rtty Files

Bug Fixes

• Keep heartbeats and HTTP timeouts reliable after clock changes

• Use monotonic timing so system clock adjustments, such as NTP synchronization, do not delay heartbeats, dead connection detection, or cleanup of idle HTTP proxy connections.

• Validate remote command messages

• Check string boundaries, token length, and parameter counts before executing commands. Reject malformed messages to prevent out-of-bounds reads and buffer overflows.

• Handle malformed registration responses safely

• Reject empty responses and limit registration error messages to the available buffer size, preventing stack buffer overflows.

• Fix command timeout cleanup

• Log the command before freeing its task, avoiding a use-after-free when a remote command times out.

• Avoid unaligned memory access in protocol messages

• Write registration and heartbeat message lengths safely on CPUs that do not support unaligned memory access.

• Fix empty HTTP proxy notifications

• Avoid passing a null pointer to a memory copy when reporting a closed connection with no payload.

• Respect custom OpenSSL installations

• Use the include and library paths discovered by pkg-config, preventing builds from accidentally using the system OpenSSL instead.

Improvements

• Update TLS library compatibility

• Support OpenSSL 4.x and Mbed TLS 4.x, while retaining Mbed TLS 2.x and 3.x compatibility. Handle Mbed TLS TLS 1.3 session ticket notifications without treating them as connection failures.

• Expand automated build coverage

• Restore builds for pull requests and add dedicated OpenSSL 4.x and Mbed TLS 4.x jobs that verify linkage to the intended libraries.

Full Changelog: https://github.com/zhaojh329/rtty/compare/v9.2.0...v9.2.1

问题修复

• 修复系统时间调整后的心跳和 HTTP 超时处理

• 使用单调计时，避免 NTP 校时等系统时间调整导致心跳发送、失效连接检测或 HTTP 代理空闲连接清理被延迟。

• 完善远程命令消息校验

• 在执行命令前检查字符串边界、令牌长度和参数数量，拒绝格式错误的消息，防止越界读取和缓冲区溢出。

• 安全处理异常注册响应

• 拒绝空响应，并将注册错误信息限制在缓冲区容量内，防止栈缓冲区溢出。

• 修复命令超时清理问题

• 在释放任务前记录命令日志，避免远程命令超时时访问已释放的内存。

• 避免协议消息中的未对齐内存访问

• 安全写入注册和心跳消息的长度字段，避免在不支持未对齐内存访问的 CPU 上发生故障。

• 修复 HTTP 代理空消息通知处理

• 发送不含数据的连接关闭通知时，不再将空指针传给内存复制操作。

• 正确使用自定义路径的 OpenSSL

• 使用 pkg-config 检测到的头文件和库路径，避免构建时意外使用系统自带的 OpenSSL。

改进优化

• 更新 TLS 库兼容性

• 支持 OpenSSL 4.x 和 Mbed TLS 4.x，同时保留对 Mbed TLS 2.x 和 3.x 的兼容。正确处理 Mbed TLS 的 TLS 1.3 会话票据通知，避免将其误判为连接失败。

• 扩展自动化构建覆盖

• 恢复拉取请求的自动构建，并新增 OpenSSL 4.x 和 Mbed TLS 4.x 专用构建任务，检查是否链接到预期的库。

完整变更记录: https://github.com/zhaojh329/rtty/compare/v9.2.0...v9.2.1