Act nowcan affect a running system
TTunnelLocal moves to authenticated, direction-specific AES-GCM
TTunnelLocal receives a security protocol rewrite: AES-CTR is replaced by authenticated AES-GCM frames, receive and send keys are separated, session data is authenticated and malformed handshakes are rejected earlier. The series also fixes OpenSSL GCM associated-data handling, a binary-cookie memory leak and parsing of spaced __Secure- cookies. Delphi 2010 gets targeted protection from unsafe inlining.
TL;DR
- Use build 2.4.17551; the TTunnelLocal security rewrite receives three immediate hardening follow-ups.
- Encrypted TTunnelLocal traffic now uses AES-GCM with authenticated frames and separate receive/send keys.
- Code referring to tlmVersion1 must migrate to tlmVersion1_aesctr or the new tlmVersion2 identifier.
- TAesGcmOsl now authenticates AEAD associated information correctly.
- TBinaryCookieGenerator destruction no longer leaks managed state after invalidation.
Upgrade advice
Land on build 2.4.17551, not builds 2.4.17544-2.4.17545 where the new tunnel protocol had not received all immediate hardening. Upgrade both TTunnelLocal endpoints together, migrate tlmVersion1 references, and retest encrypted handshakes, rejected tags and malformed metadata. OpenSSL GCM users should verify AAD vectors, and binary-cookie users should include repeated invalidate/destroy cycles.
10 of 10 entries · 11 commits upstream
1
Critical
TTunnelLocal frames gain authenticated encryption and directional keys
TTunnelLocalMagic renames tlmVersion1 to tlmVersion1_aesctr and adds tlmVersion2. The active protocol switches frames from AES-CTR to AES-GCM, derives distinct receive and send keys from each side's handshake CRC, authenticates TTunnelSession as AAD, advances a 96-bit IV per direction and rejects identical CRCs or keys.
Security
mormot.crypt.core+1
a9f6b586+105-32
net: fixed TTunnelLocal handshake security
Impact
Encrypted tunnel frames now provide integrity as well as confidentiality and cannot reuse one key in both directions. Protocol identifiers and wire framing change, so mixed old/new endpoints are not compatible.
Migration required
Upgrade both TTunnelLocal peers together. Grep for tlmVersion1 and replace intentional legacy references with tlmVersion1_aesctr; use tlmVersion2 for the authenticated protocol.
Public API
TTunnelLocalMagic.tlmVersion1renamed — The legacy AES-CTR value is now named tlmVersion1_aesctr.TTunnelLocalMagic.tlmVersion2added — Identifies the authenticated AES-GCM tunnel protocol.
2
High
Tunnel authentication failures erase plaintext and handshake secrets
TTunnelLocal clears decrypted output when GCM tag verification fails, adds a Handshake domain label to SHAKE-128 signatures, bounds-checks metadata length before pointer access and zeros receive/send keys after OpenInternal. Encryption preserves its allocated result if finalization raises.
Security
mormot.net.tunnel
beeed494+14-8
net: enhanced TTunnelLocal security
Impact
Rejected encrypted frames no longer leave unauthenticated plaintext in memory, and handshake signatures are separated from other SHAKE-128 uses. These are direct hardening follow-ups to the new protocol.
Upgrade recommended
Use this hardening commit or later and verify that a modified GCM tag terminates the tunnel without exposing plaintext.
Units
3
High
Tunnel metadata is size-checked before parsing and then erased
TTunnelLocal.OpenInternal checks that the remote frame still contains SizeOf(loc) bytes before extracting JSON metadata. After InitJsonInPlace consumes the buffer, FillZero(info) erases the decrypted metadata copy.
Security
mormot.net.tunnel
c08ef0d6+6-7
net: minor TTunnelLocal handshake refactoring
Impact
Malformed handshakes fail before metadata parsing, and sensitive tunnel information spends less time in process memory. No application API changes.
Upgrade recommended
Take this follow-up with the tunnel protocol rewrite and test rejection of truncated metadata frames.
Units
4
High
Tunnel handshake metadata cannot underflow its frame pointer
TTunnelLocal.OpenInternal subtracts the advertised JSON metadata length from the remaining frame length, rejects negative results and only then builds the RawByteString view. The previous code formed the pointer before validating the subtraction.
Security
mormot.net.tunnel
c7e0e055+6-4
net: hardened TTunnel handshake
Impact
A malformed remote handshake can no longer make metadata parsing address bytes before the received frame. Tunnel peers fail with ETunnel instead.
