Anjay-zephyr 3.2.1

ferre111 · Kucmasz · commit 6a991aee0af0 · 2022-12-13T13:57:30.000+01:00
Bugfixes
- Deleted second ANJAY_WITH_MODULE_FACTORY_PROVISIONING definition in anjay_config.h
- Added correct usage of the `ZSOCK_MSG_DONTWAIT` flag in network integration

Improvements
- Added ANJAY_WITH_COMMUNICATION_TIMESTAMP_API, ANJAY_WITH_OBSERVATION_STATUS
  and ANJAY_MAX_OBSERVATION_SERVERS_REPORTED_NUMBER to Kconfig
- Fixed compatibility with newer versions of Zephyr that require including its
  headers from the `zephyr/` directory
- Added support for private keys stored as DER-encoded PKCS#1 and SECG1
  (in addition to previously supported PKCS#8 and PEM encodings) on nRF91
  security backend
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,20 @@
 # Changelog
 
+## 3.2.1 (Dec 13th, 2022)
+
+### Bugfixes
+- Deleted second ANJAY_WITH_MODULE_FACTORY_PROVISIONING definition in anjay_config.h
+- Added correct usage of the `ZSOCK_MSG_DONTWAIT` flag in network integration
+
+### Improvements
+- Added ANJAY_WITH_COMMUNICATION_TIMESTAMP_API, ANJAY_WITH_OBSERVATION_STATUS
+  and ANJAY_MAX_OBSERVATION_SERVERS_REPORTED_NUMBER to Kconfig
+- Fixed compatibility with newer versions of Zephyr that require including its
+  headers from the `zephyr/` directory
+- Added support for private keys stored as DER-encoded PKCS#1 and SECG1
+  (in addition to previously supported PKCS#8 and PEM encodings) on nRF91
+  security backend
+
 ## 3.1.2 (Aug 31st, 2022)
 
 ### Bugfixes
diff --git a/CMakeLists.txt b/CMakeLists.txt
@@ -51,7 +51,4 @@ if(NOT CONFIG_ASSERT)
     target_compile_definitions(${ZEPHYR_CURRENT_LIBRARY} PRIVATE NDEBUG)
 endif()
 
-set_source_files_properties(${AVS_COMMONS_SOURCES}
-                            PROPERTIES INCLUDE_DIRECTORIES ${ZEPHYR_BASE}/include/posix)
-
 endif()
diff --git a/Kconfig.anjay b/Kconfig.anjay
@@ -151,9 +151,25 @@ config ANJAY_WITH_NET_STATS
     bool "Enable support for measuring amount of LwM2M traffic."
     default y
 
+config ANJAY_WITH_COMMUNICATION_TIMESTAMP_API
+    bool "Enable support for communication timestamp API."
+    default n
+    help
+      Enable anjay_get_server_last_registration_time(),
+      anjay_get_server_next_update_time() and
+      anjay_get_server_last_communication_time() functions.
+    
 config ANJAY_WITH_OBSERVATION_STATUS
     bool "Enable support for the anjay_resource_observation_status() API."
-    default y
+    default n
+    
+config ANJAY_MAX_OBSERVATION_SERVERS_REPORTED_NUMBER
+    int "Maximum number of listed servers that observe a given Resource."
+    default 0
+    depends on ANJAY_WITH_OBSERVATION_STATUS
+    help
+      Maximum number of servers observing a given Resource listed by
+      anjay_resource_observation_status() function.
 
 config ANJAY_WITH_THREAD_SAFETY
     bool "Enable guarding of all accesses to anjay_t with a mutex."
diff --git a/compat/log_impl.c b/compat/log_impl.c
@@ -14,6 +14,6 @@
  * limitations under the License.
  */
 
-#include <logging/log.h>
+#include <zephyr/logging/log.h>
 /* For now, only registering main anjay log module is required */
 LOG_MODULE_REGISTER(anjay, CONFIG_ANJAY_LOG_LEVEL);
diff --git a/compat/log_impl.h b/compat/log_impl.h
@@ -16,7 +16,7 @@
 
 #pragma once
 
-#include <logging/log.h>
+#include <zephyr/logging/log.h>
 
 LOG_MODULE_DECLARE(anjay, CONFIG_ANJAY_LOG_LEVEL);
 
diff --git a/compat/mbedtls_compat.c b/compat/mbedtls_compat.c
@@ -21,8 +21,8 @@
 #include <avsystem/commons/avs_errno.h>
 #include <avsystem/commons/avs_time.h>
 
