21#ifdef COAP_WITH_LIBWOLFSSL
78#include <wolfssl/options.h>
79#include <wolfssl/ssl.h>
80#include <wolfssl/wolfcrypt/settings.h>
81#include <wolfssl/openssl/ssl.h>
82#include <wolfssl/openssl/x509v3.h>
84#ifdef COAP_EPOLL_SUPPORT
85# include <sys/epoll.h>
88#if LIBWOLFSSL_VERSION_HEX < 0x05002000
89#error Must be compiled against wolfSSL 5.2.0 or later
93#define strcasecmp _stricmp
94#define strncasecmp _strnicmp
98#define WOLFSSL3_AL_FATAL 2
99#define WOLFSSL_TLSEXT_ERR_OK 0
102typedef struct coap_dtls_context_t {
104 WOLFSSL_HMAC_CTX *cookie_hmac;
105} coap_dtls_context_t;
107typedef struct coap_tls_context_t {
114typedef struct coap_wolfssl_context_t {
115 coap_dtls_context_t dtls;
117 coap_tls_context_t tls;
123 int trust_store_defined;
124} coap_wolfssl_context_t;
126typedef struct coap_ssl_data_t {
133typedef struct coap_wolfssl_env_t {
136 unsigned int retry_scalar;
137 coap_ssl_data_t data;
142typedef enum coap_enc_method_t {
148wolfssl_malloc(
size_t size) {
149 void *ret = XMALLOC(size, NULL, DYNAMIC_TYPE_TMP_BUFFER);
155wolfssl_free(
void *ptr) {
157 XFREE(ptr, NULL, DYNAMIC_TYPE_TMP_BUFFER);
161wolfssl_strdup(
const char *str) {
162 char *ret = (
char *)wolfssl_malloc(strlen(str) + 1);
171wolfssl_strndup(
const char *str,
size_t n) {
173 char *ret = (
char *)wolfssl_malloc(len + 1);
176 strncpy(ret, str, len);
182static coap_wolfssl_env_t *
184 coap_wolfssl_env_t *w_env = (coap_wolfssl_env_t *)c_session->
tls;
186 assert(w_env == NULL);
187 w_env = (coap_wolfssl_env_t *)wolfssl_malloc(
sizeof(coap_wolfssl_env_t));
191 memset(w_env, 0,
sizeof(coap_wolfssl_env_t));
197coap_dtls_free_wolfssl_env(coap_wolfssl_env_t *w_env) {
203#if COAP_CLIENT_SUPPORT
204#ifndef WOLFSSL_CIPHER_LIST_MAX_SIZE
205#define WOLFSSL_CIPHER_LIST_MAX_SIZE 4096
208#ifdef COAP_WOLFSSL_PSK_CIPHERS
209static char psk_ciphers[] = COAP_WOLFSSL_PSK_CIPHERS;
211static char psk_ciphers[WOLFSSL_CIPHER_LIST_MAX_SIZE];
214#ifdef COAP_WOLFSSL_PKI_CIPHERS
215static char pki_ciphers[] = COAP_WOLFSSL_PKI_CIPHERS;
217static char pki_ciphers[WOLFSSL_CIPHER_LIST_MAX_SIZE];
221set_ciphersuites(WOLFSSL *ssl, coap_enc_method_t method) {
222#if ! defined(COAP_WOLFSSL_PSK_CIPHERS) || ! defined(COAP_WOLFSSL_PKI_CIPHERS)
223 static int processed_ciphers = 0;
225 if (!processed_ciphers) {
226 static char ciphers[WOLFSSL_CIPHER_LIST_MAX_SIZE];
227 char *ciphers_ofs = ciphers;
229#if ! defined(COAP_WOLFSSL_PSK_CIPHERS)
230 char *psk_ofs = psk_ciphers;
232#if ! defined(COAP_WOLFSSL_PKI_CIPHERS)
233 char *pki_ofs = pki_ciphers;
236 if (wolfSSL_get_ciphers(ciphers, (
int)
sizeof(ciphers)) != WOLFSSL_SUCCESS) {
241 while (ciphers_ofs) {
242 cp = strchr(ciphers_ofs,
':');
245 if (strstr(ciphers_ofs,
"NULL")) {
249 if (strcmp(ciphers_ofs,
"RENEGOTIATION-INFO") == 0) {
252 }
else if (strstr(ciphers_ofs,
"PSK")) {
253#if ! defined(COAP_WOLFSSL_PSK_CIPHERS)
254 if (psk_ofs != psk_ciphers) {
258 strcpy(psk_ofs, ciphers_ofs);
259 psk_ofs += strlen(ciphers_ofs);
263#if ! defined(COAP_WOLFSSL_PKI_CIPHERS)
264 if (pki_ofs != pki_ciphers) {
268 strcpy(pki_ofs, ciphers_ofs);
269 pki_ofs += strlen(ciphers_ofs);
275 ciphers_ofs = cp + 1;
279#ifndef HAVE_SECURE_RENEGOTIATION
285#if ! defined(COAP_WOLFSSL_PSK_CIPHERS)
286 if (psk_ofs != psk_ciphers) {
290 strcpy(psk_ofs,
"RENEGOTIATION-INFO");
291 psk_ofs += strlen(
"RENEGOTIATION-INFO");
294#if ! defined(COAP_WOLFSSL_PKI_CIPHERS)
295 if (pki_ofs != pki_ciphers) {
299 strcpy(pki_ofs,
"RENEGOTIATION-INFO");
300 pki_ofs += strlen(
"RENEGOTIATION-INFO");
305 processed_ciphers = 1;
309 if (method == COAP_ENC_PSK) {
310 wolfSSL_set_cipher_list(ssl, psk_ciphers);
312 wolfSSL_set_cipher_list(ssl, pki_ciphers);
317#if COAP_SERVER_SUPPORT
318static int psk_tls_server_name_call_back(WOLFSSL *ssl,
int *sd,
void *arg);
320static int tls_verify_call_back(
int preverify_ok, WOLFSSL_X509_STORE_CTX *ctx);
324 if (wolfSSL_lib_version_hex() < 0x05002000) {
325 coap_log_warn(
"wolfSSL version 5.2.0 or later is required\n");
334 if (wolfSSL_lib_version_hex() < 0x05002000) {
335 coap_log_warn(
"wolfSSL version 5.2.0 or later is required\n");
386#if defined(HAVE_RPK) && LIBWOLFSSL_VERSION_HEX >= 0x05006004
393#if COAP_CLIENT_SUPPORT
396#if defined(WOLFSSL_DTLS_CID)
410 version.
