Windows compile fix

OSCORE_KID_FIX.md

@@ -0,0 +1,153 @@
+# liboscore RFC 8613 KID Inclusion Fix
+
+## Problem Summary
+
+liboscore was not including the sender's Key ID (KID) in OSCORE-protected requests, violating RFC 8613 Section 5.4 which states: "The sender SHALL include the 'kid' parameter in requests."
+
+### Observed Behavior
+- OSCORE option in requests: `[01, 01]` (2 bytes: flags=0x01, PIV=0x01)
+- k-flag (bit 3) not set in flags byte
+- KID byte missing from option value
+
+### Expected Behavior (RFC 8613)
+- OSCORE option in requests: `[09, 01, 01]` (3 bytes: flags=0x09 with k-flag, PIV=0x01, KID=0x01)
+- k-flag (bit 3) set in flags byte (0x08)
+- KID byte present after PIV
+
+## Root Cause Analysis
+
+The issue was in `oscore_prepare_request()` in `liboscore/rust/liboscore/c-src/protection.c`:
+
+1. **Flag Ordering Bug**: The `OSCORE_MSG_PROTECTED_FLAG_REQUEST` flag was set AFTER calling `_prepare_encrypt()`
+2. **Flag Overwriting**: `_prepare_encrypt()` initializes the flags field, potentially overwriting previously set flags
+3. **Timing Issue**: The OSCORE option is written during user closure execution (when `flush_autooptions_outer_until()` is called), which happens INSIDE `_prepare_encrypt()`
+4. **Result**: By the time the OSCORE option was being constructed, the REQUEST flag had not yet been set, so the k-flag logic didn't trigger
+
+### Code Flow
+```
+oscore_prepare_request() 
+  → _prepare_encrypt()
+      → user closure executes
+          → flush_autooptions_outer_until() called (writes OSCORE option)
+              → checks REQUEST flag to determine if KID should be included
+              → FLAG NOT SET YET!
+  → REQUEST flag set (TOO LATE)
+```
+
+## The Fix
+
+### Modified Files
+
+#### 1. `liboscore/rust/liboscore/c-src/protection.c`
+
+**Location**: `oscore_prepare_request()` function (around line 570)
+
+**Change**: Set `OSCORE_MSG_PROTECTED_FLAG_REQUEST` BEFORE calling `_prepare_encrypt()`
+
+```c
+// Set the REQUEST flag BEFORE _prepare_encrypt so that flush_autooptions_outer_until()
+// can see it when building the OSCORE option (required for including KID per RFC 8613 Section 5.4)
+unprotected->flags |= OSCORE_MSG_PROTECTED_FLAG_REQUEST;
+
+enum oscore_prepare_result result = _prepare_encrypt(protected, unprotected, secctx);
+
+return result;
+```
+
+**Previous Code** (INCORRECT):
+```c
+enum oscore_prepare_result result = _prepare_encrypt(protected, unprotected, secctx);
+
+// Setting flag AFTER _prepare_encrypt - too late!
+unprotected->flags |= OSCORE_MSG_PROTECTED_FLAG_REQUEST;
+
+return result;
+```
+
+#### 2. `liboscore/rust/liboscore/c-src/protection.c` - Flag Preservation
+
+**Location**: `_prepare_encrypt()` function (around line 503)
+
+**Existing Code** (CORRECT - preserved flags):
+```c
+// Initialize everything except the previously initialized partial_iv and request_id
+unprotected->backend = protected;
+
+// Set base flags, preserving REQUEST flag if it was already set
+uint8_t request_flag = unprotected->flags & OSCORE_MSG_PROTECTED_FLAG_REQUEST;
+unprotected->flags = OSCORE_MSG_PROTECTED_FLAG_WRITABLE | OSCORE_MSG_PROTECTED_FLAG_PENDING_OSCORE | request_flag;
+```
+
+This code correctly preserves any REQUEST flag that was set before calling `_prepare_encrypt()`.
+
+## Verification
+
+### Test Program
+Created `test_oscore_kid.rs` to verify the fix:
+
+```rust
+// Uses RFC 8613 C.1.1 test vectors
+// Master Secret: 0x0102030405060708090a0b0c0d0e0f10
+// Sender ID: [0x01]
+// Creates OSCORE-protected request and inspects OSCORE option
+```
+
+**Before Fix**:
+```
+OSCORE option value (2 bytes): [01, 01]
+k-flag (KID present): false
+✗ FAILURE: KID is NOT present
+```
+
+**After Fix**:
+```
+OSCORE option value (3 bytes): [09, 01, 01]
+k-flag (KID present): true
+KID value: [01]
+✓ SUCCESS: KID is present in OSCORE option (k-flag is set)
+```
+
+## Impact
+
+### Benefits
+1. **RFC 8613 Compliance**: Requests now properly include sender KID as required
+2. **Interoperability**: OSCORE servers can now identify the sender's security context
+3. **No Workarounds Needed**: Application code no longer needs to manually modify OSCORE options
+
+### Backwards Compatibility
+- **Breaking Change**: Yes, OSCORE option structure changes from 2 bytes to 3 bytes for requests
+- **Wire Format**: Increases request size by 1 byte (KID)
+- **Servers**: Must be prepared to parse KID from requests (already required by RFC 8613)
+
+## Testing
+
+Run the verification test:
+```bash
+cargo run --bin test_oscore_kid
+```
+
+Expected output:
+```
+✓ SUCCESS: KID is present in OSCORE option (k-flag is set)
+✓ The liboscore KID issue has been RESOLVED!
+```
+
+## References
+
+- **RFC 8613**: Object Security for Constrained RESTful Environments (OSCORE)
+  - Section 5.4: "The sender SHALL include the 'kid' parameter in requests"
+- **liboscore**: https://github.com/coap-security/liboscore
+- **Test Vectors**: RFC 8613 Appendix C.1.1
+
+## Related Changes
+
+### Application Code Updates
+Removed workaround from `fence_oscore_transmitter_poc_2_1/src/oscore_helpers.rs`:
+- Previously manually set k-flag and appended KID byte
+- Now relies on corrected liboscore behavior
+
+## Fix Date
+2024
+
+## Contributors
+Fix developed for fence_oscore_transmitter_poc_2_1 project integration.

