As str structure has been replaced by coap_string_t, remove it from the code
as it is no longer required, has been deprecated for some time and can cause
clashes with other str definitions.
Tidy up comment referring to str.
The CLI option '-o file' redirects the received payload into the
given file, where '-' denotes stdout. As the function close_output()
used to append a newline to the end of the output, certain tools
such as cbor2pretty.rb have failed, complaining about the trailing
character.
This change now writes the newline if only if option '-o' was not
specified.
For any TLS implementation, it is possible to crash the coap-server by
initiating (D)TLS handshakes but never completing them, thus continuing to use
more RAM. Each partially completed handshake is left in the endpoint->sessions
chain in a state of COAP_SESSION_STATE_HANDSHAKE and unless
endpoint->max_idle_sessions is deliberately configured, these sessions will
never get deleted.
A cause of partially completed handshakes is when there is a PSK mismatch.
Furthermore, unnecessary CPU usage is used to search down long lists held in
endpoint->sessions.
This fix limits the number of these sessions in a handshake state to the
number defined by endpoint->max_handshake_sessions if non zero or 100 to prevent
memory exhaustion. By default, endpoint->max_handshake_sessions is 0.
Sessions in state COAP_SESSION_STATE_HANDSHAKE will get timed out after 30
seconds of inactivity.
This does not prevent a DOS attack by creating max_handshake_sessions as a
genuine new session will fail to get responded to until the number of current
COAP_SESSION_STATE_HANDSHAKE sessions drop. However, the use of Cookie
exchanges by the underlying TLS library prior to a new session being created
and added into endpoint->sessions will filter out a lot of the DOS attacks.
include/coap2/coap_session.h
New default definition for COAP_DEFAULT_MAX_HANDSHAKE_SESSIONS
New default definition for COAP_PARTIAL_SESSION_TIMEOUT_TICKS
include/coap2/net.h
Include max_handshake_sessions in coap_context_t
src/coap_session.c
In coap_endpoint_get_session() check the number of sessions in
COAP_SESSION_STATE_HANDSHAKE and handle accordingly when limits are hit, or
they need to be timed out.
Information set up in the pseudo session held in endpoint->hello is not freed
off when coap_free_endpoint() is called.
A solution is to split coap_session_free() into two parts with
coap_session_free() calling a new function coap_session_mfree().
Then coap_mfree_endpoint() can call coap_session_mfree() to free off the
endpoint specific hello information.
Makefile.am
Add coap_mfree_endpoint and coap_session_mfree to the CTAGS_IGNORE list.
libcoap-2.{map|sym}
Remove coap_mfree_endpoint as it is not a public function
include/coap2/coap_session.h
Add in new coap_session_mfree() function definition
src/coap_io.c
Call coap_session_mfree() from within coap_mfree_endpoint()
src/coap_session.c
Move some of the functionality out of coap_session_free() into a new
function coap_session_mfree() and call coap_session_mfree().
src/coap_gnutls.c:
The GnuTLS server session information held in endpoint->hello was getting
polluted when a bad PSK was being used, and so a new session attempt with a
good PSK would fail. The only way to get around this was to restart the
coap-server.
OpenSSL handles this by initiating the handshake response (DTLSv1_listen()),
creating a new coap session and then using the new session to continue with
the SSL handshake (SSL_accept()) until the SSL session is set up.
For GnuTLS, there is no initial handshake initiation as everything is done
inside gnutls_handshake(). To get around this, in the post_client_hello
function a flag is set in g_env->seen_client_hello so that coap_dtls_hello()
knows that that a SSL session is being set up, but not yet complete.
This flag is cleared when coap_dtls_hello() returns 1 indicating that the
interim client_hello has been seen and it is safe to duplicate the session.
The do_gnutls_handshake() function has been cleaned up.
The coap_dtls_send() function has been updated to send any outstanding data
if the SSL session has just completed.
