Skip to content

Commit 2efd6d7

Browse files
maxd-nordicnordicjm
maxd-nordic
authored and
nordicjm
committed
treewide: use SEC_TAG_TLS_INVALID for unset security tag
This is another attempt of #23571 to fix handling sec_tags that have not been set. The fact that the modem uses uint32_t for sec_tags, while Zephyr uses int, is a bit unfortunate. Often, -1 or 0 are used to indicate an invalid sec_tag, and it is checked whether a sec_tag is positive. However, there are some "debug" sec_tags for the modem, that register as negative values, while being valid. To avoid confusion, use a proper placeholder for an invalid sec_tag. Signed-off-by: Maximilian Deubel <[email protected]>
1 parent a1c2b1d commit 2efd6d7

File tree

19 files changed

+70
-52
lines changed

19 files changed

+70
-52
lines changed

‎applications/serial_lte_modem/src/ftp_c/slm_at_ftp.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,7 @@ static int do_ftp_open(enum at_parser_cmd_type cmd_type, struct at_parser *parse
119119
char hostname[SLM_MAX_URL];
120120
int sz_hostname = sizeof(hostname);
121121
uint16_t port = FTP_DEFAULT_PORT;
122-
sec_tag_t sec_tag = INVALID_SEC_TAG;
122+
sec_tag_t sec_tag = SEC_TAG_TLS_INVALID;
123123

124124
/* Parse AT command */
125125
ret = util_string_get(parser, 2, username, &sz_username);

‎applications/serial_lte_modem/src/http_c/slm_at_httpc.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -224,7 +224,7 @@ static int do_http_connect(void)
224224
}
225225

226226
/* Open socket */
227-
if (httpc.sec_tag == INVALID_SEC_TAG) {
227+
if (httpc.sec_tag == SEC_TAG_TLS_INVALID) {
228228
ret = zsock_socket(httpc.family, SOCK_STREAM, IPPROTO_TCP);
229229
} else {
230230
ret = zsock_socket(httpc.family, SOCK_STREAM, IPPROTO_TLS_1_2);
@@ -236,7 +236,7 @@ static int do_http_connect(void)
236236
httpc.fd = ret;
237237

238238
/* Set socket options */
239-
if (httpc.sec_tag != INVALID_SEC_TAG) {
239+
if (httpc.sec_tag != SEC_TAG_TLS_INVALID) {
240240
#if defined(CONFIG_SLM_NATIVE_TLS)
241241
ret = slm_native_tls_load_credentials(httpc.sec_tag);
242242
if (ret < 0) {
@@ -444,7 +444,7 @@ static int handle_at_httpc_connect(enum at_parser_cmd_type cmd_type,
444444
return -EINVAL;
445445
}
446446

447-
httpc.sec_tag = INVALID_SEC_TAG;
447+
httpc.sec_tag = SEC_TAG_TLS_INVALID;
448448
if (param_count > 4) {
449449
if (at_parser_num_get(parser, 4, &httpc.sec_tag)) {
450450
return -EINVAL;
@@ -480,7 +480,7 @@ static int handle_at_httpc_connect(enum at_parser_cmd_type cmd_type,
480480
break;
481481

482482
case AT_PARSER_CMD_TYPE_READ:
483-
if (httpc.sec_tag != INVALID_SEC_TAG) {
483+
if (httpc.sec_tag != SEC_TAG_TLS_INVALID) {
484484
rsp_send("\r\n#XHTTPCCON: %d,\"%s\",%d,%d\r\n",
485485
(httpc.fd == INVALID_SOCKET) ? 0 : 1,
486486
httpc.host, httpc.port, httpc.sec_tag);

‎applications/serial_lte_modem/src/mqtt_c/slm_at_mqtt.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -382,7 +382,7 @@ static int do_mqtt_connect(void)
382382
/* ignore password if no user_name */
383383
}
384384
#if defined(CONFIG_MQTT_LIB_TLS)
385-
if (ctx.sec_tag != INVALID_SEC_TAG) {
385+
if (ctx.sec_tag != SEC_TAG_TLS_INVALID) {
386386
struct mqtt_sec_config *tls_config;
387387

