test

libnetplus (20260629+24) unstable; urgency=medium

  * tls: extend TLS 1.2 ECDHE support with ECDHE_RSA suites

    (0xC02F/0xC030) alongside ECDHE_ECDSA, and add AES-256-GCM variants

    (0xC02C/0xC030) — server picks ECDHE_ECDSA when the loaded cert

    bundle has an EC key, ECDHE_RSA (falling back to static RSA) when

    it has an RSA key; key-block derivation now sizes client/server

    write keys per chosen suite (16 or 32 bytes) for both CBC and GCM

  * tls: add TLS 1.2 client-side ECDHE_ECDSA handshake path — client

    detects an EC server certificate via x509::isECKey(), waits for

    ServerKeyExchange, generates an ephemeral P-256 key pair, computes

    the ECDH shared secret and sends the client EC point in

    ClientKeyExchange instead of RSA-encrypted PreMasterSecret

  * x509: add isECKey()/extractECPublicKey() to detect the

    ecPublicKey OID (1.2.840.10045.2.1) and pull the raw EC point out

    of SubjectPublicKeyInfo

  * tls: implement RFC 7627 Extended Master Secret — negotiate the

    extended_master_secret extension on both ClientHello/ServerHello

    and derive master_secret from PRF(PMS, "extended master secret",

    session_hash) instead of client/server random when both sides

    support it; add handshake_transcript tracking for ServerHello,

    Certificate, ServerKeyExchange and ServerHelloDone needed for the

    session hash

  * tls: fix ServerHello parser rejecting legacy TLS 1.2 servers that

    omit the extensions block entirely — length check required the

    2-byte extensions length field unconditionally and the SID-overflow

    check didn't account for the trailing cipher_suite+compression

    bytes, causing valid short ServerHellos to be misparsed or rejected

  * tls: fix client-side GCM cipher suites failing handshake because

    the "MAC key missing for TLS 1.2" check ran unconditionally even

    though GCM suites carry no separate MAC key

  * tls: fix recvData() deadlock when a prior non-blocking sendData()

    left TLS records queued — flush pending output before reading so

    the peer actually receives what was queued instead of both sides

    waiting on each other

  * ssl: add 15s deadline to the blocking ssl::connect() handshake

    drive loop to avoid hanging indefinitely on an unresponsive peer,

    and fix the added wait loop busy-spinning handshake_after_connect()

    on NetException::Note by waiting on socket readability

    (socketwait::waitRead, 100ms) instead of retrying immediately

  * windows/tcp: fix blocking tcp::connect() relying on WSAConnect()

    blocking indefinitely — switch to non-blocking connect + select()

    with a 10s timeout, checking SO_ERROR for real connect failure

  * windows/socket: fix setTimeout() misinterpreting its argument as

    microseconds and dividing by 1000 — all four event backends

    (epoll/iocp/kqueue/poll) already pass a millisecond timeout

    directly, so on Windows small timeouts (e.g. 500ms) were truncated

    to 0

  * event: add event::requestStop() across all backends (epoll, iocp,

    kqueue, poll) for thread-safe, immediate event-loop shutdown —

    epoll/kqueue register a wakeup eventfd/pipe that a SIGINT handler

    or requestStop() writes to, unblocking epoll_wait()/kevent()

    immediately instead of waiting for the poll timeout; iocp posts a

    zero-length completion per worker via PostQueuedCompletionStatus

  * iocp: fix accepted sockets not entering non-blocking mode and

    missing TCP keep-alive (SIO_KEEPALIVE_VALS, 60s idle/10s interval);

    fix failed IOCP completions (ok==false) falling through unhandled

    instead of clearing pending-I/O flags and cleaning up the

    connection

  * iocp: fix TLS handshake flights getting stuck under IOCP — flush

    queued records before and after each handshake_after_accept() step

    and correctly re-arm WritePending instead of silently dropping

    still-queued data when a write is already in flight

  * iocp: replace O(n) erase()-per-chunk send buffer compaction with

    position-based tracking to avoid repeated large memmoves on big

    responses; convert conMutex to std::shared_mutex so connection

    lookups no longer serialize against each other; fix EWOULDBLOCK on

    send silently dropping buffered data — now posts a completion to

    retry the send later

  * posix/tcp, posix/udp: disable IPV6_V6ONLY on IPv6 listening

    sockets so binding to "::" also serves IPv4-mapped clients

    (dual-stack), regardless of the system's bindv6only sysctl default

  * rsa: rewrite modInverse() from binary Extended Euclidean (unsigned,

    parity-based) to signed Extended Euclidean algorithm; rsa now

    stores p/q and exposes getP()/getQ() so certgen can compute real

    CRT parameters (exponent1/exponent2/coefficient) instead of writing

    zero placeholders into the PKCS#1 RSAPrivateKey DER

  * exception: make NetException derive from std::exception and

    implement what() as const char* noexcept override, so generic

    catch (std::exception&) handlers (e.g. epoll's connection-error

    logging) now also catch NetException instead of only catch (...)

 -- Jan Koester <jan.koester@tuxist.de>  Sun, 28 Jun 2026 12:00:00 +0200

libnetplus (20260528+23) unstable; urgency=medium

  * ecc: fix mod_n256 infinite loop in ECDSA signing — replace O(2^32)