20#if COAP_WITH_LIBTINYDTLS
23#undef PACKAGE_BUGREPORT
31#include <tinydtls/tinydtls.h>
32#include <tinydtls/dtls.h>
33#include <tinydtls/dtls_debug.h>
34#include <tinydtls/dtls_time.h>
38#include <dtls_debug.h>
42typedef struct coap_tiny_context_t {
43 struct dtls_context_t *dtls_context;
50#if (DTLS_MAX_CID_LENGTH > 0)
55#if ! defined(DTLS_PSK) && ! defined(DTLS_ECC)
56#error Neither DTLS_PSK or DTLS_ECC defined
59static dtls_tick_t dtls_tick_0 = 0;
117#if (DTLS_MAX_CID_LENGTH > 0)
124#if COAP_CLIENT_SUPPORT
131#if (DTLS_MAX_CID_LENGTH > 0)
143dtls_map_logging(log_t d_level) {
158 case DTLS_LOG_NOTICE:
171#ifdef HAVE_DTLS_SET_LOG_HANDLER
174dtls_logging(log_t d_level,
const char *message) {
175 coap_log_t c_level = dtls_map_logging(d_level);
184 dtls_ticks(&dtls_tick_0);
186#ifdef HAVE_DTLS_SET_LOG_HANDLER
188 dtls_set_log_handler(dtls_logging);
204 const coap_tiny_context_t *t_context =
207 return t_context->dtls_context;
219 d_level = DTLS_LOG_EMERG;
222 d_level = DTLS_LOG_ALERT;
226 d_level = DTLS_LOG_CRIT;
229 d_level = DTLS_LOG_WARN;
232 d_level = DTLS_LOG_NOTICE;
235 d_level = DTLS_LOG_INFO;
241 d_level = DTLS_LOG_DEBUG;
244 dtls_set_log_level(d_level);
249 log_t d_level = dtls_get_log_level();
251 return dtls_map_logging(d_level);
256#if defined(WITH_CONTIKI) || defined(WITH_LWIP)
258 memset(&a->
addr, 0,
sizeof(a->
addr));
259 switch (s->addr.sa.sa_family) {
262 memcpy(&a->
addr, &s->
addr.
sin.sin_addr,
sizeof(s->addr.sin.sin_addr));
263 a->port = s->
addr.
sin.sin_port;
268 memcpy(&a->
addr, &s->
addr.
sin6.sin6_addr,
sizeof(s->addr.sin6.sin6_addr));
279#elif defined(WITH_RIOT_SOCK)
280 if (s->addr.family == AF_INET6) {
281 a->riot.family = s->
addr.family;
282 memcpy(&a->riot.
addr.ipv6, &s->
addr.ipv6,
283 sizeof(a->riot.
addr.ipv6));
284 a->riot.port = ntohs(s->addr.port);
287 }
else if (s->addr.family == AF_INET) {
288 a->riot.family = s->
addr.family;
289 memcpy(&a->riot.
addr.ipv4, &s->
addr.ipv4,
sizeof(a->riot.
addr.ipv4));
290 a->riot.port = ntohs(s->addr.port);
295 if (s->addr.sa.sa_family == AF_INET6) {
298 }
else if (s->addr.sa.sa_family == AF_INET) {
302 a->
size = (socklen_t)s->size;
310#if defined(WITH_CONTIKI) || defined(WITH_LWIP)
312#if LWIP_IPV6 && LWIP_IPV4
313 if (a->
addr.type == IPADDR_TYPE_V6) {
314 s->addr.sa.sa_family = AF_INET6;
315 s->size = (socklen_t)
sizeof(s->addr.sin6);
316 memcpy(&s->addr.sin6.sin6_addr, &a->
addr,
sizeof(s->addr.sin6.sin6_addr));
317 s->addr.sin6.sin6_port = a->port;
318 }
else if (a->
addr.type == IPADDR_TYPE_V4) {
319 s->
addr.
sa.sa_family = AF_INET;
320 s->size = (socklen_t)
sizeof(s->addr.sin);
321 memcpy(&s->addr.sin.sin_addr, &a->
addr,
sizeof(s->addr.sin.sin_addr));
322 s->addr.sin.sin_port = a->port;
327 s->
size = (
unsigned char)
sizeof(s->addr);
331#elif defined(WITH_RIOT_SOCK)
332 if (a->riot.family == AF_INET6) {
333 s->
size =
sizeof(s->addr.ipv6);
334 s->addr.family = a->riot.family;
335 memcpy(&s->addr.ipv6, &a->riot.
addr.ipv6,
336 sizeof(s->addr.ipv6));
337 s->addr.port = htons(a->riot.port);
339 }
else if (a->r.family == AF_INET) {
340 s->size =
sizeof(s->addr.ipv4);
341 s->addr.family = a->r.family;
342 memcpy(&a->
addr.ipv4, &s->r.
addr.ipv4,
sizeof(a->
addr.ipv4));
343 s->addr.port = htons(a->r.port);
347 if (a->
addr.
sa.sa_family == AF_INET6) {
348 s->size = (socklen_t)
sizeof(s->addr.sin6);
350 }
else if (a->
addr.
sa.sa_family == AF_INET) {
351 s->size = (socklen_t)
sizeof(s->addr.sin);
354 s->size = (socklen_t)a->
size;
361dtls_send_to_peer(
struct dtls_context_t *dtls_context,
362 session_t *dtls_session, uint8 *data,
size_t len) {
363 coap_tiny_context_t *t_context =
364 (coap_tiny_context_t *)dtls_get_app_data(dtls_context);
365 coap_context_t *coap_context = t_context ? t_context->coap_context : NULL;
370 assert(coap_context);
371 get_session_addr(dtls_session, &remote_addr);
374 coap_log_warn(
"dtls_send_to_peer: cannot find local interface\n");
378 if (ret == -1 && (errno == ENOTCONN || errno == ECONNREFUSED))
384dtls_application_data(
struct dtls_context_t *dtls_context,
385 session_t *dtls_session, uint8 *data,
size_t len) {
386 coap_tiny_context_t *t_context =
387 (coap_tiny_context_t *)dtls_get_app_data(dtls_context);
388 coap_context_t *coap_context = t_context ? t_context->coap_context : NULL;
392 assert(coap_context);
393 get_session_addr(dtls_session, &remote_addr);
396 coap_log_debug(
"dropped message that was received on invalid interface\n");
405static int coap_event_dtls = 0;
408dtls_event(
struct dtls_context_t *dtls_context,
409 session_t *dtls_session,
410 dtls_alert_level_t level,
411 unsigned short code) {
415 if (level == DTLS_ALERT_LEVEL_FATAL)
420 case DTLS_ALERT_CLOSE_NOTIFY: {
424 case DTLS_EVENT_CONNECTED: {
428#ifdef DTLS_EVENT_RENEGOTIATE
429 case DTLS_EVENT_RENEGOTIATE: {
446get_psk_info(
struct dtls_context_t *dtls_context,
447 const session_t *dtls_session,
448 dtls_credentials_type_t type,
449 const uint8_t *
id,
size_t id_len,
450 unsigned char *result,
size_t result_length) {
452 coap_tiny_context_t *t_context =
453 (coap_tiny_context_t *)dtls_get_app_data(dtls_context);
454 coap_context_t *coap_context = t_context ? t_context->coap_context : NULL;
456 int fatal_error = DTLS_ALERT_INTERNAL_ERROR;
458#if COAP_CLIENT_SUPPORT
464#if COAP_SERVER_SUPPORT
469 assert(coap_context);
470 get_session_addr(dtls_session, &remote_addr);
478 case DTLS_PSK_IDENTITY:
480#if COAP_CLIENT_SUPPORT
492 id ? (
const char *)
id :
"");
504 psk_identity = &cpsk_info->
identity;
513 if (psk_identity == NULL) {
515 fatal_error = DTLS_ALERT_CLOSE_NOTIFY;
518 if (psk_identity->
length > result_length) {
519 coap_log_warn(
"psk_identity too large, truncated to %zd bytes\n",
523 result_length = psk_identity->
length;
525 memcpy(result, psk_identity->
s, result_length);
526 return result_length;
532#if COAP_CLIENT_SUPPORT
535 if (psk_key == NULL) {
537 fatal_error = DTLS_ALERT_CLOSE_NOTIFY;
540 if (psk_key->
length > result_length) {
545 result_length = psk_key->
length;
547 memcpy(result, psk_key->
s, result_length);
548 return result_length;
551#if COAP_SERVER_SUPPORT
555 lidentity.
length =
id ? id_len : 0;
556 lidentity.
s =
id ? (
const uint8_t *)
id : (const uint8_t *)
"";
563 (
int)lidentity.
length, lidentity.
s);
574 if (psk_key == NULL) {
580 if (psk_key->
length > result_length) {
585 result_length = psk_key->
length;
587 memcpy(result, psk_key->
s, result_length);
588 return result_length;
594#if COAP_SERVER_SUPPORT
596 if (psk_hint == NULL)
598 if (psk_hint->
length > result_length) {
599 coap_log_warn(
"psk_hint too large, truncated to %zd bytes\n",
603 result_length = psk_hint->
length;
605 memcpy(result, psk_hint->
s, result_length);
606 return result_length;
616 return dtls_alert_fatal_create(fatal_error);
621dtls_update_user_parameters(
struct dtls_context_t *ctx,
622 session_t *session, dtls_user_parameters_t *user_parameters) {
625#if (DTLS_MAX_CID_LENGTH > 0)
626 coap_tiny_context_t *t_context =
627 (coap_tiny_context_t *)dtls_get_app_data(ctx);
628 user_parameters->support_cid = t_context ? t_context->use_cid : 0;
630 (void)user_parameters;
636get_ecdsa_key(
struct dtls_context_t *dtls_context,
638 const dtls_ecdsa_key_t **result) {
639 static dtls_ecdsa_key_t ecdsa_key;
640 coap_tiny_context_t *t_context =
641 (coap_tiny_context_t *)dtls_get_app_data(dtls_context);
643 ecdsa_key.curve = DTLS_ECDH_CURVE_SECP256R1;
644 ecdsa_key.priv_key = t_context->priv_key->s;
645 ecdsa_key.pub_key_x = t_context->pub_key->s;
646 ecdsa_key.pub_key_y = &t_context->pub_key->s[DTLS_EC_KEY_SIZE];
648 *result = &ecdsa_key;
653static const unsigned char cert_asn1_header[] = {
657 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01,
659 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07,
663#define DTLS_CE_LENGTH (sizeof(cert_asn1_header) + key_size + key_size)
666verify_ecdsa_key(
struct dtls_context_t *dtls_context
COAP_UNUSED,
668 const uint8_t *other_pub_x,
669 const uint8_t *other_pub_y,
