Commits July 2026

commits@lists.kronosnet.org

2 participants
604 discussions

[jenkins] kronosnet stable1-proposed (build 263) succeeded but with 2/82 non-voting fails
by jenkins＠kronosnet.org 20 Jul '26

20 Jul '26

1 0

[jenkins] kronosnet stable1 (build 213) succeeded but with 2/82 non-voting fails
by jenkins＠kronosnet.org 20 Jul '26

20 Jul '26

1 0

[jenkins] kronosnet main (build 275) succeeded but with 2/82 non-voting fails
by jenkins＠kronosnet.org 20 Jul '26

20 Jul '26

1 0

[kronosnet/kronosnet] 993fe0: Merge pull request #494 from kronosnet/stable1-pro...
by Fabio Di Nitto 20 Jul '26

20 Jul '26

Branch: refs/heads/stable1-proposed Home: https://github.com/kronosnet/kronosnet Commit: 993fe0589e75e709d6dd206c72bf2ec3aeaf9c84 https://github.com/kronosnet/kronosnet/commit/993fe0589e75e709d6dd206c72bf2… Author: Fabio Di Nitto <fdinitto(a)redhat.com> Date: 2026-07-20 (Mon, 20 Jul 2026) Changed paths: M Makefile.am R README A README.md M configure.ac M libknet/crypto_nss.c M libknet/crypto_openssl.c M libknet/handle.c M libknet/tests/Makefile.am M libknet/tests/api_knet_handle_add_datafd.c M libknet/tests/fun_acl_check.c A libknet/tests/sec_acl_link_id_spoofing.c A libknet/tests/sec_frag_sequence.c M libknet/threads_rx.c M libnozzle/tests/api_nozzle_prefix_validation.c Log Message: ----------- Merge pull request #494 from kronosnet/stable1-proposed stable1-proposed To unsubscribe from these emails, change your notification settings at https://github.com/kronosnet/kronosnet/settings/notifications

1 0

[kronosnet/kronosnet]
by Fabio Di Nitto 20 Jul '26

20 Jul '26

Branch: refs/tags/v1.35 Home: https://github.com/kronosnet/kronosnet To unsubscribe from these emails, change your notification settings at https://github.com/kronosnet/kronosnet/settings/notifications

1 0

[kronosnet/kronosnet] f3938e: build: add CLAUDE.md to release tarball
by Fabio Di Nitto 20 Jul '26

