Merge pull request #324 from shilpa24balaji/3.12_p3b

Update retry time in connection-health-file
2026-01-27 18:20:04 +00:00 · 2019-10-25 11:49:25 -07:00 · 2019-10-24 18:20:20 -07:00 · 2019-06-12 11:38:10 -07:00 · 2019-06-11 14:20:45 -07:00 · 2019-06-05 08:56:28 -07:00
24 changed files with 1420 additions and 271 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,16 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).

 ## [Unreleased]
+- Security: Added support to use auth token during initial connect to cloud
+- Fix re-registration fails that lose a socket
+- Fix mutex error in service alive
+- Security: Mutual Authentication (mTLS or two way TLS)
+- Rename command line options for MTLS cert and Key
+- Update to use nanomsg v. 1.1.4
+- requestNewAuthToken will clear the token if it fails.
+- request auth token on every retry, not just after 403
+
+## [1.0.2] - 2019-02-08
 - Refactored connection.c and updated corresponding unit tests
 - Additional `/cloud-status` and `/cloud-disconnect` fields.
 - Switched from nanomsg (Release 1.1.2) to NNG (Release v1.0.1)
@@ -29,6 +39,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Fixed main loop to keep calling svc_alive_task during a cloud disconnect and retry
 - change svc alive back to a separate thread.  Shut it down with pthread_cond_timedwait
 - Refactored Upsteam RETRIEVE flow
+- Fix re-registration to call nn_shutdown and nn_close, so we don't lose a socket.

 ## [1.0.1] - 2018-07-18
 ### Added
@@ -61,6 +72,7 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 - Initial creation

 [Unreleased]: https://github.com/Comcast/parodus/compare/1.0.1...HEAD
+[1.0.2]: https://github.com/Comcast/parodus/compare/1.0.1...1.0.2
 [1.0.1]: https://github.com/Comcast/parodus/compare/1.0.0...1.0.1
 [1.0.0]: https://github.com/Comcast/parodus/compare/79fa7438de2b14ae64f869d52f5c127497bf9c3f...1.0.0

--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -34,6 +34,7 @@ include_directories(${INCLUDE_DIR}
                    ${INCLUDE_DIR}/cjson
                    ${INCLUDE_DIR}/nopoll
                    ${INCLUDE_DIR}/msgpack
+	            ${INCLUDE_DIR}/curl
                    ${INCLUDE_DIR}/trower-base64
                    ${INCLUDE_DIR}/wrp-c                   
                    ${INCLUDE_DIR}/libparodus
@@ -100,7 +101,7 @@ add_dependencies(libnopoll nopoll)
 ExternalProject_Add(nanomsg
    PREFIX ${CMAKE_CURRENT_BINARY_DIR}/_prefix/nanomsg
    GIT_REPOSITORY https://github.com/nanomsg/nanomsg.git
-    GIT_TAG "1.1.2"
+    GIT_TAG "1.1.4"
    CMAKE_ARGS += -DCMAKE_INSTALL_PREFIX=${INSTALL_DIR}
 )
 add_library(libnanomsg STATIC SHARED IMPORTED)
@@ -134,6 +135,18 @@ add_library(libmsgpack STATIC SHARED IMPORTED)
 add_dependencies(libmsgpack msgpack)


+# curl external dependency
+#-------------------------------------------------------------------------------
+ExternalProject_Add(curl
+    PREFIX ${CMAKE_CURRENT_BINARY_DIR}/_prefix/curl
+    GIT_REPOSITORY https://github.com/curl/curl.git
+    GIT_TAG "curl-7_63_0"
+    CMAKE_ARGS += -DCMAKE_INSTALL_PREFIX=${INSTALL_DIR} -DBUILD_TESTING=OFF
+)
+add_library(libcurl STATIC SHARED IMPORTED)
+add_dependencies(libcurl curl)
+
+
 # cimplog external dependency
 #-------------------------------------------------------------------------------
 ExternalProject_Add(cimplog
--- a/README.md
+++ b/README.md
@@ -55,9 +55,9 @@ make test

 - /force-ipv6 -Forcefully connect parodus to ipv6 address (optional argument)

- /token-read-script -Script to get auth token for establishing secure connection (absolute path where that script is present) -optional argument
+- /client-cert-path -MTLS client cert location to request auth token for establishing secure connection [absolute path where client cert is present] (optional argument)

- /token-acquisition-script -Script to create new auth token for establishing secure connection (absolute path where that script is present) -optional argument 
+- /token-server-url -complete server url with API path to request new auth token for establishing secure connection (optional argument)

 - /crud-config-file -Config json file to store objects during create, retrieve, update and delete (CRUD) operations -optional argument 

@@ -75,6 +75,12 @@ make test

 - /jwt-public-key-file -JWT token validation key

+# if ENABLE_MUTUAL_AUTH is enabled
+
+- /mtls-client-cert-path - Provide the client cert for establishing a mutual auth secure websocket connection
+
+- /mtls-client-key-path - Provide the client cert key for establishing a mutual auth secure websocket connection
+
 ```

 # Sample parodus start commands:
@@ -82,17 +88,17 @@ make test
 ```
 # Seshat & FEATURE_DNS_QUERY Enabled

-./parodus --hw-model=TGXXX --hw-serial-number=E8GBUEXXXXXXXXX --hw-manufacturer=ARRIS --hw-mac=14cfexxxxxxx --hw-last-reboot-reason=unknown --fw-name=TG1682_DEV_master_20170512115046sdy --boot-time=1494590301 --webpa-ping-timeout=180 --webpa-interface-used=eth0 --webpa-url=somebody.net:8080 --webpa-backoff-max=9 --parodus-local-url=tcp://127.0.0.1:6666 --partner-id=comcast --ssl-cert-path=/etc/ssl/certs/ca-certificates.crt --acquire-jwt=1 --dns-txt-url=somebody.net --jwt-public-key-file=webpa-rs256.pem --jwt-algo=RS256 --seshat-url=tcp://127.0.0.1:7777 --token-read-script=/usr/ccsp/parodus/parodus_token1.sh --token-acquisition-script=/usr/ccsp/parodus/parodus_token2.sh --force-ipv4 --crud-config-file=/tmp/parodus_cfg.json
+./parodus --hw-model=TGXXX --hw-serial-number=E8GBUEXXXXXXXXX --hw-manufacturer=ARRIS --hw-mac=14cfexxxxxxx --hw-last-reboot-reason=unknown --fw-name=TG1682_DEV_master_20170512115046sdy --boot-time=1494590301 --webpa-ping-timeout=180 --webpa-interface-used=eth0 --webpa-url=https://somebody.net:8080 --webpa-backoff-max=9 --parodus-local-url=tcp://127.0.0.1:6666 --partner-id=comcast --ssl-cert-path=/etc/ssl/certs/ca-certificates.crt --acquire-jwt=1 --dns-txt-url=somebody.net --jwt-public-key-file=webpa-rs256.pem --jwt-algo=RS256 --seshat-url=tcp://127.0.0.1:7777 --client-cert-path=/tmp/clientcert.mch --token-server-url=https://somebody.net:8080/token --force-ipv4 --crud-config-file=/tmp/parodus_cfg.json


 # Seshat is not enabled

-./parodus --hw-model=TGXXX --hw-serial-number=E8GBUEXXXXXXXXX --hw-manufacturer=ARRIS --hw-mac=14cfexxxxxxx --hw-last-reboot-reason=unknown --fw-name=TG1682_DEV_master_20170512115046sdy --boot-time=1494590301 --webpa-ping-timeout=180 --webpa-interface-used=eth0 --webpa-url=somebody.net:8080 --webpa-backoff-max=9 --parodus-local-url=tcp://127.0.0.1:6666 --partner-id=comcast --ssl-cert-path=/etc/ssl/certs/ca-certificates.crt --acquire-jwt=1 --dns-txt-url=somebody.net --jwt-public-key-file=webpa-rs256.pem --jwt-algo=RS256 --token-read-script=/usr/ccsp/parodus/parodus_token1.sh --token-acquisition-script=/usr/ccsp/parodus/parodus_token2.sh --force-ipv4 --crud-config-file=/tmp/parodus_cfg.json
+./parodus --hw-model=TGXXX --hw-serial-number=E8GBUEXXXXXXXXX --hw-manufacturer=ARRIS --hw-mac=14cfexxxxxxx --hw-last-reboot-reason=unknown --fw-name=TG1682_DEV_master_20170512115046sdy --boot-time=1494590301 --webpa-ping-timeout=180 --webpa-interface-used=eth0 --webpa-url=https://somebody.net:8080 --webpa-backoff-max=9 --parodus-local-url=tcp://127.0.0.1:6666 --partner-id=comcast --ssl-cert-path=/etc/ssl/certs/ca-certificates.crt --acquire-jwt=1 --dns-txt-url=somebody.net --jwt-public-key-file=webpa-rs256.pem --jwt-algo=RS256 --client-cert-path=/tmp/clientcert.mch --token-server-url=https://somebody.net:8080/token --force-ipv4 --crud-config-file=/tmp/parodus_cfg.json


