UA_FileTransferDriver_openHandle creates a Session handle with the checks of
Open, e.g. for OpenWithMasks of a TrustList (Part 12). Its openContext reaches
the backend open.
The backend open gets the caller as a context: the Session of Open, CreateFile
and the copies of MoveOrCopy, NULL for direct calls. Its result reaches the
client.
Restore application contexts before subtree deletion and keep original ownership separate from explicit Delete/move operations. Preserve contexts allocated by constructors for driver-created Objects as well.
Propagate entry metadata errors so a cross-driver move cannot delete an uncopied source file. Add lifecycle and local filesystem regressions covering both findings.
Size, LastModifiedTime, Writable and UserWritable returned the scalar for an
IndexRange (Part 4 7.27). Writable and UserWritable ignored a denied Traverse
on a managed ancestor that Open enforces (Part 20 4.2.1).
The Delete and MoveOrCopy Methods kept application Objects of the removed
storage entries; teardown and refresh still only release them. The subtree
release iterates the children instead of re-reading the child index.
A readdir() error ended the listing early, so a move to another driver could
delete source files that were never copied. Writing a file needs no read
access anymore (Part 20 4.2.2).
UA_GDSReceiver_start did not start when initGDSRolePermissions failed,
but left the push method callbacks installed. The RolePermissions are
one way to restrict the methods to SecurityAdmin (Part 12, 7.10). RBAC
is optional, and the AccessControl plugin can restrict the methods as
well. So a failed role setup is now logged as a warning and the receiver
starts.
Handles survive a vanished file or a replaced parent, Read at the end returns an
empty ByteString, the root is queried with the complete backend, failed starts
are logged and the analyzer accepts releaseSubtree.
refresh-interval 0 disables the timer, UA_FileTransferDriver_refresh() reconciles
on demand. The directory Methods respect max-scan-depth; skipped entries and cut
trees are logged at start and when they change.
Serve a single file or a directory using the shared file backend operations.
Validate relative paths, create entries exclusively, and avoid replacing an
existing rename destination. Support Windows UTF-16 paths and filter links
to directories and special files during enumeration.
Co-authored-by: Julius Pfrommer <julius.pfrommer@o6-automation.com>
Expose one file or directory backend through FileType and FileDirectoryType
Objects. Bind Objects to the driver lifetime, preserve reused application
nodes, and close session handles on stop or session cleanup.
Enforce file and directory access rights in Properties and Methods. Index
entries and handles with zip trees, reconcile storage changes, and retain
removed entries while their handles remain open. Include the reduced
namespace model and compile the driver with Method-call support in every
Namespace Zero configuration. Export the API unconditionally.
Co-authored-by: Julius Pfrommer <julius.pfrommer@o6-automation.com>
Port keyless certificate validation into the GDS receiver driver instead
of restoring the removed server implementation. Preserve master's timer
batching, PubSub lifecycle and client HTTP configuration handling.
Adapt Publish cancellation to response tokens and the HEL/fuzz harnesses
to the explicit TCP driver. Keep SKS policy history and custom datatype
ownership intact, including failed replacement configuration cleanup.
Retain TPM error cleanup while enforcing key-handle and nonce lengths.
Validation:
- Full mbedTLS unit-test build with full namespace, GDS, SKS and Query.
- 21 affected suites passed with ASan/UBSan, plus 9 isolated SKS ownership
and lifecycle checks.
- OpenSSL certificate update, GDS information model and client encryption
suites passed with sanitizers.
- OPN, MSG and binary-message fuzzers each completed 100 sanitizer runs.
- Both TPM PubSub policy sources passed compilation checks.
The full SKS client suite timed out after multicast UDP sends reported
"No route to host" on this machine; its affected ownership and lifecycle
cases passed separately. No live TPM hardware validation was performed.
Open was refused while any transaction was pending, also for the session
that owns it, so UpdateCertificate followed by a TrustList write failed.
Part 12 §7.8.2.2 says a write-mode Open continues an existing transaction.
Allow that for the owner unless ApplyChanges is queued; OpenWithMasks and
other sessions still get BadTransactionPending. Close discards only the
written data and keeps the staged changes. ApplyChanges refuses to run
while any TrustList is open for writing (§7.10.9).
CertificateTypes always listed RsaMin and RsaSha256. With no RsaMin policy
configured (the default), an RsaMin UpdateCertificate and ApplyChanges
answered Good without changing anything, and CreateSigningRequest returned
an empty CSR. Now only types with an endpoint policy in the
DefaultApplicationGroup are advertised. UpdateCertificate and
CreateSigningRequest refuse the others with BadInvalidArgument (Part 12
7.10.5, 7.10.10), and applying a type that no policy uses is an error.
SetPosition read its UInt64 Position argument through a UInt32 pointer.
Offsets above 4 GiB were truncated, and big-endian targets read the wrong
half. Read the argument with its declared type.
Private keys staged by UpdateCertificate were freed without zeroing, when
they were replaced, on allocation failures and when the transaction ended.
Zero them with UA_ByteString_memZero first, as the CSR path already does.
RemoveCertificate creates a transaction and applies it right away. When
the TrustList could not be copied into the transaction, it returned with
the transaction still pending and no session watchdog installed, so all
later TrustList changes were refused. Clear the transaction on that path.
ApplyChanges defers the completion of the transaction to a delayed
callback. An UpdateCertificate in between was accepted into the queued
transaction and then silently discarded with it. Refuse it with
BadTransactionPending until the transaction is completed.
ApplyChanges compared the caller with the owner of the transaction before
checking its state. A fresh transaction has no owner, so every caller got
BadUserAccessDenied. Check the state first, as Part 12 §7.10.9 requires.
After a certificate push the SecurityPolicy#None endpoint kept presenting
the replaced certificate, while the encrypted endpoints showed the new one.
A None SecurityPolicy with a replaced certificate is now updated as well.
Part 12 says a null CertificateGroupId selects the DefaultApplicationGroup.
The GDS receiver rejected it with Bad_NotSupported, so GDS pushes failed.
An unsupported group or type now returns Bad_InvalidArgument as specified.
Fix misspellings found with codespell across headers, sources, examples,
tests and the documentation, including "propably" in the nodeset
compiler docs. Identifiers, companion spec names and generated code are
left untouched.
The mDNSd driver used listen=true for both UDP connections. The POSIX connection manager therefore created two receive sockets. Calls to sendto on the second socket failed with EINVAL.
Set listen=false before the driver opens the send connection. The regression test verifies one receive connection and one send connection at startup.
Andreas Ebner