388388
tls_config = &(client.transport).tls.config;
@@ -574,7 +574,7 @@ static int handle_at_mqtt_connect(enum at_parser_cmd_type cmd_type, struct at_pa
574574
if (err) {
575575
return err;
576576
}
577-
ctx.sec_tag = INVALID_SEC_TAG;
577+
ctx.sec_tag = SEC_TAG_TLS_INVALID;
578578
if (param_count > 6) {
579579
err = at_parser_num_get(parser, 6, &ctx.sec_tag);
580580
if (err) {
@@ -592,7 +592,7 @@ static int handle_at_mqtt_connect(enum at_parser_cmd_type cmd_type, struct at_pa
592592

593593
case AT_PARSER_CMD_TYPE_READ:
594594
if (ctx.connected) {
595-
if (ctx.sec_tag != INVALID_SEC_TAG) {
595+
if (ctx.sec_tag != SEC_TAG_TLS_INVALID) {
596596
rsp_send("\r\n#XMQTTCON: %d,\"%s\",\"%s\",%d,%d\r\n",
597597
ctx.connected, mqtt_clientid, mqtt_broker_url,
598598
mqtt_broker_port, ctx.sec_tag);
@@ -804,7 +804,7 @@ int slm_at_mqtt_init(void)
804804
{
805805
pub_param.message_id = 0;
806806
memset(&ctx, 0, sizeof(ctx));
807-
ctx.sec_tag = INVALID_SEC_TAG;
807+
ctx.sec_tag = SEC_TAG_TLS_INVALID;
808808

809809
strcpy(mqtt_clientid, SLM_DEFAULT_CID);
810810
do_mqtt_config(CONFIG_MQTT_KEEPALIVE, CONFIG_MQTT_CLEAN_SESSION);

‎applications/serial_lte_modem/src/nativetls/slm_native_tls.c‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
*/
66
#include <zephyr/net/socket.h>
77
#include <zephyr/settings/settings.h>
8+
#include <zephyr/net/tls_credentials.h>
89
#include "slm_native_tls.h"
910
#include "slm_at_host.h"
1011
#include "slm_at_cmng.h"
@@ -27,7 +28,7 @@ struct tls_cred_buf {
2728
};
2829
static struct tls_cred_buf cred_buf[CONFIG_SLM_NATIVE_TLS_CREDENTIAL_BUFFER_COUNT] = {
2930
[0 ... CONFIG_SLM_NATIVE_TLS_CREDENTIAL_BUFFER_COUNT - 1] = {
30-
.sec_tag = -1
31+
.sec_tag = SEC_TAG_TLS_INVALID
3132
}
3233
};
3334
static uint8_t cred_buf_next; /* Index of next cred_buf to use. */
@@ -183,7 +184,7 @@ static int unload_tls_cred_buf(sec_tag_t sec_tag)
183184
{
184185
struct tls_cred_buf *cred = get_tls_cred_buf(sec_tag);
185186

186-
if (cred == NULL || sec_tag == -1) {
187+
if (cred == NULL || sec_tag == SEC_TAG_TLS_INVALID) {
187188
return 0;
188189
}
189190

@@ -201,7 +202,7 @@ static int unload_tls_cred_buf(sec_tag_t sec_tag)
201202
}
202203
}
203204
}
204-
cred->sec_tag = -1;
205+
cred->sec_tag = SEC_TAG_TLS_INVALID;
205206
cred->type_flags = 0;
206207

207208
return 0;

‎applications/serial_lte_modem/src/slm_at_fota.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -216,7 +216,7 @@ static int do_fota_start(int op, const char *file_uri, int sec_tag,
216216

217217
/* start HTTP(S) FOTA */
218218
if (slm_util_casecmp(schema, SCHEMA_HTTPS)) {
219-
if (sec_tag == INVALID_SEC_TAG) {
219+
if (sec_tag == SEC_TAG_TLS_INVALID) {
220220
LOG_ERR("Missing sec_tag");
221221
return -EINVAL;
222222
}
@@ -319,7 +319,7 @@ static int handle_at_fota(enum at_parser_cmd_type cmd_type, struct at_parser *pa
319319
char uri[FILE_URI_MAX];
320320
uint16_t pdn_id;
321321
int size = FILE_URI_MAX;
322-
sec_tag_t sec_tag = INVALID_SEC_TAG;
322+
sec_tag_t sec_tag = SEC_TAG_TLS_INVALID;
323323
enum dfu_target_image_type type;
324324

325325
err = util_string_get(parser, 2, uri, &size);

‎applications/serial_lte_modem/src/slm_at_socket.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -109,7 +109,7 @@ static void init_socket(struct slm_socket *socket)
109109
}
110110

111111
socket->family = AF_UNSPEC;
112-
socket->sec_tag = INVALID_SEC_TAG;
112+
socket->sec_tag = SEC_TAG_TLS_INVALID;
113113
socket->role = AT_SOCKET_ROLE_CLIENT;
114114
socket->fd = INVALID_SOCKET;
115115
socket->fd_peer = INVALID_SOCKET;
@@ -1117,7 +1117,7 @@ static int handle_at_secure_socket(enum at_parser_cmd_type cmd_type,
11171117
err = -EINVAL;
11181118
goto error;
11191119
}
1120-
sock->sec_tag = INVALID_SEC_TAG;
1120+
sock->sec_tag = SEC_TAG_TLS_INVALID;
11211121
err = at_parser_num_get(parser, 4, &sock->sec_tag);
11221122
if (err) {
11231123
goto error;
@@ -1284,7 +1284,7 @@ static int handle_at_secure_socketopt(enum at_parser_cmd_type cmd_type,
12841284

12851285
switch (cmd_type) {
12861286
case AT_PARSER_CMD_TYPE_SET:
1287-
if (sock->sec_tag == INVALID_SEC_TAG) {
1287+
if (sock->sec_tag == SEC_TAG_TLS_INVALID) {
12881288
LOG_ERR("Not secure socket");
12891289
return err;
12901290
}

‎applications/serial_lte_modem/src/slm_at_tcp_proxy.c‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ static int do_tcp_server_start(uint16_t port)
7272
int reuseaddr = 1;
7373

7474
/* Open socket */
75-
if (proxy.sec_tag == INVALID_SEC_TAG) {
75+
if (proxy.sec_tag == SEC_TAG_TLS_INVALID) {
7676
ret = zsock_socket(proxy.family, SOCK_STREAM, IPPROTO_TCP);
7777
} else {
7878
ret = zsock_socket(proxy.family, SOCK_STREAM, IPPROTO_TLS_1_2);
@@ -84,7 +84,7 @@ static int do_tcp_server_start(uint16_t port)
8484
}
8585
proxy.sock = ret;
8686

87-
if (proxy.sec_tag != INVALID_SEC_TAG) {
87+
if (proxy.sec_tag != SEC_TAG_TLS_INVALID) {
8888
#ifndef CONFIG_SLM_NATIVE_TLS
8989
LOG_ERR("Not supported");
9090
return -ENOTSUP;
@@ -199,7 +199,7 @@ static int do_tcp_client_connect(const char *url, uint16_t port, uint16_t cid)
199199
struct sockaddr sa;
200200

201201
/* Open socket */
202-
if (proxy.sec_tag == INVALID_SEC_TAG) {
202+
if (proxy.sec_tag == SEC_TAG_TLS_INVALID) {
203203
ret = zsock_socket(proxy.family, SOCK_STREAM, IPPROTO_TCP);
204204
} else {
205205
ret = zsock_socket(proxy.family, SOCK_STREAM, IPPROTO_TLS_1_2);
@@ -210,7 +210,7 @@ static int do_tcp_client_connect(const char *url, uint16_t port, uint16_t cid)
210210
}
211211
proxy.sock = ret;
212212

