John Carter has pointed out that non-GET requests for a resource
that does not exist caused a 4.05 response ("Method not allowed").
This fix corrects this behavior to return 4.04 in case a resource
does not exist and, for .well-known/core, 4.05 if anything but
a GET request was received.
The function cmdline_input_from_file() allocates a chunk of memory
to hold the contents of the given file. As libcoap does not offer
an interface to realloc(), we have to determine the required buffer
size before starting to read from the file, leading to a classical
TOCTOU condition.
This change mitigates the defect by first opening the file and then
calling fstat(). Note that the subsequent fread() call takes the
size of the pre-allocated buffer into account.
Free the storage allocated by coap_new_error_response() in unit tests.
This change simplifies automated leak checks as it avoids cluttering
the output with almost false positives.
Only increment block size if it can be done without causing gaps or
overlaps in the byte sequence.
The patch adds a check for alignment to ensure that no gaps appear when
a server responds with a larger block size than the original request
was using.
Ignore the block number sent by the server since that may or may not be
valid. Always recompute based on how many bytes have been sent so far.
Rationale:
Erbium (Contiki CoAP) responds to Block1 request with a Block1 option
containing the server's maximum supported Block1 size (Contiki
configuration option REST_MAX_CHUNK_SIZE). However, the block number
in the Block1 option is the same number as the block number of the
original request.
In coap_pdu_parse(), everything but the header is copied by memcmp()
from the packet to the PDU structure. An additional check ensures
that memcmp() is invoked only when there is data to copy (i.e. the
incoming CoAP message consists of more than just the base header).
On platforms other than Contiki coap_new_context() has returned NULL
when no listen address was supplied but did not free the memory that
was previously allocated for the context object.
This change re-arranges the checks to return before allocating memory.
Static code analysis tools have incorrectly reported a memory leak
in function handle_request(). To avoid this false positive, the
variable response is explicitly set to NULL after releasing the
memory with coap_delete_pdu().
coap_network_read() has used the address size reported by recvmsg()
in the msg_namelen field. As this value might be taken from the
incoming packet, coverity scan reports this value as a possible
security issue.
This fix sets the address size to the expected size and drops the
received packet if msg_namelen differs.
kFreeBSD is a modificated FreeBSD system by Debian with a FreeBSD kernel
and GNU C library (libc) used for the applications. After adding FreeBSD
support for libcoap no more changes needed to get libcoap compiled with
a kFreeBSD installation.
@john-carter has pointed out in bug #48 that valgrind reports
overlapping source and dest ranges in memcpy(). As the source
and destination in this memcpy() invocation are exactly the
same, it can be deleted safely.
For testing, the memcpy() has been replaced by an assert that
checks if these fields are alsways the same.
Processing of ancillary data for IPv4 works different on FreeBSD. This
change uses IP_RECVDSTADDR instead of IP_PKTINFO on FreeBSD.
Setting a the source address with IP_SENDSRCADDR always failed with
error 22 (Invalid argument) for sendmsg() and thus has not been
implemented. Note that for IPv4, this is not a big problem as there
is usually only one interface address even if bound to INADDR_ANY.
Deleting the pkg-config file and also the *.map and *.sym file in a
clean-local target isn't correct as we have no default automatic way to
regenerate *.map and *.sym files before the build of the libcoap is
starting.
Currently there is no need for such a automatic rebuild, the user
normaly doesn't need to do anything on those files. They even don't
should be rebuild by the users in normal cases.
Adding or removing symbols is a sensible thing and the maintenance is
probably up to the developers. Beside that there is the target
'update-map-file' that is used by the developers to (re)build this two
files if needed.
This commit is also adding a new helper target 'dist-local' with a
depency on 'update-map-file' so we are sure to have actual *.map and
*.sym file if we create a tarball for a release.
Moving the .PHONY targets to the end of the Makefile.am as this is the
typical place.