version = wolfSSL_lib_version_hex();
418coap_wolfssl_log_func(
int level,
const char *text) {
421 switch ((
int)level) {
446 if (wolfSSL_library_init() != WOLFSSL_SUCCESS) {
450 wolfSSL_load_error_strings();
451 wolfSSL_SetLoggingCb(coap_wolfssl_log_func);
452 wolfSSL_Debugging_ON();
457 wolfSSL_ERR_free_strings();
459 wolfSSL_Debugging_OFF();
468 coap_wolfssl_env_t *w_env;
471 memcpy(&w_env, &c_session->
tls,
sizeof(w_env));
473 return (
void *)&w_env->ssl;
494coap_dgram_read(WOLFSSL *ssl,
char *out,
int outl,
void *ctx) {
496 coap_wolfssl_env_t *w_env = (coap_wolfssl_env_t *)ctx;
497 coap_ssl_data_t *data = w_env ? &w_env->data : NULL;
501 if (w_env && !w_env->done_psk_check && w_env->ssl) {
502 if (wolfSSL_SSL_in_init(w_env->ssl)) {
503 const char *name = wolfSSL_get_cipher_name(w_env->ssl);
509 wolfSSL_set_verify(w_env->ssl, WOLFSSL_VERIFY_NONE, tls_verify_call_back);
510 w_env->done_psk_check = 1;
516 if (data != NULL && data->pdu_len > 0) {
517 if (outl < (
int)data->pdu_len) {
518 memcpy(out, data->pdu, outl);
521 memcpy(out, data->pdu, data->pdu_len);
522 ret = (int)data->pdu_len;
524 if (!data->peekmode) {
529 w_env->last_timeout = now;
538coap_dgram_write(WOLFSSL *ssl,
char *in,
int inl,
void *ctx) {
540 coap_wolfssl_env_t *w_env = (coap_wolfssl_env_t *)ctx;
541 coap_ssl_data_t *data = w_env ? &w_env->data : NULL;
549 && data->session->endpoint == NULL
556 ret = (int)data->session->sock.lfunc[
COAP_LAYER_TLS].l_write(data->session,
561 w_env->last_timeout = now;
569#if COAP_CLIENT_SUPPORT
571coap_dtls_psk_client_callback(WOLFSSL *ssl,
574 unsigned int max_identity_len,
576 unsigned int max_psk_len) {
578 coap_wolfssl_context_t *w_context;
585 if (c_session == NULL)
588 if (w_context == NULL)
596 temp.
s = hint ? (
const uint8_t *)hint : (const uint8_t *)
"";
597 temp.
length = strlen((
const char *)temp.
s);
601 (
const char *)temp.
s);
611 if (cpsk_info == NULL)
616 psk_identity = &cpsk_info->
identity;
617 psk_key = &cpsk_info->
key;
623 if (psk_identity == NULL || psk_key == NULL) {
629 if (!max_identity_len)
632 if (psk_identity->
length > max_identity_len) {
633 coap_log_warn(
"psk_identity too large, truncated to %d bytes\n",
637 max_identity_len = (
unsigned int)psk_identity->
length;
639 memcpy(identity, psk_identity->
s, max_identity_len);
640 identity[max_identity_len] =
'\000';
642 if (psk_key->
length > max_psk_len) {
647 max_psk_len = (
unsigned int)psk_key->
length;
649 memcpy(psk, psk_key->
s, max_psk_len);
654coap_dtls_psk_client_cs_callback(WOLFSSL *ssl,
const char *hint,
655 char *identity,
unsigned int max_identity_len,
656 unsigned char *psk,
unsigned int max_psk_len,
657 const char *ciphersuite) {
658 int key_len = coap_dtls_psk_client_callback(ssl,
671#if COAP_SERVER_SUPPORT
673coap_dtls_psk_server_callback(
675 const char *identity,
677 unsigned int max_psk_len) {
684 if (c_session == NULL)
690 lidentity.
s = identity ? (
const uint8_t *)identity : (const uint8_t *)
"";
691 lidentity.
length = strlen((
const char *)lidentity.
s);
695 (
int)lidentity.
length, (
const char *)lidentity.
s);
710 if (psk_key->
length > max_psk_len) {
715 max_psk_len = (
unsigned int)psk_key->
length;
717 memcpy(psk, psk_key->
s, max_psk_len);
723ssl_function_definition(
unsigned long e) {
724 static char buff[80];
726 snprintf(buff,
sizeof(buff),
" at %s:%s",
727 wolfSSL_ERR_lib_error_string(e), wolfSSL_ERR_func_error_string(e));
732coap_dtls_info_callback(
const WOLFSSL *ssl,
int where,
int ret) {
735 int w = where &~SSL_ST_MASK;
737 if (w & SSL_ST_CONNECT)
738 pstr =
"wolfSSL_connect";
739 else if (w & SSL_ST_ACCEPT)
740 pstr =
"wolfSSL_accept";
744 if (where & SSL_CB_LOOP) {
747 }
else if (where & SSL_CB_ALERT) {
749 pstr = (where & SSL_CB_READ) ?