 # When both Seshat & FEATURE_DNS_QUERY not Enabled

-./parodus --hw-model=TGXXX --hw-serial-number=E8GBUEXXXXXXXXX --hw-manufacturer=ARRIS --hw-mac=14cfexxxxxxx --hw-last-reboot-reason=unknown --fw-name=TG1682_DEV_master_20170512115046sdy --boot-time=1494590301 --webpa-ping-timeout=180 --webpa-interface-used=eth0 --webpa-url=somebody.net:8080 --webpa-backoff-max=9 --parodus-local-url=tcp://127.0.0.1:6666 --partner-id=comcast --ssl-cert-path=/etc/ssl/certs/ca-certificates.crt --token-read-script=/usr/ccsp/parodus/parodus_token1.sh --token-acquisition-script=/usr/ccsp/parodus/parodus_token2.sh --force-ipv4 --crud-config-file=/tmp/parodus_cfg.json
+./parodus --hw-model=TGXXX --hw-serial-number=E8GBUEXXXXXXXXX --hw-manufacturer=ARRIS --hw-mac=14cfexxxxxxx --hw-last-reboot-reason=unknown --fw-name=TG1682_DEV_master_20170512115046sdy --boot-time=1494590301 --webpa-ping-timeout=180 --webpa-interface-used=eth0 --webpa-url=https://somebody.net:8080 --webpa-backoff-max=9 --parodus-local-url=tcp://127.0.0.1:6666 --partner-id=comcast --ssl-cert-path=/etc/ssl/certs/ca-certificates.crt --client-cert-path=/tmp/clientcert.mch --token-server-url=https://somebody.net:8080/token --force-ipv4 --crud-config-file=/tmp/parodus_cfg.json

 ```

--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -15,7 +15,7 @@ set(SOURCES main.c mutex.c networking.c nopoll_helpers.c heartBeat.c nopoll_hand
    ParodusInternal.c string_helpers.c time.c config.c conn_interface.c
    connection.c spin_thread.c client_list.c service_alive.c
    upstream.c downstream.c thread_tasks.c partners_check.c token.c 
-	crud_interface.c crud_tasks.c crud_internal.c close_retry.c)
+	crud_interface.c crud_tasks.c crud_internal.c close_retry.c auth_token.c)

 if (ENABLE_SESHAT)
 set(SOURCES ${SOURCES} seshat_interface.c)
@@ -30,6 +30,7 @@ target_link_libraries (parodus
    ${CMAKE_THREAD_LIBS_INIT}
    -lwrp-c
    -lmsgpackc
+    -lcurl
    -ltrower-base64
    -lnopoll
    -luuid
--- a/src/auth_token.c
+++ b/src/auth_token.c
@@ -0,0 +1,302 @@
+/**
+ * Copyright 2015 Comcast Cable Communications Management, LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+/**
+ * @file auth_token.c
+ *
+ * @description This file is to fetch authorization token during parodus cloud connection.
+ *
+ */
+
+#include <stdio.h>
+#include <fcntl.h> 
+#include "config.h"
+#include "auth_token.h"
+#include "ParodusInternal.h"
+#include <cjwt/cjwt.h>
+#include <stdlib.h>
+#include <curl/curl.h>
+#include <uuid/uuid.h>
+
+#define MAX_BUF_SIZE	        128
+#define CURL_TIMEOUT_SEC	25L
+#define MAX_CURL_RETRY_COUNT 	3
+/*----------------------------------------------------------------------------*/
+/*                            File Scoped Variables                           */
+/*----------------------------------------------------------------------------*/
+void createCurlheader(char *mac_header, char *serial_header, char *uuid_header, char *transaction_uuid, struct curl_slist *list, struct curl_slist **header_list);
+/*----------------------------------------------------------------------------*/
+/*                             External Functions                             */
+/*----------------------------------------------------------------------------*/
+/*
+* @brief Initialize curl object with required options. create newToken using libcurl.
+* @param[out] newToken auth token string obtained from JWT curl response
+* @param[in] len total token size
+* @param[in] r_count Number of curl retries on ipv4 and ipv6 mode during failure
+* @return returns 0 if success, otherwise failed to fetch auth token and will be retried.
+*/
+
+int requestNewAuthToken(char *newToken, size_t len, int r_count)
+{
+	CURL *curl;
+	CURLcode res;
+	CURLcode time_res;
+	struct curl_slist *list = NULL;
+	struct curl_slist *headers_list = NULL;
+
+	char *mac_header = NULL;
+	char *serial_header = NULL;
+	char *uuid_header = NULL;
+	char *transaction_uuid = NULL;
+	double total;
+	long response_code;
+
+	struct token_data data;
+	data.size = 0;
+	data.data = newToken;
+
+	curl = curl_easy_init();
+	if(curl)
+	{
+		data.data[0] = '\0';
+
+		createCurlheader(mac_header, serial_header, uuid_header, transaction_uuid, list, &headers_list);
+
+		curl_easy_setopt(curl, CURLOPT_URL, get_parodus_cfg()->token_server_url);
+		curl_easy_setopt(curl, CURLOPT_TIMEOUT, CURL_TIMEOUT_SEC);
+
+		if(get_parodus_cfg()->webpa_interface_used !=NULL && strlen(get_parodus_cfg()->webpa_interface_used) >0)
+		{
+			curl_easy_setopt(curl, CURLOPT_INTERFACE, get_parodus_cfg()->webpa_interface_used);
+		}
+		/* set callback for writing received data */
+		curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, write_callback_fn);
+		curl_easy_setopt(curl, CURLOPT_WRITEDATA, &data);
+
+		curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers_list);
+
+		/* setting curl resolve option as default mode.
+		If any failure, retry with v4 first and then v6 mode. */
+
+		if(r_count == 1)
+		{
+			ParodusInfo("curl Ip resolve option set as V4 mode\n");
+			curl_easy_setopt(curl, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4);
+		}
+		else if(r_count == 2)
+		{
+			ParodusInfo("curl Ip resolve option set as V6 mode\n");
+			curl_easy_setopt(curl, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V6);
+		}
+		else
+		{
+			ParodusInfo("curl Ip resolve option set as default mode\n");
+			curl_easy_setopt(curl, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_WHATEVER);
+		}
+
+		/* set the cert for client authentication */
+		curl_easy_setopt(curl, CURLOPT_SSLCERT, get_parodus_cfg()->client_cert_path);
+
+		curl_easy_setopt(curl, CURLOPT_CAINFO, get_parodus_cfg()->cert_path);
+
+		/* disconnect if it is failed to validate server's cert */
+		curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
+
+		/* Perform the request, res will get the return code */
+		res = curl_easy_perform(curl);
+
+		curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &response_code);
+		ParodusInfo("themis curl response %d http_code %d\n", res, response_code);
+
+		time_res = curl_easy_getinfo(curl, CURLINFO_TOTAL_TIME, &total);
+		if(time_res == 0)
+		{
+			ParodusInfo("curl response Time: %.1f seconds\n", total);
+		}
+		curl_slist_free_all(headers_list);
+		if(res != 0)
+		{
+			ParodusError("curl_easy_perform() failed: %s\n", curl_easy_strerror(res));
+			curl_easy_cleanup(curl);
+			data.size = 0;
+			memset (data.data, 0, len);
+			return -1;
+		}
+		else
+		{
+			if(response_code == 200)
+			{
+				ParodusInfo("cURL success\n");
+			}
+		}
+		curl_easy_cleanup(curl);
+	}
+	else
+	{
+		ParodusError("curl init failure\n");
+		data.size = 0;
+		memset (data.data, 0, len);
+		return -1;
+	}
+
+	return 0;
+}
+
+/*
+* @brief Fetches authorization token and update to parodus config.
+  This will do curl retry in case of any failure till it reaches max curl retry count.
+ * @param[in] cfg Global parodus config structure to update webpa_auth_token
+*/
+
+void getAuthToken(ParodusCfg *cfg)
+{
+	int status = -1;
+	int retry_count = 0;
+
+	memset (cfg->webpa_auth_token, 0, sizeof(cfg->webpa_auth_token));
+	if( cfg->hw_mac != NULL && strlen(cfg->hw_mac) !=0 )
+	{
+		if( cfg->client_cert_path !=NULL && strlen(cfg->client_cert_path) !=0 )
+		{
+			while(1)
+			{
+				//Fetch new auth token using libcurl
+				status = requestNewAuthToken(cfg->webpa_auth_token, sizeof(cfg->webpa_auth_token), retry_count);
+				if(status == 0)
+				{
+					ParodusInfo("cfg->webpa_auth_token created successfully\n");
+					break;
+				}
+				else
+				{
+					ParodusError("Failed to create new token\n");
+					retry_count++;
+					ParodusError("Curl execution is failed, retry attempt: %d\n", retry_count);
+				}
+
+				if(retry_count == MAX_CURL_RETRY_COUNT)
+				{
+					ParodusError("Curl retry is reached to max %d attempts, proceeding without token\n", retry_count);
+					break;
+				}
+			}
+		}
+		else
+		{
+			ParodusError("client_cert_path is NULL, failed to fetch auth token\n");
+		}
+	}
+	else
+	{
+		ParodusError("hw_mac is NULL, failed to fetch auth token\n");
+	}
+}
+
+/* @brief callback function for writing libcurl received data
+ * @param[in] buffer curl delivered data which need to be saved.
+ * @param[in] size size is always 1
+ * @param[in] nmemb size of delivered data
+ * @param[out] data curl response data saved.
+*/
+size_t write_callback_fn(void *buffer, size_t size, size_t nmemb, struct token_data *data)
+{
+    ParodusCfg *cfg;
+    size_t max_data_size = sizeof (cfg->webpa_auth_token);
+    size_t index = data->size;
+    size_t n = (size * nmemb);
+
+    data->size += n;
+
+    if (data->size >= max_data_size) {
+        ParodusError("Auth token data overruns buffer\n");
+	data->size = 0;
+        return 0;
+    }
+
+    memcpy((data->data + index), buffer, n);
+    data->data[data->size] = '\0';
+
+    return n;
+}
+
+/* @brief function to generate random uuid.
+*/
+char* generate_trans_uuid()
+{
+	char *transID = NULL;
+	uuid_t transaction_Id;
+	char *trans_id = NULL;
+	trans_id = (char *)malloc(37);
+	uuid_generate_random(transaction_Id);
+	uuid_unparse(transaction_Id, trans_id);
+
+	if(trans_id !=NULL)
+	{
+		transID = trans_id;
+	}
+	return transID;
+}
+
+/* @brief function to create curl header contains mac, serial number and uuid.
+ * @param[in] mac_header mac address header key value pair
+ * @param[in] serial_header serial number key value pair
+ * @param[in] uuid_header transaction uuid key value pair
+ * @param[in] list temp curl header list
+ * @param[out] header_list output curl header list
+*/
+void createCurlheader(char *mac_header, char *serial_header, char *uuid_header, char *transaction_uuid, struct curl_slist *list, struct curl_slist **header_list)
+{
+	mac_header = (char *) malloc(sizeof(char)*MAX_BUF_SIZE);
+	if(mac_header !=NULL)
+	{
+		snprintf(mac_header, MAX_BUF_SIZE, "X-Midt-Mac-Address: %s", get_parodus_cfg()->hw_mac);
+		ParodusPrint("mac_header formed %s\n", mac_header);
+		list = curl_slist_append(list, mac_header);
+		free(mac_header);
+		mac_header = NULL;
+	}
+
+	serial_header = (char *) malloc(sizeof(char)*MAX_BUF_SIZE);
+	if(serial_header !=NULL)
+	{
+		snprintf(serial_header, MAX_BUF_SIZE, "X-Midt-Serial-Number: %s", get_parodus_cfg()->hw_serial_number);
+		ParodusPrint("serial_header formed %s\n", serial_header);
+		list = curl_slist_append(list, serial_header);
+		free(serial_header);
+		serial_header = NULL;
+	}
+
+	transaction_uuid = generate_trans_uuid();
+	if(transaction_uuid !=NULL)
+	{
+		uuid_header = (char *) malloc(sizeof(char)*MAX_BUF_SIZE);
+		if(uuid_header !=NULL)
+		{
+			snprintf(uuid_header, MAX_BUF_SIZE, "X-Midt-Uuid: %s", transaction_uuid);
+			ParodusInfo("uuid_header formed %s\n", uuid_header);
+			list = curl_slist_append(list, uuid_header);
+			free(transaction_uuid);
+			transaction_uuid = NULL;
+			free(uuid_header);
+			uuid_header = NULL;
+		}
+	}
+	else
+	{
+		ParodusError("Failed to generate transaction_uuid\n");
+	}
+	*header_list = list;
+}
--- a/src/auth_token.h
+++ b/src/auth_token.h
@@ -0,0 +1,57 @@
+/**
+ * Copyright 2015 Comcast Cable Communications Management, LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+/**
+ * @file auth_token.h
+ *
+ * @description This file is to fetch authorization token during parodus cloud connection.
+ *
+ */
+ 
+#ifndef _AUTH_TOKEN_H_ 
+#define _AUTH_TOKEN_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*----------------------------------------------------------------------------*/
+/*                                   Macros                                   */
+/*----------------------------------------------------------------------------*/
+
+/*----------------------------------------------------------------------------*/
+/*                               Data Structures                              */
+/*----------------------------------------------------------------------------*/
+
+struct token_data {
+    size_t size;
+    char* data;
+};
+
+/*----------------------------------------------------------------------------*/
+/*                             Function Prototypes                            */
+/*----------------------------------------------------------------------------*/
+
+int requestNewAuthToken(char *newToken, size_t len, int r_count);
+void getAuthToken(ParodusCfg *cfg);
+size_t write_callback_fn(void *buffer, size_t size, size_t nmemb, struct token_data *data);
+char* generate_trans_uuid();
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif
--- a/src/client_list.c
