||||
Reported by roberto. #716
|
||||
* Replace preprocessor condition from #if defined(MBEDTLS_THREADING_PTHREAD)
|
||||
to #if defined(MBEDTLS_THREADING_C) as the library cannot assume they will
|
||||
always be implemented by pthread support. #696
|
||||
* Fix a resource leak on Windows platforms in mbedtls_x509_crt_parse_path(),
|
||||
in the case of an error. Found by redplait. #590
|
||||
* Add MBEDTLS_MPI_CHK to check for error value of mbedtls_mpi_fill_random.
|
||||
Reported and fix suggested by guidovranken. #740
|
||||
* Fix conditional preprocessor directives in bignum.h to enable 64-bit
|
||||
compilation when using ARM Compiler 6.
|
||||
* Fix a potential integer overflow in the version verification for DER
|
||||
encoded X.509 CRLs. The overflow could enable maliciously constructed CRLs
|
||||
to bypass the version verification check. Found by Peng Li/Yueh-Hsun Lin,
|
||||
KNOX Security, Samsung Research America
|
||||
* Fix potential integer overflow in the version verification for DER
|
||||
encoded X.509 CSRs. The overflow could enable maliciously constructed CSRs
|
||||
to bypass the version verification check. Found by Peng Li/Yueh-Hsun Lin,
|
||||
KNOX Security, Samsung Research America
|
||||
* Fix a potential integer overflow in the version verification for DER
|
||||
encoded X.509 certificates. The overflow could enable maliciously
|
||||
constructed certificates to bypass the certificate verification check.
|
||||
* Fix a call to the libc function time() to call the platform abstraction
|
||||
function mbedtls_time() instead. Found by wairua. #666
|
||||
* Avoid shadowing of time and index functions through mbed TLS function
|
||||
arguments. Found by inestlerode. #557.
|
||||
|
||||
Changes
|
||||
* Added config.h option MBEDTLS_NO_UDBL_DIVISION, to prevent the use of
|
||||
64-bit division. This is useful on embedded platforms where 64-bit division
|
||||
created a dependency on external libraries. #708
|
||||
* Removed mutexes from ECP hardware accelerator code. Now all hardware
|
||||
accelerator code in the library leaves concurrency handling to the
|
||||
platform. Reported by Steven Cooreman. #863
|
||||
* Define the macro MBEDTLS_AES_ROM_TABLES in the configuration file
|
||||
config-no-entropy.h to reduce the RAM footprint.
|
||||
* Added a test script that can be hooked into git that verifies commits
|
||||
before they are pushed.
|
||||
* Improve documentation of PKCS1 decryption functions.
|
||||
|
||||
= mbed TLS 2.5.1 released 2017-06-21
|
||||
|
||||
Security
|
||||
|
|
@ -278,7 +462,7 @@ Security
|
|||
* Fix potential integer overflow to buffer overflow in
|
||||
mbedtls_rsa_rsaes_pkcs1_v15_encrypt and mbedtls_rsa_rsaes_oaep_encrypt
|
||||
(not triggerable remotely in (D)TLS).
|
||||
* Fix a potential integer underflow to buffer overread in
|
||||
* Fix a potential integer underflow to buffer overread in
|
||||
mbedtls_rsa_rsaes_oaep_decrypt. It is not triggerable remotely in
|
||||
SSL/TLS.
|
||||
|
||||
|
|
@ -298,7 +482,7 @@ Bugfix
|
|||
* Fix an issue that caused valid certificates to be rejected whenever an
|
||||
expired or not yet valid certificate was parsed before a valid certificate
|
||||
in the trusted certificate list.
|
||||
* Fix bug in mbedtls_x509_crt_parse that caused trailing extra data in the
|
||||
* Fix bug in mbedtls_x509_crt_parse that caused trailing extra data in the
|
||||
buffer after DER certificates to be included in the raw representation.
|
||||
* Fix issue that caused a hang when generating RSA keys of odd bitlength
|
||||
* Fix bug in mbedtls_rsa_rsaes_pkcs1_v15_encrypt that made null pointer
|
||||
|
|
@ -1554,7 +1738,7 @@ Security
|
|||
Changes
|
||||
* Allow enabling of dummy error_strerror() to support some use-cases
|
||||
* Debug messages about padding errors during SSL message decryption are
|
||||
disabled by default and can be enabled with POLARSSL_SSL_DEBUG_ALL
|
||||
disabled by default and can be enabled with POLARSSL_SSL_DEBUG_ALL
|
||||
* Sending of security-relevant alert messages that do not break
|
||||
interoperability can be switched on/off with the flag
|
||||
POLARSSL_SSL_ALL_ALERT_MESSAGES
|
||||
|
|
@ -1583,7 +1767,7 @@ Bugfix
|
|||
Changes
|
||||
* Added p_hw_data to ssl_context for context specific hardware acceleration
|
||||
data
|
||||
* During verify trust-CA is only checked for expiration and CRL presence
|
||||
* During verify trust-CA is only checked for expiration and CRL presence
|
||||
|
||||
Bugfixes
|
||||
* Fixed client authentication compatibility
|
||||
|
|
@ -1881,9 +2065,9 @@ Features
|
|||
with random data (Fixed ticket #10)
|
||||
|
||||
Changes
|
||||
* Debug print of MPI now removes leading zero octets and
|
||||
* Debug print of MPI now removes leading zero octets and
|
||||
displays actual bit size of the value.
|
||||
* x509parse_key() (and as a consequence x509parse_keyfile())
|
||||
* x509parse_key() (and as a consequence x509parse_keyfile())
|
||||
does not zeroize memory in advance anymore. Use rsa_init()
|
||||
before parsing a key or keyfile!
|
||||
|
||||
|
|
@ -1905,7 +2089,7 @@ Features
|
|||
printing of X509 CRLs from file
|
||||
|
||||
Changes
|
||||
* Parsing of PEM files moved to separate module (Fixes
|
||||
* Parsing of PEM files moved to separate module (Fixes
|
||||
ticket #13). Also possible to remove PEM support for
|
||||
systems only using DER encoding
|
||||
|
||||
|
|
@ -2048,7 +2232,7 @@ Bug fixes
|
|||
* Fixed HMAC-MD2 by modifying md2_starts(), so that the
|
||||
required HMAC ipad and opad variables are not cleared.
|
||||
(found by code coverage tests)
|
||||
* Prevented use of long long in bignum if
|
||||
* Prevented use of long long in bignum if
|
||||
POLARSSL_HAVE_LONGLONG not defined (found by Giles
|
||||
Bathgate).
|
||||
* Fixed incorrect handling of negative strings in
|
||||
|
|
@ -2089,7 +2273,7 @@ Bug fixes
|
|||
* Made definition of net_htons() endian-clean for big endian
|
||||
systems (Found by Gernot).
|
||||
* Undefining POLARSSL_HAVE_ASM now also handles prevents asm in
|
||||
padlock and timing code.
|
||||
padlock and timing code.
|
||||
* Fixed an off-by-one buffer allocation in ssl_set_hostname()
|
||||
responsible for crashes and unwanted behaviour.
|
||||
* Added support for Certificate Revocation List (CRL) parsing.
|
||||
|
|
@ -2263,4 +2447,3 @@ XySSL ChangeLog
|
|||
who maintains the Debian package :-)
|
||||
|
||||
= Version 0.1 released on 2006-11-01
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue