fix: preserve Uri-Query on OSCORE Echo auto-retry - #398
Open
stoprocent wants to merge 1 commit into
Open
Conversation
The client-side Echo auto-retry (RFC 8613 Appendix B.1.2 / RFC 9175) skipped Uri-Query when copying options onto the retried request, on the assumption it would be reconstructed from retryUrl like Uri-Path and Observe are. There is no such reconstruction path for Uri-Query in this library — CoapRequestParams has no `query` field, it is only ever set via setOption() on the original request — so the retry silently lost it. GWLB-2727: node-red client dropped Uri-Query when retrying after a device's 4.01 + Echo freshness challenge, causing the retried GET/DELETE to fail with 4.00 Bad Request. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The client-side Echo auto-retry (RFC 8613 Appendix B.1.2 / RFC 9175) added in #397 skips
Uri-Querywhen copying options onto the retried request, on the assumption it would be reconstructed fromretryUrlthe same wayUri-PathandObserveare. There is no such reconstruction path forUri-Queryin this library —CoapRequestParamshas noqueryfield, so it is only ever set viasetOption('Uri-Query', ...)on the original request — meaning the retry silently drops it.Reported downstream as a real interop bug: a client sends
GET /resource?param=valueover OSCORE, the server issues a4.01 Unauthorized+Echofreshness challenge on the first request after a context reset (fresh boot / no persisted replay window), and the auto-retried request arrives without the query parameters — servers that require them then reject the retry with4.00 Bad Request.Fix
lib/agent.ts: removeUri-Queryfrom the option skip-list in the Echo auto-retry path. OnlyUri-PathandObserveare actually reconstructed fromretryUrl(viaurl.pathname/url.observe), so those stay skipped; every other option — includingUri-Query— is copied through unchanged, matching a plain PDU-clone-and-add-Echo retry (e.g.coap_pdu_duplicatein libcoap).Tests
test/oscore.ts: new regression test (client-side Echo auto-retry) using a raw OSCORE fake-server harness (same pattern as the existing "non-OSCORE messages from OSCORE peer" tests) that issues a4.01+Echochallenge on the first request and asserts the retried request still carries the originalUri-Queryoption. Confirmed it fails on the pre-fix code and passes after.Full suite: 506 passing, 3 pre-existing unrelated
multicastfailures (network-environment timeouts, untouched by this change).🤖 Generated with Claude Code