20 Jul '26

Branch: refs/heads/stable1 Home: https://github.com/kronosnet/kronosnet Commit: f3938e57d8ea8eacd3540068b0e82cdf7af9b822 https://github.com/kronosnet/kronosnet/commit/f3938e57d8ea8eacd3540068b0e82… Author: Fabio M. Di Nitto <fdinitto(a)redhat.com> Date: 2026-07-01 (Wed, 01 Jul 2026) Changed paths: M Makefile.am Log Message: ----------- build: add CLAUDE.md to release tarball CLAUDE.md provides AI-assisted development documentation and should be included in release tarballs for completeness. Signed-off-by: Fabio M. Di Nitto <fabbione(a)kronosnet.org> Co-Authored-By: Claude Sonnet 4.5 <noreply(a)anthropic.com> Commit: 39327848995d86206d22c487f0bbb08ccd59df76 https://github.com/kronosnet/kronosnet/commit/39327848995d86206d22c487f0bbb… Author: Fabio M. Di Nitto <fdinitto(a)redhat.com> Date: 2026-07-01 (Wed, 01 Jul 2026) Changed paths: M Makefile.am R README A README.md Log Message: ----------- docs: convert README to markdown format Rename README to README.md and convert to proper markdown formatting for better readability on GitHub and other platforms. Signed-off-by: Fabio M. Di Nitto <fabbione(a)kronosnet.org> Co-Authored-By: Claude Sonnet 4.5 <noreply(a)anthropic.com> Commit: edf6a4b5fd995673403476d68b8c4579a082bcc5 https://github.com/kronosnet/kronosnet/commit/edf6a4b5fd995673403476d68b8c4… Author: Fabio M. Di Nitto <fdinitto(a)redhat.com> Date: 2026-07-13 (Mon, 13 Jul 2026) Changed paths: M libknet/tests/Makefile.am M libknet/tests/api_knet_handle_add_datafd.c Log Message: ----------- tests: add coverage for connected named AF_UNIX SOCK_STREAM sockets Add test case for knet_handle_add_datafd with a connected named AF_UNIX SOCK_STREAM socket to verify the happy path after commit cb896d8f. The test creates a Unix domain socket server in ABSBUILDDIR, connects a client, and validates that knet accepts the connected socket. Gracefully skips if the build path exceeds sun_path length limit. Added CLEANFILES rule to remove socket test artifacts during make clean. Signed-off-by: Fabio M. Di Nitto <fabbione(a)kronosnet.org> Co-Authored-By: Claude Sonnet 4.5 <noreply(a)anthropic.com> Commit: 72571ed61031018fde5870be55b2af9c7198443a https://github.com/kronosnet/kronosnet/commit/72571ed61031018fde5870be55b2a… Author: Christine Caulfield <ccaulfie(a)redhat.com> Date: 2026-07-13 (Mon, 13 Jul 2026) Changed paths: M libnozzle/tests/api_nozzle_prefix_validation.c Log Message: ----------- nozzle: Introduce test macros similar to libknet Add comprehensive test macros to test-common.h, similar to those used in libknet tests: - FAIL_ON_ERR: Fail if function returns error - FAIL_ON_SUCCESS: Negative test - expect failure with specific errno - FAIL_ON_NULL/FAIL_ON_NOT_NULL: For pointer-returning functions - FAIL_ON_NONZERO/FAIL_ON_ZERO: For comparisons - FAIL_ON_ERR_ONLY: For functions returning -1 on error - FAIL_ON_CMD: For execute_bin_sh_command and similar - FAIL_ON_CMD_SUCCESS: Negative test for commands These macros: - Reduce code duplication and improve readability - Print descriptive failure messages with line numbers - Handle errno correctly for debugging - Automatically clean up via 'goto out_clean' pattern All test files have been converted to use these macros, significantly reducing test code size (from 1280 to ~600 lines net) while improving clarity and error reporting. Also fixed Solaris-specific test issues where interface state checks aren't possible - these now skip the check rather than fail. Co-Authored-By: Claude Sonnet 4.5 <noreply(a)anthropic.com> Commit: 6bbc8572f7edeb53abd259647b97d74945f68e75 https://github.com/kronosnet/kronosnet/commit/6bbc8572f7edeb53abd259647b97d… Author: Fabio M. Di Nitto <fdinitto(a)redhat.com> Date: 2026-07-20 (Mon, 20 Jul 2026) Changed paths: M configure.ac M libknet/crypto_nss.c M libknet/crypto_openssl.c Log Message: ----------- CVE-2026-15811: encryption key exposure in memory after cryptographic configuration changes Severity: LOW Wipe cryptographic keys before freeing to prevent exposure through memory disclosure vulnerabilities using explicit_bzero(). Wipe private_key buffers in openssl/gcrypt backends and instance structures in all backends. The explicit_bzero() function is now required by kronosnet. All modern Linux distributions (glibc >= 2.25, musl >= 1.1.20) and BSDs provide this function. Signed-off-by: Fabio M. Di Nitto <fdinitto(a)redhat.com> Co-Authored-By: Claude Sonnet 4.5 <noreply(a)anthropic.com> Commit: d83f360d07d5b3ae33bf9659a2502d3993f5bdcf https://github.com/kronosnet/kronosnet/commit/d83f360d07d5b3ae33bf9659a2502… Author: Fabio M. Di Nitto <fdinitto(a)redhat.com> Date: 2026-07-20 (Mon, 20 Jul 2026) Changed paths: M libknet/handle.c M libknet/tests/Makefile.am M libknet/tests/fun_acl_check.c A libknet/tests/sec_acl_link_id_spoofing.c M libknet/threads_rx.c Log Message: ----------- CVE-2026-15812: access control list bypass via link ID spoofing on unencrypted dynamic links Severity: LOW Exploitable only with unencrypted traffic (not supported for production). Validate that packets originate from the configured source address for the claimed link_id. Previously, link_id was trusted without verification, allowing attackers to probe link states or confuse failover logic. Implement secure-by-default model with proper static/dynamic link handling: - Enable use_access_lists=1 by default in knet_handle_new - Static links: always validate against auto-configured ACL - Dynamic links with use_access_lists=1 (default): require ACL or reject - Dynamic links with use_access_lists=0: skip validation (explicit opt-out) Add bounds check, source address verification, and centralized _check_rx_acl(). Update tests to reflect secure-by-default model. Signed-off-by: Fabio M. Di Nitto <fdinitto(a)redhat.com> Co-Authored-By: Claude Sonnet 4.5 <noreply(a)anthropic.com> Commit: bf8fd52acf47bb1fe2b1dce8d46ea54db07075c4 https://github.com/kronosnet/kronosnet/commit/bf8fd52acf47bb1fe2b1dce8d46ea… Author: Fabio M. Di Nitto <fdinitto(a)redhat.com> Date: 2026-07-20 (Mon, 20 Jul 2026) Changed paths: M libknet/tests/Makefile.am A libknet/tests/sec_frag_sequence.c M libknet/threads_rx.c Log Message: ----------- CVE-2026-15813: memory corruption and out-of-bounds access via malformed network packet defragmentation Severity: MEDIUM Validate fragment sequence numbers before accessing defragmentation buffers. Previous code used unchecked sequence numbers as array indices, allowing heap buffer overflow. Exploitable only with unencrypted traffic (not supported for production). CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer Signed-off-by: Fabio M. Di Nitto <fdinitto(a)redhat.com> Co-Authored-By: Claude Sonnet 4.5 <noreply(a)anthropic.com> Commit: 993fe0589e75e709d6dd206c72bf2ec3aeaf9c84 https://github.com/kronosnet/kronosnet/commit/993fe0589e75e709d6dd206c72bf2… Author: Fabio Di Nitto <fdinitto(a)redhat.com> Date: 2026-07-20 (Mon, 20 Jul 2026) Changed paths: M Makefile.am R README A README.md M configure.ac M libknet/crypto_nss.c M libknet/crypto_openssl.c M libknet/handle.c M libknet/tests/Makefile.am M libknet/tests/api_knet_handle_add_datafd.c M libknet/tests/fun_acl_check.c A libknet/tests/sec_acl_link_id_spoofing.c A libknet/tests/sec_frag_sequence.c M libknet/threads_rx.c M libnozzle/tests/api_nozzle_prefix_validation.c Log Message: ----------- Merge pull request #494 from kronosnet/stable1-proposed stable1-proposed Compare: https://github.com/kronosnet/kronosnet/compare/ec9c46d3d7b9...993fe0589e75 To unsubscribe from these emails, change your notification settings at https://github.com/kronosnet/kronosnet/settings/notifications