+++ b/src/client_list.c
@@ -76,7 +76,11 @@ int addToList( wrp_msg_t **msg)
            if(rc < 0)
            {
                ParodusError ("Unable to connect socket (errno=%d, %s)\n",errno, strerror(errno));
-                nn_close (sock);
+		if (nn_close (sock) < 0)
+                {
+                   ParodusError ("nn_close socket=%d (err=%d, %s)\n", 
+			sock, errno, strerror(errno));
+		}
                
            }
            else
@@ -87,6 +91,7 @@ int addToList( wrp_msg_t **msg)
 		{
    			memset( new_node, 0, sizeof( reg_list_item_t ) );
    			new_node->sock = sock;
+                        new_node->endpoint = rc;
    			ParodusPrint("new_node->sock is %d\n", new_node->sock);
    			
    			
@@ -219,6 +224,16 @@ int deleteFromList(char* service_name)
 			}
 			
 			ParodusPrint("Deleting the node\n");
+                        if(nn_shutdown(curr_node->sock, curr_node->endpoint) < 0)
+                        {
+                           ParodusError ("nn_shutdown socket=%d endpt=%d, err=%d\n", 
+				curr_node->sock, curr_node->endpoint, errno);
+                        }
+			if (nn_close (curr_node->sock) < 0)
+                        {
+                           ParodusError ("nn_close socket=%d err=%d\n", 
+				curr_node->sock, errno);
+                        }
 			free( curr_node );
 			curr_node = NULL;
 			ParodusInfo("Deleted successfully and returning..\n");
--- a/src/client_list.h
+++ b/src/client_list.h
@@ -30,6 +30,7 @@
 typedef struct reg_list_item
 {
 	int sock;
+	int endpoint;
 	char service_name[32];
 	char url[100];
 	struct reg_list_item *next;
--- a/src/config.c
+++ b/src/config.c
@@ -26,8 +26,9 @@
 #include "config.h"
 #include "ParodusInternal.h"
 #include <cjwt/cjwt.h>
-
-#define MAX_BUF_SIZE	128
+#include <stdlib.h>
+#include <curl/curl.h>
+#include <uuid/uuid.h>

 /*----------------------------------------------------------------------------*/
 /*                            File Scoped Variables                           */
@@ -36,7 +37,6 @@
 static ParodusCfg parodusCfg;
 static unsigned int rsa_algorithms = 
 	(1<<alg_rs256) | (1<<alg_rs384) | (1<<alg_rs512);
-
 /*----------------------------------------------------------------------------*/
 /*                             External Functions                             */
 /*----------------------------------------------------------------------------*/
@@ -141,31 +141,6 @@ void read_key_from_file (const char *fname, char *buf, size_t buflen)
  ParodusInfo ("%d bytes read\n", nbytes);
 }

-void execute_token_script(char *token, char *name, size_t len, char *mac, char *serNum)
-{
-    FILE* out = NULL, *file = NULL;
-    char command[MAX_BUF_SIZE] = {'\0'};
-    if(strlen(name)>0)
-    {
-        file = fopen(name, "r");
-        if(file)
-        {
-            snprintf(command,sizeof(command),"%s %s %s",name,serNum,mac);
-            out = popen(command, "r");
-            if(out)
-            {
-                fgets(token, len, out);
-                pclose(out);
-            }
-            fclose(file);
-        }
-        else
-        {
-            ParodusError ("File %s open error\n", name);
-        }
-    }
-}
-
 // strips ':' characters
 // verifies that there exactly 12 characters
 int parse_mac_address (char *target, const char *arg)
@@ -386,10 +361,13 @@ int parseCommandLine(int argc,char **argv,ParodusCfg * cfg)
        {"ssl-cert-path",           required_argument, 0, 'c'},
        {"force-ipv4",              no_argument,       0, '4'},
        {"force-ipv6",              no_argument,       0, '6'},
-        {"token-read-script",       required_argument, 0, 'T'},
        {"boot-time-retry-wait",    required_argument, 0, 'w'},
-	{"token-acquisition-script",     required_argument, 0, 'J'},
+	{"client-cert-path",        required_argument, 0, 'P'},
+	{"token-server-url",        required_argument, 0, 'U'},
 	{"crud-config-file",        required_argument, 0, 'C'},
+	{"connection-health-file",  required_argument, 0, 'S'},
+	{"mtls-client-key-path",    required_argument, 0, 'K'},
+	{"mtls-client-cert-path",    required_argument, 0,'M'},
        {0, 0, 0, 0}
    };
    int c;
@@ -405,6 +383,9 @@ int parseCommandLine(int argc,char **argv,ParodusCfg * cfg)
 	cfg->jwt_algo = 0;
 	parStrncpy (cfg->jwt_key, "", sizeof(cfg->jwt_key));
 	cfg->crud_config_file = NULL;
+	cfg->connection_health_file = NULL;
+	cfg->client_cert_path = NULL;
+	cfg->token_server_url = NULL;
 	cfg->cloud_status = NULL;
 	cfg->cloud_disconnect = NULL;
 	optind = 1;  /* We need this if parseCommandLine is called again */
@@ -413,7 +394,7 @@ int parseCommandLine(int argc,char **argv,ParodusCfg * cfg)

      /* getopt_long stores the option index here. */
      int option_index = 0;
-      c = getopt_long (argc, argv, "m:s:f:d:r:n:b:u:t:o:i:l:p:e:D:j:a:k:c:T:w:J:46:C",
+      c = getopt_long (argc, argv, "m:s:f:d:r:n:b:u:t:o:i:l:p:e:D:j:a:k:c:T:w:J:46:C:S:K:M",
 				long_options, &option_index);

      /* Detect the end of the options. */
@@ -546,23 +527,40 @@ int parseCommandLine(int argc,char **argv,ParodusCfg * cfg)
          cfg->flags |= FLAGS_IPV6_ONLY;
          break;

-        case 'J':
-          parStrncpy(cfg->token_acquisition_script, optarg,sizeof(cfg->token_acquisition_script));
-          break;
-        
-        case 'T':
-          parStrncpy(cfg->token_read_script, optarg,sizeof(cfg->token_read_script));
-          break;
-
        case 'w':
          cfg->boot_retry_wait = parse_num_arg (optarg, "boot-time-retry-wait");
          ParodusInfo("boot_retry_wait is %d\n",cfg->boot_retry_wait);
          break;

-		case 'C':
-		  cfg->crud_config_file = strdup(optarg);
-		  ParodusInfo("crud_config_file is %s\n", cfg->crud_config_file);
-		  break;
+	case 'S':
+	  cfg->connection_health_file = strdup(optarg);
+	  ParodusInfo("connection_health_file is %s\n", cfg->connection_health_file);
+	  break;
+
+	case 'C':
+	  cfg->crud_config_file = strdup(optarg);
+	  ParodusInfo("crud_config_file is %s\n", cfg->crud_config_file);
+	  break;
+
+		case 'P':
+		cfg->client_cert_path = strdup(optarg);
+		ParodusInfo("client_cert_path is %s\n", cfg->client_cert_path);
+		break;
+
+		case 'U':
+		cfg->token_server_url = strdup(optarg);
+		ParodusInfo("token_server_url is %s\n", cfg->token_server_url);
+		break;
+
+        case 'K':
+          cfg->mtls_client_key_path = strdup(optarg);
+          ParodusInfo("mtls_client_key_path is %s\n", cfg->mtls_client_key_path);
+          break;
+
+	case 'M':
+          cfg->mtls_client_cert_path = strdup(optarg);
+          ParodusInfo("mtls_client_cert_path is %s\n", cfg->mtls_client_cert_path);
+          break;

        case '?':
          /* getopt_long already printed an error message. */
@@ -606,63 +604,6 @@ int parseCommandLine(int argc,char **argv,ParodusCfg * cfg)
    return 0;
 }

-/*
-* call parodus create/acquisition script to create new auth token, if success then calls 
-* execute_token_script func with args as parodus read script.
-*/
-
-void createNewAuthToken(char *newToken, size_t len)
-{
-	//Call create script
-	char output[12] = {'\0'};
-	execute_token_script(output,get_parodus_cfg()->token_acquisition_script,sizeof(output),get_parodus_cfg()->hw_mac,get_parodus_cfg()->hw_serial_number);
-  	if (strlen(output)>0  && strcmp(output,"SUCCESS")==0)
-	{
-		//Call read script 
-		execute_token_script(newToken,get_parodus_cfg()->token_read_script,len,get_parodus_cfg()->hw_mac,get_parodus_cfg()->hw_serial_number);
-	}	
-	else 
-	{
-		ParodusError("Failed to create new token\n");
-	}
-}
-
-/*
-* Fetches authorization token from the output of read script. If read script returns "ERROR"
-* it will call createNewAuthToken to create and read new token 
-*/
-
-void getAuthToken(ParodusCfg *cfg)
-{
-	//local var to update cfg->webpa_auth_token only in success case
-	char output[4069] = {'\0'} ;
-	
-	if( strlen(cfg->token_read_script) !=0 && strlen(cfg->token_acquisition_script) !=0)
-    	{
-		execute_token_script(output,cfg->token_read_script,sizeof(output),cfg->hw_mac,cfg->hw_serial_number);
-		
-	    	if ((strlen(output) == 0))
-	    	{
-			ParodusError("Unable to get auth token\n");
-		}
-		else if(strcmp(output,"ERROR")==0)
-		{
-			ParodusInfo("Failed to read token from %s. Proceeding to create new token.\n",cfg->token_read_script);
-			//Call create/acquisition script
-			createNewAuthToken(cfg->webpa_auth_token, sizeof(cfg->webpa_auth_token));	
-		}
-		else
-		{
-			ParodusInfo("update cfg->webpa_auth_token in success case\n");
-			parStrncpy(cfg->webpa_auth_token, output, sizeof(cfg->webpa_auth_token));
-		}
-	}
-	else
-	{
-        	ParodusInfo("Both read and write file are NULL \n");
-	}
-}
-
 void setDefaultValuesToCfg(ParodusCfg *cfg)
 {
    if(cfg == NULL)
@@ -694,6 +635,9 @@ void setDefaultValuesToCfg(ParodusCfg *cfg)
    parStrncpy(cfg->webpa_uuid, "1234567-345456546",sizeof(cfg->webpa_uuid));
    ParodusPrint("cfg->webpa_uuid is :%s\n", cfg->webpa_uuid);
    cfg->crud_config_file = NULL;
+    cfg->connection_health_file = NULL;
+    cfg->client_cert_path = NULL;
+    cfg->token_server_url = NULL;
 	
 	cfg->cloud_status = CLOUD_STATUS_OFFLINE;
 	ParodusInfo("Default cloud_status is %s\n", cfg->cloud_status);
@@ -834,24 +778,6 @@ void loadParodusCfg(ParodusCfg * config,ParodusCfg *cfg)
        ParodusPrint("cert_path is NULL. set to empty\n");
    }

-    if(strlen(config->token_acquisition_script )!=0)
-    {
-          parStrncpy(cfg->token_acquisition_script, config->token_acquisition_script,sizeof(cfg->token_acquisition_script));
-    }
-    else
-    {
-          ParodusPrint("token_acquisition_script is NULL. read from tmp file\n");
-    }
-        
-    if(strlen(config->token_read_script )!=0)
-    {
-          parStrncpy(cfg->token_read_script, config->token_read_script,sizeof(cfg->token_read_script));
-    }
-    else
-    {
-          ParodusPrint("token_read_script is NULL. read from tmp file\n");
-    }
-
    cfg->boot_time = config->boot_time;
    cfg->webpa_ping_timeout = config->webpa_ping_timeout;
    cfg->webpa_backoff_max = config->webpa_backoff_max;
@@ -861,6 +787,15 @@ void loadParodusCfg(ParodusCfg * config,ParodusCfg *cfg)
    parStrncpy(cfg->webpa_uuid, "1234567-345456546",sizeof(cfg->webpa_uuid));
    ParodusPrint("cfg->webpa_uuid is :%s\n", cfg->webpa_uuid);
    
+    if(config->connection_health_file != NULL)
+    {
+        cfg->connection_health_file = strdup(config->connection_health_file);
+    }
+    else
+    {
+        ParodusPrint("connection_health_file is NULL. set to empty\n");
+    }
+
    if(config->crud_config_file != NULL)
    {
        cfg->crud_config_file = strdup(config->crud_config_file);
@@ -869,6 +804,24 @@ void loadParodusCfg(ParodusCfg * config,ParodusCfg *cfg)
    {
        ParodusPrint("crud_config_file is NULL. set to empty\n");
    }
+
+    if(config->client_cert_path != NULL)
+    {
+        cfg->client_cert_path = strdup(config->client_cert_path);
+    }
+    else
+    {
+        ParodusPrint("client_cert_path is NULL. set to empty\n");
+    }
+
+    if(config->token_server_url != NULL)
+    {
+        cfg->token_server_url = strdup(config->token_server_url);
+    }
+    else
+    {
+        ParodusPrint("token_server_url is NULL. set to empty\n");
+    }
 }


--- a/src/config.h
+++ b/src/config.h
@@ -99,6 +99,11 @@ typedef struct
    char webpa_auth_token[4096];
    char token_acquisition_script[64];
    char token_read_script[64];
+    char *client_cert_path;
+    char *token_server_url;
+    char *connection_health_file;
+    char *mtls_client_key_path;
+    char *mtls_client_cert_path;
 	char *crud_config_file;
 	char *cloud_status;
 	char *cloud_disconnect;
@@ -114,7 +119,6 @@ typedef struct
 /*----------------------------------------------------------------------------*/

 void loadParodusCfg(ParodusCfg * config,ParodusCfg *cfg);
-void createNewAuthToken(char *newToken, size_t len);

 /**
 * parse command line arguments and create config structure
@@ -128,7 +132,6 @@ void createNewAuthToken(char *newToken, size_t len);
 int parseCommandLine(int argc,char **argv,ParodusCfg * cfg);

 void setDefaultValuesToCfg(ParodusCfg *cfg); 
-void getAuthToken(ParodusCfg *cfg);
 // Accessor for the global config structure.
 ParodusCfg *get_parodus_cfg(void);
 void set_parodus_cfg(ParodusCfg *);
@@ -149,7 +152,6 @@ void reset_cloud_disconnect_reason(ParodusCfg *cfg);
 */ 
 int parse_webpa_url (const char *full_url, 
 	char **server_addr, unsigned int *port);
-
 #ifdef __cplusplus
 }
 #endif