-#include <drivers/entropy.h>
-#include <random/rand32.h>
+#include <zephyr/drivers/entropy.h>
+#include <zephyr/random/rand32.h>
 
 typedef struct anjay_mbedtls_timing_delay_context_struct {
     avs_time_monotonic_t timer;
@@ -98,7 +98,7 @@ static int entropy_callback(void *dev,
 void anjay_zephyr_mbedtls_entropy_init__(mbedtls_entropy_context *ctx) {
     const struct device *entropy_dev = NULL;
 #ifdef CONFIG_ENTROPY_HAS_DRIVER
-    entropy_dev = device_get_binding(DT_CHOSEN_ZEPHYR_ENTROPY_LABEL);
+    entropy_dev = DEVICE_DT_GET(DT_CHOSEN(zephyr_entropy));
     AVS_ASSERT(entropy_dev, "Failed to acquire entropy device");
 #endif // CONFIG_ENTROPY_HAS_DRIVER
     int result =
diff --git a/compat/net_impl.c b/compat/net_impl.c
@@ -26,7 +26,7 @@
 #    error "Custom implementation of the network layer conflicts with AVS_COMMONS_NET_WITH_POSIX_AVS_SOCKET"
 #endif // AVS_COMMONS_NET_WITH_POSIX_AVS_SOCKET
 
-#include <net/socket.h>
+#include <zephyr/net/socket.h>
 
 #include "net_impl.h"
 
@@ -219,7 +219,8 @@ static avs_error_t net_receive(avs_net_socket_t *sock_,
     if (zsock_poll(&pfd, 1, (int) timeout_ms) == 0) {
         return avs_errno(AVS_ETIMEDOUT);
     }
-    ssize_t bytes_received = zsock_recv(sock->fd, buffer, buffer_length, 0);
+    ssize_t bytes_received =
+            zsock_recv(sock->fd, buffer, buffer_length, ZSOCK_MSG_DONTWAIT);
     if (bytes_received < 0) {
 #ifdef CONFIG_WIFI_ESWIFI
         // Although poll succeeded, recv may fail with errno set to EAGAIN when
diff --git a/compat/net_impl.h b/compat/net_impl.h
@@ -17,7 +17,7 @@
 #ifndef NET_IMPL_H
 #define NET_IMPL_H
 
-#include <net/socket.h>
+#include <zephyr/net/socket.h>
 
 #include <avsystem/commons/avs_socket_v_table.h>
 
diff --git a/compat/threading_compat.c b/compat/threading_compat.c
@@ -19,7 +19,7 @@
 #include <avsystem/commons/avs_memory.h>
 #include <avsystem/commons/avs_mutex.h>
 
-#include <kernel.h>
+#include <zephyr/kernel.h>
 
 struct avs_condvar {
     struct k_condvar zephyr_condvar;
diff --git a/compat/time_compat.c b/compat/time_compat.c
@@ -15,7 +15,7 @@
  */
 
 #include <avsystem/commons/avs_time.h>
-#include <kernel.h>
+#include <zephyr/kernel.h>
 
 #ifdef CONFIG_DATE_TIME
 #    include <date_time.h>
diff --git a/compat/zephyr_posix_compat.h b/compat/zephyr_posix_compat.h
@@ -17,8 +17,8 @@
 #ifndef COMPAT_H
 #define COMPAT_H
 
-#include <net/socket.h>
-#include <posix/time.h>
+#include <zephyr/net/socket.h>
+#include <zephyr/posix/time.h>
 
 typedef int sockfd_t;
 
diff --git a/compat/zephyr_tls_compat.c b/compat/zephyr_tls_compat.c
@@ -24,7 +24,7 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#include <random/rand32.h>
+#include <zephyr/random/rand32.h>
 
 #include <avsystem/commons/avs_base64.h>
 #include <avsystem/commons/avs_crypto_psk.h>
@@ -121,9 +121,10 @@ static int ensure_modem_deactivated(
 
 static const char PEM_BEGIN_TAG_PRE[] = "-----BEGIN ";
 
-static bool looks_like_pem_data(const uint8_t *data, size_t length) {
+static bool looks_like_pem_data(const void *data, size_t length) {
     for (size_t i = 0; i < length; ++i) {
-        if (!isgraph(data[i]) && !isspace(data[i])) {
+        uint8_t byte = ((const uint8_t *) data)[i];
+        if (!isgraph(byte) && !isspace(byte)) {
             return false;
         }
     }
@@ -133,16 +134,140 @@ static bool looks_like_pem_data(const uint8_t *data, size_t length) {
                || pem_begin_tag[-1] == '\n');
 }
 
