d33b7fa571 adds a call to setup_cpsk(),
which is only defined with COAP_PROXY_SUPPORT defined. This commit
enables said function if COAP_CLIENT_SUPPORT is enabled as well.
Don't report
WARN coap_socket_accept_tcp: accept: Resource temporarily unavailable
when multiple threads are trying to process the same incoming TCP connection.
When a FETCH request is OSCORE-protected the Content-Format option is
an inner (encrypted) option per RFC 8613 §4.1.3.1 and is legitimately
absent from the outer CoAP message. The existing RFC 8132 §2.3.1
check unconditionally rejects such requests with 4.15 (Unsupported
Content-Format) even when COAP_OSCORE_SUPPORT is disabled and the
application uses its own OSCORE stack.
Only enforce the Content-Format presence rule when no OSCORE option
is present in the outer request.
Fixes: https://github.com/obgm/libcoap/issues/1936
coap_new_cache_entry() does not correctly check for no PDU data when called
with COAP_CACHE_RECORD_PDU. No current libcoap code (examples and library)
call coap_new_cache_entry() with COAP_CACHE_RECORD_PDU set.
Internal function coap_pdu_resize() can be used to reduce a PDU size,
creating current options confusion. Fix is not to reduce PDU if new
size is smaller than the current used size. No current libcoap code calls
coap_pdu_resize() to reduce the size.
If there is an issue with the PDU options where the maximum used option
value is larger than the last defined option value, an assert() is triggered.
All of the coap_*_option() functions correctly manage pdu->max_opt, but
this issue could occur if coap_pdu_resize() was called to reduce the PDU size
below that of pdu->used_size.
If an app request call-back modifies any data associated with a resource,
then multiple threads can attempt to unsafely modify the data at the same time.
Lock the resource when calling the app request handler (as global_lock is
unlocked) to prevent concurrent changes to the resource information.
If the app request handler is definately known to not modify the resource
information, then COAP_RESOURCE_SAFE_REQUEST_HANDLER can be set in the flags
for coap_resource_init(). Usually if there is a PUT, POST, PATCH or IPATCH
handler it is unsafe to set this. Setting this will reduce lock contention.
This is similar to coap_debug_set_packet_loss() which drops packets that are
to be sent, but emulates network reported errors by reporting ECONNREFUSED.
Fixes future Node.js 20 deprecation for github workflows.
There are still some other actions that continue to use Node.js 20 which will
need to be updated when they have also been ugraded to stop CI Action run warnings.
Analyzer run time does not like A -= B or A +=B even if A and B are uint32_t as there is potential
for overflow.
Analyzer run time does not like overflow when doing coap_tick_t - coap_tick_t.
Analyzer run time does not like (uint8_t << 24) as uint8_t is promoted as int, not u_int.
Analyzer run time does not like while(A--) {} even if A is uint32_t, as A is always decremented on
the test, even if the value of A is 0.
Fix potential overflow when analyzing an asn.1 tag.
Fix potential overflow when doing decode_segment() on a % hex value.
Include
-DCOAP_OPENSSL_PSK_SECURITY_LEVEL=0
as a compile time option to give a security level of 0 for PSK clients,
allowing them to connect to old servers that have not been TLS updated..
Vslues ore 0-5. The default (usually) is 1.
The function SSL_set_security_level() is called
with the defined level of COAP_OPENSSL_PSK_SECURITY_LEVEL.
Note: Setting this to 0 adds weak ciphers to the list of supported ciphers,
opening up potential security vulnerabilities.
Jon Shallow