671 coap_tiny_context_t *t_context =
672 (coap_tiny_context_t *)dtls_get_app_data(dtls_context);
675 if (t_context && t_context->setup_data.validate_cn_call_back) {
677 get_session_addr(dtls_session, &remote_addr);
679 &remote_addr, dtls_session->ifindex);
692 memcpy(p, &cert_asn1_header,
sizeof(cert_asn1_header));
693 p +=
sizeof(cert_asn1_header);
695 memcpy(p, other_pub_x, key_size);
698 memcpy(p, other_pub_y, key_size);
703 buf, p-buf, c_session, 0, 1, t_context->setup_data.cn_call_back_arg));
712static dtls_handler_t ec_cb = {
713 .write = dtls_send_to_peer,
714 .read = dtls_application_data,
715 .get_user_parameters = dtls_update_user_parameters,
718 .get_psk_info = NULL,
720 .get_ecdsa_key = get_ecdsa_key,
721 .verify_ecdsa_key = verify_ecdsa_key
725static dtls_handler_t psk_cb = {
726 .write = dtls_send_to_peer,
727 .read = dtls_application_data,
728 .get_user_parameters = dtls_update_user_parameters,
731 .get_psk_info = get_psk_info,
734 .get_ecdsa_key = NULL,
735 .verify_ecdsa_key = NULL
742 struct dtls_context_t *dtls_context = t_context ? dtls_new_context(t_context) : NULL;
745 memset(t_context, 0,
sizeof(coap_tiny_context_t));
746 t_context->coap_context = coap_context;
747 t_context->dtls_context = dtls_context;
748 dtls_set_handler(dtls_context, &psk_cb);
761 coap_tiny_context_t *t_context = (coap_tiny_context_t *)handle;
763 if (t_context->priv_key) {
765 t_context->priv_key = NULL;
767 if (t_context->pub_key) {
769 t_context->pub_key = NULL;
772 if (t_context->dtls_context)
773 dtls_free_context(t_context->dtls_context);
785 dtls_session_init(dtls_session);
787 dtls_session->ifindex = session->
ifindex;
794#if COAP_SERVER_SUPPORT
797 return coap_dtls_new_session(session);
801#if COAP_CLIENT_SUPPORT
806 dtls_context_t *dtls_context = t_context ? t_context->dtls_context : NULL;
807 session_t *dtls_session = dtls_context ? coap_dtls_new_session(session) : NULL;
812 dtls_get_peer(dtls_context, dtls_session);
818 if (dtls_connect(dtls_context, dtls_session) >= 0) {
820 dtls_get_peer(dtls_context, dtls_session);
841 coap_tiny_context_t *t_context =
843 dtls_context_t *dtls_context = t_context ? t_context->dtls_context : NULL;
845 if (dtls_context == NULL)
847 if (coap_session->
tls && dtls_context) {
848 dtls_peer_t *peer = dtls_get_peer(dtls_context, (session_t *)coap_session->
tls);
850 dtls_reset_peer(dtls_context, peer);
852 dtls_close(dtls_context, (session_t *)coap_session->
tls);
855 coap_session->
tls = NULL;
867 dtls_context_t *dtls_context = t_context ? t_context->dtls_context : NULL;
869 assert(dtls_context);
871 coap_event_dtls = -1;
875 memcpy(&data_rw, &data,
sizeof(data_rw));
876 res = dtls_write(dtls_context,
877 (session_t *)session->
tls, data_rw, data_len);
882 if (coap_event_dtls >= 0) {
887#if (DTLS_MAX_CID_LENGTH > 0) && COAP_CLIENT_SUPPORT
889 dtls_peer_t *peer = dtls_get_peer(dtls_context, (session_t *)session->
tls);
890 dtls_security_parameters_t *security = dtls_security_params(peer);
892 if (security->write_cid_length > 0) {
916 clock_time_t next = 0;
917 coap_tiny_context_t *t_context = (coap_tiny_context_t *)tiny_context;
918 dtls_context_t *dtls_context = t_context ? t_context->dtls_context : NULL;
920 dtls_check_retransmit(dtls_context, &next);
949 session_t *dtls_session = (session_t *)session->
tls;
953 dtls_context_t *dtls_context = t_context ? t_context->dtls_context : NULL;
955 assert(dtls_context);
956 coap_event_dtls = -1;
958 memcpy(&data_rw, &data,
sizeof(data_rw));
959 err = dtls_handle_message(dtls_context, dtls_session, data_rw, (
int)data_len);
965 if (coap_event_dtls >= 0) {
971#if (DTLS_MAX_CID_LENGTH > 0) && COAP_CLIENT_SUPPORT
973 dtls_peer_t *peer = dtls_get_peer(dtls_context, (session_t *)session->
tls);
974 dtls_security_parameters_t *security = dtls_security_params(peer);
976 if (security->write_cid_length > 0) {
992#if COAP_SERVER_SUPPORT
998 session_t dtls_session;
1000 dtls_context_t *dtls_context = t_context ? t_context->dtls_context : NULL;
1003 assert(dtls_context);
1004 dtls_session_init(&dtls_session);
1006 dtls_session.ifindex = session->
ifindex;
1008 memcpy(&data_rw, &data,
sizeof(data_rw));
1009 int res = dtls_handle_message(dtls_context, &dtls_session,
1010 data_rw, (
int)data_len);
1012 if (dtls_get_peer(dtls_context, &dtls_session))
1035 const char *vers = dtls_package_version();
1039 long int p1, p2 = 0, p3 = 0;
1042 p1 = strtol(vers, &endptr, 10);
1043 if (*endptr ==
'.') {
1044 p2 = strtol(endptr+1, &endptr, 10);
1045 if (*endptr ==
'.') {
1046 p3 = strtol(endptr+1, &endptr, 10);
1049 version.