"read" :
"write";
750 if ((where & (SSL_CB_WRITE|SSL_CB_READ)) && (ret >> 8) == WOLFSSL3_AL_FATAL) {
752 if ((ret & 0xff) != close_notify)
757 coap_log(log_level,
"* %s: SSL3 alert %s:%s:%s\n",
760 wolfSSL_alert_type_string_long(ret),
761 wolfSSL_alert_desc_string_long(ret));
762 }
else if (where & SSL_CB_EXIT) {
768 while ((e = wolfSSL_ERR_get_error()))
771 ssl_function_definition(e));
773 }
else if (ret < 0) {
778 memcpy(&rw_ssl, &ssl,
sizeof(rw_ssl));
779 int err = wolfSSL_get_error(rw_ssl, ret);
780 if (err != WOLFSSL_ERROR_WANT_READ && err != WOLFSSL_ERROR_WANT_WRITE &&
781 err != WOLFSSL_ERROR_WANT_CONNECT && err != WOLFSSL_ERROR_WANT_ACCEPT &&
782 err != WOLFSSL_ERROR_WANT_X509_LOOKUP) {
786 while ((e = wolfSSL_ERR_get_error()))
789 ssl_function_definition(e));
795 if (where == SSL_CB_HANDSHAKE_START) {
799 memcpy(&rw_ssl, &ssl,
sizeof(rw_ssl));
800 if (wolfSSL_is_init_finished(rw_ssl))
812coap_sock_read(WOLFSSL *ssl,
char *out,
int outl,
void *ctx) {
813 coap_wolfssl_env_t *w_env = (coap_wolfssl_env_t *)ctx;
819 if (w_env && !w_env->done_psk_check && w_env->ssl &&
821 if (wolfSSL_SSL_in_init(w_env->ssl)) {
822 const char *name = wolfSSL_get_cipher_name(w_env->ssl);
827 if (strstr(name,
"PSK")) {
828 wolfSSL_set_verify(w_env->ssl, WOLFSSL_VERIFY_NONE, tls_verify_call_back);
829 w_env->done_psk_check = 1;
851coap_sock_write(WOLFSSL *ssl,
char *in,
int inl,
void *ctx) {
852 coap_wolfssl_env_t *w_env = (coap_wolfssl_env_t *)ctx;
868 (errno == EPIPE || errno == ECONNRESET)) {
888coap_set_user_prefs(WOLFSSL_CTX *ctx) {
891#ifdef COAP_WOLFSSL_SIGALGS
892 wolfSSL_CTX_set1_sigalgs_list(ctx, COAP_WOLFSSL_SIGALGS);
894#ifdef COAP_WOLFSSL_GROUPS
896 ret = wolfSSL_CTX_set1_groups_list(ctx,
897 (
char *) COAP_WOLFSSL_GROUPS);
898 if (ret != WOLFSSL_SUCCESS) {
906setup_dtls_context(coap_wolfssl_context_t *w_context) {
907 if (!w_context->dtls.ctx) {
908 uint8_t cookie_secret[32];
911 w_context->dtls.ctx = wolfSSL_CTX_new(wolfDTLS_method());
912 if (!w_context->dtls.ctx)
914 wolfSSL_CTX_set_min_proto_version(w_context->dtls.ctx,
916 wolfSSL_CTX_set_ex_data(w_context->dtls.ctx, 0, &w_context->dtls);
917 coap_set_user_prefs(w_context->dtls.ctx);
918 memset(cookie_secret, 0,
sizeof(cookie_secret));
919 if (!wolfSSL_RAND_bytes(cookie_secret, (
int)
sizeof(cookie_secret))) {
921 "Insufficient entropy for random cookie generation");
924 w_context->dtls.cookie_hmac = wolfSSL_HMAC_CTX_new();
925 if (!wolfSSL_HMAC_Init_ex(w_context->dtls.cookie_hmac, cookie_secret, (
int)
sizeof(cookie_secret),
926 wolfSSL_EVP_sha256(), NULL))
929 wolfSSL_CTX_set_info_callback(w_context->dtls.ctx, coap_dtls_info_callback);
930 wolfSSL_CTX_set_options(w_context->dtls.ctx, SSL_OP_NO_QUERY_MTU);
931 wolfSSL_SetIORecv(w_context->dtls.ctx, coap_dgram_read);
932 wolfSSL_SetIOSend(w_context->dtls.ctx, coap_dgram_write);
933#ifdef WOLFSSL_DTLS_MTU
936#ifdef WOLFSSL_SYS_CA_CERTS
937 if (w_context->trust_store_defined) {
938 if (!wolfSSL_CTX_load_system_CA_certs(w_context->dtls.ctx)) {
944 if (w_context->root_ca_file || w_context->root_ca_dir) {
945 if (!wolfSSL_CTX_load_verify_locations_ex(w_context->dtls.ctx,
946 w_context->root_ca_file,
947 w_context->root_ca_dir,
948 w_context->setup_data.allow_expired_certs ?
949 WOLFSSL_LOAD_FLAG_DATE_ERR_OKAY : 0)) {
951 w_context->root_ca_file ? w_context->root_ca_file :
"NULL",
952 w_context->root_ca_dir ? w_context->root_ca_dir :
"NULL");
957 if (w_context->setup_data.verify_peer_cert)
958 wolfSSL_CTX_set_verify(w_context->dtls.ctx,
959 WOLFSSL_VERIFY_PEER |
960 WOLFSSL_VERIFY_CLIENT_ONCE |
961 WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT,
962 tls_verify_call_back);
964 wolfSSL_CTX_set_verify(w_context->dtls.ctx, WOLFSSL_VERIFY_NONE, tls_verify_call_back);
977setup_tls_context(coap_wolfssl_context_t *w_context) {
978 if (!w_context->tls.ctx) {
980 w_context->tls.ctx = wolfSSL_CTX_new(wolfSSLv23_method());
981 if (!w_context->tls.ctx)
983 wolfSSL_CTX_set_ex_data(w_context->tls.ctx, 0, &w_context->tls);
984 wolfSSL_CTX_set_min_proto_version(w_context->tls.ctx, TLS1_VERSION);
985 coap_set_user_prefs(w_context->tls.ctx);
986 wolfSSL_CTX_set_info_callback(w_context->tls.ctx, coap_dtls_info_callback);
987 wolfSSL_SetIORecv(w_context->tls.ctx, coap_sock_read);
988 wolfSSL_SetIOSend(w_context->tls.ctx, coap_sock_write);
989#if COAP_CLIENT_SUPPORT
990 if (w_context->psk_pki_enabled & IS_PSK) {
991 wolfSSL_CTX_set_psk_client_cs_callback(w_context->tls.ctx,
992 coap_dtls_psk_client_cs_callback);
995 if (w_context->root_ca_file || w_context->root_ca_dir) {
996 if (!wolfSSL_CTX_load_verify_locations_ex(w_context->tls.ctx,
997 w_context->root_ca_file,
998 w_context->root_ca_dir,
999 w_context->setup_data.allow_expired_certs ?
1000 WOLFSSL_LOAD_FLAG_DATE_ERR_OKAY : 0)) {
1002 w_context->root_ca_file ? w_context->root_ca_file :
"NULL",
1003 w_context->root_ca_dir ? w_context->root_ca_dir :
"NULL");
1008#ifdef WOLFSSL_SYS_CA_CERTS
1009 if (w_context->trust_store_defined) {
1010 if (!wolfSSL_CTX_load_system_CA_certs(w_context->tls.ctx)) {
1016 if (w_context->setup_data.verify_peer_cert)
1017 wolfSSL_CTX_set_verify(w_context->tls.ctx,
1018 WOLFSSL_VERIFY_PEER |
1019 WOLFSSL_VERIFY_CLIENT_ONCE |
1020 WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT,
1021 tls_verify_call_back);
1023 wolfSSL_CTX_set_verify(w_context->tls.ctx, WOLFSSL_VERIFY_NONE, tls_verify_call_back);
1035 coap_wolfssl_context_t *w_context;
1038 w_context = (coap_wolfssl_context_t *)wolfssl_malloc(
sizeof(coap_wolfssl_context_t));
1040 memset(w_context, 0,
sizeof(coap_wolfssl_context_t));
1046#if COAP_SERVER_SUPPORT
1051 coap_wolfssl_context_t *w_context =
1054 if (!setup_data || !w_context)
1057 if (!setup_dtls_context(w_context))
1059#if !COAP_DISABLE_TCP
1060 if (!setup_tls_context(w_context))
1064 wolfSSL_CTX_set_psk_server_callback(w_context->dtls.ctx,
1065 coap_dtls_psk_server_callback);
1067#if !COAP_DISABLE_TCP
1068 wolfSSL_CTX_set_psk_server_callback(w_context->tls.ctx,
1069 coap_dtls_psk_server_callback);
1075 wolfSSL_CTX_use_psk_identity_hint(w_context->dtls.ctx, hint);
1076#if !COAP_DISABLE_TCP
1077 wolfSSL_CTX_use_psk_identity_hint(w_context->tls.ctx, hint);
1081 wolfSSL_CTX_set_servername_arg(w_context->dtls.ctx,
1083 wolfSSL_CTX_set_tlsext_servername_callback(w_context->dtls.ctx,
1084 psk_tls_server_name_call_back);
1085#if !COAP_DISABLE_TCP
1086 wolfSSL_CTX_set_servername_arg(w_context->tls.ctx,
1088 wolfSSL_CTX_set_tlsext_servername_callback(w_context->tls.ctx,
1089 psk_tls_server_name_call_back);
1095 w_context->psk_pki_enabled |= IS_PSK;
1100#if COAP_CLIENT_SUPPORT
1105 coap_wolfssl_context_t *w_context =
1108 if (!setup_data || !w_context)
1115#if ! defined(WOLFSSL_DTLS_CID)
1119 w_context->psk_pki_enabled |= IS_PSK;
1124#if !COAP_DISABLE_TCP
1125static uint8_t coap_alpn[] = { 4,
'c',
'o',
'a',
'p' };
1127#if COAP_SERVER_SUPPORT
1130 const unsigned char **out,
1131 unsigned char *outlen,
1132 const unsigned char *in,
1136 unsigned char *tout = NULL;
1139 return SSL_TLSEXT_ERR_NOACK;
1140 ret = wolfSSL_select_next_proto(&tout,
1147 return (ret != OPENSSL_NPN_NEGOTIATED) ? noack_return : WOLFSSL_TLSEXT_ERR_OK;
1153setup_pki_ssl(WOLFSSL *ssl,
1156 WOLFSSL_CTX *ctx = wolfSSL_get_SSL_CTX(ssl);
1170 if (!(wolfSSL_use_PrivateKey_file(ssl,
1172 WOLFSSL_FILETYPE_PEM))) {
1179 if (!(wolfSSL_use_PrivateKey_buffer(ssl,
1182 WOLFSSL_FILETYPE_PEM))) {
1189#if defined(HAVE_RPK) && LIBWOLFSSL_VERSION_HEX >= 0x05006004
1190 if (!(wolfSSL_use_PrivateKey_buffer(ssl,
1193 WOLFSSL_FILETYPE_PEM))) {
1205 if (!(wolfSSL_use_PrivateKey_file(ssl,
1207 WOLFSSL_FILETYPE_ASN1))) {
1214 if (!(wolfSSL_use_PrivateKey_buffer(ssl,
1217 WOLFSSL_FILETYPE_ASN1))) {
1246 if (!(wolfSSL_use_certificate_chain_file(ssl,
1254 if (!(wolfSSL_use_certificate_chain_buffer(ssl,
1263#if defined(HAVE_RPK) && LIBWOLFSSL_VERSION_HEX >= 0x05006004
1265 unsigned char der_buff[512];
1267 char ctype[] = {WOLFSSL_CERT_TYPE_RPK};
1268 char stype[] = {WOLFSSL_CERT_TYPE_RPK};
1270 wolfSSL_set_client_cert_type(ssl, ctype,
sizeof(ctype)/
sizeof(ctype[0]));
1271 wolfSSL_set_server_cert_type(ssl, stype,
sizeof(stype)/
sizeof(stype[0]));
1275 der_buff, (
int)
sizeof(der_buff));
1279 der_buff, (
int)
sizeof(der_buff), NULL);
1288 if (!wolfSSL_use_PrivateKey_buffer(ssl, der_buff, ret, WOLFSSL_FILETYPE_ASN1)) {
1293 if (!wolfSSL_use_certificate_buffer(ssl, spki->
s, spki->
length, WOLFSSL_FILETYPE_ASN1)) {
1308 if (!wolfSSL_use_certificate_buffer(ssl, der_buff, ret, WOLFSSL_FILETYPE_ASN1)) {
1321 if (!(wolfSSL_use_certificate_file(ssl,
1323 WOLFSSL_FILETYPE_ASN1))) {
1330 if (!(wolfSSL_use_certificate_buffer(ssl,
1333 WOLFSSL_FILETYPE_ASN1))) {
1354#if defined(HAVE_RPK) && LIBWOLFSSL_VERSION_HEX >= 0x05006004
1356 char stype[] = {WOLFSSL_CERT_TYPE_X509, WOLFSSL_CERT_TYPE_RPK};
1357 wolfSSL_set_server_cert_type(ssl, stype,
sizeof(stype)/
sizeof(stype[0]));
1368 if (!wolfSSL_CTX_load_verify_locations_ex(ctx,
1372 WOLFSSL_LOAD_FLAG_DATE_ERR_OKAY : 0)) {
1379 if (!wolfSSL_CTX_load_verify_buffer_ex(ctx,
1385 WOLFSSL_LOAD_FLAG_DATE_ERR_OKAY : 0)) {
1395 if (!wolfSSL_CTX_load_verify_locations_ex(ctx,
1399 WOLFSSL_LOAD_FLAG_DATE_ERR_OKAY : 0)) {
1406 if (!wolfSSL_CTX_load_verify_buffer_ex(ctx,
