Act nowcan affect a running systemReviewed all 54 non-merge commits from build 2.4.17082 through 2.4.17135: 1,474 additions and 904 deletions. Version bookkeeping was ignored. The raw payload has no superseded_by metadata; avoid windows come from directly inspected same-routine fixes in this edition.
TLS backends settle after a full-stack repair
OpenSSL and Windows SChannel receive a broad correction pass across callbacks, certificate policy, asynchronous I/O, shutdown and error reporting. External ORM inserts now stop safely when SELECT max(ID) fails instead of retrying IDs from one, and SQLite’s fallback allocator restores the alignment required on Android ARM64. This is a production-facing batch: take the final head rather than any intermediate TLS build.
TL;DR
- Land on upstream head 34c5672df4ab31378524d2868b8482b408eafbdd at build 2.4.17135.
- External ORM max-ID failures return 0 and suppress inserts instead of attempting duplicate IDs from one.
- OpenSSL callbacks, mTLS authorities, async retries, password callbacks, SNI and shutdown receive linked fixes.
- SChannel is rewritten for buffered async I/O, then repaired through handshake, TLS 1.3, shutdown, ClientHello and final error handling.
- SQLite’s fallback allocator uses a 16-byte header so Android ARM64 atomic accesses remain aligned.
- Avoid build 2.4.17117 and the intermediate OpenSSL 2.4.17083–2.4.17113 and SChannel 2.4.17119–2.4.17134 sequences.
Upgrade advice
Land on build 2.4.17135 at head 34c5672df4ab31378524d2868b8482b408eafbdd. Upgrade promptly for TRestStorageExternal max-ID allocation, OpenSSL callbacks or mTLS, async TLS, Windows SChannel, or SQLite’s fallback allocator on Android ARM64. Test lost-connection recovery, concurrent certificate callbacks, proxy/SNI/IPv6, WANT retries, SChannel shutdown and partial handshakes. Avoid the three intermediate ranges.
54 of 54 entries · 57 commits upstream
1
Critical
Nested HTTPS calls preserve OpenSSL callback state
Nested HTTPS calls preserve OpenSSL callback state. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Fixes
mormot.lib.openssl11
1e6d6c00+25-13
lib: ensure OpenSSL TLS callbacks are rentrant
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
2
Critical
Missing peer certificates no longer dereference nil
Missing peer certificates no longer dereference nil. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Fixes
mormot.lib.openssl11
82d1185a+18-9
lib: fixed potential GPF in OpenSSL OnEachPeerVerify
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
3
Critical
SQLite’s fallback allocator preserves 16-byte alignment
SQLite’s fallback allocator preserves 16-byte alignment. mormot.db.raw.sqlite3 changes xMalloc2, xFree2, xRealloc2 and xSize2 to use a 16-byte size header, handle nil and preserve SQLite allocation alignment.
Fixes
mormot.db.raw.sqlite3
469c0fca+16-8
sqlite: preserve alignment in custom allocator
Impact
Fallback SQLite allocators, especially Android ARM64, regain alignment required for atomic access without an application-source migration.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
4
Critical
Verification callbacks clear a dangling thread pointer
Verification callbacks clear a dangling thread pointer. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Fixes
mormot.lib.openssl11
5608ee27+3-2
lib: fixed dangling pointer after OnEachPeerVerify callback
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
5
High
SChannel handshake, send and shutdown states are corrected
SChannel handshake, send and shutdown states are corrected. mormot.net.sock.windows changes the TSChannelNetTls handshake, credential, buffering, send, receive or shutdown path named in the headline; the SSPI status and buffer transitions were inspected.
Fixes
mormot.net.sock.windows
ad930f3f+121-75
net: several TSChannelNetTls fixes
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
6
High
Failed SChannel connections reset the whole socket state
Failed SChannel connections reset the whole socket state. mormot.net.sock.windows changes the TSChannelNetTls handshake, credential, buffering, send, receive or shutdown path named in the headline; the SSPI status and buffer transitions were inspected.
Fixes
mormot.net.sock.windows+1
42530424+41-63
net: simplified TSChannelNetTls.AfterConnection
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
7
High
Failed max-ID lookup no longer restarts external IDs at one
Failed max-ID lookup no longer restarts external IDs at one. mormot.orm.sql changes the EngineLockedNextID failure path and its direct callers; the diff was checked against the external SQL insertion flow.