version = (p1 << 16) | (p2 << 8) | p3;
1057static const uint8_t b64_6[256] = {
1058 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
1059 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
1061 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 62, 64, 64, 64, 63,
1063 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 64, 64, 64, 64, 64, 64,
1065 64, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14,
1067 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 64, 64, 64, 64, 64,
1069 64, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40,
1071 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 64, 64, 64, 64, 64,
1072 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
1073 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
1074 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
1075 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
1076 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
1077 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
1078 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64,
1079 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64, 64
1084pem_base64_decode(
const uint8_t *data,
size_t size) {
1086 size_t nbytesdecoded;
1091 size_t nb64bytes = 0;
1093 for (i = 0; i < size; i++) {
1101 if (b64_6[data[i]] == 64)
1103 tbuf[nb64bytes++] = data[i];
1109 nbytesdecoded = ((nb64bytes + 3) / 4) * 3;
1117 while (nb64bytes > 4) {
1118 *(out++) = b64_6[ptr[0]] << 2 | b64_6[ptr[1]] >> 4;
1119 *(out++) = b64_6[ptr[1]] << 4 | b64_6[ptr[2]] >> 2;
1120 *(out++) = b64_6[ptr[2]] << 6 | b64_6[ptr[3]];
1126 if (nb64bytes > 1) {
1127 *(out++) = b64_6[ptr[0]] << 2 | b64_6[ptr[1]] >> 4;
1129 if (nb64bytes > 2) {
1130 *(out++) = b64_6[ptr[1]] << 4 | b64_6[ptr[2]] >> 2;
1132 if (nb64bytes > 3) {
1133 *(out++) = b64_6[ptr[2]] << 6 | b64_6[ptr[3]];
1136 decoded->
length = nbytesdecoded - ((4 - nb64bytes) & 3);
1141typedef coap_binary_t *(*asn1_callback)(
const uint8_t *data,
size_t size);
1144asn1_verify_privkey(
const uint8_t *data,
size_t size) {
1147 if (size - 1 == DTLS_EC_KEY_SIZE && *data ==
'\000') {
1153 if (size != DTLS_EC_KEY_SIZE)
1160asn1_verify_pubkey(
const uint8_t *data,
size_t size) {
1165 if (size - 2 != 2 * DTLS_EC_KEY_SIZE)
1172asn1_verify_curve(
const uint8_t *data,
size_t size) {
1173 static uint8_t prime256v1_oid[] =
1175 { 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07 };
1178 if (size !=
sizeof(prime256v1_oid) ||
1179 memcmp(data, prime256v1_oid, size) != 0)
1186asn1_verify_pkcs8_version(
const uint8_t *data,
size_t size) {
1188 if (size != 1 || *data != 0)
1195asn1_verify_ec_identifier(
const uint8_t *data,
size_t size) {
1196 static uint8_t ec_public_key_oid[] =
1198 { 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01 };
1201 if (size !=
sizeof(ec_public_key_oid) ||
1202 memcmp(data, ec_public_key_oid, size) != 0)
1209asn1_verify_ec_key(
const uint8_t *data,
size_t size) {
1219asn1_derive_keys(coap_tiny_context_t *t_context,
1220 const uint8_t *priv_data,
size_t priv_len,
1221 const uint8_t *pub_data,
size_t pub_len,
1226 priv_len, asn1_verify_privkey);
1227 if (!t_context->priv_key) {
1232 if (t_context->priv_key->length - 1 == DTLS_EC_KEY_SIZE &&
1233 t_context->priv_key->s[0] ==
'\000') {
1234 t_context->priv_key->length--;
1235 t_context->priv_key->s++;
1243 coap_log_info(
"EC Private Key (RPK) invalid elliptic curve\n");
1245 t_context->priv_key = NULL;
1252 asn1_verify_pubkey);
1253 if (!t_context->pub_key) {
1256 t_context->priv_key = NULL;
1260 t_context->pub_key->s += 2;
1261 t_context->pub_key->length -= 2;
1262 dtls_set_handler(t_context->dtls_context, &ec_cb);
1267ec_abstract_pkcs8_asn1(
const uint8_t *asn1_ptr,
size_t asn1_length) {
1271 asn1_verify_pkcs8_version);
1278 asn1_verify_ec_identifier);
1286 coap_log_info(
"EC Private Key (RPK) invalid elliptic curve\n");
1292 asn1_verify_ec_key);
1297pem_decode_mem_asn1(
const char *begstr,
const uint8_t *str) {
1298 char *bcp = str ? strstr((
const char *)str, begstr) : NULL;
1299 char *tcp = bcp ? strstr(bcp,
"-----END ") : NULL;
1302 bcp += strlen(begstr);
1303 return pem_base64_decode((
const uint8_t *)bcp, tcp - bcp);
1315 coap_tiny_context_t *t_context;
1332 if (t_context->priv_key) {
