Branch: refs/heads/stable1 Home: https://github.com/kronosnet/kronosnet Commit: f3938e57d8ea8eacd3540068b0e82cdf7af9b822 https://github.com/kronosnet/kronosnet/commit/f3938e57d8ea8eacd3540068b0e82c... Author: Fabio M. Di Nitto fdinitto@redhat.com Date: 2026-07-01 (Wed, 01 Jul 2026)
Changed paths: M Makefile.am
Log Message: ----------- build: add CLAUDE.md to release tarball
CLAUDE.md provides AI-assisted development documentation and should be included in release tarballs for completeness.
Signed-off-by: Fabio M. Di Nitto fabbione@kronosnet.org Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com
Commit: 39327848995d86206d22c487f0bbb08ccd59df76 https://github.com/kronosnet/kronosnet/commit/39327848995d86206d22c487f0bbb0... Author: Fabio M. Di Nitto fdinitto@redhat.com Date: 2026-07-01 (Wed, 01 Jul 2026)
Changed paths: M Makefile.am R README A README.md
Log Message: ----------- docs: convert README to markdown format
Rename README to README.md and convert to proper markdown formatting for better readability on GitHub and other platforms.
Signed-off-by: Fabio M. Di Nitto fabbione@kronosnet.org Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com
Commit: edf6a4b5fd995673403476d68b8c4579a082bcc5 https://github.com/kronosnet/kronosnet/commit/edf6a4b5fd995673403476d68b8c45... Author: Fabio M. Di Nitto fdinitto@redhat.com Date: 2026-07-13 (Mon, 13 Jul 2026)
Changed paths: M libknet/tests/Makefile.am M libknet/tests/api_knet_handle_add_datafd.c
Log Message: ----------- tests: add coverage for connected named AF_UNIX SOCK_STREAM sockets
Add test case for knet_handle_add_datafd with a connected named AF_UNIX SOCK_STREAM socket to verify the happy path after commit cb896d8f.
The test creates a Unix domain socket server in ABSBUILDDIR, connects a client, and validates that knet accepts the connected socket. Gracefully skips if the build path exceeds sun_path length limit.
Added CLEANFILES rule to remove socket test artifacts during make clean.
Signed-off-by: Fabio M. Di Nitto fabbione@kronosnet.org Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com
Commit: 72571ed61031018fde5870be55b2af9c7198443a https://github.com/kronosnet/kronosnet/commit/72571ed61031018fde5870be55b2af... Author: Christine Caulfield ccaulfie@redhat.com Date: 2026-07-13 (Mon, 13 Jul 2026)
Changed paths: M libnozzle/tests/api_nozzle_prefix_validation.c
Log Message: ----------- nozzle: Introduce test macros similar to libknet
Add comprehensive test macros to test-common.h, similar to those used in libknet tests: - FAIL_ON_ERR: Fail if function returns error - FAIL_ON_SUCCESS: Negative test - expect failure with specific errno - FAIL_ON_NULL/FAIL_ON_NOT_NULL: For pointer-returning functions - FAIL_ON_NONZERO/FAIL_ON_ZERO: For comparisons - FAIL_ON_ERR_ONLY: For functions returning -1 on error - FAIL_ON_CMD: For execute_bin_sh_command and similar - FAIL_ON_CMD_SUCCESS: Negative test for commands
These macros: - Reduce code duplication and improve readability - Print descriptive failure messages with line numbers - Handle errno correctly for debugging - Automatically clean up via 'goto out_clean' pattern
All test files have been converted to use these macros, significantly reducing test code size (from 1280 to ~600 lines net) while improving clarity and error reporting.
Also fixed Solaris-specific test issues where interface state checks aren't possible - these now skip the check rather than fail.
Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com
Commit: 6bbc8572f7edeb53abd259647b97d74945f68e75 https://github.com/kronosnet/kronosnet/commit/6bbc8572f7edeb53abd259647b97d7... Author: Fabio M. Di Nitto fdinitto@redhat.com Date: 2026-07-20 (Mon, 20 Jul 2026)
Changed paths: M configure.ac M libknet/crypto_nss.c M libknet/crypto_openssl.c
Log Message: ----------- CVE-2026-15811: encryption key exposure in memory after cryptographic configuration changes
Severity: LOW
Wipe cryptographic keys before freeing to prevent exposure through memory disclosure vulnerabilities using explicit_bzero().