213-
if (proxy.sec_tag != INVALID_SEC_TAG) {
213+
if (proxy.sec_tag != SEC_TAG_TLS_INVALID) {
214214
#if defined(CONFIG_SLM_NATIVE_TLS)
215215
ret = slm_native_tls_load_credentials(proxy.sec_tag);
216216
if (ret < 0) {
@@ -690,7 +690,7 @@ static int handle_at_tcp_server(enum at_parser_cmd_type cmd_type, struct at_pars
690690
if (err) {
691691
return err;
692692
}
693-
proxy.sec_tag = INVALID_SEC_TAG;
693+
proxy.sec_tag = SEC_TAG_TLS_INVALID;
694694
if (param_count > 3) {
695695
err = at_parser_num_get(parser, 3, &proxy.sec_tag);
696696
if (err) {
@@ -752,7 +752,7 @@ static int handle_at_tcp_client(enum at_parser_cmd_type cmd_type, struct at_pars
752752
if (at_parser_num_get(parser, 3, &port)) {
753753
return -EINVAL;
754754
}
755-
proxy.sec_tag = INVALID_SEC_TAG;
755+
proxy.sec_tag = SEC_TAG_TLS_INVALID;
756756
if (param_count > 4) { /* optional param */
757757
err = at_parser_num_get(parser, 4, &proxy.sec_tag);
758758
if (err != 0 && err != -EOPNOTSUPP) {
@@ -905,7 +905,7 @@ int slm_at_tcp_proxy_init(void)
905905
proxy.family = AF_UNSPEC;
906906
proxy.sock_peer = INVALID_SOCKET;
907907
proxy.role = INVALID_ROLE;
908-
proxy.sec_tag = INVALID_SEC_TAG;
908+
proxy.sec_tag = SEC_TAG_TLS_INVALID;
909909
proxy.efd = INVALID_SOCKET;
910910

911911
return 0;

‎applications/serial_lte_modem/src/slm_at_udp_proxy.c‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ static int do_udp_server_start(uint16_t port)
6969
int ret;
7070

7171
/* Open socket */
72-
if (proxy.sec_tag == INVALID_SEC_TAG) {
72+
if (proxy.sec_tag == SEC_TAG_TLS_INVALID) {
7373
ret = zsock_socket(proxy.family, SOCK_DGRAM, IPPROTO_UDP);
7474
} else {
7575
ret = zsock_socket(proxy.family, SOCK_DGRAM, IPPROTO_DTLS_1_2);
@@ -81,7 +81,7 @@ static int do_udp_server_start(uint16_t port)
8181
}
8282
proxy.sock = ret;
8383

84-
if (proxy.sec_tag != INVALID_SEC_TAG) {
84+
if (proxy.sec_tag != SEC_TAG_TLS_INVALID) {
8585
#ifndef CONFIG_SLM_NATIVE_TLS
8686
LOG_ERR("Not supported");
8787
ret = -ENOTSUP;
@@ -190,7 +190,7 @@ static int do_udp_client_connect(const char *url, uint16_t port, uint16_t cid)
190190
int ret;
191191
struct sockaddr sa;
192192
const bool using_cid = (proxy.dtls_cid != INVALID_DTLS_CID);
193-
const bool using_dtls = (proxy.sec_tag != INVALID_SEC_TAG);
193+
const bool using_dtls = (proxy.sec_tag != SEC_TAG_TLS_INVALID);
194194