Upgrade recommended
Upgrade both tunnel peers and include undersized and oversized JSON metadata lengths in handshake tests.
Units
5
High
OpenSSL GCM preserves its IV while processing associated data
TAesOsl.UpdEvp gains an optional KeepIV argument. TAesGcmOsl passes it for payload and AAD updates so EVP_CIPHER_CTX_iv is not copied back into Owner.IV during a GCM round, and zero-length AAD calls are skipped.
Fixes
mormot.crypt.openssl
c9ed0cb9+14-19
crypt: fixed TAesGcmOsl with AEAD associated information
Impact
TAesGcmOsl can now authenticate associated information correctly instead of corrupting its IV state. OpenSSL-backed AEAD output should match the framework's pure implementation for the same vectors.
Upgrade recommended
Upgrade any TAesGcmOsl use with AesGcmAad and rerun known-answer tests for ciphertext and tags.
Public API
TAesOsl.UpdEvpsignature-changed — Adds the optional KeepIV boolean parameter with a false default.
Units
6
High
Binary-cookie destruction releases managed context state
TBinaryCookieGenerator.Destroy replaces FillCharFast on fContext with FillZeroRtti(TypeInfo(TBinaryCookieContext), fContext). The regression test invalidates a generated cookie, validates the empty state and then destroys the generator.
Fixes
mormot.crypt.secure
69b16d3f+13-3
crypt: fixed #650 binary cookie generator memory leak
Impact
Managed fields inside TBinaryCookieContext are finalized before the anti-forensic zeroing, preventing memory retained when a generator is destroyed after cookie invalidation.
Upgrade recommended
Upgrade services that create and discard TBinaryCookieGenerator instances, especially after one-time cookie invalidation.
Units
7
Medium
Spaced __Secure- cookies are parsed under their logical name
THttpCookies.ParseServer and CookieFromHeaders call GotoNextNotSpace before checking the __Secure- prefix for each cookie pair. Tests cover a prefixed cookie following another value after a semicolon and space.
Fixes
mormot.core.text
95a8e9d0+8-2
net: fixed #649 cookie parsing
Impact
Cookie headers using the normal semicolon-space separator now expose __Secure- values under the expected unprefixed name instead of missing them.
Upgrade recommended
Upgrade HTTP code that reads __Secure- cookies from multi-cookie headers and rerun cookie lookup tests.
Units
8
Medium
AES-GCM gains a public 96-bit nonce increment helper
mormot.crypt.core adds GCM_IncIV, which increments bytes 0 through 11 of TAesBlock in big-endian order while leaving the 32-bit counter suffix untouched. GMAC_SIZE is expressed as SizeOf(THash128), and AES-GCM documentation clarifies buffer layout choices.
New features
mormot.crypt.core
54b070e6+24-3
crypt: new GCM_IncIV() wrapper function
Impact
Cryptographic callers can advance the 96-bit GCM nonce without modifying the block counter. Existing APIs and ciphertext formats are unchanged unless the new helper is adopted.
Public API
GCM_IncIVadded — Increments the 96-bit AES-GCM nonce portion of a TAesBlock.
Units
9
Medium
Delphi 2010 avoids unsafe inline expansion in core paths
HASSAFEINLINE now starts at Delphi XE rather than Delphi 2010. Several string, lock, HTTP and ORM methods use HASSAFEINLINE so Delphi 2010 compiles them out of line while newer Delphi and FPC keep their existing inline paths.
Compiler & platform
mormot.core.base+4
86119552+15-16
core: circumvent Delphi 2010 inlining bug
Impact
Delphi 2010 builds avoid a compiler inlining defect in frequently used routines. Other supported compilers retain the same behavior and APIs.
Upgrade recommended
Rebuild Delphi 2010 targets and exercise string conversion, locking, HTTP compression and ORM JSON paths.
10
Low
String-header access is simplified without changing behavior
mormot.core.base consistently names PStrRec variables sr and uses pointer decrement to reach string headers in EnsureRawUtf8 and FakeCodePage. TLdapClientSettings.SetTargetUri drops address normalization already handled by URI parsing.
Under the hood
mormot.core.base+1
b59d0bf0+51-46
core: some refactoring with no functional change
Impact
No intended application-code or runtime behavior changes. This is internal cleanup of string allocation and LDAP target parsing.