1334 t_context->priv_key = NULL;
1336 if (t_context->pub_key) {
1338 t_context->pub_key = NULL;
1340 t_context->setup_data = *setup_data;
1355 asn1_priv = pem_decode_mem_asn1(
"-----BEGIN EC PRIVATE KEY-----",
1358 asn1_priv = pem_decode_mem_asn1(
"-----BEGIN PRIVATE KEY-----",
1365 asn1_temp = ec_abstract_pkcs8_asn1(asn1_priv->
s, asn1_priv->
length);
1367 coap_log_info(
"*** setup_pki: (D)TLS: PKCS#8 Private Key (RPK) invalid\n");
1374 asn1_priv = asn1_temp;
1377 asn1_pub = pem_decode_mem_asn1(
"-----BEGIN PUBLIC KEY-----",
1380 asn1_pub = pem_decode_mem_asn1(
"-----BEGIN EC PRIVATE KEY-----",
1383 asn1_pub = pem_decode_mem_asn1(
"-----BEGIN PRIVATE KEY-----",
1386 coap_log_info(
"*** setup_pki: (D)TLS: Public Key (RPK) invalid\n");
1392 asn1_temp = ec_abstract_pkcs8_asn1(asn1_pub->
s, asn1_pub->
length);
1394 coap_log_info(
"*** setup_pki: (D)TLS: PKCS#8 Private Key (RPK) invalid\n");
1402 asn1_pub = asn1_temp;
1406 if (!asn1_derive_keys(t_context, asn1_priv->
s, asn1_priv->
length,
1407 asn1_pub->
s, asn1_pub->
length, is_pkcs8)) {
1408 coap_log_info(
"*** setup_pki: (D)TLS: Unable to derive Public/Private Keys\n");
1427 private_key = asn1_temp->
s;
1428 private_key_len = asn1_temp->
length;
1434 if (!asn1_derive_keys(t_context,
1440 coap_log_info(
"*** setup_pki: (D)TLS: Unable to derive Public/Private Keys\n");
1445 if (!asn1_derive_keys(t_context,
1451 coap_log_info(
"*** setup_pki: (D)TLS: Unable to derive Public/Private Keys\n");
1528#if (DTLS_MAX_CID_LENGTH == 0)
1532#if (DTLS_MAX_CID_LENGTH > 0)
1533 t_context->use_cid = setup_data->
use_cid;
1559#if COAP_CLIENT_SUPPORT
1563 coap_tiny_context_t *t_context;
1568 t_context = (coap_tiny_context_t *)coap_context->
dtls_context;
1573#if (DTLS_MAX_CID_LENGTH == 0)
1577#if (DTLS_MAX_CID_LENGTH > 0)
1578 t_context->use_cid = setup_data->
use_cid;
1592#if COAP_SERVER_SUPPORT
1602 coap_log_warn(
"CoAP Server with TinyDTLS does not support SNI selection\n");
1621#if !COAP_DISABLE_TCP
1622#if COAP_CLIENT_SUPPORT
1629#if COAP_SERVER_SUPPORT
1667#if COAP_SERVER_SUPPORT
1673 dtls_sha256_init(digest_ctx);
1686 const uint8_t *data,
1688 dtls_sha256_update(digest_ctx, data, data_len);
1696 dtls_sha256_final((uint8_t *)digest_buffer, digest_ctx);
1728#if COAP_OSCORE_SUPPORT
1740static struct cipher_algs {
1751 for (idx = 0; idx <
sizeof(ciphers)/
sizeof(
struct cipher_algs); idx++) {
1752 if (ciphers[idx].alg == alg)
1753 return ciphers[idx].cipher_type;
1755 coap_log_debug(
"get_cipher_alg: COSE cipher %d not supported\n", alg);
1764static struct hmac_algs {
1775 for (idx = 0; idx <
sizeof(hmacs)/
sizeof(
struct hmac_algs); idx++) {
1776 if (hmacs[idx].hmac_alg == hmac_alg)
1777 return hmacs[idx].hmac_type;
1779 coap_log_debug(
"get_hmac_alg: COSE HMAC %d not supported\n", hmac_alg);
1785 return get_cipher_alg(alg);
1794 return get_hmac_alg(hmac_alg);
1801 uint8_t *result,
size_t *max_result_len) {
1804 dtls_ccm_params_t dtls_params;
1812 if (get_cipher_alg(params->
alg) == 0) {
1813 coap_log_debug(
"coap_crypto_encrypt: algorithm %d not supported\n",
1824 dtls_params.nonce = ccm->
nonce;
1825 dtls_params.tag_length = ccm->
tag_len;
1826 dtls_params.l = ccm->
l;
1835 num_bytes = dtls_encrypt_params(&dtls_params,
1840 if (num_bytes < 0) {
1843 *max_result_len = num_bytes;
1851 uint8_t *result,
size_t *max_result_len) {
1854 dtls_ccm_params_t dtls_params;
1862 if (get_cipher_alg(params->
alg) == 0) {
1863 coap_log_debug(
"coap_crypto_decrypt: algorithm %d not supported\n",
1875 dtls_params.nonce = ccm->
nonce;
1876 dtls_params.tag_length = ccm->
tag_len;
1877 dtls_params.l = ccm->
l;
1886 num_bytes = dtls_decrypt_params(&dtls_params,
1891 if (num_bytes < 0) {
1894 *max_result_len = num_bytes;
1901 dtls_hmac_context_t hmac_context;
1908 if (get_hmac_alg(hmac_alg) == 0) {
1909 coap_log_debug(
"coap_crypto_hmac: algorithm %d not supported\n", hmac_alg);
1917 dtls_hmac_init(&hmac_context, key->
s, key->
length);
1918 dtls_hmac_update(&hmac_context, data->
s, data->
length);
1919 num_bytes = dtls_hmac_finalize(&hmac_context,
dummy->s);
1921 if (num_bytes != DTLS_SHA256_DIGEST_LENGTH) {
1937#pragma GCC diagnostic ignored "-Wunused-function"
Library specific build wrapper for coap_internal.h.