1412 WOLFSSL_LOAD_FLAG_DATE_ERR_OKAY : 0)) {
1431get_san_or_cn_from_cert(WOLFSSL_X509 *x509) {
1435 WOLF_STACK_OF(WOLFSSL_GENERAL_NAME) *san_list;
1439 san_list = wolfSSL_X509_get_ext_d2i(x509, NID_subject_alt_name, NULL, NULL);
1441 int san_count = wolfSSL_sk_GENERAL_NAME_num(san_list);
1443 for (n = 0; n < san_count; n++) {
1444 const WOLFSSL_GENERAL_NAME *name = wolfSSL_sk_GENERAL_NAME_value(san_list, n);
1446 if (name->type == GEN_DNS) {
1447 const char *dns_name = (
const char *)wolfSSL_ASN1_STRING_get0_data(name->d.dNSName);
1450 if (wolfSSL_ASN1_STRING_length(name->d.dNSName) != (int)strlen(dns_name))
1452 cn = wolfssl_strdup(dns_name);
1453 wolfSSL_sk_GENERAL_NAME_pop_free(san_list, wolfSSL_GENERAL_NAME_free);
1457 wolfSSL_sk_GENERAL_NAME_pop_free(san_list, wolfSSL_GENERAL_NAME_free);
1460 wolfSSL_X509_NAME_oneline(wolfSSL_X509_get_subject_name((WOLFSSL_X509 *)(x509)), buffer,
1464 n = (int)strlen(buffer) - 3;
1467 if (((cn[0] ==
'C') || (cn[0] ==
'c')) &&
1468 ((cn[1] ==
'N') || (cn[1] ==
'n')) &&
1477 char *ecn = strchr(cn,
'/');
1479 return wolfssl_strndup(cn, ecn-cn);
1481 return wolfssl_strdup(cn);
1489tls_verify_call_back(
int preverify_ok, WOLFSSL_X509_STORE_CTX *ctx) {
1490 WOLFSSL *ssl = wolfSSL_X509_STORE_CTX_get_ex_data(ctx,
1491 wolfSSL_get_ex_data_X509_STORE_CTX_idx());
1493 coap_wolfssl_context_t *w_context =
1496 int depth = wolfSSL_X509_STORE_CTX_get_error_depth(ctx);
1497 int err = wolfSSL_X509_STORE_CTX_get_error(ctx);
1498 WOLFSSL_X509 *x509 = wolfSSL_X509_STORE_CTX_get_current_cert(ctx);
1500 int keep_preverify_ok = preverify_ok;
1503 cn = wolfssl_strdup(
"RPK");
1505 cn = get_san_or_cn_from_cert(x509);
1507 if (!preverify_ok) {
1509 case X509_V_ERR_CERT_NOT_YET_VALID:
1510 case X509_V_ERR_CERT_HAS_EXPIRED:
1511 case ASN_NO_SIGNER_E:
1512 case ASN_AFTER_DATE_E:
1516 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
1520 case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
1524 case X509_V_ERR_UNABLE_TO_GET_CRL:
1528 case X509_V_ERR_CRL_NOT_YET_VALID:
1529 case X509_V_ERR_CRL_HAS_EXPIRED:
1533 case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
1534 case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
1535 case X509_V_ERR_AKID_SKID_MISMATCH:
1545 err = X509_V_ERR_CERT_CHAIN_TOO_LONG;
1546 wolfSSL_X509_STORE_CTX_set_error(ctx, err);
1548 if (!preverify_ok) {
1549 if (err == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) {
1552 "Unknown CA", cn ? cn :
"?", depth);
1556 wolfSSL_X509_verify_cert_error_string(err), cn ? cn :
"?", depth);
1561 wolfSSL_X509_verify_cert_error_string(err), cn ? cn :
"?", depth);
1566 int length = wolfSSL_i2d_X509(x509, NULL);
1570 uint8_t *base_buf2 = base_buf = wolfssl_malloc(length);
1574 wolfSSL_i2d_X509(x509, &base_buf2);
1577 depth, preverify_ok,
1581 wolfSSL_X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_REJECTED);
1583 wolfSSL_X509_STORE_CTX_set_error(ctx, X509_V_ERR_INVALID_CA);
1587 wolfssl_free(base_buf);
1591 return preverify_ok;
1594#if COAP_SERVER_SUPPORT
1605tls_server_name_call_back(WOLFSSL *ssl,
1610 coap_wolfssl_context_t *w_context =
1614 return noack_return;
1619 const char *sni = wolfSSL_get_servername(ssl, WOLFSSL_SNI_HOST_NAME);
1623 if (!sni || !sni[0]) {
1630 return fatal_return;
1632 sni_setup_data = *setup_data;
1633 sni_setup_data.
pki_key = *new_entry;
1637 if (w_context->psk_pki_enabled & IS_PSK) {
1638 wolfSSL_set_psk_server_callback(ssl, coap_dtls_psk_server_callback);
1640 return SSL_TLSEXT_ERR_OK;
1651psk_tls_server_name_call_back(WOLFSSL *ssl,
1657 coap_wolfssl_context_t *w_context =
1661 return noack_return;
1666 const char *sni = wolfSSL_get_servername(ssl, WOLFSSL_SNI_HOST_NAME);
1670 if (!sni || !sni[0]) {
1679 snprintf(lhint,
sizeof(lhint),
"%.*s",
1682 wolfSSL_use_psk_identity_hint(ssl, lhint);
1686 if (w_context->psk_pki_enabled & IS_PSK) {
1687 wolfSSL_set_psk_server_callback(ssl, coap_dtls_psk_server_callback);
1689 return SSL_TLSEXT_ERR_OK;
1697 coap_wolfssl_context_t *w_context =
1703 w_context->setup_data = *setup_data;
1704 if (!w_context->setup_data.verify_peer_cert) {
1706 w_context->setup_data.check_common_ca = 0;
1707 if (w_context->setup_data.is_rpk_not_cert) {
1709 w_context->setup_data.allow_self_signed = 0;
1710 w_context->setup_data.allow_expired_certs = 0;
1711 w_context->setup_data.cert_chain_validation = 0;
1712 w_context->setup_data.cert_chain_verify_depth = 0;
1713 w_context->setup_data.check_cert_revocation = 0;
