Commit Graph
3235 Commits
Author SHA1 Message Date
Jon Shallow 21b7a9a0eb Debugging: Add coap_debug_set_packet_fail() for testing network failures
This is similar to coap_debug_set_packet_loss() which drops packets that are
to be sent, but emulates network reported errors by reporting ECONNREFUSED.
2026-03-20 09:13:41 +00:00
Jon Shallow c0ee83bcfb Sanitizer: Add in build environment support
configure --enable-sanitizer
cmake -DENABLE_SANITIZER=ON
2026-03-20 08:24:43 +00:00
Florek, Bartlomiej 44e5c68c51 fix: OSCORE ACK retransmission handling 2026-03-19 15:13:32 +00:00
Lucien Zuercher 5b5b6972ec fix: do not override sequence counter after window processing 2026-03-19 14:48:16 +00:00
Jon Shallow 66f465a022 coap_tinydtls.c: Correctly initialize address in get_session_addr() 2026-03-19 11:05:22 +00:00
Jon Shallow 7c6912a68b coap_block.c: Fix mcast slave token generation 2026-03-19 09:30:58 +00:00
Arthur Chan 766711f62c OSS-Fuzz: Revamp block_fuzzer and add corpus seed
Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
2026-03-18 10:05:42 +00:00
Jon Shallow c1b1ffa27d oss-fuzz: Fix complaint about memcpy() 2026-03-16 14:49:56 +00:00
Jon Shallow ef97823845 main.yml: Use actions/checkout@v6
Fixes future Node.js 20 deprecation for github workflows.

There are still some other actions that continue to use Node.js 20 which will
need to be updated when they have also been ugraded to stop CI Action run warnings.
2026-03-16 14:49:02 +00:00
Arthur Chan f39d2152b3 OSS-Fuzz: Add observe fuzzer
Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
2026-03-16 12:40:27 +00:00
Jon Shallow 513685b580 SECURITY.md: Update the Security Policy 2026-03-13 16:05:25 +00:00
Florek, Bartlomiej d15d25f1ab impr(security): tracking CVE using CPE 2026-03-13 14:36:24 +00:00
Arthur Chan cc8de29bd4 OSS-Fuzz: Add more targets to network fuzzer
Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
2026-03-13 13:53:45 +00:00
Jon Shallow 9fc4d35cb2 coap_resource.c: Fix reference to deleted Observe after transmit failure 2026-03-13 13:52:22 +00:00
Jon Shallow 27f8e127ed coap_debug.c: Fix coap_debug_set_packet_loss("100%") 2026-03-13 13:49:21 +00:00
Lucien Zuercher e774e2e7ee fix: memory leak if client receives ACK response via OSCORE 2026-03-10 14:29:36 +00:00
Jon Shallow 40502ffebb oss-fuzz: Fix undefined-behavior
Analyzer run time does not like A -= B or A +=B even if A and B are uint32_t as there is potential
for overflow.

Analyzer run time does not like overflow when doing coap_tick_t - coap_tick_t.

Analyzer run time does not like (uint8_t << 24) as uint8_t is promoted as int, not u_int.

Analyzer run time does not like while(A--) {} even if A is uint32_t, as A is always decremented on
the test, even if the value of A is 0.

Fix potential overflow when analyzing an asn.1 tag.

Fix potential overflow when doing decode_segment() on a % hex value.
2026-03-10 11:09:10 +00:00
Jon Shallow fe41b51aab OSS-FUZZ: Fix build issue 2026-03-04 17:31:05 +00:00
Arthur Chan 099d9842da OSS-Fuzz: Simplify block_fuzzer
Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
2026-03-04 16:38:54 +00:00
Jon Shallow af72924dcc coap_openssl.c: Tidy up old versions builds (< 1.1.1)
Fix formatting
2026-03-04 16:33:39 +00:00
Jon Shallow 30875ab127 OSS-FUZZ: Fix discovered issues 2026-03-04 16:18:15 +00:00
Arthur Chan bb639096ab OSS-Fuzz: Fix Makefile for fuzzer to include CFLAGS from OSS-Fuzz
Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
2026-03-04 11:05:56 +00:00
Arthur Chan ea9d1cb803 OSS-Fuzz: Fix bias condition
Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
2026-03-04 11:05:33 +00:00
Jon Shallow 210cbf378a ASN1: Check for buffer overflows when determining tags and length
Include oss-fuzzer checks.
2026-03-03 10:36:46 +00:00
Arthur Chan e57294c7e6 OSS-Fuzz: Add fuzzer for coap-net targets
Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
2026-03-03 10:36:16 +00:00
Florek, Bartlomiej a4d7c29313 fix(config): enhance Zephyr configuration for libcoap 2026-03-03 10:35:36 +00:00
Carl Elgstrom e24ce7a6b3 coap_mem: fix -Werror=return-type in coap_malloc() lwIP stub 2026-02-27 16:32:56 +00:00
Arthur Chan 6fd1fbf702 OSS-Fuzz: Add new fuzzer for coap block processing
Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
2026-02-23 09:28:27 +00:00
Jon Shallow 55eba9193a oscore.c: Boundary check oscore_generate_nonce() parameters
Follows https://datatracker.ietf.org/doc/html/rfc8613#section-5.2 and Figure 8.
2026-02-23 09:15:41 +00:00
Jon Shallow 9d5d063331 RIOT: Fix building against the latest RIOT code 2026-02-21 10:56:44 +00:00
Jon Shallow 83ceb9687c coap_openssl.c: Support setting of PSK security level at compile time
Include
 -DCOAP_OPENSSL_PSK_SECURITY_LEVEL=0
as a compile time option to give a security level of 0 for PSK clients,
allowing them to connect to old servers that have not been TLS updated..