void * coap_malloc_type(coap_memory_tag_t type, size_t size)
Allocates a chunk of size bytes and returns a pointer to the newly allocated memory.
void coap_free_type(coap_memory_tag_t type, void *p)
Releases the memory that was allocated by coap_malloc_type().
int coap_dtls_context_set_pki(coap_context_t *ctx COAP_UNUSED, const coap_dtls_pki_t *setup_data COAP_UNUSED, const coap_dtls_role_t role COAP_UNUSED)
coap_tick_t coap_dtls_get_timeout(coap_session_t *session COAP_UNUSED, coap_tick_t now COAP_UNUSED)
ssize_t coap_tls_read(coap_session_t *session COAP_UNUSED, uint8_t *data COAP_UNUSED, size_t data_len COAP_UNUSED)
coap_tick_t coap_dtls_get_context_timeout(void *dtls_context COAP_UNUSED)
int coap_dtls_receive(coap_session_t *session COAP_UNUSED, const uint8_t *data COAP_UNUSED, size_t data_len COAP_UNUSED)
void * coap_dtls_get_tls(const coap_session_t *c_session COAP_UNUSED, coap_tls_library_t *tls_lib)
unsigned int coap_dtls_get_overhead(coap_session_t *session COAP_UNUSED)
int coap_dtls_context_load_pki_trust_store(coap_context_t *ctx COAP_UNUSED)
int coap_dtls_context_check_keys_enabled(coap_context_t *ctx COAP_UNUSED)
ssize_t coap_dtls_send(coap_session_t *session COAP_UNUSED, const uint8_t *data COAP_UNUSED, size_t data_len COAP_UNUSED)
ssize_t coap_tls_write(coap_session_t *session COAP_UNUSED, const uint8_t *data COAP_UNUSED, size_t data_len COAP_UNUSED)
void coap_dtls_session_update_mtu(coap_session_t *session COAP_UNUSED)
int coap_dtls_context_set_pki_root_cas(coap_context_t *ctx COAP_UNUSED, const char *ca_file COAP_UNUSED, const char *ca_path COAP_UNUSED)
int coap_dtls_handle_timeout(coap_session_t *session COAP_UNUSED)
void coap_dtls_free_context(void *handle COAP_UNUSED)
void coap_dtls_free_session(coap_session_t *coap_session COAP_UNUSED)
void * coap_dtls_new_context(coap_context_t *coap_context COAP_UNUSED)
void coap_tls_free_session(coap_session_t *coap_session COAP_UNUSED)
int SHA1Result(SHA1Context *, uint8_t Message_Digest[SHA1HashSize])
int SHA1Reset(SHA1Context *)
int SHA1Input(SHA1Context *, const uint8_t *, unsigned int)
coap_binary_t * get_asn1_tag(coap_asn1_tag_t ltag, const uint8_t *ptr, size_t tlen, asn1_validate validate)
Get the asn1 tag and data from the current ptr.
void coap_digest_free(coap_digest_ctx_t *digest_ctx)
Free off coap_digest_ctx_t.
int coap_digest_final(coap_digest_ctx_t *digest_ctx, coap_digest_t *digest_buffer)
Finalize the coap_digest information into the provided digest_buffer.
int coap_digest_update(coap_digest_ctx_t *digest_ctx, const uint8_t *data, size_t data_len)
Update the coap_digest information with the next chunk of data.
coap_digest_ctx_t * coap_digest_setup(void)
Initialize a coap_digest.
uint64_t coap_tick_t
This data type represents internal timer ticks with COAP_TICKS_PER_SECOND resolution.
#define COAP_TICKS_PER_SECOND
Use ms resolution on POSIX systems.
int coap_handle_event_lkd(coap_context_t *context, coap_event_t event, coap_session_t *session)
Invokes the event handler of context for the given event and data.
int coap_handle_dgram(coap_context_t *ctx, coap_session_t *session, uint8_t *msg, size_t msg_len)
Parses and interprets a CoAP datagram with context ctx.
void coap_ticks(coap_tick_t *t)
Returns the current value of an internal tick counter.
int coap_crypto_hmac(cose_hmac_alg_t hmac_alg, coap_bin_const_t *key, coap_bin_const_t *data, coap_bin_const_t **hmac)
Create a HMAC hash of the provided data.
int coap_crypto_aead_decrypt(const coap_crypto_param_t *params, coap_bin_const_t *data, coap_bin_const_t *aad, uint8_t *result, size_t *max_result_len)
Decrypt the provided encrypted data into plaintext.
int coap_crypto_aead_encrypt(const coap_crypto_param_t *params, coap_bin_const_t *data, coap_bin_const_t *aad, uint8_t *result, size_t *max_result_len)
Encrypt the provided plaintext data.
int coap_crypto_hash(cose_alg_t alg, const coap_bin_const_t *data, coap_bin_const_t **hash)
Create a hash of the provided data.