1714 w_context->setup_data.allow_no_crl = 0;
1715 w_context->setup_data.allow_expired_crl = 0;
1716 w_context->setup_data.allow_bad_md_hash = 0;
1717 w_context->setup_data.allow_short_rsa_length = 0;
1720 w_context->setup_data.allow_self_signed = 1;
1721 w_context->setup_data.allow_expired_certs = 1;
1722 w_context->setup_data.cert_chain_validation = 1;
1723 w_context->setup_data.cert_chain_verify_depth = 10;
1724 w_context->setup_data.check_cert_revocation = 1;
1725 w_context->setup_data.allow_no_crl = 1;
1726 w_context->setup_data.allow_expired_crl = 1;
1727 w_context->setup_data.allow_bad_md_hash = 1;
1728 w_context->setup_data.allow_short_rsa_length = 1;
1731#if COAP_SERVER_SUPPORT
1733 if (!setup_dtls_context(w_context))
1735 if (w_context->dtls.ctx) {
1736#if defined(HAVE_RPK) && LIBWOLFSSL_VERSION_HEX >= 0x05006004
1737 char ctype[] = {WOLFSSL_CERT_TYPE_RPK};
1738 char stype[] = {WOLFSSL_CERT_TYPE_RPK};
1741 wolfSSL_CTX_set_servername_arg(w_context->dtls.ctx,
1742 &w_context->setup_data);
1743 wolfSSL_CTX_set_tlsext_servername_callback(w_context->dtls.ctx,
1744 tls_server_name_call_back);
1746#if defined(HAVE_RPK) && LIBWOLFSSL_VERSION_HEX >= 0x05006004
1747 if (w_context->setup_data.is_rpk_not_cert) {
1748 wolfSSL_CTX_set_client_cert_type(w_context->dtls.ctx, ctype,
sizeof(ctype)/
sizeof(ctype[0]));
1749 wolfSSL_CTX_set_server_cert_type(w_context->dtls.ctx, stype,
sizeof(stype)/
sizeof(stype[0]));
1753#if !COAP_DISABLE_TCP
1754 if (!setup_tls_context(w_context))
1756 if (w_context->tls.ctx) {
1757 wolfSSL_CTX_set_servername_arg(w_context->tls.ctx,
1758 &w_context->setup_data);
1759 wolfSSL_CTX_set_tlsext_servername_callback(w_context->tls.ctx,
1760 tls_server_name_call_back);
1763 wolfSSL_CTX_set_alpn_select_cb(w_context->tls.ctx,
1764 server_alpn_callback, NULL);
1768 if (w_context->setup_data.check_cert_revocation) {
1769 WOLFSSL_X509_VERIFY_PARAM *param;
1771 param = wolfSSL_X509_VERIFY_PARAM_new();
1772 wolfSSL_X509_VERIFY_PARAM_set_flags(param, WOLFSSL_CRL_CHECK);
1773 wolfSSL_CTX_set1_param(w_context->dtls.ctx, param);
1774#if !COAP_DISABLE_TCP
1775 wolfSSL_CTX_set1_param(w_context->tls.ctx, param);
1777 wolfSSL_X509_VERIFY_PARAM_free(param);
1780 if (w_context->setup_data.verify_peer_cert) {
1781 wolfSSL_CTX_set_verify(w_context->dtls.ctx,
1782 WOLFSSL_VERIFY_PEER |
1783 WOLFSSL_VERIFY_CLIENT_ONCE |
1784 WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT,
1785 tls_verify_call_back);
1786#if !COAP_DISABLE_TCP
1787 wolfSSL_CTX_set_verify(w_context->tls.ctx,
1788 WOLFSSL_VERIFY_PEER |
1789 WOLFSSL_VERIFY_CLIENT_ONCE |
1790 WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT,
1791 tls_verify_call_back);
1794 wolfSSL_CTX_set_verify(w_context->dtls.ctx,
1795 WOLFSSL_VERIFY_NONE, tls_verify_call_back);
1796#if !COAP_DISABLE_TCP
1797 wolfSSL_CTX_set_verify(w_context->tls.ctx,
1798 WOLFSSL_VERIFY_NONE, tls_verify_call_back);
1803 if (w_context->setup_data.cert_chain_validation) {
1804 wolfSSL_CTX_set_verify_depth(w_context->dtls.ctx,
1806#if !COAP_DISABLE_TCP
1807 wolfSSL_CTX_set_verify_depth(w_context->tls.ctx,
1816 w_context->psk_pki_enabled |= IS_PKI;
1818#if ! defined(WOLFSSL_DTLS_CID)
1827 const char *ca_file,
1828 const char *ca_dir) {
1829 coap_wolfssl_context_t *w_context =
1833 coap_log_warn(
"coap_context_set_pki_root_cas: (D)TLS environment "
1837 if (ca_file == NULL && ca_dir == NULL) {
1838 coap_log_warn(
"coap_context_set_pki_root_cas: ca_file and/or ca_dir "
1842 if (w_context->root_ca_file) {
1843 wolfssl_free(w_context->root_ca_file);
1844 w_context->root_ca_file = NULL;
1847 w_context->root_ca_file = wolfssl_strdup(ca_file);
1849 if (w_context->root_ca_dir) {
1850 wolfssl_free(w_context->root_ca_dir);
1851 w_context->root_ca_dir = NULL;
1854 w_context->root_ca_dir = wolfssl_strdup(ca_dir);
1861 coap_wolfssl_context_t *w_context =
1865 coap_log_warn(
"coap_context_set_pki_trust_store: (D)TLS environment "
1869#ifdef WOLFSSL_SYS_CA_CERTS
1870 w_context->trust_store_defined = 1;
1873 coap_log_warn(
"coap_context_set_pki_trust_store: (D)TLS environment "
1874 "not supported for wolfSSL < v5.5.2 or –enable-sys-ca-certs not defined\n");
1880 coap_wolfssl_context_t *w_context =
1882 return w_context->psk_pki_enabled ? 1 : 0;
1887 coap_wolfssl_context_t *w_context = (coap_wolfssl_context_t *)handle;
1891 wolfssl_free(w_context->root_ca_file);
1892 wolfssl_free(w_context->root_ca_dir);
1894 if (w_context->dtls.ctx)
1895 wolfSSL_CTX_free(w_context->dtls.ctx);