Fixes
mormot.orm.sql
24ae11c3+84-11
orm: EngineLockedNextID returned ID=1 when 'select max(ID)' failed
Impact
External SQL inserts now stop when the next ID is unknown instead of attempting duplicate IDs. No caller source change is required.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Public API
TRestStorageExternal.EngineLockedNextIDbehaviour-changed — Returns 0 when SELECT max(ID) fails instead of deriving ID=1.
Units
8
High
SChannel frees every handshake output buffer
SChannel frees every handshake output buffer. mormot.net.sock.windows changes the TSChannelNetTls handshake, credential, buffering, send, receive or shutdown path named in the headline; the SSPI status and buffer transitions were inspected.
Fixes
mormot.net.sock.windows
495b0e66+47-43
net: fixed memory leak in SChannel handshake buffers
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
9
High
OpenSSL callback exceptions stay inside the C boundary
OpenSSL callback exceptions stay inside the C boundary. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Fixes
mormot.lib.openssl11
0db48a16+40-39
lib: hardened OpenSSL TLS callbacks
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
10
High
OpenSSL mTLS advertises the client CA
OpenSSL mTLS advertises the client CA. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Fixes
mormot.lib.openssl11
811d0ff9+64-7
lib: fixed server-side client CA support for mTLS
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
11
High
TLS host parsing and reuse receive corrective follow-ups
TLS host parsing and reuse receive corrective follow-ups. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Fixes
mormot.lib.openssl11+1
54837fd6+33-30
net: fixed previous TLS-related commits
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
12
High
OpenSSL I/O callbacks handle TLS 1.2 renegotiation
OpenSSL I/O callbacks handle TLS 1.2 renegotiation. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Fixes
mormot.lib.openssl11
124b23dd+32-28
lib: fixed TOpenSslNetTls IO callbacks support
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
13
High
SChannel enables TLS 1.3 with the correct flags
SChannel enables TLS 1.3 with the correct flags. mormot.net.sock.windows changes the TSChannelNetTls handshake, credential, buffering, send, receive or shutdown path named in the headline; the SSPI status and buffer transitions were inspected.
Fixes
mormot.net.sock.windows+1
1939c37c+32-22
net: properly enable TLS 1.3 on TSChannelNetTls
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
14
High
SChannel reports final SSPI errors accurately
SChannel reports final SSPI errors accurately. mormot.net.sock.windows changes the TSChannelNetTls handshake, credential, buffering, send, receive or shutdown path named in the headline; the SSPI status and buffer transitions were inspected.
Fixes
mormot.net.sock.windows
a7361d83+20-32
net: fixed TSChannelNetTls error handling
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
15
High
SChannel preserves complete ClientHello input
SChannel preserves complete ClientHello input. mormot.net.sock.windows changes the TSChannelNetTls handshake, credential, buffering, send, receive or shutdown path named in the headline; the SSPI status and buffer transitions were inspected.
Fixes
mormot.net.sock.windows
7843132e+27-17
net: fixed ClientHello TLS message on SChannel
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
16
High
Server certificate callbacks stop sharing client state
Server certificate callbacks stop sharing client state. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Fixes
mormot.lib.openssl11
c4666e24+28-15
lib: fixed OpenSSL OnEachPeerVerify callback
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
17
High
OpenSSL setup and I/O errors use separate reporting
OpenSSL setup and I/O errors use separate reporting. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Fixes
mormot.lib.openssl11
ec4282ea+27-11
lib: hardened OpenSSL TLS layer error handling
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
18
High
TLS reuse compares the full client policy
TLS reuse compares the full client policy. mormot.net.sock changes the TLS context, host selection or connection-reuse path named in the headline; the affected public record and socket flow were inspected.
Fixes
mormot.net.sock
fd947708+23-14
net: fixed SameNetTlsContext()
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Public API
SameNetTlsContextbehaviour-changed — Now compares protocol flags, ciphers, peer-info and validation callbacks for client reuse.
