| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
fix: address security review findings on rsa, bn, sha2, mldsa, cmac and CI - ci: run the riscv64 self-hosted job on push only, so untrusted PR code cannot execute on the self-hosted runner - sha2: gate the multi-buffer SHA256 path on the ARM SHA2 extension at init to avoid SIGILL on cores without it; add missing input checks to the one-shot CRYPT_SHA256_MB - mldsa: decrement the loop counter in the ARMv8 UseHint32/88 routines; the missing decrement emitted a 17th 64-byte chunk store, writing 64 bytes past each w[i] polynomial during signature verification. Add an SDV case with a canary after the last polynomial to guard the bound - rsa: reject inLen < 2 in CRYPT_RSA_VerifyPkcsV15Type2TLS before reading in[0]/in[1] to prevent an out-of-bounds read with a malformed short modulus - bn: BN_GenPrime now retries only on a composite candidate and aborts on real errors, preventing an infinite loop when the rand source fails persistently (aligned with OpenSSL behavior) - cmac: replace NULL + 0 pointer arithmetic on empty updates with an index loop to remove undefined behavior - curve25519: clear the partially duplicated key context on the DupCtx failure path - benchmark: reject -l values beyond the fixed buffer size Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1803 | 1 天前 | |
fix: resolve compilation errors in test framework - handleSignal now takes int sig param and casts it unused - Serverstartflag matches HLT_FrameCallBack signature Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1732 | 27 天前 | |
feat(entropy): add multi-source entropy health management - Add CPU-jitter and hash-loop delta source support with platform timing and assessment utilities - Expand entropy health-test, seed-pool, SAL timing, and SDV coverage. Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1704 | 11 天前 | |
test(entropy): add retry helper for transient ES alarms Replace direct CRYPT_ENTROPY_GATHER_ENTROPY calls with EsGatherRetryOnAlarm(), which retries up to 5 times when a noise source raises a retryable RCT/APT alarm (either as a raw verdict or wrapped inside ENTROPY_NOT_ENOUGH). Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1779 | 9 天前 | |
feat: add forbidLegacyClientRenegotiate option for server-side RI/SCSV enforcement Add a new bool config option forbidLegacyClientRenegotiate (default false). When set to true, the server will abort the handshake with fatal handshake_failure alert if a pre-TLS1.3 ClientHello contains neither the renegotiation_info extension nor the TLS_EMPTY_RENEGOTIATION_INFO_SCSV cipher suite. This mirrors the existing client-side allowLegacyRenegotiate behavior, giving the server the same ability to reject legacy peers that do not support secure renegotiation (RFC 5746). New public APIs: - HITLS_CFG_SetForbidLegacyClientRenegotiate(config, forbid) - HITLS_CFG_GetForbidLegacyClientRenegotiate(config, &isForbid) - HITLS_SetForbidLegacyClientRenegotiate(ctx, forbid) - HITLS_GetForbidLegacyClientRenegotiate(ctx, &isForbid) Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1815 | 15 小时前 | |
feat(quic): support quic-tls-api according to rfc9001 Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1774 | 1 天前 | |
feat: add forbidLegacyClientRenegotiate option for server-side RI/SCSV enforcement Add a new bool config option forbidLegacyClientRenegotiate (default false). When set to true, the server will abort the handshake with fatal handshake_failure alert if a pre-TLS1.3 ClientHello contains neither the renegotiation_info extension nor the TLS_EMPTY_RENEGOTIATION_INFO_SCSV cipher suite. This mirrors the existing client-side allowLegacyRenegotiate behavior, giving the server the same ability to reject legacy peers that do not support secure renegotiation (RFC 5746). New public APIs: - HITLS_CFG_SetForbidLegacyClientRenegotiate(config, forbid) - HITLS_CFG_GetForbidLegacyClientRenegotiate(config, &isForbid) - HITLS_SetForbidLegacyClientRenegotiate(ctx, forbid) - HITLS_GetForbidLegacyClientRenegotiate(ctx, &isForbid) Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1815 | 15 小时前 | |
feat(dtls13-cid): Connection ID (RFC 9146/9147) and shared integration layer Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1635 | 23 天前 | |
fix:CDP, IDP and DELTACRL fields are not supported under the HITLS_PKI_X509_VFY_CRL_LITE Signed-off-by: Lzhjian <liuzhijian24@huawei.com> Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1793 | 1 天前 | |
feat(entropy): add multi-source entropy health management - Add CPU-jitter and hash-loop delta source support with platform timing and assessment utilities - Expand entropy health-test, seed-pool, SAL timing, and SDV coverage. Cherry-picked from: https://gitcode.com/openHiTLS/openhitls/merge_requests/1704 | 11 天前 |