--- a/src/conn_interface.c
+++ b/src/conn_interface.c
@@ -36,6 +36,7 @@
 #include "crud_interface.h"
 #include "heartBeat.h"
 #include "close_retry.h"
+#include <curl/curl.h>
 #ifdef FEATURE_DNS_QUERY
 #include <ucresolv_log.h>
 #endif
@@ -73,6 +74,7 @@ void createSocketConnection(void (* initKeypress)())
    //ParodusCfg *tmpCfg = (ParodusCfg*)config_in;
    noPollCtx *ctx;
    bool seshat_registered = false;
+    int create_conn_rtn = 0;
    unsigned int webpa_ping_timeout_ms = 1000 * get_parodus_cfg()->webpa_ping_timeout;
    unsigned int heartBeatTimer = 0;
    struct timespec start_svc_alive_timer;
@@ -93,7 +95,10 @@ void createSocketConnection(void (* initKeypress)())
    nopoll_log_set_handler (ctx, __report_log, NULL);
    #endif

-    if(!createNopollConnection(ctx))
+    start_conn_in_progress ();
+    create_conn_rtn = createNopollConnection(ctx);
+    stop_conn_in_progress ();
+    if(!create_conn_rtn)
    {
 		ParodusError("Unrecovered error, terminating the process\n");
 		abort();
@@ -176,7 +181,9 @@ void createSocketConnection(void (* initKeypress)())
 		free(get_parodus_cfg()->cloud_disconnect);
 		reset_cloud_disconnect_reason(get_parodus_cfg());
            }
+            start_conn_in_progress ();
            createNopollConnection(ctx);
+            stop_conn_in_progress ();
        }
       } while(!get_close_retry() && !g_shutdown);

@@ -205,6 +212,7 @@ void createSocketConnection(void (* initKeypress)())
    close_and_unref_connection(get_global_conn());
    nopoll_ctx_unref(ctx);
    nopoll_cleanup_library();
+    curl_global_cleanup();
 }

 void shutdownSocketConnection(void) {
--- a/src/connection.c
+++ b/src/connection.c
@@ -25,6 +25,7 @@
 #include "time.h"
 #include "token.h"
 #include "config.h"
+#include "auth_token.h"
 #include "nopoll_helpers.h"
 #include "mutex.h"
 #include "spin_thread.h"
@@ -213,6 +214,13 @@ int update_backoff_delay (backoff_timer_t *timer)
 static void backoff_delay (backoff_timer_t *timer)
 {
  update_backoff_delay (timer);
+
+  // Update retry time for conn progress
+  if(timer->count == timer->max_count) 
+  {
+	start_conn_in_progress();
+  }
+
  ParodusInfo("Waiting with backoffRetryTime %d seconds\n", timer->delay);
  sleep (timer->delay);
 }  
@@ -295,22 +303,25 @@ void set_current_server (create_connection_ctx_t *ctx)
  ctx->current_server = get_current_server (&ctx->server_list);
 }

-void set_extra_headers (create_connection_ctx_t *ctx, int reauthorize)
-{
-  if (reauthorize && (strlen(get_parodus_cfg()->token_acquisition_script) >0))
-  {
-    createNewAuthToken(get_parodus_cfg()->webpa_auth_token,
-      sizeof(get_parodus_cfg()->webpa_auth_token));
-  }
-  
-  ctx->extra_headers = build_extra_hdrs (&ctx->header_info);
-}
-
 void free_extra_headers (create_connection_ctx_t *ctx)
 {
  FREE_PTR_VAR (ctx->extra_headers)
 }

+void set_extra_headers (create_connection_ctx_t *ctx)
+{
+  ParodusCfg * cfg = get_parodus_cfg();
+
+  free_extra_headers (ctx);
+  if ((strlen(cfg->webpa_auth_token) == 0) &&
+      (cfg->client_cert_path != NULL) && (strlen(cfg->client_cert_path) > 0))
+  {
+    getAuthToken(cfg);
+  }
+  
+  ctx->extra_headers = build_extra_hdrs (&ctx->header_info);
+}
+
 void free_connection_ctx (create_connection_ctx_t *ctx)
 {
  free_extra_headers (ctx);
@@ -404,7 +415,7 @@ int nopoll_connect (create_connection_ctx_t *ctx, int is_ipv6)
 //--------------------------------------------------------------------
 // Return codes for wait_connection_ready
 #define WAIT_SUCCESS	0
-#define WAIT_ACTION_RETRY	1	// if wait_status is 307, 302, 303 or 403
+#define WAIT_ACTION_RETRY	1	// if wait_status is 307, 302, 303, or 403
 #define WAIT_FAIL 	2

 #define FREE_NON_NULL_PTR(ptr) if (NULL != ptr) free(ptr)
@@ -440,10 +451,11 @@ int wait_connection_ready (create_connection_ctx_t *ctx)
  FREE_NON_NULL_PTR (redirectURL);
  if(wait_status == 403) 
  {
-	ParodusError("Received Unauthorized response with status: %d\n", wait_status);
-	free_extra_headers (ctx);
-	set_extra_headers (ctx, true);
-	return WAIT_ACTION_RETRY;
+    ParodusCfg *cfg = get_parodus_cfg();
+    /* clear auth token in cfg so that we will refetch auth token */
+    memset (cfg->webpa_auth_token, 0, sizeof(cfg->webpa_auth_token));
+    ParodusError("Received Unauthorized response with status: %d\n", wait_status);
+    return WAIT_ACTION_RETRY;
  }
  ParodusError("Client connection timeout\n");	
  ParodusError("RDK-10037 - WebPA Connection Lost\n");
@@ -453,9 +465,9 @@ int wait_connection_ready (create_connection_ctx_t *ctx)
 
 //--------------------------------------------------------------------
 // Return codes for connect_and_wait
-#define CONN_WAIT_SUCCESS	0
-#define CONN_WAIT_ACTION_RETRY	1	// if wait_status is 307, 302, 303 or 403
-#define CONN_WAIT_RETRY_DNS 	2
+#define CONN_WAIT_SUCCESS	 0
+#define CONN_WAIT_ACTION_RETRY	 1	// if wait_status is 307, 302, 303, or 403
+#define CONN_WAIT_RETRY_DNS 	 2

 int connect_and_wait (create_connection_ctx_t *ctx)
 {
@@ -514,9 +526,12 @@ int keep_trying_to_connect (create_connection_ctx_t *ctx,
    
    while (true)
    {
+      set_extra_headers (ctx);
+
      rtn = connect_and_wait (ctx);
      if (rtn == CONN_WAIT_SUCCESS)
        return true;
+
      if (rtn == CONN_WAIT_ACTION_RETRY) // if redirected or build_headers
        continue;
      backoff_delay (backoff_timer); // 3,7,15,31 ..
@@ -552,11 +567,11 @@ int createNopollConnection(noPollCtx *ctx)
 	
 	max_retry_count = (int) get_parodus_cfg()->webpa_backoff_max;
 	ParodusPrint("max_retry_count is %d\n", max_retry_count );
-  
+
+	memset (&conn_ctx, 0, sizeof(create_connection_ctx_t));
 	conn_ctx.nopoll_ctx = ctx;
 	init_expire_timer (&conn_ctx.connect_timer);
 	init_header_info (&conn_ctx.header_info);
-	set_extra_headers (&conn_ctx, false);
        set_server_list_null (&conn_ctx.server_list);
        init_backoff_timer (&backoff_timer, max_retry_count);
  
@@ -628,13 +643,20 @@ static char* build_extra_headers( const char *auth, const char *device_id,
 static noPollConnOpts * createConnOpts (char * extra_headers, bool secure)
 {
    noPollConnOpts * opts;
+    char * mtls_client_cert_path = NULL;
+    char * mtls_client_key_path = NULL;
    
    opts = nopoll_conn_opts_new ();
    if(secure) 
 	{
 	    if(strlen(get_parodus_cfg()->cert_path) > 0)
            {
-                nopoll_conn_opts_set_ssl_certs(opts, NULL, NULL, NULL, get_parodus_cfg()->cert_path);
+                if( ( get_parodus_cfg()->mtls_client_cert_path !=NULL && strlen(get_parodus_cfg()->mtls_client_cert_path) > 0) && (get_parodus_cfg()->mtls_client_key_path !=NULL && strlen(get_parodus_cfg()->mtls_client_key_path) > 0) )
+                {
+                       mtls_client_cert_path = get_parodus_cfg()->mtls_client_cert_path;
+                       mtls_client_key_path = get_parodus_cfg()->mtls_client_key_path;
+                }
+                nopoll_conn_opts_set_ssl_certs(opts, mtls_client_cert_path, mtls_client_key_path, NULL, get_parodus_cfg()->cert_path);
            }
 	    nopoll_conn_opts_ssl_peer_verify (opts, nopoll_true);
 	    nopoll_conn_opts_set_ssl_protocol (opts, NOPOLL_METHOD_TLSV1_2);
@@ -655,3 +677,38 @@ void close_and_unref_connection(noPollConn *conn)
    }
 }

+void write_conn_in_prog_file (const char *msg)
+{
+  int fd;
+  FILE *fp;
+  unsigned long timestamp;
+  ParodusCfg *cfg = get_parodus_cfg();
+
+  if (NULL == cfg->connection_health_file)
+    return;
+  fd = open (cfg->connection_health_file, O_CREAT | O_WRONLY | O_SYNC, 0666);
+  if (fd < 0) {
+    ParodusError ("Error(1) %d opening file %s\n", errno, cfg->connection_health_file);
+    return;
+  }
+  ftruncate (fd, 0);
+  fp = fdopen (fd, "w");
+  if (fp == NULL) {
+    ParodusError ("Error(2) %d opening file %s\n", errno, cfg->connection_health_file);
+    return;
+  }
+  timestamp = (unsigned long) time(NULL);
+  fprintf (fp, "{%s=%lu}\n", msg, timestamp);
+  fclose (fp);
+}
+
+void start_conn_in_progress (void)
+{
+  write_conn_in_prog_file ("START");
+}   
+
+void stop_conn_in_progress (void)
+{
+  write_conn_in_prog_file ("STOP");
+}   
+
--- a/src/connection.h
+++ b/src/connection.h
@@ -57,6 +57,13 @@ void set_global_reconnect_status(bool status);

 int get_cloud_disconnect_time();
 void set_cloud_disconnect_time(int disconnTime);
+
+/**
+ * @brief Interface to self heal connection in progress getting stuck
+ */
+void start_conn_in_progress (void);
+void stop_conn_in_progress (void);
+
 #ifdef __cplusplus
 }
 #endif
--- a/src/main.c
+++ b/src/main.c
@@ -18,8 +18,10 @@
 #include <string.h>
 #include "stdlib.h"
 #include "config.h"
+#include "auth_token.h"
 #include "conn_interface.h"
 #include "parodus_log.h"
+#include <curl/curl.h>
 #ifdef INCLUDE_BREAKPAD
 #include "breakpad_wrapper.h"
 #else
@@ -80,7 +82,7 @@ int main( int argc, char **argv)
    if (0 != parseCommandLine(argc,argv,cfg)) {
 		abort();
 	}
-    getAuthToken(cfg);
+    curl_global_init(CURL_GLOBAL_DEFAULT);
     
    createSocketConnection( NULL);
    
--- a/src/service_alive.c
+++ b/src/service_alive.c
@@ -114,8 +114,9 @@ void *serviceAliveTask()
 				        byte = 0;
 				        if(ret == 0)
 				        {
-					        ParodusPrint("Deletion from list is success, doing resync with head\n");
+						release_global_node ();
 					        temp= get_global_node();
+					        ParodusInfo("Deletion from list is success, doing resync with head\n");
 					        ret = -1;
 				        }
 				        else
--- a/src/upstream.c
+++ b/src/upstream.c
@@ -190,6 +190,16 @@ void *handle_upstream()
                    ParodusError("failure in allocation for message\n");
                }
            }
+	    if(nn_shutdown(sock, bind) < 0)
+	    {
+	        ParodusError ("nn_shutdown bind socket=%d endpt=%d, err=%d\n", 
+		    sock, bind, errno);
+	    }
+	    if (nn_close (sock) < 0)
+	    {
+	        ParodusError ("nn_close bind socket=%d err=%d\n", 
+		    sock, errno);
+	    }
        }
    }
    else
@@ -234,7 +244,7 @@ void *processUpstreamMessage()
            if(rv > 0)
            {
                msgType = msg->msg_type;				   
-                if(msgType == 9)
+                if(msgType == WRP_MSG_TYPE__SVC_REGISTRATION)
                {
                    ParodusInfo("\n Nanomsg client Registration for Upstream\n");
                    //Extract serviceName and url & store it in a linked list for reg_clients
@@ -249,9 +259,15 @@ void *processUpstreamMessage()
                            {
                                ParodusInfo("match found, client is already registered\n");
                                parStrncpy(temp->url,msg->u.reg.url, sizeof(temp->url));
-                                if(nn_shutdown(temp->sock, 0) < 0)
+                                if(nn_shutdown(temp->sock, temp->endpoint) < 0)
                                {
-                                    ParodusError ("Failed to shutdown\n");
+                                    ParodusError ("nn_shutdown socket=%d endpt=%d, err=%d\n", 
+					temp->sock, temp->endpoint, errno);
+                                }
+				if (nn_close (temp->sock) < 0)
+                                {
+                                    ParodusError ("nn_close socket=%d err=%d\n", 
+					temp->sock, errno);
                                }

                                temp->sock = nn_socket(AF_SP,NN_PUSH );
@@ -270,7 +286,8 @@ void *processUpstreamMessage()
                                    }
                                    else
                                    {
-                                        ParodusInfo("Client registered before. Sending acknowledgement \n"); 
+                                        temp->endpoint = rc;
+                                        ParodusInfo("Client registered before. Sending ack on socket %d\n", temp->sock); 
                                        status =sendAuthStatus(temp);

                                        if(status == 0)
@@ -400,9 +417,8 @@ void *processUpstreamMessage()
 								{
 									ParodusError("Failed to get device_id\n");
 								}
-						}
-						else
-						{
+						} else if (WRP_MSG_TYPE__SVC_ALIVE != msgType) {
+						  /* Don't reply to service alive message */
 							sendUpstreamMsgToServer(&message->msg, message->len);
 						}
 					}
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -120,10 +120,10 @@ target_link_libraries (test_nopoll_handlers_fragment -lnopoll -lcunit -lcimplog
 add_test(NAME test_connection COMMAND ${MEMORY_CHECK} ./test_connection)