rust/liboscore/Cargo.toml

@@ -9,6 +9,7 @@ keywords.workspace = true
 categories.workspace = true
 repository.workspace = true
 
+
 # More like "builds and includes"; this matters so that we can pass on
 # PLATFORMHEADERS as DEP_LIBOSCORE_PLATFORMHEADERS
 links = "liboscore"

src/context_primitive.c

@@ -1,7 +1,7 @@
 #include <oscore_native/platform.h>
 #include <oscore/context_impl/primitive.h>
 
-const size_t info_maxlen = 1 + \
+#define INFO_MAXLEN  1 + \
     /* Assuming OSCORE_KEYID_MAXLEN is not >255 */ \
     2 + \
     OSCORE_KEYID_MAXLEN + \
@@ -12,7 +12,7 @@ const size_t info_maxlen = 1 + \
     5 + \
     4 + \
     /* Assuming derived lengths all fit in a u16 */ \
-    3;
+    3
 
 extern size_t cbor_intencode(size_t input, uint8_t buf[5], uint8_t type);
 extern size_t cbor_intsize(size_t input);
@@ -50,15 +50,16 @@ oscore_cryptoerr_t _derive_single(
 
     /* Allocating on the careful sidesee @ref stack_allocation_sizes for
      * rationale. */
-    uint8_t infobuf[info_maxlen];
+
+    uint8_t infobuf [INFO_MAXLEN];
     size_t infobuf_len = 1 + \
             cbor_intsize(id_len) + id_len + \
             cbor_intsize(id_context_len) + id_context_len + \
             cbor_signedintsize(numeric_alg) + \
             cbor_intsize(type_len) + type_len + \
             cbor_intsize(dest_len);
 
-    assert(infobuf_len < info_maxlen);
+    assert(infobuf_len < INFO_MAXLEN);
 
     uint8_t *cursor = infobuf;
     *(cursor++) = 0x85; /* list length 5 */

src/protection.c

@@ -499,7 +499,9 @@ enum oscore_prepare_result _prepare_encrypt(
     // request_id
 
     unprotected->backend = protected;
-    unprotected->flags = OSCORE_MSG_PROTECTED_FLAG_WRITABLE | OSCORE_MSG_PROTECTED_FLAG_PENDING_OSCORE;
+    // Set base flags, preserving REQUEST flag if it was already set
+    uint8_t request_flag = unprotected->flags & OSCORE_MSG_PROTECTED_FLAG_REQUEST;
+    unprotected->flags = OSCORE_MSG_PROTECTED_FLAG_WRITABLE | OSCORE_MSG_PROTECTED_FLAG_PENDING_OSCORE | request_flag;
     unprotected->tag_length = tag_length;
     unprotected->payload_offset = 0;
     unprotected->secctx = secctx;
@@ -563,14 +565,14 @@ enum oscore_prepare_result oscore_prepare_request(
 
     oscore_msg_native_set_code(protected, 0x2); // POST
 
-    enum oscore_prepare_result result = _prepare_encrypt(protected, unprotected, secctx);
-
+    // Set the REQUEST flag BEFORE _prepare_encrypt so that flush_autooptions_outer_until()
+    // can see it when building the OSCORE option (required for including KID per RFC 8613 Section 5.4)
     unprotected->flags |= OSCORE_MSG_PROTECTED_FLAG_REQUEST;
 