Wipe private_key buffers in openssl/gcrypt backends and instance structures in all backends.
The explicit_bzero() function is now required by kronosnet. All modern Linux distributions (glibc >= 2.25, musl >= 1.1.20) and BSDs provide this function.
Signed-off-by: Fabio M. Di Nitto fdinitto@redhat.com Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com
Commit: d83f360d07d5b3ae33bf9659a2502d3993f5bdcf https://github.com/kronosnet/kronosnet/commit/d83f360d07d5b3ae33bf9659a2502d... Author: Fabio M. Di Nitto fdinitto@redhat.com Date: 2026-07-20 (Mon, 20 Jul 2026)
Changed paths: M libknet/handle.c M libknet/tests/Makefile.am M libknet/tests/fun_acl_check.c A libknet/tests/sec_acl_link_id_spoofing.c M libknet/threads_rx.c
Log Message: ----------- CVE-2026-15812: access control list bypass via link ID spoofing on unencrypted dynamic links
Severity: LOW
Exploitable only with unencrypted traffic (not supported for production).
Validate that packets originate from the configured source address for the claimed link_id. Previously, link_id was trusted without verification, allowing attackers to probe link states or confuse failover logic.
Implement secure-by-default model with proper static/dynamic link handling: - Enable use_access_lists=1 by default in knet_handle_new - Static links: always validate against auto-configured ACL - Dynamic links with use_access_lists=1 (default): require ACL or reject - Dynamic links with use_access_lists=0: skip validation (explicit opt-out)
Add bounds check, source address verification, and centralized _check_rx_acl(). Update tests to reflect secure-by-default model.
Signed-off-by: Fabio M. Di Nitto fdinitto@redhat.com Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com
Commit: bf8fd52acf47bb1fe2b1dce8d46ea54db07075c4 https://github.com/kronosnet/kronosnet/commit/bf8fd52acf47bb1fe2b1dce8d46ea5... Author: Fabio M. Di Nitto fdinitto@redhat.com Date: 2026-07-20 (Mon, 20 Jul 2026)
Changed paths: M libknet/tests/Makefile.am A libknet/tests/sec_frag_sequence.c M libknet/threads_rx.c
Log Message: ----------- CVE-2026-15813: memory corruption and out-of-bounds access via malformed network packet defragmentation
Severity: MEDIUM
Validate fragment sequence numbers before accessing defragmentation buffers. Previous code used unchecked sequence numbers as array indices, allowing heap buffer overflow.
Exploitable only with unencrypted traffic (not supported for production).
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
Signed-off-by: Fabio M. Di Nitto fdinitto@redhat.com Co-Authored-By: Claude Sonnet 4.5 noreply@anthropic.com
Commit: 993fe0589e75e709d6dd206c72bf2ec3aeaf9c84 https://github.com/kronosnet/kronosnet/commit/993fe0589e75e709d6dd206c72bf2e... Author: Fabio Di Nitto fdinitto@redhat.com Date: 2026-07-20 (Mon, 20 Jul 2026)
Changed paths: M Makefile.am R README A README.md M configure.ac M libknet/crypto_nss.c M libknet/crypto_openssl.c M libknet/handle.c M libknet/tests/Makefile.am M libknet/tests/api_knet_handle_add_datafd.c M libknet/tests/fun_acl_check.c A libknet/tests/sec_acl_link_id_spoofing.c A libknet/tests/sec_frag_sequence.c M libknet/threads_rx.c M libnozzle/tests/api_nozzle_prefix_validation.c
Log Message: ----------- Merge pull request #494 from kronosnet/stable1-proposed
stable1-proposed
Compare: https://github.com/kronosnet/kronosnet/compare/ec9c46d3d7b9...993fe0589e75
To unsubscribe from these emails, change your notification settings at https://github.com/kronosnet/kronosnet/settings/notifications
-
Fabio Di Nitto