 set (CONN_SRC ../src/connection.c 
  ../src/string_helpers.c ../src/mutex.c ../src/time.c 
-  ../src/config.c ../src/spin_thread.c  ../src/heartBeat.c ../src/close_retry.c)
+  ../src/config.c ../src/auth_token.c ../src/spin_thread.c  ../src/heartBeat.c ../src/close_retry.c)
 #set(CONN_SRC ../src/connection.c ${PARODUS_COMMON_SRC})
 add_executable(test_connection test_connection.c ${CONN_SRC})
-target_link_libraries (test_connection ${PARODUS_COMMON_LIBS} -lcmocka)
+target_link_libraries (test_connection ${PARODUS_COMMON_LIBS} -lcmocka -lcurl -luuid)

 #-------------------------------------------------------------------------------
 #   test_connection - function createNopollConnection
@@ -141,7 +141,7 @@ target_link_libraries (test_connection ${PARODUS_COMMON_LIBS} -lcmocka)
 add_test(NAME test_client_list COMMAND ${MEMORY_CHECK} ./test_client_list)
 #add_executable(test_client_list test_client_list.c ../src/client_list.c ../src/service_alive.c ../src/upstream.c ../src/networking.c ../src/nopoll_helpers.c ../src/downstream.c ../src/connection.c ../src/nopoll_handlers.c ../src/ParodusInternal.c ../src/thread_tasks.c ../src/conn_interface.c ../src/partners_check.c ${PARODUS_COMMON_SRC})
 #target_link_libraries (test_client_list ${PARODUS_COMMON_LIBS})
-set(CLIST_SRC test_client_list.c ../src/client_list.c 
+set(CLIST_SRC test_client_list.c ../src/client_list.c ../src/auth_token.c
 ../src/service_alive.c ../src/upstream.c ../src/networking.c ../src/nopoll_helpers.c 
 ../src/downstream.c ../src/connection.c ../src/nopoll_handlers.c ../src/heartBeat.c ../src/close_retry.c
 ../src/ParodusInternal.c ../src/thread_tasks.c ../src/conn_interface.c 
@@ -155,7 +155,7 @@ endif (ENABLE_SESHAT)
 
 add_executable(test_client_list ${CLIST_SRC})
 #target_link_libraries (test_client_list ${PARODUS_CONN_LIBS} ${PARODUS_COMMON_LIBS})
-target_link_libraries (test_client_list ${PARODUS_COMMON_LIBS})
+target_link_libraries (test_client_list ${PARODUS_COMMON_LIBS} -lcurl -luuid)

 #-------------------------------------------------------------------------------
 #   test_service_alive
@@ -163,7 +163,7 @@ target_link_libraries (test_client_list ${PARODUS_COMMON_LIBS})
 add_test(NAME test_service_alive COMMAND ${MEMORY_CHECK} ./test_service_alive)
 #add_executable(test_service_alive test_service_alive.c ../src/client_list.c ../src/service_alive.c ../src/upstream.c ../src/networking.c ../src/nopoll_helpers.c ../src/nopoll_handlers.c ../src/config.c ../src/connection.c ../src/ParodusInternal.c ../src/downstream.c ../src/thread_tasks.c ../src/conn_interface.c ../src/partners_check.c ${PARODUS_COMMON_SRC})
 #target_link_libraries (test_service_alive ${PARODUS_COMMON_LIBS})
-set(SVA_SRC test_service_alive.c ../src/client_list.c ../src/service_alive.c ../src/upstream.c ../src/networking.c ../src/nopoll_helpers.c ../src/nopoll_handlers.c ../src/config.c ../src/connection.c ../src/ParodusInternal.c ../src/downstream.c ../src/thread_tasks.c ../src/conn_interface.c ../src/partners_check.c ../src/heartBeat.c ../src/close_retry.c ${PARODUS_COMMON_SRC})
+set(SVA_SRC test_service_alive.c ../src/client_list.c ../src/service_alive.c ../src/auth_token.c ../src/upstream.c ../src/networking.c ../src/nopoll_helpers.c ../src/nopoll_handlers.c ../src/config.c ../src/connection.c ../src/ParodusInternal.c ../src/downstream.c ../src/thread_tasks.c ../src/conn_interface.c ../src/partners_check.c ../src/heartBeat.c ../src/close_retry.c ${PARODUS_COMMON_SRC})
 if (ENABLE_SESHAT)
 set(SVA_SRC ${SVA_SRC} ../src/seshat_interface.c)
 else()
@@ -172,16 +172,36 @@ endif (ENABLE_SESHAT)

 add_executable(test_service_alive ${SVA_SRC})
 #target_link_libraries (test_service_alive ${PARODUS_CONN_LIBS} ${PARODUS_COMMON_LIBS})
-target_link_libraries (test_service_alive ${PARODUS_COMMON_LIBS})
+target_link_libraries (test_service_alive ${PARODUS_COMMON_LIBS} -lcurl -luuid)

 #-------------------------------------------------------------------------------
 #   test_config
 #-------------------------------------------------------------------------------
 add_test(NAME test_config COMMAND ${MEMORY_CHECK} ./test_config)
-add_executable(test_config test_config.c ../src/config.c ../src/string_helpers.c)
+add_executable(test_config test_config.c ../src/config.c ../src/auth_token.c ../src/string_helpers.c)
 target_link_libraries (test_config -lcmocka
 -Wl,--no-as-needed -lcimplog
- -lcjson -lcjwt -ltrower-base64 -lssl -lcrypto -lrt -lm
+ -lcjson -lcjwt -ltrower-base64 -lssl -lcrypto -lrt -lm -lcurl -luuid
+)
+
+#-------------------------------------------------------------------------------
+#   test_auth_token
+#-------------------------------------------------------------------------------
+add_test(NAME test_auth_token COMMAND ${MEMORY_CHECK} ./test_auth_token)
+add_executable(test_auth_token test_auth_token.c ../src/config.c ../src/auth_token.c ../src/string_helpers.c)
+target_link_libraries (test_auth_token -lcmocka
+ -Wl,--no-as-needed -lcimplog
+ -lcjson -lcjwt -ltrower-base64 -lssl -lcrypto -lrt -lm -lcurl -luuid
+)
+
+#-------------------------------------------------------------------------------
+#   test_auth_token_more
+#-------------------------------------------------------------------------------
+add_test(NAME test_auth_token_more COMMAND ${MEMORY_CHECK} ./test_auth_token_more)
+add_executable(test_auth_token_more test_auth_token_more.c ../src/config.c ../src/auth_token.c ../src/string_helpers.c)
+target_link_libraries (test_auth_token_more -lcmocka
+ -Wl,--no-as-needed -lcimplog
+ -lcjson -lcjwt -ltrower-base64 -lssl -lcrypto -lrt -lm -lcurl -luuid
 )

 #-------------------------------------------------------------------------------
@@ -203,7 +223,7 @@ target_link_libraries (test_crud_tasks -lcmocka ${PARODUS_COMMON_LIBS} )
 #-------------------------------------------------------------------------------
 add_test(NAME test_crud_internal COMMAND ${MEMORY_CHECK} ./test_crud_internal)
 add_executable(test_crud_internal test_crud_internal.c ../src/config.c ../src/close_retry.c ../src/string_helpers.c ../src/crud_internal.c )
-target_link_libraries (test_crud_internal -lcmocka ${PARODUS_COMMON_LIBS} )
+target_link_libraries (test_crud_internal -lcmocka ${PARODUS_COMMON_LIBS} -lcurl -luuid)

 #-------------------------------------------------------------------------------
 #   test_upstream
@@ -215,6 +235,17 @@ target_link_libraries (test_upstream -lcmocka gcov -lcunit -lcimplog
 -Wl,--no-as-needed -lcjson -lcjwt -ltrower-base64
 -lssl -lcrypto -lrt -lm)

+#-------------------------------------------------------------------------------
+#   test_upstream_sock
+#-------------------------------------------------------------------------------
+add_test(NAME test_upstream_sock COMMAND ${MEMORY_CHECK} ./test_upstream_sock)
+add_executable(test_upstream_sock test_upstream_sock.c ../src/upstream.c 
+  ../src/client_list.c ../src/close_retry.c ../src/string_helpers.c)
+target_link_libraries (test_upstream_sock -lcmocka gcov -lcunit -lcimplog
+ -lwrp-c -luuid -lpthread -lmsgpackc -lnopoll -lnanomsg
+ -Wl,--no-as-needed -lcjson -lcjwt -ltrower-base64
+ -lssl -lcrypto -lrt -lm)
+
 #-------------------------------------------------------------------------------
 #   test_downstream
 #-------------------------------------------------------------------------------
@@ -259,14 +290,14 @@ else()
 set(CONIFC_SRC ${CONIFC_SRC} ../src/seshat_interface_stub.c)
 endif (ENABLE_SESHAT)
 add_executable(test_conn_interface ${CONIFC_SRC})
-target_link_libraries (test_conn_interface -lcmocka ${PARODUS_COMMON_LIBS} )
+target_link_libraries (test_conn_interface -lcmocka ${PARODUS_COMMON_LIBS} -lcurl -luuid )

 #-------------------------------------------------------------------------------
 #   test_ParodusInternal
 #-------------------------------------------------------------------------------
 add_test(NAME test_ParodusInternal COMMAND ${MEMORY_CHECK} ./test_ParodusInternal)
 add_executable(test_ParodusInternal test_ParodusInternal.c ../src/ParodusInternal.c ../src/config.c ../src/string_helpers.c)
-target_link_libraries (test_ParodusInternal -lcmocka ${PARODUS_COMMON_LIBS} )
+target_link_libraries (test_ParodusInternal -lcmocka ${PARODUS_COMMON_LIBS} -lcurl -luuid)

 #-------------------------------------------------------------------------------
 #   test_partners_check
@@ -285,7 +316,7 @@ set(TOKEN_SRC ../src/conn_interface.c ../src/config.c
 ../src/nopoll_handlers.c ../src/nopoll_helpers.c
 ../src/partners_check.c ../src/ParodusInternal.c
 ../src/upstream.c ../src/downstream.c 
- ../src/networking.c
+ ../src/networking.c ../src/auth_token.c
 ../src/thread_tasks.c ../src/time.c
 ../src/string_helpers.c ../src/mutex.c 
 ../src/token.c ../src/heartBeat.c
@@ -306,7 +337,7 @@ endif (FEATURE_DNS_QUERY)

 add_executable(test_token ${TOKEN_SRC} ) 
 #target_link_libraries (test_token ${PARODUS_COMMON_LIBS} ${PARODUS_JWT_LIBS} -lcmocka )
-target_link_libraries (test_token ${PARODUS_COMMON_LIBS} -lcmocka )
+target_link_libraries (test_token ${PARODUS_COMMON_LIBS} -lcmocka -lcurl -luuid)

 #-------------------------------------------------------------------------------
 #   test_seshat_interface - registerWithSeshat
--- a/tests/test_auth_token.c
+++ b/tests/test_auth_token.c
@@ -0,0 +1,334 @@
+/**
+ *  Copyright 2010-2016 Comcast Cable Communications Management, LLC
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ */
+#include <assert.h>
+#include <errno.h>
+#include <pthread.h>
+#include <malloc.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <setjmp.h>
+#include <cmocka.h>
+
+#include <CUnit/Basic.h>
+
+#include "../src/config.h"
+#include "../src/auth_token.h"
+#include "../src/ParodusInternal.h"
+
+extern int requestNewAuthToken(char *newToken, size_t len, int r_count);
+
+/*----------------------------------------------------------------------------*/
+/*                                   Mocks                                    */
+/*----------------------------------------------------------------------------*/
+typedef void CURL;
+
+typedef enum {
+  CURLINFO_RESPONSE_CODE    = 2,
+  CURLINFO_TOTAL_TIME
+} CURLINFO;
+
+struct token_data test_data;
+
+int curl_easy_perform(CURL *curl)
+{
+	UNUSED(curl);
+	char *msg = "response";
+	int rtn;
+
+	function_called();
+	rtn = (int) mock();
+	if (0 == rtn)
+	  write_callback_fn (msg, 1, strlen(msg), &test_data);
+	return rtn;
+}
+
+int curl_easy_getinfo(CURL *curl, CURLINFO CURLINFO_RESPONSE_CODE, long response_code)
+{
+	UNUSED(curl);
+	UNUSED(CURLINFO_RESPONSE_CODE);
+	UNUSED(response_code);
+	function_called();
+	return (int) mock();
+}
+/*----------------------------------------------------------------------------*/
+/*                                   Tests                                    */
+/*----------------------------------------------------------------------------*/
+void getAuthToken_Null()
+{
+	ParodusCfg cfg;
+	memset(&cfg,0,sizeof(cfg));
+	parStrncpy(cfg.hw_mac , "123567892366", sizeof(cfg.hw_mac));
+	cfg.client_cert_path = NULL;
+	getAuthToken(&cfg);
+	set_parodus_cfg(&cfg);
+	assert( cfg.client_cert_path == NULL);
+	assert_int_equal (0, (int) cfg.webpa_auth_token[0]);
+}
+
+void getAuthToken_MacNull()
+{
+    ParodusCfg cfg;
+    memset(&cfg,0,sizeof(cfg));
+    cfg.client_cert_path = NULL;
+    getAuthToken(&cfg);
+    set_parodus_cfg(&cfg);
+    assert( cfg.client_cert_path == NULL);
+    assert_int_equal (0, (int) cfg.webpa_auth_token[0]);
+}
+
+#if 0
+void test_requestNewAuthToken_init_fail ()
+{
+	char token[32];
+	ParodusCfg cfg;
+	int output = -1;
+	memset(&cfg,0,sizeof(cfg));
+
+	cfg.token_server_url = strdup("https://dev.comcast.net/token");
+	parStrncpy(cfg.cert_path , "/etc/ssl/certs/ca-certificates.crt", sizeof(cfg.cert_path));
+	parStrncpy(cfg.hw_serial_number, "Fer23u948590", sizeof(cfg.hw_serial_number));
+	parStrncpy(cfg.hw_mac , "123567892366", sizeof(cfg.hw_mac));
+
+	set_parodus_cfg(&cfg);
+
+	will_return (curl_easy_perform, -1);
+	expect_function_calls (curl_easy_perform, 1);
+
+	will_return (curl_easy_getinfo, 0);
+	expect_function_calls (curl_easy_getinfo, 1);
+
+	will_return (curl_easy_getinfo, -1);
+	expect_function_calls (curl_easy_getinfo, 1);
+
+	requestNewAuthToken (token, sizeof(token), 2);
+	assert_int_equal (output, -1);
+	free(cfg.token_server_url);
+}
+#endif
+
+void test_requestNewAuthToken_failure ()
+{
+	char token[32];
+	ParodusCfg cfg;
+	int output = -1;
+	memset(&cfg,0,sizeof(cfg));
+
+	cfg.token_server_url = strdup("https://dev.comcast.net/token");