Units
19
High
OpenSSL async sockets wait for the requested event
OpenSSL async sockets wait for the requested event. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Fixes
mormot.lib.openssl11
86768ea7+21-11
lib: fixed OpenSSL asynchronous socket support
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
20
High
OpenSSL callbacks receive the live server connection context
OpenSSL callbacks receive the live server connection context. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Fixes
mormot.lib.openssl11
c8ac89c3+18-10
lib: fixed TOpenSslNetTls callback support
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
21
High
SChannel treats an expired context as closure
SChannel treats an expired context as closure. mormot.net.sock.windows changes the TSChannelNetTls handshake, credential, buffering, send, receive or shutdown path named in the headline; the SSPI status and buffer transitions were inspected.
Fixes
mormot.net.sock.windows
77b07e28+16-5
net: fixed SEC_I_CONTEXT_EXPIRED process on SChannel
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
22
High
SChannel validates credential acquisition results
SChannel validates credential acquisition results. mormot.net.sock.windows changes the TSChannelNetTls handshake, credential, buffering, send, receive or shutdown path named in the headline; the SSPI status and buffer transitions were inspected.
Fixes
mormot.net.sock.windows+1
28348826+9-10
net: some SChannel credential check fixes
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
23
High
Async HTTP clients keep TLS setup state
Async HTTP clients keep TLS setup state. mormot.net.async corrects the THttpAsyncClientConnection TLS state transition so encrypted asynchronous setup completes before normal I/O.
Fixes
mormot.net.async
734bd258+10-7
net: fixed THttpAsyncClientConnection TLS support
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
24
High
SChannel retries incomplete client credentials
SChannel retries incomplete client credentials. mormot.net.sock.windows changes the TSChannelNetTls handshake, credential, buffering, send, receive or shutdown path named in the headline; the SSPI status and buffer transitions were inspected.
Fixes
mormot.net.sock.windows
1bef5038+9-8
net: better SEC_I_INCOMPLETE_CREDENTIALS fix for SChannel TLS
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
25
High
Password callbacks receive SSL_CTX during setup
Password callbacks receive SSL_CTX during setup. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Fixes
mormot.lib.openssl11
c82df225+8-8
lib: fixed OpenSSL TLS OnPrivatePassword callback usage
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
26
High
OpenSSL authority loading aborts on failure
OpenSSL authority loading aborts on failure. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Fixes
mormot.lib.openssl11
c98d4afe+8-6
lib: fixed TOpenSslNetTls.SetupCtx authority setup
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
27
High
OpenSSL private-key setup errors are no longer silent
OpenSSL private-key setup errors are no longer silent. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Fixes
mormot.lib.openssl11
a3cbd086+8-6
lib: fixed OpenSSL private key setup
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
28
High
HTTPS proxy TLS validates the proxy host
HTTPS proxy TLS validates the proxy host. mormot.net.sock changes the TLS context, host selection or connection-reuse path named in the headline; the affected public record and socket flow were inspected.
Fixes
mormot.net.sock
02f0f1fc+11-3
net: fixed proper host for the proxy TLS handshake
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
29
High
A missing OpenSSL certificate file fails explicitly
A missing OpenSSL certificate file fails explicitly. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Fixes
mormot.lib.openssl11
d03acfbc+7-2
lib: OpenSSL detect missing CertificateFile
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
30
High
OpenSSL mTLS receives a client-authority follow-up
OpenSSL mTLS receives a client-authority follow-up. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Fixes
mormot.lib.openssl11
6fd56b09+5-3
lib: another mTLS fix for OpenSSL
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
31
High
The external-ID refactor initializes its failure result
The external-ID refactor initializes its failure result. mormot.orm.sql changes the EngineLockedNextID failure path and its direct callers; the diff was checked against the external SQL insertion flow.
Fixes
mormot.orm.sql+1
ccda80ea+5-2
all: minor fixes after latest commits
Impact
External SQL inserts now stop when the next ID is unknown instead of attempting duplicate IDs. No caller source change is required.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
32
High
SChannel begins a stateful async I/O repair
SChannel begins a stateful async I/O repair. mormot.net.sock.windows changes the TSChannelNetTls handshake, credential, buffering, send, receive or shutdown path named in the headline; the SSPI status and buffer transitions were inspected.
