Files
Michael Sauer 2e90b8fd06 fix: kleinere Netzwerk-Härtungen
M2: WLAN-Passwort muss leer (offenes Netz) oder 8..64 Zeichen lang sein
(400 "invalid password" bei 1..7 Zeichen). CMake prüft NINLIGHT_WIFI_PASSWORD
ebenso (0 oder 8..63 Zeichen) und der Zeichen-Blacklist-Check bekommt `;`
dazu.

M4: Ein Authorization-Wert, der länger als NL_TOKEN_LEN-1 (64) ist, wird
von nl_http_parse() nicht mehr stillschweigend abgeschnitten, sondern setzt
`auth_too_long` in nl_http_request_t; nl_api_handle() behandelt eine solche
Anfrage als unauthentifiziert (außer bei offenem Zugriff), damit ein
abgeschnittener Wert nie zufällig auf ein kürzeres Token passt.

M5: get_int() prüfte die (long)-Cast-Gleichheit vor dem Bereichscheck -
bei sehr großen oder NaN-Werten ist der Cast von double nach long
undefiniertes Verhalten. Bereichs- und NaN-Check laufen jetzt vor dem Cast.

T1: sdk/Platform/Drivers/internalflash/wm_internal_fls.c: tls_fls_init()
ignorierte den Rückgabewert von tls_os_sem_create(&s_fls2_lock, 1) - jetzt
eine TLS_DBGPRT_ERR-Meldung, falls das fehlschlägt (dokumentiert in
sdk/PATCHES.md).

Tests: test_api.c (Passwortlängen, auth_too_long, 1e300-Brightness),
test_http.c (auth_too_long wird gesetzt). Für M5 zeigt der Host-Test kein
sichtbares RED, weil der (double)->(long)-Cast auf dieser Plattform/diesem
Compiler keinen Crash auslöst (implementation-defined statt UB-Crash) - der
Fix wird trotzdem angewendet, da er auf dem Zielcompiler (arm-none-eabi 4.9)
nicht garantiert sicher ist.
2026-09-11 23:52:03 +02:00