int coap_crypto_check_hkdf_alg(cose_hkdf_alg_t hkdf_alg)
Check whether the defined hkdf algorithm is supported by the underlying crypto library.
int coap_crypto_check_cipher_alg(cose_alg_t alg)
Check whether the defined cipher algorithm is supported by the underlying crypto library.
void * coap_tls_new_server_session(coap_session_t *coap_session)
Create a TLS new server-side session.
const coap_bin_const_t * coap_get_session_client_psk_identity(const coap_session_t *coap_session)
Get the current client's PSK identity.
void coap_dtls_startup(void)
Initialize the underlying (D)TLS Library layer.
int coap_dtls_define_issue(coap_define_issue_key_t type, coap_define_issue_fail_t fail, coap_dtls_key_t *key, const coap_dtls_role_t role, int ret)
Report PKI DEFINE type issue.
void * coap_dtls_new_client_session(coap_session_t *coap_session)
Create a new client-side session.
void * coap_dtls_new_server_session(coap_session_t *coap_session)
Create a new DTLS server-side session.
int coap_dtls_hello(coap_session_t *coap_session, const uint8_t *data, size_t data_len)
Handling client HELLO messages from a new candiate peer.
int coap_dtls_set_cid_tuple_change(coap_context_t *context, uint8_t every)
Set the Connection ID client tuple frequency change for testing CIDs.
int coap_dtls_is_context_timeout(void)
Check if timeout is handled per CoAP session or per CoAP context.
int coap_dtls_context_set_cpsk(coap_context_t *coap_context, coap_dtls_cpsk_t *setup_data)
Set the DTLS context's default client PSK information.
int coap_dtls_context_set_spsk(coap_context_t *coap_context, coap_dtls_spsk_t *setup_data)
Set the DTLS context's default server PSK information.
void coap_dtls_shutdown(void)
Close down the underlying (D)TLS Library layer.
const coap_bin_const_t * coap_get_session_client_psk_key(const coap_session_t *coap_session)
Get the current client's PSK key.
void * coap_tls_new_client_session(coap_session_t *coap_session)
Create a new TLS client-side session.
void coap_dtls_map_key_type_to_define(const coap_dtls_pki_t *setup_data, coap_dtls_key_t *key)
Map the PKI key definitions to the new DEFINE format.
const coap_bin_const_t * coap_get_session_server_psk_key(const coap_session_t *coap_session)
Get the current server's PSK key.
const coap_bin_const_t * coap_get_session_server_psk_hint(const coap_session_t *coap_session)
Get the current server's PSK identity hint.
@ COAP_DEFINE_KEY_PRIVATE
@ COAP_DEFINE_FAIL_NOT_SUPPORTED
coap_tls_version_t * coap_get_tls_library_version(void)
Determine the type and version of the underlying (D)TLS library.
#define COAP_DTLS_RPK_CERT_CN
@ COAP_PKI_KEY_DEF_PKCS11
The PKI key type is PKCS11 (pkcs11:...).
@ COAP_PKI_KEY_DEF_DER_BUF
The PKI key type is DER buffer (ASN.1).
@ COAP_PKI_KEY_DEF_PEM_BUF
The PKI key type is PEM buffer.
@ COAP_PKI_KEY_DEF_PEM
The PKI key type is PEM file.
@ COAP_PKI_KEY_DEF_ENGINE
The PKI key type is to be passed to ENGINE.
@ COAP_PKI_KEY_DEF_RPK_BUF
The PKI key type is RPK in buffer.
@ COAP_PKI_KEY_DEF_DER
The PKI key type is DER file.
@ COAP_PKI_KEY_DEF_PKCS11_RPK
The PKI key type is PKCS11 w/ RPK (pkcs11:...).
@ COAP_PKI_KEY_DEFINE
The individual PKI key types are Definable.
@ COAP_ASN1_PKEY_EC
EC type.
@ COAP_TLS_LIBRARY_TINYDTLS
Using TinyDTLS library.
@ COAP_EVENT_DTLS_CLOSED
Triggerred when (D)TLS session closed.
@ COAP_EVENT_DTLS_CONNECTED
Triggered when (D)TLS session connected.
@ COAP_EVENT_DTLS_RENEGOTIATE
Triggered when (D)TLS session renegotiated.
@ COAP_EVENT_DTLS_ERROR
Triggered when (D)TLS error occurs.
#define coap_lock_callback_ret(r, func)
Dummy for no thread-safe code.
#define coap_log_debug(...)
coap_log_t coap_dtls_get_log_level(void)
Get the current (D)TLS logging.
#define coap_dtls_log(level,...)
Logging function.
void coap_dtls_set_log_level(coap_log_t level)
Sets the (D)TLS logging level to the specified level.
const char * coap_session_str(const coap_session_t *session)
Get session description.
#define coap_log_info(...)