1 0

[kronosnet/kronosnet]
by Fabio Di Nitto 20 Jul '26

20 Jul '26

Branch: refs/heads/security-fixes-cve-only Home: https://github.com/kronosnet/kronosnet To unsubscribe from these emails, change your notification settings at https://github.com/kronosnet/kronosnet/settings/notifications

1 0

[kronosnet/kronosnet] 0f6636: CVE-2026-15811: encryption key exposure in memory ...
by Fabio Di Nitto 20 Jul '26

20 Jul '26

Branch: refs/heads/main Home: https://github.com/kronosnet/kronosnet Commit: 0f66366cbe3fc6d7742571187442ba5cda627d1d https://github.com/kronosnet/kronosnet/commit/0f66366cbe3fc6d7742571187442b… Author: Fabio M. Di Nitto <fdinitto(a)redhat.com> Date: 2026-07-20 (Mon, 20 Jul 2026) Changed paths: M configure.ac M libknet/crypto_gcrypt.c M libknet/crypto_nss.c M libknet/crypto_openssl.c Log Message: ----------- CVE-2026-15811: encryption key exposure in memory after cryptographic configuration changes Severity: LOW Wipe cryptographic keys before freeing to prevent exposure through memory disclosure vulnerabilities using explicit_bzero(). Wipe private_key buffers in openssl/gcrypt backends and instance structures in all backends. The explicit_bzero() function is now required by kronosnet. All modern Linux distributions (glibc >= 2.25, musl >= 1.1.20) and BSDs provide this function. Signed-off-by: Fabio M. Di Nitto <fdinitto(a)redhat.com> Co-Authored-By: Claude Sonnet 4.5 <noreply(a)anthropic.com> Commit: e13cb431329417b530277593a4094ef8bb0572d1 https://github.com/kronosnet/kronosnet/commit/e13cb431329417b530277593a4094… Author: Fabio M. Di Nitto <fdinitto(a)redhat.com> Date: 2026-07-20 (Mon, 20 Jul 2026) Changed paths: M libknet/handle.c M libknet/onwire_v1.c M libknet/tests/Makefile.am M libknet/tests/fun_acl_check.c A libknet/tests/sec_acl_link_id_spoofing.c M libknet/threads_rx.c Log Message: ----------- CVE-2026-15812: access control list bypass via link ID spoofing on unencrypted dynamic links Severity: LOW Exploitable only with unencrypted traffic (not supported for production). Validate that packets originate from the configured source address for the claimed link_id. Previously, link_id was trusted without verification, allowing attackers to probe link states or confuse failover logic. Implement secure-by-default model with proper static/dynamic link handling: - Enable use_access_lists=1 by default in knet_handle_new - Static links: always validate against auto-configured ACL - Dynamic links with use_access_lists=1 (default): require ACL or reject - Dynamic links with use_access_lists=0: skip validation (explicit opt-out) Add bounds check, source address verification, and centralized _check_rx_acl(). Update tests to reflect secure-by-default model. Signed-off-by: Fabio M. Di Nitto <fdinitto(a)redhat.com> Co-Authored-By: Claude Sonnet 4.5 <noreply(a)anthropic.com> Commit: f1e8e1c536a8340fa154b097fc69dadaef7a366a https://github.com/kronosnet/kronosnet/commit/f1e8e1c536a8340fa154b097fc69d… Author: Fabio M. Di Nitto <fdinitto(a)redhat.com> Date: 2026-07-20 (Mon, 20 Jul 2026) Changed paths: M libknet/tests/Makefile.am A libknet/tests/sec_frag_sequence.c M libknet/threads_rx.c Log Message: ----------- CVE-2026-15813: memory corruption and out-of-bounds access via malformed network packet defragmentation Severity: MEDIUM Validate fragment sequence numbers before accessing defragmentation buffers. Previous code used unchecked sequence numbers as array indices, allowing heap buffer overflow. Exploitable only with unencrypted traffic (not supported for production). CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer Signed-off-by: Fabio M. Di Nitto <fdinitto(a)redhat.com> Co-Authored-By: Claude Sonnet 4.5 <noreply(a)anthropic.com> Commit: 38258b1be497077e8dd63ad97df356f639a8703c https://github.com/kronosnet/kronosnet/commit/38258b1be497077e8dd63ad97df35… Author: Fabio Di Nitto <fdinitto(a)redhat.com> Date: 2026-07-20 (Mon, 20 Jul 2026) Changed paths: M configure.ac M libknet/crypto_gcrypt.c M libknet/crypto_nss.c M libknet/crypto_openssl.c M libknet/handle.c M libknet/onwire_v1.c M libknet/tests/Makefile.am M libknet/tests/fun_acl_check.c A libknet/tests/sec_acl_link_id_spoofing.c A libknet/tests/sec_frag_sequence.c M libknet/threads_rx.c Log Message: ----------- Merge pull request #499 from kronosnet/security-fixes-cve-only Security fixes: CVE-2026-15811, CVE-2026-15812, CVE-2026-15813 Compare: https://github.com/kronosnet/kronosnet/compare/45470b8f0ed7...38258b1be497 To unsubscribe from these emails, change your notification settings at https://github.com/kronosnet/kronosnet/settings/notifications