136 lines
4.9 KiB
C

#include <stdio.h>
#include <string.h>
#include "unity.h"
#include "net/nl_http.h"
void setUp(void) {}
void tearDown(void) {}
static nl_http_parse_t parse(const char *s, nl_http_request_t *r)
{
return nl_http_parse(s, strlen(s), r);
}
static void test_simple_get(void)
{
nl_http_request_t r;
TEST_ASSERT_EQUAL(NL_HTTP_COMPLETE, parse("GET /api/v1/device/state HTTP/1.1\r\nHost: x\r\n\r\n", &r));
TEST_ASSERT_EQUAL(NL_HTTP_GET, r.method);
TEST_ASSERT_EQUAL_STRING("/api/v1/device/state", r.path);
TEST_ASSERT_EQUAL_STRING("", r.auth);
TEST_ASSERT_EQUAL_UINT(0, r.body_len);
}
static void test_post_body_arrives_in_parts(void)
{
const char *full = "POST /api/v1/device/state HTTP/1.1\r\nContent-Length: 11\r\n\r\n{\"on\":true}";
nl_http_request_t r;
TEST_ASSERT_EQUAL(NL_HTTP_INCOMPLETE, nl_http_parse(full, 20, &r));
TEST_ASSERT_EQUAL(NL_HTTP_INCOMPLETE, nl_http_parse(full, strlen(full) - 1, &r));
TEST_ASSERT_EQUAL(NL_HTTP_COMPLETE, nl_http_parse(full, strlen(full), &r));
TEST_ASSERT_EQUAL(NL_HTTP_POST, r.method);
TEST_ASSERT_EQUAL_UINT(11, r.body_len);
TEST_ASSERT_EQUAL_MEMORY("{\"on\":true}", r.body, 11);
}
static void test_headers_case_insensitive_and_bearer(void)
{
nl_http_request_t r;
TEST_ASSERT_EQUAL(NL_HTTP_COMPLETE,
parse("PUT /api/v1/system/command HTTP/1.1\r\nauthorization: Bearer abc123\r\n"
"CONTENT-LENGTH: 2\r\n\r\n{}", &r));
TEST_ASSERT_EQUAL(NL_HTTP_PUT, r.method);
TEST_ASSERT_EQUAL_STRING("abc123", r.auth);
TEST_ASSERT_EQUAL_UINT(2, r.body_len);
TEST_ASSERT_FALSE(r.auth_too_long);
}
static void test_auth_too_long_sets_flag(void)
{
/* M4: token max is 64 chars (NL_TOKEN_LEN - 1); one char beyond that must be flagged
* rather than silently truncated and possibly matching by accident. */
char hdr[128];
nl_http_request_t r;
char token[66];
memset(token, 'a', sizeof token - 1);
token[sizeof token - 1] = '\0'; /* 65 chars: one more than NL_TOKEN_LEN - 1 */
snprintf(hdr, sizeof hdr, "GET / HTTP/1.1\r\nAuthorization: %s\r\n\r\n", token);
TEST_ASSERT_EQUAL(NL_HTTP_COMPLETE, parse(hdr, &r));
TEST_ASSERT_TRUE(r.auth_too_long);
}
static void test_plain_token_and_query_string(void)
{
nl_http_request_t r;
TEST_ASSERT_EQUAL(NL_HTTP_COMPLETE,
parse("GET /api/v1/system/info?x=1 HTTP/1.0\r\nAuthorization: aabbccddeeff0011223344\r\n\r\n", &r));
TEST_ASSERT_EQUAL_STRING("/api/v1/system/info", r.path);
TEST_ASSERT_EQUAL_STRING("aabbccddeeff0011223344", r.auth);
}
static void test_other_method(void)
{
nl_http_request_t r;
TEST_ASSERT_EQUAL(NL_HTTP_COMPLETE, parse("DELETE /api/v1/device/state HTTP/1.1\r\n\r\n", &r));
TEST_ASSERT_EQUAL(NL_HTTP_OTHER, r.method);
}
static void test_body_too_large(void)
{
nl_http_request_t r;
TEST_ASSERT_EQUAL(NL_HTTP_TOO_LARGE, parse("POST / HTTP/1.1\r\nContent-Length: 1025\r\n\r\n", &r));
}
static void test_headers_never_end(void)
{
static char buf[NL_HTTP_MAX_REQUEST];
nl_http_request_t r;
memset(buf, 'a', sizeof buf);
memcpy(buf, "GET / HTTP/1.1\r\n", 16);
TEST_ASSERT_EQUAL(NL_HTTP_TOO_LARGE, nl_http_parse(buf, sizeof buf, &r));
TEST_ASSERT_EQUAL(NL_HTTP_INCOMPLETE, nl_http_parse(buf, 100, &r));
}
static void test_bad_requests(void)
{
nl_http_request_t r;
char longpath[200];
TEST_ASSERT_EQUAL(NL_HTTP_BAD_REQUEST, parse("GET /x\r\n\r\n", &r));
TEST_ASSERT_EQUAL(NL_HTTP_BAD_REQUEST, parse("GET /x FTP/1.1\r\n\r\n", &r));
TEST_ASSERT_EQUAL(NL_HTTP_BAD_REQUEST, parse("\r\n\r\n", &r));
TEST_ASSERT_EQUAL(NL_HTTP_BAD_REQUEST, parse("POST / HTTP/1.1\r\nContent-Length: abc\r\n\r\n", &r));
strcpy(longpath, "GET /");
memset(longpath + 5, 'p', 100);
strcpy(longpath + 105, " HTTP/1.1\r\n\r\n");
TEST_ASSERT_EQUAL(NL_HTTP_BAD_REQUEST, parse(longpath, &r));
}
static void test_response(void)
{
char out[256];
size_t n = nl_http_response(out, sizeof out, 404, "{\"error\":\"not found\"}");
TEST_ASSERT_EQUAL_STRING("HTTP/1.1 404 Not Found\r\nContent-Type: application/json\r\n"
"Content-Length: 21\r\nConnection: close\r\n\r\n{\"error\":\"not found\"}", out);
TEST_ASSERT_EQUAL_UINT(strlen(out), n);
TEST_ASSERT_EQUAL_UINT(0, nl_http_response(out, 20, 200, "{}"));
TEST_ASSERT_EQUAL_STRING("Accepted", nl_http_reason(202));
TEST_ASSERT_EQUAL_STRING("Payload Too Large", nl_http_reason(413));
TEST_ASSERT_EQUAL_STRING("Not Implemented", nl_http_reason(501));
}
int main(void)
{
UNITY_BEGIN();
RUN_TEST(test_simple_get);
RUN_TEST(test_post_body_arrives_in_parts);
RUN_TEST(test_headers_case_insensitive_and_bearer);
RUN_TEST(test_auth_too_long_sets_flag);
RUN_TEST(test_plain_token_and_query_string);
RUN_TEST(test_other_method);
RUN_TEST(test_body_too_large);
RUN_TEST(test_headers_never_end);
RUN_TEST(test_bad_requests);
RUN_TEST(test_response);
return UNITY_END();
}