Add in -n option to support making require_peer_cert configurable, by default
it is enabled unless -n is set.
examples/coap-server.c:
Code changes.
man/coap-server.txt.in
Update documentation
include/coap2/libcoap.h
_LIBCOAP_H_ to COAP_LIBCOAP_H_
src/coap_session.c
_COAP_SESSION_H_ to COAP_SESSION_C_
include/coap2/coap_session.h
_SESSION_H_ to COAP_SESSION_H_
otherwise, all #define _COAP_xxxxx wrappers are now COAP_xxxxx
Fixes#291
When a new resource is created with PUT, the given Content-Format is
stored as parameter ct with the resource description.
This change is based on a fix provided by Peter van der Stok.
As discussed in issue #286 [1], the mandatory-to-implement
cipher suites TLS_PSK_WITH_AES_128_CCM_8 and TLS_ECDHE_ECDSA_AES_128_CCM_8
should be enabled if possible.
[1] https://github.com/obgm/libcoap/issues/286
Signed-off-by: Olaf Bergmann <bergmann@tzi.org>
As str structure has been replaced by coap_string_t, remove it from the code
as it is no longer required, has been deprecated for some time and can cause
clashes with other str definitions.
Tidy up comment referring to str.
The CLI option '-o file' redirects the received payload into the
given file, where '-' denotes stdout. As the function close_output()
used to append a newline to the end of the output, certain tools
such as cbor2pretty.rb have failed, complaining about the trailing
character.
This change now writes the newline if only if option '-o' was not
specified.
For any TLS implementation, it is possible to crash the coap-server by
initiating (D)TLS handshakes but never completing them, thus continuing to use
more RAM. Each partially completed handshake is left in the endpoint->sessions
chain in a state of COAP_SESSION_STATE_HANDSHAKE and unless
endpoint->max_idle_sessions is deliberately configured, these sessions will
never get deleted.
A cause of partially completed handshakes is when there is a PSK mismatch.
Furthermore, unnecessary CPU usage is used to search down long lists held in
endpoint->sessions.
This fix limits the number of these sessions in a handshake state to the
number defined by endpoint->max_handshake_sessions if non zero or 100 to prevent
memory exhaustion. By default, endpoint->max_handshake_sessions is 0.
Sessions in state COAP_SESSION_STATE_HANDSHAKE will get timed out after 30
seconds of inactivity.
This does not prevent a DOS attack by creating max_handshake_sessions as a
genuine new session will fail to get responded to until the number of current
COAP_SESSION_STATE_HANDSHAKE sessions drop. However, the use of Cookie
exchanges by the underlying TLS library prior to a new session being created
and added into endpoint->sessions will filter out a lot of the DOS attacks.
include/coap2/coap_session.h
New default definition for COAP_DEFAULT_MAX_HANDSHAKE_SESSIONS
New default definition for COAP_PARTIAL_SESSION_TIMEOUT_TICKS
include/coap2/net.h
Include max_handshake_sessions in coap_context_t
src/coap_session.c
In coap_endpoint_get_session() check the number of sessions in
COAP_SESSION_STATE_HANDSHAKE and handle accordingly when limits are hit, or
they need to be timed out.
Information set up in the pseudo session held in endpoint->hello is not freed
off when coap_free_endpoint() is called.
A solution is to split coap_session_free() into two parts with
coap_session_free() calling a new function coap_session_mfree().
Then coap_mfree_endpoint() can call coap_session_mfree() to free off the
endpoint specific hello information.
Makefile.am
Add coap_mfree_endpoint and coap_session_mfree to the CTAGS_IGNORE list.
libcoap-2.{map|sym}
Remove coap_mfree_endpoint as it is not a public function
include/coap2/coap_session.h
Add in new coap_session_mfree() function definition
src/coap_io.c
Call coap_session_mfree() from within coap_mfree_endpoint()
src/coap_session.c
Move some of the functionality out of coap_session_free() into a new
function coap_session_mfree() and call coap_session_mfree().
src/coap_gnutls.c:
The GnuTLS server session information held in endpoint->hello was getting
polluted when a bad PSK was being used, and so a new session attempt with a
good PSK would fail. The only way to get around this was to restart the
coap-server.
OpenSSL handles this by initiating the handshake response (DTLSv1_listen()),
creating a new coap session and then using the new session to continue with
the SSL handshake (SSL_accept()) until the SSL session is set up.
For GnuTLS, there is no initial handshake initiation as everything is done
inside gnutls_handshake(). To get around this, in the post_client_hello
function a flag is set in g_env->seen_client_hello so that coap_dtls_hello()
knows that that a SSL session is being set up, but not yet complete.
This flag is cleared when coap_dtls_hello() returns 1 indicating that the
interim client_hello has been seen and it is safe to duplicate the session.
The do_gnutls_handshake() function has been cleaned up.
The coap_dtls_send() function has been updated to send any outstanding data
if the SSL session has just completed.
Re-organize usage() and man pages to seperate out the PSK and PKI options
for clarity - as they may not be available for all TLS library versions
examples/client.c
examples/coap-server.c
man/coap-client.txt.in
man/coap-server.txt.in
src/coap_io.c:
ifdef out IPv4 struct in_pktinfo code that does not compile, copying what
has been done later in the same coap_network_send() function.
tests/test_session.c
Correctly reverse the parameters to coap_new_client_session() in t_session6()
so that the test application does not bind to local-address, port 5683 twice.
[It seems that other distrubutions are happy with this when just SO_REUSEADDR
is used on the socket, but FreeBSD needs SO_REUSEPORT enabled as well.]
BUILDING
Record that gmake is required to build TinyDTLS for FreeBSD, not make.
Update all the coap_ calls to use the new API, and the updated structures.
Introduce using session instead of context.
Correct all the compiler warnings.
Update all the coap_ calls to use the new API, and the updated structures.
Introduce using session instead of context.
Correct all the compiler warnings.
Keep the payload in the resource rather than separately.
The authors file now lists the names of authors that have siginificantly
contributed to the current code base. A link to the GH contributors'
page is included as a reference to authors with fewer or minor
contributions.
Thus it must not be postfixed with a colon character in the optstring.
While at it move the option to the beginning of the opstring to the
other options which don't expect an argument.
Without this commit the -U option is unusable.
Carsten Schoenert