+	parStrncpy(cfg.cert_path , "/etc/ssl/certs/ca-certificates.crt", sizeof(cfg.cert_path));
+	parStrncpy(cfg.hw_serial_number, "Fer23u948590", sizeof(cfg.hw_serial_number));
+	parStrncpy(cfg.hw_mac , "123567892366", sizeof(cfg.hw_mac));
+	set_parodus_cfg(&cfg);
+
+	test_data.size = 0;
+	test_data.data = token;
+	will_return (curl_easy_perform, -1);
+	expect_function_calls (curl_easy_perform, 1);
+
+	will_return (curl_easy_getinfo, 0);
+	expect_function_calls (curl_easy_getinfo, 1);
+
+	will_return (curl_easy_getinfo, -1);
+	expect_function_calls (curl_easy_getinfo, 1);
+
+	requestNewAuthToken (token, sizeof(token), 2);
+	assert_int_equal (output, -1);
+	assert_int_equal (0, (int) token[0]);
+	free(cfg.token_server_url);
+}
+
+
+void test_requestNewAuthToken ()
+{
+  char token[1024];
+  ParodusCfg cfg;
+  int output = -1;
+  memset(&cfg,0,sizeof(cfg));
+
+  cfg.token_server_url = strdup("https://dev.comcast.net/token");
+  parStrncpy(cfg.cert_path , "/etc/ssl/certs/ca-certificates.crt", sizeof(cfg.cert_path));
+  parStrncpy(cfg.webpa_interface_used , "eth0", sizeof(cfg.webpa_interface_used));
+  parStrncpy(cfg.hw_serial_number, "Fer23u948590", sizeof(cfg.hw_serial_number));
+  parStrncpy(cfg.hw_mac , "123567892366", sizeof(cfg.hw_mac));
+  set_parodus_cfg(&cfg);
+
+  test_data.size = 0;
+  test_data.data = token;
+  will_return (curl_easy_perform, 0);
+  expect_function_calls (curl_easy_perform, 1);
+  will_return (curl_easy_getinfo, 0);
+  expect_function_calls (curl_easy_getinfo, 1);
+
+  will_return (curl_easy_getinfo, 0);
+  expect_function_calls (curl_easy_getinfo, 1);
+
+  output = requestNewAuthToken (token, sizeof(token), 1);
+  assert_int_equal (output, 0);
+  assert_string_equal (token, "response");
+  free(cfg.token_server_url);
+}
+
+void test_getAuthToken ()
+{
+	ParodusCfg cfg;
+	memset(&cfg,0,sizeof(cfg));
+
+	cfg.token_server_url = strdup("https://dev.comcast.net/token");
+	cfg.client_cert_path = strdup("testcert");
+	parStrncpy(cfg.cert_path , "/etc/ssl/certs/ca-certificates.crt", sizeof(cfg.cert_path));
+	parStrncpy(cfg.webpa_interface_used , "eth0", sizeof(cfg.webpa_interface_used));
+	parStrncpy(cfg.hw_serial_number, "Fer23u948590", sizeof(cfg.hw_serial_number));
+	parStrncpy(cfg.hw_mac , "123567892366", sizeof(cfg.hw_mac));
+	set_parodus_cfg(&cfg);
+
+	/* To test curl failure case and retry on v4 mode */
+	will_return (curl_easy_perform, -1);
+	expect_function_calls (curl_easy_perform, 1);
+
+	will_return (curl_easy_getinfo, 0);
+	expect_function_calls (curl_easy_getinfo, 1);
+
+	will_return (curl_easy_getinfo, 0);
+	expect_function_calls (curl_easy_getinfo, 1);
+
+	/* To test curl failure case and retry on v6 mode */
+	will_return (curl_easy_perform, -1);
+	expect_function_calls (curl_easy_perform, 1);
+
+	will_return (curl_easy_getinfo, 0);
+	expect_function_calls (curl_easy_getinfo, 1);
+
+	will_return (curl_easy_getinfo, 0);
+	expect_function_calls (curl_easy_getinfo, 1);
+
+	/* To test curl success case */
+	test_data.size = 0;
+	test_data.data = cfg.webpa_auth_token;
+	will_return (curl_easy_perform, 0);
+	expect_function_calls (curl_easy_perform, 1);
+
+	will_return (curl_easy_getinfo, 0);
+	expect_function_calls (curl_easy_getinfo, 1);
+
+	will_return (curl_easy_getinfo, 0);
+	expect_function_calls (curl_easy_getinfo, 1);
+
+	getAuthToken(&cfg);
+	assert_string_equal (cfg.webpa_auth_token, "response");
+	free(cfg.client_cert_path);
+	free(cfg.token_server_url);
+}
+
+void test_getAuthTokenFailure ()
+{
+	ParodusCfg cfg;
+	memset(&cfg,0,sizeof(cfg));
+
+	cfg.token_server_url = strdup("https://dev.comcast.net/token");
+	cfg.client_cert_path = strdup("testcert");
+	parStrncpy(cfg.cert_path , "/etc/ssl/certs/ca-certificates.crt", sizeof(cfg.cert_path));
+	parStrncpy(cfg.webpa_interface_used , "eth0", sizeof(cfg.webpa_interface_used));
+	parStrncpy(cfg.hw_serial_number, "Fer23u948590", sizeof(cfg.hw_serial_number));
+	parStrncpy(cfg.hw_mac , "123567892366", sizeof(cfg.hw_mac));
+	set_parodus_cfg(&cfg);
+
+	will_return (curl_easy_perform, -1);
+	expect_function_calls (curl_easy_perform, 1);
+
+	will_return (curl_easy_getinfo, 0);
+	expect_function_calls (curl_easy_getinfo, 1);
+
+	will_return (curl_easy_getinfo, 0);
+	expect_function_calls (curl_easy_getinfo, 1);
+
+	will_return (curl_easy_perform, -1);
+	expect_function_calls (curl_easy_perform, 1);
+
+	will_return (curl_easy_getinfo, 0);
+	expect_function_calls (curl_easy_getinfo, 1);
+
+	will_return (curl_easy_getinfo, 0);
+	expect_function_calls (curl_easy_getinfo, 1);
+
+	will_return (curl_easy_perform, -1);
+	expect_function_calls (curl_easy_perform, 1);
+
+	will_return (curl_easy_getinfo, 0);
+	expect_function_calls (curl_easy_getinfo, 1);
+
+	will_return (curl_easy_getinfo, 0);
+	expect_function_calls (curl_easy_getinfo, 1);
+
+	getAuthToken(&cfg);
+
+	assert_string_equal( cfg.webpa_auth_token, "");
+
+	free(cfg.client_cert_path);
+	free(cfg.token_server_url);
+}
+
+void test_write_callback_fn ()
+{
+	ParodusCfg *cfg;
+	size_t max_data_size = sizeof (cfg->webpa_auth_token);
+	char *buffer1 = "response1";
+	size_t buf1len = strlen(buffer1);
+        char *buffer2 = "R2";
+	size_t buf2len = strlen(buffer2);
+	char buffer3[max_data_size];
+	int out_len=0;
+	struct token_data data;
+	data.size = 0;
+
+	data.data = (char *) malloc(max_data_size);
+	data.data[0] = '\0';
+
+	out_len = write_callback_fn(buffer1, 1, buf1len, &data);
+	assert_string_equal(data.data, buffer1);
+	assert_int_equal (out_len, buf1len);
+	assert_int_equal (data.size, buf1len);
+
+	out_len = write_callback_fn(buffer2, 1, buf2len, &data);
+	assert_string_equal(data.data, "response1R2");
+	assert_int_equal (out_len, buf2len);
+	assert_int_equal (data.size, buf1len+buf2len);
+
+	memset (buffer3, 'x', max_data_size);
+	out_len = write_callback_fn(buffer3, 1, max_data_size, &data);
+	assert_int_equal (out_len, 0);
+	assert_int_equal (data.size, 0);
+
+	free(data.data);
+}
+
+/*----------------------------------------------------------------------------*/
+/*                             External Functions                             */
+/*----------------------------------------------------------------------------*/
+
+int main(void)
+{
+    const struct CMUnitTest tests[] = {
+	cmocka_unit_test(test_write_callback_fn),
+        cmocka_unit_test(test_requestNewAuthToken),
+	// cmocka_unit_test(test_requestNewAuthToken_init_fail),
+	cmocka_unit_test(test_requestNewAuthToken_failure),
+	cmocka_unit_test(getAuthToken_Null),
+	cmocka_unit_test(getAuthToken_MacNull),
+	cmocka_unit_test(test_getAuthToken),
+	cmocka_unit_test(test_getAuthTokenFailure),
+    };
+
+    return cmocka_run_group_tests(tests, NULL, NULL);
+}
--- a/tests/test_auth_token_more.c
+++ b/tests/test_auth_token_more.c
@@ -0,0 +1,109 @@
+/**
+ *  Copyright 2010-2016 Comcast Cable Communications Management, LLC
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ */
+#include <assert.h>
+#include <errno.h>
+#include <pthread.h>
+#include <malloc.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <setjmp.h>
+#include <cmocka.h>
+
+#include <CUnit/Basic.h>
+
+#include "../src/config.h"
+#include "../src/auth_token.h"
+#include "../src/ParodusInternal.h"
+
+extern int requestNewAuthToken(char *newToken, size_t len, int r_count);
+
+/*----------------------------------------------------------------------------*/
+/*                                   Mocks                                    */
+/*----------------------------------------------------------------------------*/
+typedef void CURL;
+
+typedef enum {
+  CURLINFO_RESPONSE_CODE    = 2,
+  CURLINFO_TOTAL_TIME
+} CURLINFO;
+
+struct token_data test_data;
+
+CURL *curl_easy_init  ()
+{
+	function_called();
+	return (CURL *) mock();
+}
+
+int curl_easy_perform(CURL *curl)
+{
+	UNUSED(curl);
+	char *msg = "response";
+	int rtn;
+
+	function_called();
+	rtn = (int) mock();
+	if (0 == rtn)
+	  write_callback_fn (msg, 1, strlen(msg), &test_data);
+	return rtn;
+}
+
+int curl_easy_getinfo(CURL *curl, CURLINFO CURLINFO_RESPONSE_CODE, long response_code)
+{
+	UNUSED(curl);
+	UNUSED(CURLINFO_RESPONSE_CODE);
+	UNUSED(response_code);
+	function_called();
+	return (int) mock();
+}
+/*----------------------------------------------------------------------------*/
+/*                                   Tests                                    */
+/*----------------------------------------------------------------------------*/
+void test_requestNewAuthToken_init_fail ()
+{
+	char token[32];
+	ParodusCfg cfg;
+	int output = -1;
+	memset(&cfg,0,sizeof(cfg));
+
+	cfg.token_server_url = strdup("https://dev.comcast.net/token");
+	parStrncpy(cfg.cert_path , "/etc/ssl/certs/ca-certificates.crt", sizeof(cfg.cert_path));
+	parStrncpy(cfg.hw_serial_number, "Fer23u948590", sizeof(cfg.hw_serial_number));
+	parStrncpy(cfg.hw_mac , "123567892366", sizeof(cfg.hw_mac));
+
+	set_parodus_cfg(&cfg);
+
+	will_return (curl_easy_init, NULL);
+	expect_function_calls (curl_easy_init, 1);
+
+	requestNewAuthToken (token, sizeof(token), 2);
+	assert_int_equal (output, -1);
+	assert_int_equal (0, (int) token[0]);
+	free(cfg.token_server_url);
+}
+
+/*----------------------------------------------------------------------------*/
+/*                             External Functions                             */
+/*----------------------------------------------------------------------------*/
+
+int main(void)
+{
+    const struct CMUnitTest tests[] = {
+	cmocka_unit_test(test_requestNewAuthToken_init_fail)
+    };
+
+    return cmocka_run_group_tests(tests, NULL, NULL);
+}
--- a/tests/test_config.c
+++ b/tests/test_config.c
@@ -25,6 +25,7 @@
 #include <CUnit/Basic.h>

 #include "../src/config.h"
+#include "../src/auth_token.h"
 #include "../src/ParodusInternal.h"

 extern int parse_mac_address (char *target, const char *arg);
@@ -37,8 +38,6 @@ extern int parse_webpa_url (const char *full_url,
 	char **server_addr, unsigned int *port);
 extern unsigned int get_algo_mask (const char *algo_str);
 extern unsigned int parse_num_arg (const char *arg, const char *arg_name);
-extern void execute_token_script(char *token, char *name, size_t len, char *mac, char *serNum);
-extern void createNewAuthToken(char *newToken, size_t len);

 /*----------------------------------------------------------------------------*/
 /*                                   Mocks                                    */
@@ -53,6 +52,7 @@ void create_token_script(char *fname)
    sprintf(command, "chmod +x %s",fname);
    system(command);
 }
+
 /*----------------------------------------------------------------------------*/
 /*                                   Tests                                    */
 /*----------------------------------------------------------------------------*/
@@ -184,9 +184,10 @@ void test_parseCommandLine()
 #endif
 		"--force-ipv4",
 		"--force-ipv6",
-		"--token-read-script=/tmp/token.sh",
-		"--token-acquisition-script=/tmp/token.sh",
+		"--boot-time-retry-wait=10",
 		"--ssl-cert-path=/etc/ssl/certs/ca-certificates.crt",
+		"--client-cert-path=testcert",
+		"--token-server-url=https://dev.comcast.net/token",
 #ifdef FEATURE_DNS_QUERY
 		"--acquire-jwt=1",
 		"--dns-txt-url=mydns.mycom.net",
@@ -214,6 +215,7 @@ void test_parseCommandLine()
    assert_string_equal( parodusCfg.hw_last_reboot_reason, "unknown");	
    assert_string_equal( parodusCfg.fw_name, "TG1682_DEV_master_2016000000sdy");	
    assert_int_equal( (int) parodusCfg.webpa_ping_timeout,180);	
+    assert_int_equal( (int) parodusCfg.boot_retry_wait,10);
    assert_string_equal( parodusCfg.webpa_interface_used, "br0");	
    assert_string_equal( parodusCfg.webpa_url, "http://127.0.0.1");
    assert_int_equal( (int) parodusCfg.webpa_backoff_max,0);
@@ -224,18 +226,20 @@ void test_parseCommandLine()
    assert_string_equal(  parodusCfg.seshat_url, "ipc://127.0.0.1:7777");
 #endif
    assert_int_equal( (int) parodusCfg.flags, FLAGS_IPV6_ONLY|FLAGS_IPV4_ONLY);
-    sprintf(expectedToken,"secure-token-%s-%s",parodusCfg.hw_serial_number,parodusCfg.hw_mac);
-    getAuthToken(&parodusCfg);
-    set_parodus_cfg(&parodusCfg);
    
+    set_parodus_cfg(&parodusCfg);
+    getAuthToken(&parodusCfg);
    assert_string_equal(  get_parodus_cfg()->webpa_auth_token,expectedToken);
    assert_string_equal(  parodusCfg.cert_path,"/etc/ssl/certs/ca-certificates.crt");
+	assert_string_equal(  parodusCfg.client_cert_path,"testcert");
+	assert_string_equal(  parodusCfg.token_server_url,"https://dev.comcast.net/token");