1896 if (w_context->dtls.cookie_hmac)
1897 wolfSSL_HMAC_CTX_free(w_context->dtls.cookie_hmac);
1899#if !COAP_DISABLE_TCP
1900 if (w_context->tls.ctx)
1901 wolfSSL_CTX_free(w_context->tls.ctx);
1903 wolfssl_free(w_context);
1906#if COAP_SERVER_SUPPORT
1909 coap_wolfssl_context_t *w_context =
1911 coap_dtls_context_t *dtls;
1912 WOLFSSL *ssl = NULL;
1915 coap_wolfssl_env_t *w_env = (coap_wolfssl_env_t *)session->
tls;
1921 if (!setup_dtls_context(w_context))
1923 dtls = &w_context->dtls;
1925 ssl = wolfSSL_new(dtls->ctx);
1929 wolfSSL_set_app_data(ssl, NULL);
1930 wolfSSL_set_options(ssl, SSL_OP_COOKIE_EXCHANGE);
1931#ifdef WOLFSSL_DTLS_MTU
1932 wolfSSL_dtls_set_mtu(ssl, (
long)session->
mtu);
1935 wolfSSL_SetIOWriteCtx(ssl, w_env);
1936 wolfSSL_SetIOReadCtx(ssl, w_env);
1937 wolfSSL_set_app_data(ssl, session);
1938 w_env->data.session = session;
1940#if defined(WOLFSSL_DTLS13) && defined(WOLFSSL_SEND_HRR_COOKIE)
1941 if (wolfSSL_send_hrr_cookie(ssl, NULL, 0) != WOLFSSL_SUCCESS)
1942 coap_log_debug(
"Error: Unable to set cookie with Hello Retry Request\n");
1945#ifdef HAVE_SERVER_RENEGOTIATION_INFO
1946 if (wolfSSL_UseSecureRenegotiation(ssl) != WOLFSSL_SUCCESS) {
1947 coap_log_debug(
"Error: wolfSSL_UseSecureRenegotiation failed\n");
1951 if (w_context->psk_pki_enabled & IS_PSK) {
1954 if (psk_hint != NULL && psk_hint->length) {
1955 char *hint = wolfssl_malloc(psk_hint->length + 1);
1958 memcpy(hint, psk_hint->s, psk_hint->length);
1959 hint[psk_hint->length] =
'\000';
1960 wolfSSL_use_psk_identity_hint(ssl, hint);
1967 if (w_context->psk_pki_enabled & IS_PKI) {
1972#if defined(WOLFSSL_DTLS_CH_FRAG) && defined(WOLFSSL_DTLS13)
1973 if (wolfSSL_dtls13_allow_ch_frag(ssl, 1) != WOLFSSL_SUCCESS) {
1978#if defined(WOLFSSL_DTLS_CID) && defined(WOLFSSL_DTLS13)
1980#if COAP_DTLS_CID_LENGTH > DTLS_CID_MAX_SIZE
1981#bad COAP_DTLS_CID_LENGTH > DTLS_CID_MAX_SIZE
1984 if (wolfSSL_dtls_cid_use(ssl) != WOLFSSL_SUCCESS)
1986 uint8_t cid[COAP_DTLS_CID_LENGTH];
1991 if (wolfSSL_dtls_cid_set(ssl, cid,
sizeof(cid)) != WOLFSSL_SUCCESS)
1997 w_env->last_timeout = now;
2000 r = wolfSSL_accept(ssl);
2002 int err = wolfSSL_get_error(ssl, r);
2003 if (err != WOLFSSL_ERROR_WANT_READ && err != WOLFSSL_ERROR_WANT_WRITE)
2016 coap_dtls_free_wolfssl_env(w_env);
2021#if COAP_CLIENT_SUPPORT
2024 coap_wolfssl_context_t *w_context =
2027 if (w_context->psk_pki_enabled & IS_PSK) {
2032 wolfSSL_set_max_proto_version(ssl,
2035#if !COAP_DISABLE_TCP
2037 wolfSSL_set_max_proto_version(ssl,
2039 wolfSSL_set_options(ssl, WOLFSSL_OP_NO_TLSv1_3);
2042 coap_log_debug(
"CoAP Client restricted to (D)TLS1.2 with Identity Hint callback\n");
2044 set_ciphersuites(ssl, COAP_ENC_PSK);
2048 wolfSSL_set_tlsext_host_name(ssl, setup_data->
client_sni) != 1) {
2049 coap_log_warn(
"wolfSSL_set_tlsext_host_name: set '%s' failed",
2052 wolfSSL_set_psk_client_callback(ssl, coap_dtls_psk_client_callback);
2054#if defined(WOLFSSL_DTLS_CID) && defined(WOLFSSL_DTLS13)
2056 if (wolfSSL_dtls_cid_use(ssl) != WOLFSSL_SUCCESS)
2061 if (wolfSSL_dtls_cid_set(ssl, NULL, 0) != WOLFSSL_SUCCESS)
2066 if (w_context->psk_pki_enabled & IS_PKI) {
2069 set_ciphersuites(ssl, COAP_ENC_PKI);
2073#if !COAP_DISABLE_TCP
2075 wolfSSL_set_alpn_protos(ssl, coap_alpn,
sizeof(coap_alpn));
2080 wolfSSL_set_tlsext_host_name(ssl, setup_data->
client_sni) != 1) {
2081 coap_log_warn(
"wolfSSL_set_tlsext_host_name: set '%s' failed",
2086 WOLFSSL_X509_VERIFY_PARAM *param;
2088 param = wolfSSL_X509_VERIFY_PARAM_new();
2089 wolfSSL_X509_VERIFY_PARAM_set_flags(param, WOLFSSL_CRL_CHECK);
2090 WOLFSSL_CTX *ctx = wolfSSL_get_SSL_CTX(ssl);
2092 wolfSSL_CTX_set1_param(ctx, param);
2093 wolfSSL_X509_VERIFY_PARAM_free(param);
2097 wolfSSL_set_verify(ssl,
2098 WOLFSSL_VERIFY_PEER |
2099 WOLFSSL_VERIFY_CLIENT_ONCE |
2100 WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT,
2101 tls_verify_call_back);
2103 wolfSSL_set_verify(ssl, WOLFSSL_VERIFY_NONE, tls_verify_call_back);
2109#if defined(WOLFSSL_DTLS_CID) && defined(WOLFSSL_DTLS13)
2111 if (wolfSSL_dtls_cid_use(ssl) != WOLFSSL_SUCCESS)
2116 if (wolfSSL_dtls_cid_set(ssl, NULL, 0) != WOLFSSL_SUCCESS)
2127 WOLFSSL *ssl = NULL;
2129 coap_wolfssl_context_t *w_context =
2131 coap_dtls_context_t *dtls;
2132 coap_wolfssl_env_t *w_env =
2139 if (!setup_dtls_context(w_context))
2141 dtls = &w_context->dtls;
2143 ssl = wolfSSL_new(dtls->ctx);
2147 w_env->data.session = session;
2148 wolfSSL_set_app_data(ssl, session);