Under the hood
mormot.net.sock.windows
66d9147e+127-64
net: first pass to fix TSChannelNetTls
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
33
High
SChannel Send retries without losing encrypted output
SChannel Send retries without losing encrypted output. mormot.net.sock.windows changes the TSChannelNetTls handshake, credential, buffering, send, receive or shutdown path named in the headline; the SSPI status and buffer transitions were inspected.
Under the hood
mormot.net.sock.windows
fed67288+108-78
net: rewritten TSChannelNetTls.Send
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
34
High
SChannel I/O is rewritten around buffered retries
SChannel I/O is rewritten around buffered retries. mormot.net.sock.windows changes the TSChannelNetTls handshake, credential, buffering, send, receive or shutdown path named in the headline; the SSPI status and buffer transitions were inspected.
Under the hood
mormot.net.sock.windows
bf18eb15+57-31
net: rewritten TSChannelNetTls I/O logic
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
35
Medium
OpenSSL sends a bounded close notification
OpenSSL sends a bounded close notification. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Fixes
mormot.lib.openssl11
f3cb34c3+31-6
lib: new TOpenSslNetTls.CleanShutdown method
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
36
Medium
SChannel shutdown flushes pending encrypted bytes
SChannel shutdown flushes pending encrypted bytes. mormot.net.sock.windows changes the TSChannelNetTls handshake, credential, buffering, send, receive or shutdown path named in the headline; the SSPI status and buffer transitions were inspected.
Fixes
mormot.net.sock.windows
48f902c5+17-9
net: fixed TSChannelNetTls.CleanShutdown
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
37
Medium
Empty host entries no longer poison identity checks
Empty host entries no longer poison identity checks. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Fixes
mormot.lib.openssl11
511e0315+12-5
lib: hardened TNetTlsContext.HostNamesCsv parsing
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
38
Medium
ClientVerifyOnce maps to the OpenSSL verification mode
ClientVerifyOnce maps to the OpenSSL verification mode. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Fixes
mormot.lib.openssl11
1b63d2d7+6-8
lib: fixed TNetTlsContext.ClientVerifyOnce
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
39
Medium
Bracketed IPv6 hosts work in OpenSSL clients
Bracketed IPv6 hosts work in OpenSSL clients. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Fixes
mormot.lib.openssl11
ae8e267c+10-2
lib: let TOpenSslNetTls.AfterConnection support IPv6 hosts
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
40
Medium
TLS reuse includes the peer-info choice
TLS reuse includes the peer-info choice. mormot.net.sock changes the TLS context, host selection or connection-reuse path named in the headline; the affected public record and socket flow were inspected.
Fixes
mormot.net.sock
1fcfea85+6-4
net: some TNetTlsContext fixes
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
41
Medium
Peer-certificate probing limits SNI to DNS hosts
Peer-certificate probing limits SNI to DNS hosts. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Fixes
mormot.lib.openssl11
309ceb0a+5-4
lib: GetPeerCertFromUrl() error fix for SNI
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
42
Medium
OpenSSL sends SNI only for valid DNS host names
OpenSSL sends SNI only for valid DNS host names. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Fixes
mormot.lib.openssl11
f5d0a79a+5-3
lib: fixed AfterConnection set_tlsext_host_name() usage
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
43
Medium
PKCS#12 certificates can use the password callback
PKCS#12 certificates can use the password callback. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
New features
mormot.lib.openssl11
81116eb3+43-32
lib: support OnPrivatePassword callback for certificate in .pfx/pkcs#12 format
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Worth a look
Review this configuration and test it on build 2.4.17135.
Units
44
Medium
SChannel server certificates support CNG keys
SChannel server certificates support CNG keys. mormot.net.sock.windows changes the TSChannelNetTls handshake, credential, buffering, send, receive or shutdown path named in the headline; the SSPI status and buffer transitions were inspected.
New features
mormot.net.sock.windows
a1cf5e0f+9-10
net: CNG support for TSChannelNetTls.AfterBind
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Worth a look
Review this configuration and test it on build 2.4.17135.
45
Medium
SChannel state handling improves Wine support
SChannel state handling improves Wine support. mormot.net.sock.windows changes the TSChannelNetTls handshake, credential, buffering, send, receive or shutdown path named in the headline; the SSPI status and buffer transitions were inspected.
