* [Cellular] Add cellulr lib submodule and demo app
* [Cellular] Fix memory violation in transport layer and add using LoggingPrintf
* Update FreeRTOS Cellular Interface
* Change the mbedtls usage in FreeRTOS-Plus
* [Cellular] Fix missing spell
* [Cellular] Add manifest.yml
* Fix missing spell
* Update manifest.yml
* [Cellular] Add integration test
* Modify the demo log level to LOG_INFO
* Update cellular interface
* The modification of the folder structure for cellular library
* Rename the naming of demo
* Adjust the location of using_mbedtls and socket_wrapper
* Adjust project setting for relocating using_mbedtls and socket_wrapper
* Turn off PSM mode
* Add start marker for CI validation.
* The modification for mbedtls platform send/recv function for cellular
* Change the project file due to the changes of mbedtls platform send/recv function for cellular
* Fix missing newline and remove unused file
* Add missing configuration.
* Make cellular and freertos tcp plus use the same transport implementation
* Add comment for the macro MBEDTLS_SSL_SEND and MBEDTLS_SSL_RECV
* Make changes from the github comment.
* Updated submodule libraries to latest release
* Updated pointer for FreeRTOS-Plus-TCP
* Updated README about SNTP
* Updated link for coreSNTP on freertos.org
* Updated corePKCS11 to 'update-pkcs11submodule' branch for testing
* Update corePKCS11 version in manifest.yml
* Updated corePKCS11 pointer to v3.1.0
Co-authored-by: Oscar Michael Abrina <abrinao@amazon.com>
Co-authored-by: Archit Aggarwal <architag@amazon.com>
* Remove submodules of community and partner contribution repos, and stale directory of FreeRTOS+UDP
* Obselete NTP demo and rename of HTTP server demo folder
* Update manifest.yml
Since `mbedtls_error.c` is already part of the mbedTLS submodule, the duplicate files are removed from this repository.
Co-authored-by: Cobus van Eeden <35851496+cobusve@users.noreply.github.com>
Issue
The existing clock discipline algorithm in the coreSNTP demo yields an inaccurate wall-clock time (in UTC) that is always behind the astronomical UTC time by the chosen polling interval period of the demo. The issue with the clock discipline algorithm was that it was calculating the slew rate to make the system clock be gradually compensated for the previous time synchronization clock drift over the period of the subsequent polling time interval. Thereby, the clock slew rate correction calculated is always lower than it should be (because it does not incorporate possible clock drift that would occur over another period of time polling interval till the next time synchronization attempt).
Fix
This PR fixes the clock discipline algorithm to make the demo calculate its system time that matches the astronomical UTC time.
The fix involves simplifying the clock discipline algorithm to use a combination of step and slew correction approaches where:
1. Step correction is applied on EVERY time successful synchronization with a time server. This immediately corrects the system time to match server time.
2. Slew rate is calculated ONCE (on the second successful time synchronization with server) and applied henceforth, on every time polling interval period to compensate gradually for the system clock drift during the period.
This PR makes the following changes in the coreSNTP demo:
To suggest the most secure way of using SNTP communication, we are adding a documentation note about the Network Time Security in the SNTP demo.
Hygiene update of using the FreeRTOS/backoffAlgorithm utility library for calculating time polling period interval backoff when time requests are rejected by a time server.
Issue
There is a possible vulnerability of Denial of Service attack by keeping the UDP socket for the SNTP client task always open in the coreSNTP demo. The Denial of Service attack can occur from receiving multiple server response (duplicated or malicious) for a single SNTP time request sent by the client, and thereby, filing the socket network buffer response packets that affect future time requests.
Solution
This PR fixes this vulnerability by updating the demo to keep a UDP socket open only for the time period of waiting for server response, closing the socket on either receiving a server response or experiencing server timeout, and re-creating a UDP socket for the next polling try. This PR also adds another security functionality using a random port for UDP socket to protect against spoofing attacks from "off-network path" attackers.
Update the coreSNTP submodule to the latest commit. Also, make updates to the coreSNTP demo for the new changes in the SNTP library which include the following:
1. Update to the type for packet size from size_t to uint16_t for parameters in the transport and authentication interfaces.