The No-Response option can be used in a request to express disinterest
or interest in certain response classes. This modification adds
No-Response handling for unicast messages and provides basic
functionality for handling multicast responses
When the No-Response became RFC 7967, the numeric value was changed
to better reflect its characteristics. This modification fixes the
reference in the documentation the option value.
The documentation for Observe and Block1/Block2 referenced
outdated Internet Drafts which have become RFCs some time ago.
This change now mentions the correct RFC numbers.
The Trusty build environment comes with a pkg-config file for CUnit
which lacks a version number and has a syntax error. The build script
now calls scripts/fix-cunit.sh to create a fixed version of the
existing cunit.pc file and point the configure script to this file.
The default build environment lacks pkg-config support for CUnit
causing the new configure script to fail when checking dependencies.
This change also adds docbook-xsl for building the man pages.
The pkgconfig specification for libcunit1-dev version 2.1-2 is
horribly broken. build.sh (invoked by the travis CI system,
see .travis.yml) now runs a new script fix-cunit.sh when TESTS is
set to 'yes'.
The build environment was lacking the possibility to get libcoap
buildable out of tree, simply checkable by the running 'make distcheck'.
Without this fix the users are impossible to build libcoap in a own
folder that's independed from the source containing folder. Typical use
case would be:
$ mkdir libcoap-build && cd libcoap-build
$ /path/to/libcoap-source/configure \
--srcdir=/path/to/libcoap-source \
--prefix=/somethere/to-install
This commit enables the out of tree build by adding and changing some
needed variables.
To get more in sync with the existing output from the default helping
text by various autotools/automake stuff improving a little bit the
existing helper text of some configure arguments.
The CUNIT_LIBS are already used, the CUNIT_CFLAGS are also needed to
ensure that get also header files that are not inside the default search
patch of the compiler. For example header within /usr/local/include
instead /usr/include.
CUNIT_LIBS and CUNIT_CFLAGS are generated by PKG_CHECK_MODULES([CUNIT] ...
in configure.ac.
The old behaviour on testing for CUnit library and header files (that
are needed while building the internal testbinary) was done on manually
search for the header and the library file without a real need because
CUnit ships a pkg-config file with a version for longer time.
By using the PKG_CHECK_MODULES macro the check is much easier as the
pkg-config file is serving all the needed information like the search
path for the header files as also LDFLAGS for linking against. This
ensures the environment variables are always setup correctly.
Note that FreeBSD uses for example /usr/include and /user/local/include
for the header files, the pkg-config files can be found in
/usr{/local}/libdata/pkgconfig. The pkg-config file will pick up the
right places then.
As FreeBSD uses default the csh (C-shell) or the tcsh (Tennex-shell)
with some different output redirection than bash for example, and the
user might have installed a other shell we need to grep the version from
the dot binary by a csh shell call because this shell be always available.
Happily the 'dot -V' command is quite the same on FreeBSD and Linux
systems. Maybe we need to change this in the future again.
On FreeBSD the default ctags binary isn't usable for getting the tags
from the header files, we need to take the binary exctags explicitly.
Also before the check can be done we need to know on which platform we
running.
No technical changes.
We have mixed indention styles, there are spaces and tabs used,
switching all tab indentions into spaces.
This increasing readability of configure.ac on systems with especially
tabwidth>4.
Joel Sandin has pointed out that a buffer flow was possible in
coap_write_block_opt() as the block number is encoded without
range check into the local variable buf. As the block number is
stored in 20 bits, the buffer is enlarged to 4 bytes to fix this.
As a second counter-measure against wrong block numbers, the function
coap_get_block() is modified to check the decoded Block option.
Numbers larger than 0xFFFFF (20 bits) cause this option to be ignored.
cmdline_subscribe() has used the global variable optarg instead of
the local argument that was passed to this function. Changing this
as intended also makes __attribute__((unused)) unneeded.
Olaf Bergmann