1 0

[jenkins] kronosnet PR-499 (build 3) succeeded but with 2/82 non-voting fails
by jenkins＠kronosnet.org 20 Jul '26

20 Jul '26

Failed jobs: alpine-x86-64(nonvoting-clang: Build source) alpine-x86-64(nonvoting-clang_debug: Build source) Run reason: Pull request #499 updated Total runtime: 2 hr 27 min Split logs: https://ci.kronosnet.org/job/kronosnet/job/kronosnet-pipeline/job/PR-499/3/… Full log: https://ci.kronosnet.org/job/kronosnet/job/kronosnet-pipeline/job/PR-499/3/… Failed logs: https://ci.kronosnet.org/job/kronosnet/job/kronosnet-pipeline/job/PR-499/3/… https://ci.kronosnet.org/job/kronosnet/job/kronosnet-pipeline/job/PR-499/3/… Full Coverity results: http://ci.kronosnet.org/coverity/kronosnet/rhel-10-coverity-x86-64/pr499//3 http://ci.kronosnet.org/coverity/kronosnet/rhel-8-coverity-x86-64/pr499//3 http://ci.kronosnet.org/coverity/kronosnet/rhel-9-coverity-x86-64/pr499//3

1 0

[jenkins] kronosnet PR-494 (build 8) succeeded but with 2/82 non-voting fails
by jenkins＠kronosnet.org 20 Jul '26

20 Jul '26

Failed jobs: alpine-x86-64(nonvoting-clang: Build source) alpine-x86-64(nonvoting-clang_debug: Build source) Run reason: Pull request #494 updated Total runtime: 2 hr 1 min Split logs: https://ci.kronosnet.org/job/kronosnet/job/kronosnet-pipeline/job/PR-494/8/… Full log: https://ci.kronosnet.org/job/kronosnet/job/kronosnet-pipeline/job/PR-494/8/… Failed logs: https://ci.kronosnet.org/job/kronosnet/job/kronosnet-pipeline/job/PR-494/8/… https://ci.kronosnet.org/job/kronosnet/job/kronosnet-pipeline/job/PR-494/8/… Full Coverity results: http://ci.kronosnet.org/coverity/kronosnet/rhel-10-coverity-x86-64/pr494//8 http://ci.kronosnet.org/coverity/kronosnet/rhel-9-coverity-x86-64/pr494//8 http://ci.kronosnet.org/coverity/kronosnet/rhel-8-coverity-x86-64/pr494//8

1 0

← Newer
1
2
3
4
5
6
7
...
61
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

Commits July 2026