memset the node when a new optlist node is created, because the node->next maybe not NULL, so if it creates a new optlist node, and delete it, and then create it again, error will be occurred
Coverity scan found an out-of-bounds array access while reading the local array identity
(CID 1476518). This change also ensures that the result parameters are always initialized
and avoids invalid pointer dereference in case gnutls_malloc() returns NULL.
Coverity found that status is always 0 when validate_cn_call_back()
is invoked (CID 1476517). This change removes the dead code by
introducing a constant that can be inferred at compile-time.
GnuTLS 3.6.0 or later requires that gnutls_certificate_set_x509_system_trust()
is set up if PSK is not being used and PKI is not defined and the session
is to be DTLS based.
src/coap_gnutls.c:
Add in call to gnutls_certificate_set_x509_system_trust() in
setup_pki_credentials() if PKI has not been set up.
src/coap_gnutls.s:
If a DTLS server session setup fails (invalid / missing certificate etc.)
and the client has sent some more of the DTLS setup exchange packets before
receiving the TLS alert packet closing things down, any subsequent new DTLS
sessions will fail.
Caused by the g_env environment getting partially polluted with information
with the subsequent DTLS setup exchange packets.
The primary fix is for coap_dtls_hello() is to clear out g_env if there is a
ClientHello packet failure (error return from do_gnutls_handshake()) as well
as if the packet is not of the form of a ClientHello, then it is simply
ignored.
(This may be what is being seen in #300)
If there is an issue during DTLS setup, the coap-client will keep on retrying
and then getting the same failure.
examples/client.c:
This fix introduces using coap events into coap-client, and on detection of
a close event, the coap-client closes down
To reproduce the issue:
Server session
$ coap-server -v9 -n -k secretPSK -c server.pem -C ca.pem -R /etc/ssl/certs
Client session
$ examples/coap-client -v9 coaps://127.0.0.1/
include/coap2/coap_dtls.h:
src/coap_gnutls.c:
If neither coap_new_client_session_pki() or coap_new_client_session_psk()
is called, but coap_new_client_session() is (as done by coap-client if
no PKI or PSK options set), then set up a default PKI session to be
able to talk to a coap server.
To reproduce:-
Run a GnuTLS-based coap-server with option `-n` and connect with
`openssl s_client` to port 5684. The handshake works and see binary data
(the CoAP/TCP CSM signaling). Now, then interrupt the openssl s_client process
with SIGINT, This generates a lot of these messages:
Feb 14 19:22:39 DEBG ASSERT: ../../lib/record.c[_gnutls_recv_int]:1766
Feb 14 19:22:39 DEBG ASSERT: ../../lib/buffers.c[_gnutls_io_read_buffered]:589
Feb 14 19:22:39 DEBG ASSERT: ../../lib/record.c[_gnutls_recv_int]:1766
Feb 14 19:22:39 DEBG ASSERT: ../../lib/buffers.c[_gnutls_io_read_buffered]:589
Feb 14 19:22:39 DEBG ASSERT: ../../lib/record.c[_gnutls_recv_int]:1766
Feb 14 19:22:39 DEBG ASSERT: ../../lib/buffers.c[_gnutls_io_read_buffered]:589
Feb 14 19:22:39 DEBG ASSERT: ../../lib/record.c[_gnutls_recv_int]:1766
Feb 14 19:22:39 DEBG ASSERT: ../../lib/buffers.c[_gnutls_io_read_buffered]:589
An OpenSSL-based coap-server gets a clean disconnect and closes the session as
expected.
src/coap_gnutls.c:
Return correct response when coap_sock_read() is called by GnuTLS internal
Pull and the TCP session is closed so that the coap session is closed
correctly
By defining the CA file or Root CAs in the client, the server's certificate
can be validated by the options in coap_dtls_pki_t parameter even if the client
does not define a certificate.
[The server must be configured not to require a Client Cert]
examples/client.c:
Add in the support to the coap-client to allow any of Root CA, CA and Cert
to be defined to set up PKI checking.
src/coap_gnutls.c:
src/coap_openssl.c:
Remove the checks in the OpenSSL and GnuTLS underlying support that previously
used to enforce that both CA and Cert had to be set in the client.
Correct some of the PKI setup error messages to relect whether the failure is
on the client or the server.
include/coap2/coap_dtls.h:
src/coap_gnutls.c:
src/coap_notls.c:
src/coap_openssl.c:
src/coap_tinydtls.c:
Convert COAP_DTLS_ROLE_SERVER and COAP_DTLS_ROLE_CLIENT to enum
coap_dtls_role_t and use as appropriate to differentiate between the roles
in the different DTLS libraries
In tls_client_hello_call_back():
When SSL_client_hello_get0_ciphers() returns 0, the result parameter
out is not set. SSL_bytes_to_cipher_list() therefore is called only
if len > 0. This function's results parameters peer_ciphers and
scsvc also are accessed only if SSL_bytes_to_cipher_list() has
returned 1.
To avoid freeing invalid pointers by sk_SSL_CIPHER_free(), peer_ciphers
and scsvc have been initialized with NULL.
Add in -n option to support making require_peer_cert configurable, by default
it is enabled unless -n is set.
examples/coap-server.c:
Code changes.
man/coap-server.txt.in
Update documentation
include/coap2/libcoap.h
_LIBCOAP_H_ to COAP_LIBCOAP_H_
src/coap_session.c
_COAP_SESSION_H_ to COAP_SESSION_C_
include/coap2/coap_session.h
_SESSION_H_ to COAP_SESSION_H_
otherwise, all #define _COAP_xxxxx wrappers are now COAP_xxxxx
Fixes#291
When a new resource is created with PUT, the given Content-Format is
stored as parameter ct with the resource description.
This change is based on a fix provided by Peter van der Stok.
As discussed in issue #286 [1], the mandatory-to-implement
cipher suites TLS_PSK_WITH_AES_128_CCM_8 and TLS_ECDHE_ECDSA_AES_128_CCM_8
should be enabled if possible.
[1] https://github.com/obgm/libcoap/issues/286
Signed-off-by: Olaf Bergmann <bergmann@tzi.org>
As str structure has been replaced by coap_string_t, remove it from the code
as it is no longer required, has been deprecated for some time and can cause
clashes with other str definitions.
Tidy up comment referring to str.
The CLI option '-o file' redirects the received payload into the
given file, where '-' denotes stdout. As the function close_output()
used to append a newline to the end of the output, certain tools
such as cbor2pretty.rb have failed, complaining about the trailing
character.
This change now writes the newline if only if option '-o' was not
specified.
Olaf Bergmann