patchlwIP - A Lightweight TCP/IP stack - Patches: patch #9862, altcp_mbedtls: multiple fixes and...


You are not allowed to post comments on this tracker with your current authentication level.

patch #9862: altcp_mbedtls: multiple fixes and session save/restore

Submitter:  David GIRAULT <dgirault>
Submitted:  Tue 15 Oct 2019 01:01:04 PM UTC
Category:  apps Priority:  5 - Normal
Status:  None Privacy:  Public
Assigned to:  None Open/Closed:  Open
Planned Release:  None

Thu 12 Dec 2019 06:04:56 PM UTC, comment #2: 

Hi Simon,

I'll come back to you tomorrow for your questions.
Seems there is some pb with the rebase I made for this patchset.


David GIRAULT <dgirault>
Wed 11 Dec 2019 08:46:18 PM UTC, comment #1: 

Sorry this took 2 months...

- to 0001: shouldn't this be fixed by altcp_mbedtls_unref_entropy() some lines below?
- to 0002: including mbedtls headers in the application should be avoided. Up to now, applications don't need to set an include path that provides mbedtls headers, and I'd like to keep it that way. Given how much mbedTLS itself uses malloc, can we solve this without a public include to mbedTLS?
- to 0003: I don't really get the code flow here, could you explain more in the commit message what's done?
- to 0005: This seems wrong: you can't block interrupts during ref/unref/free entropy (you'll break realtime behaviour of many systems) and you shouldn't. All this altcp code is expected to be called under CORE_LOCK, so concurrent execution is not supported anyway.

Simon Goldschmidt <goldsimon>
Group administrator
Tue 15 Oct 2019 01:01:04 PM UTC, original submission:  

-   Ensure no memory leaks and entropy counter is protected

-   Use ERR_CLSD only for handshake error.   
    This allow better handling of handshake error in application.

-   Call the application sent() callback with usefull len
    First calculate and sum TLS overhead when altcp_mbedtls_write() is called.
    Then take care of it when calling application sent callback. Give reveived
    len from inner_conn, minus calculated overhead.

-   Support for saving/restoring session information
    According to mbedTLS source code and documentation, calls to
    `mbedtls_ssl_conf_session_cache` and `mbedtls_ssl_conf_session_tickets_cb`
    are only available if mbedTLS is configured for server mode (ie. MBEDTLS_SSL_SRV_C
    is defined). This cannot be used on client mode to resume a previous session.
    To allow session reuse in client mode, application must save session parameters
    (including tickets provided by the server if any) after successfull connection
    and restore them before attemting to reconnect. Since `alctp_close()` free the
    structure, it cannot be used to store the required information.
    So, two new API were added, directly wrapped to mbedTLS functions, allow application
    to do that by itself.
    Also added full declaration of `struct altcp_tls_session` in altcp_tls.h to allow
    easier usage in application when using mbedTLS port.

-   Ensure configuration is properly freed.

David GIRAULT <dgirault>


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by dgirault (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.


    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-10-15 dgirault Attached File- Added 0005-altcp_tls-ensure-no-memory-leaks-and-entropy-counter.patch, #47690
    2019-10-15 dgirault Attached File- Added 0001-altcp_tls_mbedtls-ensure-configuration-is-properly-f.patch, #47686
        Attached File- Added 0002-altcp_tls-support-for-saving-restoring-session-infor.patch, #47687
        Attached File- Added 0003-altcp_tls-call-the-application-sent-callback-with-us.patch, #47688
        Attached File- Added 0004-altcp_tls-use-ERR_CLSD-only-for-handshake-error.patch, #47689

    Back to the top

    Powered by Savane 3.13-4b48.
    Corresponding source code