#define coap_log_warn(...)
int cose_get_hmac_alg_for_hkdf(cose_hkdf_alg_t hkdf_alg, cose_hmac_alg_t *hmac_alg)
@ COSE_HMAC_ALG_HMAC256_256
@ COSE_ALGORITHM_AES_CCM_16_64_128
int coap_session_refresh_psk_hint(coap_session_t *session, const coap_bin_const_t *psk_hint)
Refresh the session's current Identity Hint (PSK).
int coap_session_refresh_psk_key(coap_session_t *session, const coap_bin_const_t *psk_key)
Refresh the session's current pre-shared key (PSK).
void coap_session_connected(coap_session_t *session)
Notify session that it has just connected or reconnected.
int coap_session_refresh_psk_identity(coap_session_t *session, const coap_bin_const_t *psk_identity)
Refresh the session's current pre-shared identity (PSK).
void coap_session_disconnected_lkd(coap_session_t *session, coap_nack_reason_t reason)
Notify session that it has failed.
coap_session_t * coap_session_get_by_peer(const coap_context_t *ctx, const coap_address_t *remote_addr, int ifindex)
Get the session associated with the specified remote_addr and index.
@ COAP_SESSION_TYPE_CLIENT
client-side
coap_binary_t * coap_new_binary(size_t size)
Returns a new binary object with at least size bytes storage allocated.
void coap_delete_binary(coap_binary_t *s)
Deletes the given coap_binary_t object and releases any memory allocated.
int coap_dtls_cid_is_supported(void)
Check whether (D)TLS CID is available.
int coap_dtls_psk_is_supported(void)
Check whether (D)TLS PSK is available.
int coap_tls_is_supported(void)
Check whether TLS is available.
int coap_oscore_is_supported(void)
Check whether OSCORE is available.
int coap_dtls_is_supported(void)
Check whether DTLS is available.
int coap_dtls_pki_is_supported(void)
Check whether (D)TLS PKI is available.
int coap_dtls_rpk_is_supported(void)
Check whether (D)TLS RPK is available.
int coap_dtls_pkcs11_is_supported(void)
Check whether (D)TLS PKCS11 is available.
coap_address_t remote
remote address and port
Multi-purpose address abstraction.
socklen_t size
size of addr
union coap_address_t::@0 addr
CoAP binary data definition with const data.
size_t length
length of binary data
const uint8_t * s
read-only binary data
CoAP binary data definition.
size_t length
length of binary data
The CoAP stack's global state is stored in a coap_context_t object.
uint8_t testing_cids
Change client's source port every testing_cids.
coap_dtls_spsk_t spsk_setup_data
Contains the initial PSK server setup data.
The structure that holds the AES Crypto information.
size_t l
The number of bytes in the length field.
const uint8_t * nonce
must be exactly 15 - l bytes
coap_crypto_key_t key
The Key to use.
size_t tag_len
The size of the Tag.
The common structure that holds the Crypto information.
union coap_crypto_param_t::@2 params
coap_crypto_aes_ccm_t aes
Used if AES type encryption.
cose_alg_t alg
The COSE algorith to use.
The structure that holds the Client PSK information.
coap_bin_const_t identity
The structure used for defining the Client PSK setup data to be used.
uint8_t use_cid
Set to 1 if DTLS Connection ID is to be used.
void * ih_call_back_arg
Passed in to the Identity Hint callback function.
coap_dtls_ih_callback_t validate_ih_call_back
Identity Hint check callback function.
uint8_t ec_jpake
Set to COAP_DTLS_CPSK_SETUP_VERSION to support this version of the struct.
The structure that holds the PKI key information.
coap_pki_key_define_t define
for definable type keys
union coap_dtls_key_t::@3 key
coap_pki_key_t key_type
key format type
The structure used for defining the PKI setup data to be used.
uint8_t use_cid
1 if DTLS Connection ID is to be used (Client only, server always enabled) if supported
uint8_t is_rpk_not_cert
1 is RPK instead of Public Certificate.
The structure used for defining the Server PSK setup data to be used.
coap_dtls_psk_sni_callback_t validate_sni_call_back
SNI check callback function.
coap_dtls_id_callback_t validate_id_call_back
Identity check callback function.
void * id_call_back_arg
Passed in to the Identity callback function.
uint8_t ec_jpake
Set to COAP_DTLS_SPSK_SETUP_VERSION to support this version of the struct.
coap_layer_write_t l_write
coap_const_char_ptr_t public_cert
define: Public Cert
coap_asn1_privatekey_type_t private_key_type
define: ASN1 Private Key Type (if needed)
coap_const_char_ptr_t private_key
define: Private Key
coap_const_char_ptr_t ca
define: Common CA Certificate
size_t public_cert_len
define Public Cert length (if needed)
coap_pki_define_t private_key_def
define: Private Key type definition
size_t private_key_len
define Private Key length (if needed)
coap_pki_define_t ca_def
define: Common CA type definition
coap_pki_define_t public_cert_def
define: Public Cert type definition
Abstraction of virtual session that can be attached to coap_context_t (client) or coap_endpoint_t (se...
coap_socket_t sock
socket object for the session, if any
coap_addr_tuple_t addr_info
remote/local address info
coap_dtls_cpsk_t cpsk_setup_data
client provided PSK initial setup data
uint8_t negotiated_cid
Set for a client if CID negotiated.
int dtls_event
Tracking any (D)TLS events on this session.
void * tls
security parameters
coap_session_type_t type
client or server side socket
coap_context_t * context
session's context
int ifindex
interface index
coap_layer_func_t lfunc[COAP_LAYER_LAST]
Layer functions to use.
CoAP string data definition with const data.
const uint8_t * s
read-only string data
size_t length
length of string
The structure used for returning the underlying (D)TLS library information.
uint64_t built_version
(D)TLS Built against Library Version
coap_tls_library_t type
Library type.
uint64_t version
(D)TLS runtime Library Version
const uint8_t * u_byte
unsigned char ptr