Thread SDK / OTA bug

RE: Thread SDK / OTA bug

Piotr Szkotak — Wed, 10 Mar 2021 09:31:58 GMT

Hi krbvroc1,

Thanks for your patience.

The issue is related to the heap memory. Both DFU and Thread Commissioning use the mem manager to allocate the memory.

The following changes in the sdk_config.h solve the problem with the Thread DFU Client Commissioning.

#define MEMORY_MANAGER_XSMALL_BLOCK_COUNT 4 (line 1982).

#define MEMORY_MANAGER_XXSMALL_BLOCK_COUNT 28 (line 1996).

Please note that if your application uses the memory allocated by the memory manager this values may not be sufficient.

In that case I recommend to switch on logging (#define MEM_MANAGER_CONFIG_LOG_ENABLED 1) and possibly limit the number of log messagess with setting the default log level to error for all components (#define NRF_LOG_DEFAULT_LEVEL 1).

Then I would modify the mem_manager.c:719 to:

        NRF_LOG_ERROR("Memory reservation result %d, memory %p, size %d!",
                err_code,
                (uint32_t)(*pp_buffer),
                (*p_size));

Then the RTT console would nicely report what buffer allocation failed and you can increase the count of those.

Best regards,

Piotr Szkotak

RE: Thread SDK / OTA bug

krbvroc1 — Thu, 11 Feb 2021 16:07:29 GMT

Here you go...

JoinFail_DTLS.pcapng

JoinSuccess_DTLS.pcapng

RE: Thread SDK / OTA bug

Achim Kraus — Thu, 11 Feb 2021 08:58:51 GMT

Just, if providing the captures it too complex, you may also get some textual copies by selecting a item an use the context menu for "copy -> All visible selected tree items".

Cipher Suites (1 suite)
    Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 (0xc0ae)

Extension: supported_groups (len=6)
    Type: supported_groups (10)
    Length: 6
    Supported Groups List Length: 4
    Supported Groups (2 groups)
        Supported Group: secp256r1 (0x0017)
        Supported Group: secp384r1 (0x0018)

Extension: signature_algorithms (len=6)
    Type: signature_algorithms (13)
    Length: 6
    Signature Hash Algorithms Length: 4
    Signature Hash Algorithms (2 algorithms)
        Signature Algorithm: ecdsa_secp256r1_sha256 (0x0403)
            Signature Hash Algorithm Hash: SHA256 (4)
            Signature Hash Algorithm Signature: ECDSA (3)
        Signature Algorithm: rsa_pkcs1_sha256 (0x0401)
            Signature Hash Algorithm Hash: SHA256 (4)
            Signature Hash Algorithm Signature: RSA (1)

That's an example with the cipher suite list (1)

though it uses ecdsa/ecdhe with the supported groups,

though it uses ecdsa with the supported signature algorithms,

RE: Thread SDK / OTA bug

Achim Kraus — Thu, 11 Feb 2021 08:45:45 GMT

"pretty close" or "identical"?

The success of the handshake depends not only on the list of cipher suites, for some there are additional parameters, which may cause the "incompatibility".

Just if you want, you may zip the capture(s) of two client_hellos and provide this somehow to me. On way to do that would be to create an issue in "Eclipse/Californium"'s github and "drag and drop" the zipped capture there. Please ensure, you only provide the two client_hellos and not other traffic!

RE: Thread SDK / OTA bug

krbvroc1 — Wed, 10 Feb 2021 23:45:57 GMT

The DTLS Client Hello is pretty close to identical. The one difference is that in the successful handshake, according to Wireshark, the successful handshake contains an extra 334 bytes at the end. Wireshark labels that as an Extension of Unknown type 256 that contains 330 bytes. The failed example is missing that part of the Client Hello. Other than that, everything else appears identical.

RE: Thread SDK / OTA bug

Achim Kraus — Tue, 09 Feb 2021 19:25:50 GMT

Such failures are mostly caused by not proper setup/configured dtls-libraries. Maybe you need to enable the right cipher suites (and disable the not supported ones in order to get a small hello_client),

If you're able to capture a successful handshake and the failing one, I may check, what I see.

I'm not sure, if this short instructions work in your case

Logs and IP Capturing ‐ How To Provide The Right Information

but at least, it's point to start.

RE: Thread SDK / OTA bug

krbvroc1 — Mon, 08 Feb 2021 14:49:18 GMT

I have setup a border router with some debugging information. I am finding the following error message on the border router when commissioning fails. I am 99% sure it is somehow related to nrf_security being initialized / used. Maybe this helps whomever is researching it.

SECURITY: SSL - None of the common ciphersuites is usable (eg, no suitable certificate, see debug messages)

RE: Thread SDK / OTA bug

krbvroc1 — Fri, 05 Feb 2021 17:02:29 GMT

In your experience, how long before I should expect some workaround or fix? As I mentioned in one of my responses, because I had to rewrite all my CoAP interface code to use the IoT CoAP stack rather than the Openthread CoAP stack, I am left in a situation where I cannot proceed with development of the two feature I am currently working on... Thread DFU updates and Device commissioning.

RE: Thread SDK / OTA bug

Jørgen Holmefjord — Thu, 04 Feb 2021 15:16:06 GMT

I have recreated the problem on my setup, and have created an internal report of the issue.

Will get back to you as soon as I have some more information to share.

RE: Thread SDK / OTA bug

krbvroc1 — Mon, 01 Feb 2021 14:49:12 GMT

The thread/cli example (which does not use the nrf_crypto libraries) works fine. That was my initial baseline, but I had to rebase my code to the thread/dfu/client to add background OTA DFU behavior. It was a lot of work too because it meant I needed to rewrite all my code to use the IoT CoAP stack rather than the Openthread CoAP stack to coexists. Regardless, I found the problem easy to reproduce as I describe above. Thanks and looking forward to a solution so i can continue development.

RE: Thread SDK / OTA bug

Jørgen Holmefjord — Mon, 01 Feb 2021 14:44:03 GMT

Hi,

I will try to reproduce this behavior, but just wanted to ask first if you have reproduced this with any other examples (for instance the CLI example), or if it only happens with the DFU client examples?

Best regards,
Jørgen