Vslues ore 0-5.  The default (usually) is 1.

The function SSL_set_security_level() is called
with the defined level of COAP_OPENSSL_PSK_SECURITY_LEVEL.

Note: Setting this to 0 adds weak ciphers to the list of supported ciphers,
opening up potential security vulnerabilities.
2026-02-18 20:54:04 +00:00
Magdalena Szumny e80fe9edd2 API for checking session encryption 2026-02-17 09:57:28 +00:00
Jon Shallow 146e0bbe77 coap_pdu_options: Split out PDU options into coap_pdu_options(3)
Split out coap_pdu_setup(3) into coap_cpu_setup(3) and coap_pdu_options(3)
for ease of finding information.
2026-02-16 13:07:24 +00:00
Magdalena Szumny e92618ebd6 Fix conflict with Zephyr's hex2char 2026-02-16 11:01:01 +00:00
Magdalena Szumny f79eaba9b9 Add sorting of optlist 2026-02-16 10:34:48 +00:00
Arthur Chan d2b61c2e49 OSS-Fuzz: Add oscore conf parse fuzzer 2026-02-16 09:44:20 +00:00
Arthur Chan 0bcd5923e7 OSS-Fuzz: Add new fuzzer for oscore pdu decryption
Signed-off-by: Arthur Chan <arthur.chan@adalogics.com>
2026-02-12 16:14:19 +00:00
Jon Shallow 7be251532c Critical Options: Respond with 4.02, not RST for NON PDUs
Fixes ambiguity in RFC7252.

See https://datatracker.ietf.org/doc/html/draft-ietf-core-corr-clar#section-2.2
2026-02-02 10:32:18 +00:00
Jon Shallow 40aa07a177 oss-fuzz: Remove the need for declaring internal functions 2026-02-02 10:21:41 +00:00
Jon Shallow 152f6a8a58 Includes: Remove unnecessary include files
Include common system header files in coap_internal.h based on HAVE_*H
definitions.

Remove these system header files from include/*/*.h.

Add in system header files where appropriate in various apps.
2026-02-02 10:09:17 +00:00
Jon Shallow c9a4b716c4 binary/strings: Check for size overflows when allocating
Includes a check in coap_block_build_body().
2026-02-02 09:52:55 +00:00
Marco Casaroli a90916a4fe zephyr: mbedlts improvements
Add some improvements to make secure coap work on Zephyr 4.3.0
with mbedtls (not using Zephyr TLS protocol options).

We now set the build options to zephyr, so we make use of the
internal mbedtl in zephyr, so we do not require a specific header
file anymore.

In older versions of Zephyr, where mbedtls does not expose the
configuration, we can force-set the macro in the C flags, so that
mbedtls will have our required function.

This way, we do not need to change the mbedtls included in Zephyr,
while still supporting a few older versions.
2026-01-30 16:18:34 +00:00
Jon Shallow b7e538c4f3 Zephyr: Default to zephyr v4.3.0 for builds
Update to next version when the main branch becomes stable and a new release is out..
2026-01-30 10:08:57 +00:00
Jon Shallow 07c7a7aa57 body_size: Support configuration of max supported body size for RFC7959
Function coap_context_set_max_body_size() added.

For servers, if body size is too large, a 4.13 response is generated.

For clients, if the body size is too large, the server gets a RST and
no date is passed to the application.  A new event COAP_EVENT_BLOCK_ISSUE
is generated.
2026-01-29 09:53:52 +00:00
Jon Shallow 6c0be0c898 coap_oscore.c: Add in missing non-OSCORE stub functions 2026-01-28 10:28:47 +00:00
Jon Shallow 9b408902ba coap_oscore.c: Fix coap_parse_oscore_conf_mem() memory leak 2026-01-27 11:17:34 +00:00
Jon Shallow afba4f78e3 Zephyr: Fix build to handle latest Zephyr updates 2026-01-27 11:06:23 +00:00
Jon Shallow 167fc9b870 coap_openssl.c: Check returns from *_new() functions 2026-01-27 09:30:18 +00:00
Jon Shallow d16ffb270f configure.ac: Abstract WARNINGs from config.log for summary report
Aids troubleshooting.
2026-01-26 10:34:47 +00:00
Jon Shallow 2ddf01b446 configure.ac: Fix -Wlogical-op test for cifuzz
Report on ./configure warnings in ./get_config.sh
2026-01-24 16:16:21 +00:00