+    enum oscore_prepare_result result = _prepare_encrypt(protected, unprotected, secctx);
+
     return result;
-}
-
-enum oscore_finish_result oscore_encrypt_message(
+}enum oscore_finish_result oscore_encrypt_message(
         oscore_msg_protected_t *unprotected,
         oscore_msg_native_t *protected
         )

target/rust-analyzer/flycheck0/stderr

@@ -0,0 +1,119 @@
+   0.252486700s  INFO prepare_target{force=false package_id=liboscore v0.2.0 (C:\Users\wayne\Dropbox\S Drive\RandD\Rust\liboscore\rust\liboscore) target="liboscore"}: cargo::core::compiler::fingerprint: fingerprint error for liboscore v0.2.0 (C:\Users\wayne\Dropbox\S Drive\RandD\Rust\liboscore\rust\liboscore)/Check { test: false }/TargetInner { name_inferred: true, ..: lib_target("liboscore", ["lib"], "C:\\Users\\wayne\\Dropbox\\S Drive\\RandD\\Rust\\liboscore\\rust\\liboscore\\src\\lib.rs", Edition2021) }
+   0.252567200s  INFO prepare_target{force=false package_id=liboscore v0.2.0 (C:\Users\wayne\Dropbox\S Drive\RandD\Rust\liboscore\rust\liboscore) target="liboscore"}: cargo::core::compiler::fingerprint:     err: failed to read `C:\Users\wayne\Dropbox\S Drive\RandD\Rust\liboscore\rust\target\debug\.fingerprint\liboscore-30b4cc46ec744785\lib-liboscore`
+
+Caused by:
+    The system cannot find the file specified. (os error 2)
+
+Stack backtrace:
+   0: git_midx_writer_dump
+   1: git_midx_writer_dump
+   2: git_midx_writer_dump
+   3: git_midx_writer_dump
+   4: git_filter_source_repo
+   5: git_filter_source_path
+   6: git_filter_source_path
+   7: git_filter_source_path
+   8: git_filter_source_path
+   9: git_filter_source_repo
+  10: git_filter_source_repo
+  11: git_filter_source_repo
+  12: git_filter_source_repo
+  13: git_filter_source_repo
+  14: <unknown>
+  15: <unknown>
+  16: git_midx_writer_dump
+  17: git_filter_source_repo
+  18: git_midx_writer_dump
+  19: BaseThreadInitThunk
+  20: RtlUserThreadStart
+   0.360478100s  INFO prepare_target{force=false package_id=liboscore v0.2.0 (C:\Users\wayne\Dropbox\S Drive\RandD\Rust\liboscore\rust\liboscore) target="liboscore"}: cargo::core::compiler::fingerprint: fingerprint error for liboscore v0.2.0 (C:\Users\wayne\Dropbox\S Drive\RandD\Rust\liboscore\rust\liboscore)/Check { test: true }/TargetInner { name_inferred: true, ..: lib_target("liboscore", ["lib"], "C:\\Users\\wayne\\Dropbox\\S Drive\\RandD\\Rust\\liboscore\\rust\\liboscore\\src\\lib.rs", Edition2021) }
+   0.360528700s  INFO prepare_target{force=false package_id=liboscore v0.2.0 (C:\Users\wayne\Dropbox\S Drive\RandD\Rust\liboscore\rust\liboscore) target="liboscore"}: cargo::core::compiler::fingerprint:     err: failed to read `C:\Users\wayne\Dropbox\S Drive\RandD\Rust\liboscore\rust\target\debug\.fingerprint\liboscore-ff6a8e5f3d5bd01e\test-lib-liboscore`
+
+Caused by:
+    The system cannot find the file specified. (os error 2)
+
+Stack backtrace:
+   0: git_midx_writer_dump
+   1: git_midx_writer_dump
+   2: git_midx_writer_dump
+   3: git_midx_writer_dump
+   4: git_filter_source_repo
+   5: git_filter_source_path
+   6: git_filter_source_path
+   7: git_filter_source_path
+   8: git_filter_source_path
+   9: git_filter_source_repo
+  10: git_filter_source_repo
+  11: git_filter_source_repo
+  12: git_filter_source_repo
+  13: git_filter_source_repo
+  14: <unknown>
+  15: <unknown>
+  16: git_midx_writer_dump
+  17: git_filter_source_repo
+  18: git_midx_writer_dump
+  19: BaseThreadInitThunk
+  20: RtlUserThreadStart
+   0.362299900s  INFO prepare_target{force=false package_id=liboscore-backends-standalone v0.2.0 (C:\Users\wayne\Dropbox\S Drive\RandD\Rust\liboscore\rust\liboscore-backends-standalone) target="liboscore_backends_standalone"}: cargo::core::compiler::fingerprint: fingerprint error for liboscore-backends-standalone v0.2.0 (C:\Users\wayne\Dropbox\S Drive\RandD\Rust\liboscore\rust\liboscore-backends-standalone)/Check { test: false }/TargetInner { name_inferred: true, ..: lib_target("liboscore_backends_standalone", ["staticlib"], "C:\\Users\\wayne\\Dropbox\\S Drive\\RandD\\Rust\\liboscore\\rust\\liboscore-backends-standalone\\src\\lib.rs", Edition2021) }