Re-organize usage() and man pages to seperate out the PSK and PKI options
for clarity - as they may not be available for all TLS library versions
examples/client.c
examples/coap-server.c
man/coap-client.txt.in
man/coap-server.txt.in
src/coap_io.c:
ifdef out IPv4 struct in_pktinfo code that does not compile, copying what
has been done later in the same coap_network_send() function.
tests/test_session.c
Correctly reverse the parameters to coap_new_client_session() in t_session6()
so that the test application does not bind to local-address, port 5683 twice.
[It seems that other distrubutions are happy with this when just SO_REUSEADDR
is used on the socket, but FreeBSD needs SO_REUSEPORT enabled as well.]
BUILDING
Record that gmake is required to build TinyDTLS for FreeBSD, not make.
Update all the coap_ calls to use the new API, and the updated structures.
Introduce using session instead of context.
Correct all the compiler warnings.
Update all the coap_ calls to use the new API, and the updated structures.
Introduce using session instead of context.
Correct all the compiler warnings.
Keep the payload in the resource rather than separately.
The authors file now lists the names of authors that have siginificantly
contributed to the current code base. A link to the GH contributors'
page is included as a reference to authors with fewer or minor
contributions.
Thus it must not be postfixed with a colon character in the optstring.
While at it move the option to the beginning of the opstring to the
other options which don't expect an argument.
Without this commit the -U option is unusable.
The install target of cn-cbor's Makefile fails when the documentation
files have not been generated. To fix this, the doc target is
explicitly invoked before install.
examples/coap-server.c:
examples/etsi_iot_01.c:
Replace signal() with sigaction() for handling SIGINT or SIGTERM
examples/client.c:
Include sigaction() for catching SIGINT or SIGTERM for a clean shutdown.
undef PACKAGE_* so that TinyDTLS versions are used instead
include dtls_debug.h to get in the correct function definitions instead of
hardcoding some of them.
Create a read-write version of some of the const parameters passed in to
the interim functions before calling the underlying TinyDTLS functions.
.travis.yml
Add in the gnutls build.
build-env/Dockerfile.build-env
build-env/Dockerfile.develop
Add in libgnutls28-dev to the apt-get list.
scripts/build.sh
scripts/dist.sh
Support TLS set to gnutls for building.
man/coap-client.txt.in
man/coap-rd.txt.in
man/coap-server.txt.in
Document usage over -v7 for extra GnuTLS library output.
man/coap_attribute.txt.in
man/coap_context.txt.in
man/coap_encryption.txt.in
man/coap_handler.txt.in
man/coap_logging.txt.in
man/coap_observe.txt.in
man/coap_pdu_setup.txt.in
man/coap_recovery.txt.in
man/coap_resource.txt.in
man/coap_session.txt.in
man/coap_tls_library.txt.in
Include new -lcoap-@LIBCOAP_API_VERSION@-gnutls option.
Remove trailing spaces at end of line
man/coap_encryption.txt.in
Update with GnuTLS information
man/coap_logging.txt.in
Update with more information about logging levels.
man/coap_tls_library.txt.in
Include new functions coap_show_tls_version() and coap_string_tls_version()
HAVE_GNUTLS -> HAVE_LIBGNUTLS
Correct TinyDTLS version checks as TinyDTLS is now returning the
actual TinyDTLS library version.
For TinyDTLS builds, #undef PACKAGE_* to remove compiler warnings.
These new functions can be used to either update a buffer with, or coap_log()
out the current runtime TLS library along with the version of the library
that libcoap was built against.
include/coap2/debug.h
src/debug.c
libcoap-2.map
libcoap-2.sym
Support for the new functions coap_show_tls_version() and coap_string_tls_version().
This allows an application to determine what the built version is
as well as what the runtime version of a TLS library is.
include/coap2/coap_dtls.h
Add built_version to coap_tls_version_t
src/coap_openssl.c
src/coap_tinydtls.c
Additionally populate coap_tls_version_t with build_version when
coap_get_tls_library_version() is called.
src/coap_tinydtls.c
Correct the version returned as actual TinyDTLS version instead the
binary value of a DTLS packet type.
Jon Shallow