smpp-js/CHANGELOG.md

Changelog

0.6.0 (unreleased)

• client() now bounds each connect attempt at 10 seconds, the TLS handshake included, and reports one that expires as an ordinary connect failure, so reconnect retries it on its usual backoff. A connect previously waited the operating system out, around 130 s on Linux against a host that drops SYNs. connectTimeout retunes the bound, and connectTimeout: false restores the old wait.

• Addresses, ids and every other text field on the wire are read and written as latin1. A source_addr of Kaffeé previously reached the application as Kaffei, because the codec wrote the octet and then masked bit 7 reading it back; destination_addr, system_id, message_id, password, service_type and the C-Octet String TLVs were affected the same way. A character past U+00FF in one of those fields is now refused, where it used to go out as its low octet.

  A server comparing systemId or password could be impersonated. Masking bit 7 folded 127 of the 255 non-zero octets onto a character a low octet also reaches, so the bind credentials your authenticate received were not unique to the octets the peer sent: one refused as admin could bind as \xE1dmin and match the same string. latin1 is one-to-one over the octets, so two different wire values no longer arrive as one. Read 0.5.0 bind logs for a systemId you did not issue.

  Check what you stored before you roll this out. Values your application persisted under 0.5.0 were read with bit 7 masked, so an address or a message_id carrying an octet above 0x7F is spelled differently now: a stored id will not match the receipt it belongs to, and a stored address will not match the sender it came from. Ids most SMSCs issue are digits or hex and are unaffected.

• A U+0000 inside a C-Octet String — source_addr, message_id, system_id and the rest — is refused. An Octet String carries a NULL as before.

• A non-finite number — NaN, Infinity, -Infinity — is refused where a text field on the wire takes one. sendSms({ from: NaN }) put the literal sender NaN on the wire and resolved as a successful send; message_id, source_addr and the string TLVs took such a number the same way. The call now resolves with err naming the field — from: Expected a finite number, got NaN — so a caller that reads only smsIds meets a failure it has not met before. A whole number in an address or an id still spells its digits, so message_id: 123 is unchanged. The integer fields name a refused NaN too, where the refusal used to read null.

• An alert_notification or an outbind from the peer is logged and left unanswered, as SMPP 3.4 gives neither a response. Each one used to emit sessionError, "alert_notification" has no response command.

• maxOctets charges each held segment, and every TLV it carries, for the memory it keeps beyond its octets. A peer could hold around 67 times the cap with segments of empty fields, and megabytes per segment with thousands of empty TLVs, both of which the cap counted as next to nothing.

• server() refuses a maxOctets below 1 or not a whole number, Infinity included, like its other limits. server({ maxOctets: 0 }) used to start and then refuse every multipart message.

• callback_num, callback_num_atag, callback_num_pres_ind, broadcast_area_identifier and broadcast_error_status, the TLVs SMPP allows more than once in a PDU, keep every occurrence in wire order. A PDU carrying two of one used to keep only the last.

  Reading one of these now needs an index. pduObj.tlvs.callback_num?.tagValue is a Buffer[] even where one arrived (a number[] for callback_num_pres_ind and broadcast_error_status), so a Buffer.isBuffer() or typeof check written for 0.5.0 now reads it as absent. Read tagValue[0] for the first occurrence. objToPdu(), session.send() and session.sendReturn() take { tagValue: [value] } for them and refuse a lone value before anything goes out.

• cmds.broadcast_sm_resp.tlvMap is removed; nothing read it.

0.5.0

The TypeScript rewrite. What a 0.4.0 consumer has to change is in MIGRATION.md.