195195
/* Open socket */
196196
ret = zsock_socket(proxy.family, SOCK_DGRAM, using_dtls ? IPPROTO_DTLS_1_2 : IPPROTO_UDP);
@@ -452,7 +452,7 @@ static void udp_thread_func(void *p1, void *p2, void *p3)
452452
ret = -EIO;
453453
break;
454454
}
455-
if (proxy.role == UDP_ROLE_SERVER && proxy.sec_tag != INVALID_SEC_TAG &&
455+
if (proxy.role == UDP_ROLE_SERVER && proxy.sec_tag != SEC_TAG_TLS_INVALID &&
456456
value == ECONNABORTED) {
457457
util_get_peer_addr((struct sockaddr *)&proxy.remote, peer_addr,
458458
&peer_port);
@@ -470,7 +470,7 @@ static void udp_thread_func(void *p1, void *p2, void *p3)
470470
break;
471471
}
472472
if ((fds[SOCK].revents & ZSOCK_POLLHUP) != 0) {
473-
if (proxy.role == UDP_ROLE_SERVER && proxy.sec_tag != INVALID_SEC_TAG) {
473+
if (proxy.role == UDP_ROLE_SERVER && proxy.sec_tag != SEC_TAG_TLS_INVALID) {
474474
util_get_peer_addr((struct sockaddr *)&proxy.remote, peer_addr,
475475
&peer_port);
476476
LOG_INF("DTLS client disconnected: \"%s\",%d\r\n", peer_addr,
@@ -564,7 +564,7 @@ static int handle_at_udp_server(enum at_parser_cmd_type cmd_type, struct at_pars
564564
if (err) {
565565
return err;
566566
}
567-
proxy.sec_tag = INVALID_SEC_TAG;
567+
proxy.sec_tag = SEC_TAG_TLS_INVALID;
568568
if (param_count > 3 &&
569569
at_parser_num_get(parser, 3, &proxy.sec_tag)) {
570570
return -EINVAL;
@@ -623,7 +623,7 @@ static int handle_at_udp_client(enum at_parser_cmd_type cmd_type, struct at_pars
623623
if (err) {
624624
return err;
625625
}
626-
proxy.sec_tag = INVALID_SEC_TAG;
626+
proxy.sec_tag = SEC_TAG_TLS_INVALID;
627627
if (param_count > 4) { /* optional param */
628628
err = at_parser_num_get(parser, 4, &proxy.sec_tag);
629629
if ((err != 0 && err != -EOPNOTSUPP)) {
@@ -744,7 +744,7 @@ static int handle_at_udp_send(enum at_parser_cmd_type cmd_type, struct at_parser
744744
int slm_at_udp_proxy_init(void)
745745
{
746746
proxy.sock = INVALID_SOCKET;
747-
proxy.sec_tag = INVALID_SEC_TAG;
747+
proxy.sec_tag = SEC_TAG_TLS_INVALID;
748748
proxy.efd = INVALID_SOCKET;
749749

750750
return 0;

‎applications/serial_lte_modem/src/slm_defines.h‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@
1111
#include "slm_trap_macros.h"
1212

1313
#define INVALID_SOCKET -1
14-
#define INVALID_SEC_TAG -1
1514
#define INVALID_ROLE -1
1615
#define INVALID_DTLS_CID -1
1716

‎doc/nrf/releases_and_maturity/releases/release-notes-changelog.rst‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -218,7 +218,8 @@ nRF Machine Learning (Edge Impulse)
218218
Serial LTE modem
219219
----------------
220220

221-
|no_changes_yet_note|
221+
* Updated to use the new ``SEC_TAG_TLS_INVALID`` definition as a placeholder for security tags.
222+
222223

223224
Thingy:53: Matter weather station
224225
---------------------------------
@@ -267,6 +268,13 @@ Cellular samples
267268

268269
* Added runtime setting of the log level for the nRF Cloud logging feature.
269270

271+
* Updated the following samples to use the new ``SEC_TAG_TLS_INVALID`` definition:
272+
273+
* :ref:`modem_shell_application`
274+
* :ref:`http_application_update_sample`
275+
* :ref:`http_modem_delta_update_sample`
276+
* :ref:`http_modem_full_update_sample`
277+
270278
Cryptography samples
271279
--------------------
272280

@@ -448,7 +456,11 @@ Multiprotocol Service Layer libraries
448456
Libraries for networking
449457
------------------------
450458

451-
|no_changes_yet_note|
459+
* Updated the following libraries to use the new ``SEC_TAG_TLS_INVALID`` definition for checking whether a security tag is valid:
460+
461+
* :ref:`lib_aws_fota`
462+
* :ref:`lib_fota_download`
463+
* :ref:`lib_ftp_client`
452464

453465
Libraries for NFC
454466
-----------------

0 commit comments

Comments
 (0)