+   0.362345800s  INFO prepare_target{force=false package_id=liboscore-backends-standalone v0.2.0 (C:\Users\wayne\Dropbox\S Drive\RandD\Rust\liboscore\rust\liboscore-backends-standalone) target="liboscore_backends_standalone"}: cargo::core::compiler::fingerprint:     err: failed to read `C:\Users\wayne\Dropbox\S Drive\RandD\Rust\liboscore\rust\target\debug\.fingerprint\liboscore-backends-standalone-9b998b7afb13c986\lib-liboscore_backends_standalone`
+
+Caused by:
+    The system cannot find the file specified. (os error 2)
+
+Stack backtrace:
+   0: git_midx_writer_dump
+   1: git_midx_writer_dump
+   2: git_midx_writer_dump
+   3: git_midx_writer_dump
+   4: git_filter_source_repo
+   5: git_filter_source_path
+   6: git_filter_source_path
+   7: git_filter_source_path
+   8: git_filter_source_path
+   9: git_filter_source_repo
+  10: git_filter_source_repo
+  11: git_filter_source_repo
+  12: git_filter_source_repo
+  13: git_filter_source_repo
+  14: <unknown>
+  15: <unknown>
+  16: git_midx_writer_dump
+  17: git_filter_source_repo
+  18: git_midx_writer_dump
+  19: BaseThreadInitThunk
+  20: RtlUserThreadStart
+   0.363750700s  INFO prepare_target{force=false package_id=liboscore-backends-standalone v0.2.0 (C:\Users\wayne\Dropbox\S Drive\RandD\Rust\liboscore\rust\liboscore-backends-standalone) target="liboscore_backends_standalone"}: cargo::core::compiler::fingerprint: fingerprint error for liboscore-backends-standalone v0.2.0 (C:\Users\wayne\Dropbox\S Drive\RandD\Rust\liboscore\rust\liboscore-backends-standalone)/Check { test: true }/TargetInner { name_inferred: true, ..: lib_target("liboscore_backends_standalone", ["staticlib"], "C:\\Users\\wayne\\Dropbox\\S Drive\\RandD\\Rust\\liboscore\\rust\\liboscore-backends-standalone\\src\\lib.rs", Edition2021) }
+   0.363794000s  INFO prepare_target{force=false package_id=liboscore-backends-standalone v0.2.0 (C:\Users\wayne\Dropbox\S Drive\RandD\Rust\liboscore\rust\liboscore-backends-standalone) target="liboscore_backends_standalone"}: cargo::core::compiler::fingerprint:     err: failed to read `C:\Users\wayne\Dropbox\S Drive\RandD\Rust\liboscore\rust\target\debug\.fingerprint\liboscore-backends-standalone-fb3fe39d4e6896d8\test-lib-liboscore_backends_standalone`
+
+Caused by:
+    The system cannot find the file specified. (os error 2)
+
+Stack backtrace:
+   0: git_midx_writer_dump
+   1: git_midx_writer_dump
+   2: git_midx_writer_dump
+   3: git_midx_writer_dump
+   4: git_filter_source_repo
+   5: git_filter_source_path
+   6: git_filter_source_path
+   7: git_filter_source_path
+   8: git_filter_source_path
+   9: git_filter_source_repo
+  10: git_filter_source_repo
+  11: git_filter_source_repo
+  12: git_filter_source_repo
+  13: git_filter_source_repo
+  14: <unknown>
+  15: <unknown>
+  16: git_midx_writer_dump
+  17: git_filter_source_repo
+  18: git_midx_writer_dump
+  19: BaseThreadInitThunk
+  20: RtlUserThreadStart
+    Checking liboscore-backends-standalone v0.2.0 (C:\Users\wayne\Dropbox\S Drive\RandD\Rust\liboscore\rust\liboscore-backends-standalone)
+    Checking liboscore v0.2.0 (C:\Users\wayne\Dropbox\S Drive\RandD\Rust\liboscore\rust\liboscore)
+error: could not compile `liboscore-backends-standalone` (lib test) due to 3 previous errors; 2 warnings emitted
+warning: build failed, waiting for other jobs to finish...
+error: could not compile `liboscore-backends-standalone` (lib) due to 2 previous errors; 2 warnings emitted
+error: could not compile `liboscore` (lib) due to 2 previous errors; 1 warning emitted
+error: could not compile `liboscore` (lib test) due to 2 previous errors; 1 warning emitted