 #ifdef FEATURE_DNS_QUERY
 	assert_int_equal( (int) parodusCfg.acquire_jwt, 1);
    assert_string_equal(parodusCfg.dns_txt_url, "mydns.mycom.net");
    assert_int_equal( (int) parodusCfg.jwt_algo, 1024);
 	assert_string_equal ( get_parodus_cfg()->jwt_key, jwt_key);
 #endif
+	assert_int_equal( (int) parodusCfg.boot_retry_wait, 10);
 	assert_string_equal(parodusCfg.crud_config_file, "parodus_cfg.json");
 }

@@ -317,13 +321,13 @@ void test_loadParodusCfg()
    Cfg->jwt_algo = 1025;
    parStrncpy(Cfg->jwt_key, "AGdyuwyhwl2ow2ydsoioiygkshwdthuwd",sizeof(Cfg->jwt_key));
 #endif
-    parStrncpy(Cfg->token_acquisition_script , "/tmp/token.sh", sizeof(Cfg->token_acquisition_script));
-    parStrncpy(Cfg->token_read_script , "/tmp/token.sh", sizeof(Cfg->token_read_script));
    parStrncpy(Cfg->cert_path, "/etc/ssl.crt",sizeof(Cfg->cert_path));
 #ifdef ENABLE_SESHAT
    parStrncpy(Cfg->seshat_url, "ipc://tmp/seshat_service.url", sizeof(Cfg->seshat_url));
 #endif
 	Cfg->crud_config_file = strdup("parodus_cfg.json");
+	Cfg->client_cert_path = strdup("testcert");
+	Cfg->token_server_url = strdup("https://dev.comcast.net/token");
    memset(&tmpcfg,0,sizeof(ParodusCfg));
    loadParodusCfg(Cfg,&tmpcfg);

@@ -334,14 +338,14 @@ void test_loadParodusCfg()
    assert_string_equal( tmpcfg.local_url, "tcp://10.0.0.1:6000");
    assert_string_equal( tmpcfg.partner_id, "shaw");
    assert_string_equal( tmpcfg.webpa_protocol, protocol);
+	assert_string_equal(tmpcfg.client_cert_path, "testcert");
+	assert_string_equal(tmpcfg.token_server_url, "https://dev.comcast.net/token");
 #ifdef FEATURE_DNS_QUERY
 	assert_int_equal( (int) tmpcfg.acquire_jwt, 1);
    assert_string_equal(tmpcfg.dns_txt_url, "mydns");
    assert_int_equal( (int) tmpcfg.jwt_algo, 1025);
    assert_string_equal(tmpcfg.jwt_key, "AGdyuwyhwl2ow2ydsoioiygkshwdthuwd");
 #endif
-    assert_string_equal(  tmpcfg.token_acquisition_script,"/tmp/token.sh");
-    assert_string_equal(  tmpcfg.token_read_script,"/tmp/token.sh");
    assert_string_equal(tmpcfg.cert_path, "/etc/ssl.crt");
 #ifdef ENABLE_SESHAT
    assert_string_equal(tmpcfg.seshat_url, "ipc://tmp/seshat_service.url");
@@ -553,47 +557,6 @@ void test_get_algo_mask ()
 #endif	
 }

-void test_execute_token_script()
-{
-  char *cmd1 = "../../tests/return_ser_mac.bsh";
-  char *cmd2 = "nosuch";
-  char token[32];
-  
-  memset (token, '\0', sizeof(token));
-  execute_token_script (token, cmd1, sizeof(token), "mac123", "ser456");
-  assert_string_equal (token, "SER_MAC ser456 mac123");
-  
-  memset (token, '\0', sizeof(token));
-  execute_token_script (token, cmd2, sizeof(token), "mac123", "ser456");
-  assert_string_equal (token, "");
-}
-
-void test_new_auth_token ()
-{
-  char token[64];
-  ParodusCfg cfg;
-  memset(&cfg,0,sizeof(cfg));
-
-  parStrncpy (cfg.token_acquisition_script, "../../tests/return_success.bsh",
-	sizeof(cfg.token_acquisition_script));
-  parStrncpy (cfg.token_read_script, "../../tests/return_ser_mac.bsh",
-	sizeof(cfg.token_read_script));
-  parStrncpy(cfg.hw_serial_number, "Fer23u948590", sizeof(cfg.hw_serial_number));
-  parStrncpy(cfg.hw_mac , "123567892366", sizeof(cfg.hw_mac));
-	
-  set_parodus_cfg(&cfg);
-  createNewAuthToken (token, sizeof(token));
-  assert_string_equal (token, "SER_MAC Fer23u948590 123567892366");
-  
-  memset (token, 0, sizeof(token));
-  parStrncpy (cfg.token_acquisition_script, "../../tests/return_failure.bsh",
-	sizeof(cfg.token_acquisition_script));
-  set_parodus_cfg(&cfg);
-  createNewAuthToken (token, sizeof(token));
-  assert_string_equal (token, "");  
-	
-}
-
 /*----------------------------------------------------------------------------*/
 /*                             External Functions                             */
 /*----------------------------------------------------------------------------*/
@@ -618,8 +581,6 @@ int main(void)
        //cmocka_unit_test(test_parodusGitVersion),
        cmocka_unit_test(test_setDefaultValuesToCfg),
        cmocka_unit_test(err_setDefaultValuesToCfg),
-        cmocka_unit_test(test_execute_token_script),
-        cmocka_unit_test(test_new_auth_token)
    };

    return cmocka_run_group_tests(tests, NULL, NULL);
--- a/tests/test_conn_interface.c
+++ b/tests/test_conn_interface.c
@@ -74,6 +74,15 @@ noPollMutexUnlock 	mutex_unlock
    UNUSED(mutex_create); UNUSED(mutex_destroy); UNUSED(mutex_lock); UNUSED(mutex_unlock);
    function_called();
 }
+
+void start_conn_in_progress (void)
+{
+}   
+
+void stop_conn_in_progress (void)
+{
+}   
+
 void packMetaData()
 {
    function_called();
--- a/tests/test_connection.c
+++ b/tests/test_connection.c
@@ -117,6 +117,8 @@ nopoll_bool  nopoll_conn_wait_for_status_until_connection_ready (noPollConn * co
 	int timeout, int *status, char ** message)
 {
    UNUSED(conn); UNUSED(timeout);
+
+    *message = NULL;
    if (mock_wait_status >= 1000) {
      *status = mock_wait_status / 1000;
      mock_wait_status = mock_wait_status % 1000;
@@ -375,13 +377,21 @@ void test_set_current_server()
  assert_ptr_equal (&ctx.server_list.defaults, ctx.current_server);
 }

+void init_cfg_header_info (ParodusCfg *cfg)
+{
+  parStrncpy(cfg->hw_mac , "123567892366", sizeof(cfg->hw_mac));
+  parStrncpy(cfg->hw_model, "TG1682", sizeof(cfg->hw_model));
+  parStrncpy(cfg->hw_manufacturer , "ARRISGroup,Inc.", sizeof(cfg->hw_manufacturer));
+  parStrncpy(cfg->fw_name , "2.364s2", sizeof(cfg->fw_name));
+  parStrncpy(cfg->webpa_protocol , "WebPA-1.6", sizeof(cfg->webpa_protocol));
+}
+
 void test_set_extra_headers ()
 {
  int rtn;
  create_connection_ctx_t ctx;
  ParodusCfg cfg;
  const char *expected_extra_headers =
-      "\r\nAuthorization: Bearer SER_MAC Fer23u948590 123567892366"
      "\r\nX-WebPA-Device-Name: mac:123567892366"
      "\r\nX-WebPA-Device-Protocols: wrp-0.11,getset-0.1"
      "\r\nUser-Agent: WebPA-1.6 (2.364s2; TG1682/ARRISGroup,Inc.;)"
@@ -390,16 +400,10 @@ void test_set_extra_headers ()
  memset(&cfg,0,sizeof(cfg));
  memset (&ctx, 0, sizeof(ctx));

-  parStrncpy (cfg.token_acquisition_script, "../../tests/return_success.bsh",
-	sizeof(cfg.token_acquisition_script));    
-  parStrncpy (cfg.token_read_script, "../../tests/return_ser_mac.bsh",
-	sizeof(cfg.token_read_script));
+  cfg.client_cert_path = strdup("testcert");
  parStrncpy(cfg.hw_serial_number, "Fer23u948590", sizeof(cfg.hw_serial_number));
-  parStrncpy(cfg.hw_mac , "123567892366", sizeof(cfg.hw_mac));
-  parStrncpy(cfg.hw_model, "TG1682", sizeof(cfg.hw_model));
-  parStrncpy(cfg.hw_manufacturer , "ARRISGroup,Inc.", sizeof(cfg.hw_manufacturer));
-  parStrncpy(cfg.fw_name , "2.364s2", sizeof(cfg.fw_name));
-  parStrncpy(cfg.webpa_protocol , "WebPA-1.6", sizeof(cfg.webpa_protocol));
+  init_cfg_header_info (&cfg);
+  parStrncpy(cfg.cert_path , "/etc/ssl/certs/ca-certificates.crt", sizeof(cfg.cert_path));
 	
  set_parodus_cfg(&cfg);
  rtn = init_header_info (&ctx.header_info);
@@ -410,9 +414,9 @@ void test_set_extra_headers ()
  assert_string_equal (ctx.header_info.conveyHeader, "WebPA-1.6 (TG1682)");
  set_extra_headers (&ctx, true);
  
-  assert_string_equal (get_parodus_cfg()->webpa_auth_token, 
-    "SER_MAC Fer23u948590 123567892366");
  assert_string_equal (ctx.extra_headers, expected_extra_headers);
+  if(cfg.client_cert_path !=NULL) {
+  free(cfg.client_cert_path); }
  free (ctx.extra_headers);
  free_header_info (&ctx.header_info);
 	
@@ -581,19 +585,12 @@ void test_nopoll_connect ()

 // Return codes for wait_connection_ready
 #define WAIT_SUCCESS	0
-#define WAIT_ACTION_RETRY	1	// if wait_status is 307, 302, 303 or 403
+#define WAIT_ACTION_RETRY	1	// if wait_status is 307, 302, 303, or 403
 #define WAIT_FAIL 	2

 void test_wait_connection_ready ()
 {
  create_connection_ctx_t ctx;
-  ParodusCfg Cfg;
-  const char *expected_extra_headers =
-      "\r\nAuthorization: Bearer Auth---"
-      "\r\nX-WebPA-Device-Name: mac:123567892366"
-      "\r\nX-WebPA-Device-Protocols: wrp-0.11,getset-0.1"
-      "\r\nUser-Agent: WebPA-1.6 (2.364s2; TG1682/ARRISGroup,Inc.;)"
-      "\r\nX-WebPA-Convey: WebPA-1.6 (TG1682)";

  memset(&ctx,0,sizeof(ctx));
  set_server_list_null (&ctx.server_list);
@@ -608,7 +605,7 @@ void test_wait_connection_ready ()
  will_return (nopoll_conn_wait_for_status_until_connection_ready, nopoll_false);
  expect_function_call (nopoll_conn_wait_for_status_until_connection_ready);
  assert_int_equal (wait_connection_ready (&ctx), WAIT_FAIL);
-  
+
  mock_wait_status = 503;
  will_return (nopoll_conn_wait_for_status_until_connection_ready, nopoll_false);
  expect_function_call (nopoll_conn_wait_for_status_until_connection_ready);
@@ -643,30 +640,18 @@ void test_wait_connection_ready ()
  free_server (&ctx.server_list.redirect);
  
    mock_wait_status = 403;
-    memset(&Cfg, 0, sizeof(ParodusCfg));
-
-    parStrncpy (Cfg.webpa_auth_token, "Auth---", sizeof (Cfg.webpa_auth_token));
-    parStrncpy(Cfg.hw_model, "TG1682", sizeof(Cfg.hw_model));
-    parStrncpy(Cfg.hw_manufacturer , "ARRISGroup,Inc.", sizeof(Cfg.hw_manufacturer));
-    parStrncpy(Cfg.hw_mac , "123567892366", sizeof(Cfg.hw_mac));
-    parStrncpy(Cfg.fw_name , "2.364s2", sizeof(Cfg.fw_name));
-    parStrncpy(Cfg.webpa_protocol , "WebPA-1.6", sizeof(Cfg.webpa_protocol));
-    set_parodus_cfg(&Cfg);
-  
-    init_header_info (&ctx.header_info);
    will_return (nopoll_conn_wait_for_status_until_connection_ready, nopoll_false);
    expect_function_call (nopoll_conn_wait_for_status_until_connection_ready);
    assert_int_equal (wait_connection_ready (&ctx), WAIT_ACTION_RETRY);
-    
-    assert_string_equal (ctx.extra_headers, expected_extra_headers);
+
    free_extra_headers (&ctx);
    free_header_info (&ctx.header_info);
 }

 // Return codes for connect_and_wait
 #define CONN_WAIT_SUCCESS	0
-#define CONN_WAIT_ACTION_RETRY	1	// if wait_status is 307, 302, 303 or 403
-#define CONN_WAIT_RETRY_DNS 	2
+#define CONN_WAIT_ACTION_RETRY	 1	// if wait_status is 307, 302, 303, or 403
+#define CONN_WAIT_RETRY_DNS 	 2

 void test_connect_and_wait ()
 {
@@ -818,22 +803,16 @@ void test_keep_trying ()
  server_t test_server;
  backoff_timer_t backoff_timer;
  ParodusCfg Cfg;
-  char *test_extra_headers =
-      "\r\nAuthorization: Bearer SER_MAC Fer23u948590 123567892366"
-      "\r\nX-WebPA-Device-Name: mac:123567892366"
-      "\r\nX-WebPA-Device-Protocols: wrp-0.11,getset-0.1"
-      "\r\nUser-Agent: WebPA-1.6 (2.364s2; TG1682/ARRISGroup,Inc.;)"
-      "\r\nX-WebPA-Convey: WebPA-1.6 (TG1682)";

  memset(&Cfg, 0, sizeof(ParodusCfg));
  parStrncpy (Cfg.webpa_url, "http://mydns.mycom.net:8080", sizeof(Cfg.webpa_url));
+  init_cfg_header_info (&Cfg);

  mock_wait_status = 0;

  memset(&ctx,0,sizeof(ctx));
  ctx.nopoll_ctx = &test_nopoll_ctx;
  ctx.current_server = &test_server;
-  ctx.extra_headers = test_extra_headers;

  test_server.allow_insecure = 1;
  test_server.server_addr = "mydns.mycom.net";
--- a/tests/test_upstream.c
+++ b/tests/test_upstream.c
@@ -215,6 +215,13 @@ int nn_shutdown (int s, int how)
    return (int)mock();
 }

+int nn_close (int s)
+{
+    UNUSED(s);
+    function_called();
+    return (int)mock();
+}
+
 int nn_setsockopt (int s, int level, int option, const void *optval, size_t optvallen)
 {
    UNUSED(s); UNUSED(level); UNUSED(option); UNUSED(optval); UNUSED(optvallen);
@@ -266,6 +273,10 @@ void test_handleUpstreamNull()
    expect_function_call(nn_bind);
    will_return(nn_recv, 12);
    expect_function_call(nn_recv);
+    will_return(nn_shutdown, 0);
+    expect_function_call(nn_shutdown);
+    will_return(nn_close, 0);
+    expect_function_call(nn_close);
    handle_upstream();
 }

@@ -287,6 +298,10 @@ void test_handle_upstream()
    expect_function_call(nn_bind);
    will_return(nn_recv, 12);
    expect_function_call(nn_recv);
+    will_return(nn_shutdown, 0);
+    expect_function_call(nn_shutdown);
+    will_return(nn_close, 0);
+    expect_function_call(nn_close);
    handle_upstream();
    free(UpStreamMsgQ->next);
    free(UpStreamMsgQ);
@@ -448,6 +463,9 @@ void test_processUpstreamMessageRegMsg()
    will_return(nn_shutdown, 1);
    expect_function_call(nn_shutdown);

+    will_return(nn_close, 0);
+    expect_function_call(nn_close);
+
    will_return(nn_socket, 1);
    expect_function_call(nn_socket);

@@ -607,12 +625,18 @@ void err_processUpstreamMessageRegMsg()
    will_return(nn_shutdown, -1);
    expect_function_call(nn_shutdown);

+    will_return(nn_close, 0);
+    expect_function_call(nn_close);
+
    will_return(nn_socket, -1);
    expect_function_call(nn_socket);

    will_return(nn_shutdown, 1);