2. Change in the call to Sntp_SendTimeRequest API to pass the new blockTimeMs parameter added to the API.
3. Update to the clock-offfset type from int32_t to int64_t for representing information in milliseconds. To accommodate this update in the SntpSetTime_t interface, the mathematical model for representing system clock has been updated to store slew rate as milliseconds/second (instead of second/second). This change improves the accuracy of the WinSim demo time correction (because the milliseconds of time difference between server and client time is corrected over the entire polling interval which makes a significant difference!).
This PR also adds demo config macros for setting the block time values passed to the Sntp_SendTimeRequest and Sntp_ReceiveTimeResponse APIs.
Update the coreSNTP demo to showcase use of symmetric key algorithm of authentication scheme for securing SNTP communication between client and server.
The demo uses the AES-128-CMAC algorithm for the generating Message Authentication Code for the client on sending the SNTP time request to server as well as validating the server response received by verifying if the payload present authentication code can be generated. Use of an authentication mechanism in SNTP communication protects against server spoofing attacks as well as man-in-the-middle attacks of server response modification.
The demo uses corePKCS11 library for the AES-CMAC operations. Also, the demo adds functionality of generating random number, using corePKCS11, for sending as a parameter to the Sntp_SendTimeRequest API.
Note: For symmetric key based security mechanism to be protective against malicious, it is IMPORTANT to securely pre-share the symmetric key between client and server.
Add the FreeRTOS/coreSNTP library as a submodule (along with manifest.yaml file update) and add a demo project to showcase use of the coreSNTP library for having a SNTP client daemon in the system for periodically synchronizing system time with the internet to maintain Coordinated Univeral Time (UTC) in a device. This demo maintains UTC time of system in RAM, thereby, representing systems without a Real-Time Clock (RTC) module in the device.
Note: This demo shows use of coreSNTP library for SNTP communication with NTP/SNTP time servers in non-authenticated mode (i.e. without any security mechanism payload beyond the standard 48 bytes of NTP packet exchange between client-server).
* Added spell check
* All words
* Add a missing word
* Fix header checks
* Fix header checks v1
* Fix header check v2
* Updated freertos link in header
* Fixed afr link in the header
* Fix last of header checks
* Update the spell check script to check amazon licensed files only
* Fixed paths and added comments
* Try with modified repo
* Add inplace substitute option to sed
* Use official repo as the spell checker source
* Add vendor file to the ignored list
Co-authored-by: root <root@ip-172-31-5-28.us-west-2.compute.internal>
This change adds the OTA demos and required dependencies and helper components .
* Add demos , configs and project files
* Add subscription manager
* Add HTTP utils
* Submodules the OTA LTS 3.0 Library.
* Add OTA pal
It is recommended by the AWS IoT Jobs service to use DescribeJobExecution API for scaling purposes instead of StartNextPendingJobExecution API. Thus, update the Jobs demo to replace the latter API call with the former API call.
* Clean up demo config for wolfSSL mutual auth.
* Add comment about picking the correct ROOT CA.
* uncrustify using_wolfSSL.c and some other code style changes.
* Apply suggestions from code review
Co-authored-by: Archit Aggarwal <architag@amazon.com>
Add URL file links to the MQTT agent documentation page.
Add comment blocks into each demo that also point toward the MQTT agent documentation to ensure users are aware the agent method exists.
* Set mbedtls submodule tag to v2.24.0
* Update projects
Co-authored-by: Oscar Michael Abrina <abrinao@amazon.com>
Co-authored-by: Cobus van Eeden <35851496+cobusve@users.noreply.github.com>
- Adding a comment to the top of S3 download and multi-threaded download demo source code files, to explain how to handle S3 request limits. This is done to prevent users from treating this case as a bug.
- Increasing ipconfigTCP_RX_BUFFER_LENGTH to 5000, as was done recently for other demos.
andysun2015
Shivangi
chinglee-iot
tianmc1
tianmc1
Archit Aggarwal
Oscar Michael Abrina
thomas-coding
jasonpcarroll
Archit Gupta
Hein Tibosch
Aniruddha Kanhere
Prasad Vyawahare
alfred gedeon
TakayukiMatsuo
Muneeb Ahmed
Carl Lundin
alfred gedeon
Joseph Julicher
Carl Lundin
Sukhmani Minhas
RichardBarry