+static ptrdiff_t read_asn1_length(const uint8_t **ptr, const uint8_t *end) {
+    if (*ptr >= end) {
+        return -1;
+    }
+
+    uint8_t first_byte = **ptr;
+    ++*ptr;
+
+    // See X.690 (02/21) <https://www.itu.int/rec/T-REC-X.690-202102-I/en>
+    // sections 8.1.3.3 and 10.1 for an authoritative spec of this encoding.
+
+    // Short form - the highest bit is zero, and the rest encode the length
+    if (!(first_byte & 0x80)) {
+        return first_byte;
+    }
+
+    // Long form - the highest bit is 1, the rest encode the "length of the
+    // length", and the subsequent bytes are the length encoded as big-endian
+    first_byte &= 0x7F;
+    if (first_byte > sizeof(ptrdiff_t) || *ptr + first_byte > end) {
+        return -1;
+    }
+
+    ptrdiff_t result = 0;
+
+    for (size_t i = 0; i < first_byte; ++i) {
+        result *= 256;
+        result += **ptr;
+        ++*ptr;
+    }
+
+    return result;
+}
+
+typedef enum {
+    DER_PRIVATE_KEY_UNKNOWN = -1,
+    DER_PRIVATE_KEY_PKCS8 = 0,
+    DER_PRIVATE_KEY_ECPK,
+    DER_PRIVATE_KEY_PKCS1
+} der_private_key_format_t;
+
+#    define ASN1_TAG_INTEGER 0x02
+#    define ASN1_TAG_OCTET_STRING 0x04
+#    define ASN1_TAG_CONSTRUCTED_SEQUENCE 0x30
+
+// data may be one of:
+// a) PKCS#8 private key format, as per RFC 5958:
+//
+// OneAsymmetricKey ::= SEQUENCE {
+//  version                  Version,
+//  privateKeyAlgorithm      SEQUENCE {
+//   algorithm                 PUBLIC-KEY.&id({PublicKeySet}),
+//    parameters               PUBLIC-KEY.&Params({PublicKeySet}
+//                               {@privateKeyAlgorithm.algorithm})
+//                               OPTIONAL}
+//  privateKey               OCTET STRING (CONTAINING
+//                             PUBLIC-KEY.&PrivateKey({PublicKeySet}
+//                             {@privateKeyAlgorithm.algorithm})),
+//  attributes           [0] Attributes OPTIONAL,
+//  ...,
+//  [[2: publicKey       [1] BIT STRING (CONTAINING
+//                             PUBLIC-KEY.&Params({PublicKeySet}
+//                             {@privateKeyAlgorithm.algorithm})
+//                             OPTIONAL,
+//  ...
+//    }
+//
+// b) ECPrivateKey, as per SECG1 or RFC 5915:
+//
+// ECPrivateKey ::= SEQUENCE {
+//       version INTEGER { ecPrivkeyVer1(1) } (ecPrivkeyVer1),
+//       privateKey OCTET STRING,
+//       parameters [0] ECDomainParameters {{ SECGCurveNames }} OPTIONAL,
+//       publicKey [1] BIT STRING OPTIONAL
+// }
+//
+// c) PKCS#1 RSA private key format, as per RFC 8017:
+//
+// RSAPrivateKey ::= SEQUENCE {
+//     version           Version,
+//     modulus           INTEGER,  -- n
+//     publicExponent    INTEGER,  -- e
+//     privateExponent   INTEGER,  -- d
+//     prime1            INTEGER,  -- p
+//     prime2            INTEGER,  -- q
+//     exponent1         INTEGER,  -- d mod (p-1)
+//     exponent2         INTEGER,  -- d mod (q-1)
+//     coefficient       INTEGER,  -- (inverse of q) mod p
+//     otherPrimeInfos   OtherPrimeInfos OPTIONAL
+// }
+//
+// So we can assume that:
+// - the outermost structure is always an ASN.1 SEQUENCE
+// - the first field is always an INTEGER specifying the version
+// - the second field will be:
+//   a) SEQUENCE in case of PKCS#8
+//   b) OCTET STRING in case of ECPrivateKey
+//   c) INTEGER in case of PKCS#1
+static der_private_key_format_t detect_private_key_format(const void *data_,
+                                                          size_t length) {
+    const uint8_t *data = (const uint8_t *) data_;
+    const uint8_t *const data_end = data + length;
+    // skip over the outer SEQUENCE header
+    if (data >= data_end || *data++ != ASN1_TAG_CONSTRUCTED_SEQUENCE
+            || read_asn1_length(&data, data_end) < 0) {
+        return DER_PRIVATE_KEY_UNKNOWN;
+    }
+    // skip over the version field
+    if (data >= data_end || *data++ != ASN1_TAG_INTEGER) {
+        return DER_PRIVATE_KEY_UNKNOWN;