Compiler & platform
mormot.net.sock.windows
9de9bf9b+9-9
net: enhanced TSChannelNetTls
Impact
Existing TLS source code need not change, but the affected path could fail, leak, crash, stall or apply the wrong policy before this correction. Retest it on the final build.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
46
Medium
The TLS rewrite compiles with Delphi 2007
The TLS rewrite compiles with Delphi 2007. The changed declaration or expression restores the compiler/platform path named in the headline without changing the intended runtime contract.
Compiler & platform
mormot.core.base
39ef397a+3-3
core: fixed Delphi 2007 compilation
Impact
Projects on the named compiler or platform regain a working build or execution path without changing application source.
Upgrade recommended
Land on build 2.4.17135 and retest this exact path.
Units
47
Medium
OpenSSL errors are read at the operation that failed
OpenSSL errors are read at the operation that failed. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Under the hood
mormot.lib.openssl11
3915b75d+37-31
lib: some more OpenSSL error detection cleanup
Impact
No impact on application code; this is refactoring, documentation or test coverage around the existing contract.
Units
48
Low
A public helper validates DNS names suitable for SNI
A public helper validates DNS names suitable for SNI. mormot.net.sock changes the TLS context, host selection or connection-reuse path named in the headline; the affected public record and socket flow were inspected.
New features
mormot.net.sock
71c52e11+93-3
net: new IsDnsHostName() function
Impact
Existing callers are unaffected because this adds a helper; new code may adopt it for strict RFC 6066 SNI host validation.
Public API
IsDnsHostNameadded — Public RFC 6066-style DNS host validation helper for SNI.
Units
49
Low
OpenSSL setup uses instance state consistently
OpenSSL setup uses instance state consistently. mormot.lib.openssl11 changes the OpenSSL context, callback, certificate or I/O path named in the headline; the operation and its cleanup/error branches were inspected in the diff.
Under the hood
mormot.lib.openssl11
8eca964f+50-56
lib: simplified TOpenSslNetTls.SetupCtx method
Impact
No impact on application code; this is refactoring, documentation or test coverage around the existing contract.
Units
50
Low
Network cleanup leaves TLS behavior unchanged
Network cleanup leaves TLS behavior unchanged. mormot.net.sock.windows changes the TSChannelNetTls handshake, credential, buffering, send, receive or shutdown path named in the headline; the SSPI status and buffer transitions were inspected.
Under the hood
mormot.net.sock.windows+1
7dbebefa+11-8
net: some code cleanup with no functional change
Impact
No impact on application code; this is refactoring, documentation or test coverage around the existing contract.
51
Low
External-ID allocation is simplified after the fix
External-ID allocation is simplified after the fix. mormot.orm.sql changes the EngineLockedNextID failure path and its direct callers; the diff was checked against the external SQL insertion flow.
Under the hood
mormot.orm.sql
273f6500+5-11
orm: minor refactoring of #616
Impact
No impact on application code; this is refactoring, documentation or test coverage around the existing contract.
Units
52
Low
ARM hard-float tests avoid an undefined shift
ARM hard-float tests avoid an undefined shift. The test diff narrows or extends coverage for the platform case named in the headline without changing a runtime unit.
Tests
88081088+4-4
test: fixed BenchmarkNumber "shr 32" issue on armhf
Impact
No impact on application code; this is refactoring, documentation or test coverage around the existing contract.
53
Low
Numeric benchmarks validate generated input bounds
Numeric benchmarks validate generated input bounds. The test diff narrows or extends coverage for the platform case named in the headline without changing a runtime unit.
Tests
e1c69c62+5-2
test: enhanced BenchmarkNumbers input numbers generation checking
Impact
No impact on application code; this is refactoring, documentation or test coverage around the existing contract.
54
Low
SMBIOS tests distinguish OEM strings from type 12 data
SMBIOS tests distinguish OEM strings from type 12 data. The test diff narrows or extends coverage for the platform case named in the headline without changing a runtime unit.
Tests
793fa7ea+5-1
test: account for SMBIOS type 12 OEM strings
Impact
No impact on application code; this is refactoring, documentation or test coverage around the existing contract.