    expect_function_call(nn_shutdown);

+    will_return(nn_close, 0);
+    expect_function_call(nn_close);
+
    will_return(nn_socket, 1);
    expect_function_call(nn_socket);

--- a/tests/test_upstream_sock.c
+++ b/tests/test_upstream_sock.c
@@ -0,0 +1,249 @@
+/**
+ *  Copyright 2010-2016 Comcast Cable Communications Management, LLC
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ */
+#include <assert.h>
+#include <errno.h>
+#include <pthread.h>
+#include <malloc.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <setjmp.h>
+#include <cmocka.h>
+
+#include <nopoll.h>
+#include <wrp-c.h>
+#include <nanomsg/nn.h>
+
+#include "../src/upstream.h"
+#include "../src/config.h"
+#include "../src/client_list.h"
+#include "../src/ParodusInternal.h"
+#include "../src/partners_check.h"
+#include "../src/close_retry.h"
+
+/*----------------------------------------------------------------------------*/
+/*                            File Scoped Variables                           */
+/*----------------------------------------------------------------------------*/
+#define GOOD_CLIENT_URL "tcp://127.0.0.1:6667"
+
+static noPollConn *conn;
+static char *reconnect_reason = "webpa_process_starts";
+bool g_shutdown  = false;
+static ParodusCfg parodusCfg;
+extern size_t metaPackSize;
+extern UpStreamMsg *UpStreamMsgQ;
+int numLoops = 1;
+int deviceIDNull =0;
+wrp_msg_t *reg_msg = NULL;
+extern pthread_mutex_t nano_mut;
+extern pthread_cond_t nano_con;
+
+/*----------------------------------------------------------------------------*/
+/*                                   Mocks                                    */
+/*----------------------------------------------------------------------------*/
+reg_list_item_t *get_reg_list()
+{
+  reg_list_item_t *item = get_global_node();
+  release_global_node();
+  return item;
+}
+
+noPollConn *get_global_conn()
+{
+    return conn;   
+}
+
+char *get_global_reconnect_reason()
+{
+    return reconnect_reason;
+}
+
+void addCRUDmsgToQueue(wrp_msg_t *crudMsg)
+{
+	(void)crudMsg;
+	function_called();
+	return;
+}
+
+void sendMessage(noPollConn *conn, void *msg, size_t len)
+{
+    (void) conn; (void) msg; (void) len;
+    function_called();
+}
+
+void set_parodus_cfg(ParodusCfg *cfg)
+{
+    memcpy(&parodusCfg, cfg, sizeof(ParodusCfg));
+}
+
+ParodusCfg *get_parodus_cfg(void) 
+{
+	ParodusCfg cfg;
+	memset(&cfg,0,sizeof(cfg));
+	parStrncpy(cfg.hw_mac , "14cfe2142xxx", sizeof(cfg.hw_mac));
+	if(deviceIDNull)
+	{
+		parStrncpy(cfg.hw_mac , "", sizeof(cfg.hw_mac));
+	}
+	set_parodus_cfg(&cfg);
+    return &parodusCfg;
+}
+
+/*-------------------------------------------
+int nn_connect (int s, const char *addr)
+{
+    (void) s; (void) addr;
+    printf ("nn_connect, socket %d\n", s);
+    return 1;
+}
+---------------------------------------------*/
+
+ssize_t wrp_pack_metadata( const data_t *packData, void **data )
+{
+    (void) packData; (void) data;
+    function_called();
+    
+    return (ssize_t)mock();
+}
+
+size_t appendEncodedData( void **appendData, void *encodedBuffer, size_t encodedSize, void *metadataPack, size_t metadataSize )
+{
+    (void) encodedBuffer; (void) encodedSize; (void) metadataPack; (void) metadataSize;
+    function_called();
+    char *data = (char *) malloc (sizeof(char) * 100);
+    parStrncpy(data, "AAAAAAAAYYYYIGkYTUYFJH", 100);
+    *appendData = data;
+    return (size_t)mock();
+}
+
+int nn_send (int s, const void *buf, size_t len, int flags)
+{
+    UNUSED(s); UNUSED(buf); UNUSED(len); UNUSED(flags);
+    function_called();
+    return (int)mock();
+}
+
+int pthread_cond_wait(pthread_cond_t *restrict cond, pthread_mutex_t *restrict mutex)
+{
+    UNUSED(cond); UNUSED(mutex);
+    function_called();
+    return (int)mock();
+}
+
+ssize_t wrp_to_struct( const void *bytes, const size_t length, const enum wrp_format fmt, wrp_msg_t **msg )
+{
+    UNUSED(bytes); UNUSED(length); UNUSED(fmt);
+    function_called();
+    *msg = reg_msg;
+    return (ssize_t)mock();
+}
+
+void wrp_free_struct( wrp_msg_t *msg )
+{
+    UNUSED(msg);
+    function_called();
+}
+
+int nn_freemsg (void *msg)
+{
+    UNUSED(msg);
+    function_called();
+    return (int)mock();
+}
+
+int validate_partner_id(wrp_msg_t *msg, partners_t **partnerIds)
+{
+    UNUSED(msg); UNUSED(partnerIds);
+    function_called();
+    return (int) mock();
+}
+
+/*----------------------------------------------------------------------------*/
+/*                                   Tests                                    */
+/*----------------------------------------------------------------------------*/
+
+
+void test_message()
+{
+    metaPackSize = 20;
+    UpStreamMsgQ = (UpStreamMsg *) malloc(sizeof(UpStreamMsg));
+    UpStreamMsgQ->msg = "First Message";
+    UpStreamMsgQ->len = 13;
+    UpStreamMsgQ->next = NULL;
+
+    numLoops = 1;
+    reg_msg = (wrp_msg_t *) malloc(sizeof(wrp_msg_t));
+    memset(reg_msg,0,sizeof(wrp_msg_t));
+    reg_msg->msg_type = WRP_MSG_TYPE__SVC_REGISTRATION;
+    reg_msg->u.reg.service_name = "config";
+    reg_msg->u.reg.url = GOOD_CLIENT_URL;
+
+    will_return(wrp_to_struct, 12);
+    expect_function_call(wrp_to_struct);
+
+    will_return(nn_send, 1);
+    expect_function_call(nn_send);
+
+    will_return(nn_freemsg, 0);
+    expect_function_call(nn_freemsg);
+    expect_function_call(wrp_free_struct);
+
+    processUpstreamMessage();
+    free(reg_msg);
+    free(UpStreamMsgQ);
+}
+
+void test_processUpstreamMessage()
+{
+  int last_sock = -1;
+  reg_list_item_t * reg_item = get_reg_list ();
+
+  assert_null (reg_item);
+  test_message();
+  reg_item = get_reg_list ();
+  assert_non_null (reg_item);
+  if (NULL == reg_item)
+    return;
+
+  last_sock = reg_item->sock;
+  test_message ();
+  assert_int_equal (get_numOfClients(), 1);
+  if (get_numOfClients() != 1)
+    return;
+  reg_item = get_reg_list ();
+  assert_int_equal (last_sock, reg_item->sock);
+  if (last_sock != reg_item->sock)
+    return;
+
+  test_message ();
+  assert_int_equal (get_numOfClients(), 1);
+  if (get_numOfClients() != 1)
+    return;
+  reg_item = get_reg_list ();
+  assert_int_equal (last_sock, reg_item->sock);
+
+}
+
+/*----------------------------------------------------------------------------*/
+/*                             External Functions                             */
+/*----------------------------------------------------------------------------*/
+
+int main(void)
+{
+    const struct CMUnitTest tests[] = {
+        cmocka_unit_test(test_processUpstreamMessage)
+    };
+    return cmocka_run_group_tests(tests, NULL, NULL);
+}
Author	SHA1	Message	Date
shilpa24balaji	b46e07cc5f	Merge pull request #324 from shilpa24balaji/3.12_p3b Update retry time in connection-health-file	2019-10-25 11:49:25 -07:00
Shilpa Seshadri	879a585b66	Update retry time in connection-health-file	2019-10-24 18:20:20 -07:00
shilpa24balaji	95b6f75284	Merge pull request #306 from bill1600/newauthtoken request new auth token on every retry, not just after 403	2019-06-12 11:38:10 -07:00
Bill Williams	f87e69c07b	no need for backoff after 403	2019-06-11 14:20:45 -07:00
Bill Williams	647905639c	refine connect/auth-token logic	2019-06-05 08:56:28 -07:00
Bill Williams	ceadc4b51f	refine fetch auth token	2019-06-03 16:55:29 -07:00
Bill Williams	38dee179e7	request new auth token on every retry, not just after 403	2019-05-30 13:44:49 -07:00
shilpa24balaji	9feafedff8	Merge pull request #302 from bill1600/clrtoken requestNewAuthToken will clear token if it fails	2019-05-21 17:49:33 -07:00
Bill Williams	2807f8e43a	add test_auth_token_more.c	2019-05-16 13:48:02 -07:00
Bill Williams	5132675700	add unit tests for auth_token	2019-05-16 13:41:19 -07:00
Bill Williams	e166b9fdf5	use memset to clear auth token in requestNewAuthToken	2019-05-14 13:34:35 -07:00
Bill Williams	60789f0ec8	requestNewAuthToken will clear token if it fails	2019-05-14 11:51:40 -07:00
shilpa24balaji	65098e36cb	Merge pull request #298 from bill1600/nano_115 Update to use nanomsg v 1.1.4	2019-04-24 10:30:41 -07:00
shilpa24balaji	c585300f76	Merge pull request #297 from bill1600/test_upstream Add unit test for re-registrations	2019-04-24 10:27:48 -07:00
Bill Williams	e4e78118cf	Use nanomsg version 1.1.4	2019-04-23 17:12:48 -07:00
Bill Williams	8b4541b570	Update to use nanomsg v 1.1.5	2019-04-23 13:29:35 -07:00
Bill Williams	acc542647b	Add unit test for re-registrations	2019-04-12 09:09:23 -07:00
shilpa24balaji	da6614b19d	Merge pull request #294 from bill1600/cnheal Add logic to save parodus connection status in health file	2019-04-04 11:28:23 -07:00
Bill Williams	096271279d	new self heal version woth merged close/endpoint	2019-04-01 09:22:40 -07:00
shilpa24balaji	50176fb120	Merge pull request #292 from bill1600/close_endpt Fix nanomsg client close handling	2019-03-29 14:31:57 -07:00
Bill Williams	2ad896abc6	log all nn_close	2019-03-27 11:35:16 -07:00
Bill Williams	f58f85bc32	close client when deleting from client list	2019-03-26 16:54:52 -07:00
Bill Williams	4fef26c082	use endpoint in nn_shutdown and log nn_close errors	2019-03-26 16:26:09 -07:00
shilpa24balaji	1995a664ad	Merge pull request #291 from sadhyama/master Rename command line options for MTLS cert and Key #290	2019-03-22 10:39:44 -07:00
Weston Schmidt	f1b2add244	Merge branch 'nosinovacao-feature_mutual_auth_v1'	2019-03-20 09:08:47 -07:00
Weston Schmidt	13739786a0	Resolve the merge conflicts in PR 246. Remove the ifdef flag as this should always be available. Fix a mistake in the commandline option parsing of the C flag ... needs to be C:.	2019-03-20 09:05:20 -07:00
Sadhyama Vengilat	4fc082cb43	Updated CHANGELOG.md	2019-03-19 17:29:26 +05:30
Sadhyama Vengilat	08feef216e	Rename command line options for MTLS cert and Key #290	2019-03-19 17:19:00 +05:30
shilpa24balaji	2bde60e885	Merge pull request #289 from bill1600/camera fix mutex error in service alive	2019-03-17 19:30:34 -07:00
Bill Williams	5d05150249	fix mutex error in service alive	2019-03-17 16:57:20 -07:00
shilpa24balaji	40bf7eeb0e	Merge pull request #287 from bill1600/shutfail add nn_close to nn_shutdown	2019-03-05 15:50:51 -08:00
Bill Williams	fcec26a25f	fix test_upstream test	2019-03-04 15:48:41 -08:00
Bill Williams	1b71082e77	add nn_close to nn_shutdown	2019-03-04 15:28:00 -08:00
shilpa24balaji	4085c56ed6	Merge pull request #284 from sadhyama/master Move auth token request code to separate file	2019-02-18 14:07:15 -08:00
shilpa24balaji	0b700e57ff	Merge pull request #283 from sadhyama/master Add support to use auth token during initial connect to cloud	2019-02-15 12:51:21 -08:00
shilpa24balaji	1b903521d2	Update connection.c	2019-02-15 12:43:14 -08:00
shilpa24balaji	3814f873bc	Update CHANGELOG.md	2019-02-15 12:41:48 -08:00
shilpa24balaji	8a3e4507ef	Update config.c	2019-02-15 12:41:13 -08:00
shilpa24balaji	c7c93254ff	Update README.md	2019-02-15 12:38:45 -08:00
shilpa24balaji	0875751c3f	Update CHANGELOG.md	2019-02-15 12:34:22 -08:00
shilpa24balaji	c2edbbc074	Update CHANGELOG.md	2019-02-15 12:33:41 -08:00
Sadhyama Vengilat	7b03fad90f	Unit tests on auth token request	2019-02-10 11:11:29 +05:30
Sadhyama Vengilat	a5081a5cfa	Move auth jwt request code to separate file	2019-02-10 10:54:56 +05:30
Sadhyama Vengilat	25a6a99c69	Added unit tests for themis curl changes	2019-02-10 01:58:16 +05:30
Sadhyama Vengilat	5a60847e28	Themis JWT token fetch using libcurl	2019-02-09 20:28:27 +05:30
Sadhyama Vengilat	29f00e5850	Remove themis create read scripts command line arguments	2019-02-09 20:25:56 +05:30
Sadhyama Vengilat	4bd9e87125	Add new cmd line argument for client-cert-path and token-server-url	2019-02-09 20:19:06 +05:30
Sadhyama Vengilat	56ab5f13fe	Add libcurl dependency in parodus	2019-02-09 20:12:32 +05:30
shilpa24balaji	57ca4084ce	Update CHANGELOG.md	2019-02-08 16:11:19 -08:00
Nuno Martins	3bb48b48c0	Added Security Feature: Mutual Authentication (mTLS or two way TLS) This change adds support for two new program parameters -q "client_cert_path" and -k "client key path" Where here client is the CPE, so It will be the CPE cert and corresponding key. Having those two parameters we are in position to pass them on the nopoll_conn_opts_set_ssl_certs function. This function, previously, was being set with NULL values. As most parameters have a path with 64 characters, we also created those (cert and key) paths with that length. We also changed the README.md accordingly, to show how to enable and use this feature. Signed-off-by: Nuno Martins <nuno.mmartins@parceiros.nos.pt>	2018-10-08 16:16:08 +01:00