+    }
+    ptrdiff_t version_length = read_asn1_length(&data, data_end);
+    if (version_length < 0 || data + version_length >= data_end) {
+        return DER_PRIVATE_KEY_UNKNOWN;
+    }
+    data += version_length;
+
+    switch (*data) {
+    case ASN1_TAG_CONSTRUCTED_SEQUENCE:
+        return DER_PRIVATE_KEY_PKCS8;
+    case ASN1_TAG_OCTET_STRING:
+        return DER_PRIVATE_KEY_ECPK;
+    case ASN1_TAG_INTEGER:
+        return DER_PRIVATE_KEY_PKCS1;
+    default:
+        return DER_PRIVATE_KEY_UNKNOWN;
+    }
+}
+
 static avs_error_t encode_pem_data(void **out_pem,
                                    size_t *out_pem_length,
                                    const char *label,
                                    const void *data,
                                    size_t length) {
-    if (looks_like_pem_data((const uint8_t *) data, length)) {
-        *out_pem = (void *) (intptr_t) data;
-        *out_pem_length = length;
-        return AVS_OK;
-    }
     static const char END_TAG_PRE[] = "\r\n-----END ";
     static const char TAG_POST[] = "-----";
     size_t base64_bytes = avs_base64_encoded_size(length) - 1;
@@ -189,18 +314,46 @@ static avs_error_t security_credential_set(
     switch (type) {
     case ANJAY_ZEPHYR_TLS_CRED_CA_CERT:
     case ANJAY_ZEPHYR_TLS_CRED_SERVER_CERT: {
-        avs_error_t err = encode_pem_data(&processed_data, &processed_length,
-                                          "CERTIFICATE", data, length);
-        if (avs_is_err(err)) {
-            return err;
+        if (looks_like_pem_data((const uint8_t *) data, length)) {
+            processed_data = (void *) (intptr_t) data;
+            processed_length = length;
+        } else {
+            avs_error_t err =
+                    encode_pem_data(&processed_data, &processed_length,
+                                    "CERTIFICATE", data, length);
+            if (avs_is_err(err)) {
+                return err;
+            }
         }
         break;
     }
     case ANJAY_ZEPHYR_TLS_CRED_PRIVATE_KEY: {
-        avs_error_t err = encode_pem_data(&processed_data, &processed_length,
-                                          "PRIVATE KEY", data, length);
-        if (avs_is_err(err)) {
-            return err;
+        if (looks_like_pem_data((const uint8_t *) data, length)) {
+            processed_data = (void *) (intptr_t) data;
+            processed_length = length;
+        } else {
+            const char *label = NULL;
+            switch (detect_private_key_format(data, length)) {
+            case DER_PRIVATE_KEY_PKCS8:
+                label = "PRIVATE KEY";
+                break;
+            case DER_PRIVATE_KEY_ECPK:
+                label = "EC PRIVATE KEY";
+                break;
+            case DER_PRIVATE_KEY_PKCS1:
+                label = "RSA PRIVATE KEY";
+                break;
+            case DER_PRIVATE_KEY_UNKNOWN:
+                break;
+            }
+            avs_error_t err = avs_errno(AVS_EINVAL);
+            if (label) {
+                err = encode_pem_data(&processed_data, &processed_length, label,
+                                      data, length);
+            }
+            if (avs_is_err(err)) {
+                return err;
+            }
         }
         break;
     }
diff --git a/compat/zephyr_tls_compat.h b/compat/zephyr_tls_compat.h
@@ -23,7 +23,7 @@
 #    include <nrf_errno.h>
 #    include <nrf_modem_gnss.h>
 #else // defined(CONFIG_NRF_MODEM_LIB) && defined(CONFIG_MODEM_KEY_MGMT)
-#    include <net/tls_credentials.h>
+#    include <zephyr/net/tls_credentials.h>
 #endif // defined(CONFIG_NRF_MODEM_LIB) && defined(CONFIG_MODEM_KEY_MGMT)
 
 #include <avsystem/commons/avs_socket.h>
diff --git a/config/anjay/anjay_config.h b/config/anjay/anjay_config.h
diff --git a/config/avsystem/commons/avs_commons_config.h b/config/avsystem/commons/avs_commons_config.h
diff --git a/deps/anjay b/deps/anjay
