patchlwIP - A Lightweight TCP/IP stack - Patches: patch #9862, altcp_mbedtls: multiple fixes and...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #9862: altcp_mbedtls: multiple fixes and session save/restore

Submitted by:  David GIRAULT <dgirault>
Submitted on:  Tue 15 Oct 2019 01:01:04 PM UTC  
 
Category:  apps Priority:  5 - Normal
Status:  None Privacy:  Public
Assigned to:  None Open/Closed:  Open
Planned Release:  None

Thu 12 Dec 2019 06:04:56 PM UTC, comment #2: 

Hi Simon,

I'll come back to you tomorrow for your questions.
Seems there is some pb with the rebase I made for this patchset.

David

David GIRAULT <dgirault>
Wed 11 Dec 2019 08:46:18 PM UTC, comment #1: 

Sorry this took 2 months...

- to 0001: shouldn't this be fixed by altcp_mbedtls_unref_entropy() some lines below?
- to 0002: including mbedtls headers in the application should be avoided. Up to now, applications don't need to set an include path that provides mbedtls headers, and I'd like to keep it that way. Given how much mbedTLS itself uses malloc, can we solve this without a public include to mbedTLS?
- to 0003: I don't really get the code flow here, could you explain more in the commit message what's done?
- to 0005: This seems wrong: you can't block interrupts during ref/unref/free entropy (you'll break realtime behaviour of many systems) and you shouldn't. All this altcp code is expected to be called under CORE_LOCK, so concurrent execution is not supported anyway.

Simon Goldschmidt <goldsimon>
Project Administrator
Tue 15 Oct 2019 01:01:04 PM UTC, original submission:  

-   Ensure no memory leaks and entropy counter is protected

-   Use ERR_CLSD only for handshake error.   
    This allow better handling of handshake error in application.

-   Call the application sent() callback with usefull len

   

    First calculate and sum TLS overhead when altcp_mbedtls_write() is called.
    Then take care of it when calling application sent callback. Give reveived
    len from inner_conn, minus calculated overhead.

-   Support for saving/restoring session information

   

    According to mbedTLS source code and documentation, calls to
    `mbedtls_ssl_conf_session_cache` and `mbedtls_ssl_conf_session_tickets_cb`
    are only available if mbedTLS is configured for server mode (ie. MBEDTLS_SSL_SRV_C
    is defined). This cannot be used on client mode to resume a previous session.

   

    To allow session reuse in client mode, application must save session parameters
    (including tickets provided by the server if any) after successfull connection
    and restore them before attemting to reconnect. Since `alctp_close()` free the
    structure, it cannot be used to store the required information.

   

    So, two new API were added, directly wrapped to mbedTLS functions, allow application
    to do that by itself.

   

    Also added full declaration of `struct altcp_tls_session` in altcp_tls.h to allow
    easier usage in application when using mbedTLS port.

-   Ensure configuration is properly freed.

David GIRAULT <dgirault>

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by dgirault (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-10-15 dgirault Attached File- => Added 0005-altcp_tls-ensure-no-memory-leaks-and-entropy-counter.patch, #47690
    2019-10-15 dgirault Attached File- => Added 0001-altcp_tls_mbedtls-ensure-configuration-is-properly-f.patch, #47686
        Attached File- => Added 0002-altcp_tls-support-for-saving-restoring-session-infor.patch, #47687
        Attached File- => Added 0003-altcp_tls-call-the-application-sent-callback-with-us.patch, #47688
        Attached File- => Added 0004-altcp_tls-use-ERR_CLSD-only-for-handshake-error.patch, #47689

    Back to the top


    Powered by Savane 3.5