2149 wolfSSL_set_options(ssl, SSL_OP_COOKIE_EXCHANGE);
2150 wolfSSL_SetIOWriteCtx(ssl, w_env);
2151 wolfSSL_SetIOReadCtx(ssl, w_env);
2152#ifdef WOLFSSL_DTLS_MTU
2153 wolfSSL_dtls_set_mtu(ssl, (
long)session->
mtu);
2156 if (!setup_client_ssl_session(session, ssl))
2158#ifdef HAVE_SERVER_RENEGOTIATION_INFO
2159 if (wolfSSL_UseSecureRenegotiation(ssl) != WOLFSSL_SUCCESS) {
2160 coap_log_debug(
"Error: wolfSSL_UseSecureRenegotiation failed\n");
2166#if defined(WOLFSSL_DTLS13) && defined(WOLFSSL_SEND_HRR_COOKIE)
2167 wolfSSL_NoKeyShares(ssl);
2169 r = wolfSSL_connect(ssl);
2171 int ret = wolfSSL_get_error(ssl, r);
2172 if (ret != WOLFSSL_ERROR_WANT_READ && ret != WOLFSSL_ERROR_WANT_WRITE)
2180 w_env->last_timeout = now;
2192#ifdef WOLFSSL_DTLS_MTU
2193 coap_wolfssl_env_t *w_env = (coap_wolfssl_env_t *)session->
tls;
2194 WOLFSSL *ssl = w_env ? w_env->ssl : NULL;
2197 wolfSSL_dtls_set_mtu(ssl, (
long)session->
mtu);
2206 coap_wolfssl_env_t *w_env = (coap_wolfssl_env_t *)session->
tls;
2207 WOLFSSL *ssl = w_env ? w_env->ssl : NULL;
2210 if (!wolfSSL_SSL_in_init(ssl) && !(wolfSSL_get_shutdown(ssl) & WOLFSSL_SENT_SHUTDOWN)) {
2211 int r = wolfSSL_shutdown(ssl);
2213 wolfSSL_shutdown(ssl);
2220 coap_dtls_free_wolfssl_env(w_env);
2225 const uint8_t *data,
size_t data_len) {
2226 coap_wolfssl_env_t *w_env = (coap_wolfssl_env_t *)session->
tls;
2227 WOLFSSL *ssl = w_env ? w_env->ssl : NULL;
2230 assert(ssl != NULL);
2235 r = wolfSSL_write(ssl, data, (
int)data_len);
2238 int err = wolfSSL_get_error(ssl, r);
2239 if (err == WOLFSSL_ERROR_WANT_READ || err == WOLFSSL_ERROR_WANT_WRITE) {
2243 if (err == WOLFSSL_ERROR_ZERO_RETURN)
2245 else if (err == WOLFSSL_ERROR_SSL)
2278 coap_wolfssl_env_t *w_env = (coap_wolfssl_env_t *)session->
tls;
2279 unsigned int scalar;
2286 scalar = 1 << w_env->retry_scalar;
2300 coap_wolfssl_env_t *w_env = (coap_wolfssl_env_t *)session->
tls;
2301 WOLFSSL *ssl = w_env ? w_env->ssl : NULL;
2304 w_env->retry_scalar++;
2310 wolfSSL_dtls_retransmit(ssl);
2314#if COAP_SERVER_SUPPORT
2318 const uint8_t *data,
size_t data_len) {
2319 coap_wolfssl_env_t *w_env = (coap_wolfssl_env_t *)session->
tls;
2320 coap_ssl_data_t *ssl_data;
2325 session->
tls = w_env;
2332 ssl_data = w_env ? &w_env->data : NULL;
2333 assert(ssl_data != NULL);
2335 if (ssl_data->pdu_len) {
2336 coap_log_err(
"** %s: Previous data not read %u bytes\n",
2340 ssl_data->session = session;
2341 ssl_data->pdu = data;
2342 ssl_data->pdu_len = (unsigned)data_len;
2351 coap_ssl_data_t *ssl_data;
2352 coap_wolfssl_env_t *w_env = (coap_wolfssl_env_t *)session->
tls;
2353 WOLFSSL *ssl = w_env ? w_env->ssl : NULL;
2355 int in_init = wolfSSL_SSL_in_init(ssl);
2358 assert(ssl != NULL);
2360 ssl_data = &w_env->data;
2362 if (ssl_data->pdu_len) {
2363 coap_log_err(
"** %s: Previous data not read %u bytes\n",
2366 ssl_data->pdu = data;
2367 ssl_data->pdu_len = (unsigned)data_len;
2370 r = wolfSSL_read(ssl, pdu, (
int)
sizeof(pdu));
2377 int err = wolfSSL_get_error(ssl, r);
2378 if (err == WOLFSSL_ERROR_WANT_READ || err == WOLFSSL_ERROR_WANT_WRITE) {
2379 if (in_init && wolfSSL_is_init_finished(ssl)) {
2382#if defined(WOLFSSL_DTLS_CID) && defined(WOLFSSL_DTLS13) && COAP_CLIENT_SUPPORT
2385 if (wolfSSL_dtls_cid_is_enabled(ssl)) {
2393 if (!strcmp(wolfSSL_get_version(ssl),
"DTLSv1.3")) {
2402 }
else if (err == APP_DATA_READY) {
2403 r = wolfSSL_read(ssl, pdu, (
int)
sizeof(pdu));
2411 if (err == WOLFSSL_ERROR_ZERO_RETURN) {
2416 if (err == FATAL_ERROR) {
2417 WOLFSSL_ALERT_HISTORY h;
2419 if (wolfSSL_get_alert_history(ssl, &h) == WOLFSSL_SUCCESS) {
2420 if (h.last_rx.code != close_notify && h.last_rx.code != -1) {
2423 wolfSSL_alert_desc_string_long(h.last_rx.code));
2444 if (ssl_data && ssl_data->pdu_len) {
2446 coap_log_debug(
"coap_dtls_receive: ret %d: remaining data %u\n", r, ssl_data->pdu_len);
2447 ssl_data->pdu_len = 0;
2448 ssl_data->pdu = NULL;
2455 unsigned int overhead = 37;
2456 const WOLFSSL_CIPHER *s_ciph = NULL;
2457 coap_wolfssl_env_t *w_env = (coap_wolfssl_env_t *)session->
tls;
2458 WOLFSSL *ssl = w_env ? w_env->ssl : NULL;
2461 s_ciph = wolfSSL_get_current_cipher(ssl);
2463 unsigned int ivlen, maclen, blocksize = 1, pad = 0;
2465 const WOLFSSL_EVP_CIPHER *e_ciph;
2466 const WOLFSSL_EVP_MD *e_md;
2469 e_ciph = wolfSSL_EVP_get_cipherbynid(wolfSSL_CIPHER_get_cipher_nid(s_ciph));
2471 switch (WOLFSSL_EVP_CIPHER_mode(e_ciph)) {
2473 case WOLFSSL_EVP_CIPH_GCM_MODE:
2474#ifndef WOLFSSL_EVP_GCM_TLS_EXPLICIT_IV_LEN
2475#define WOLFSSL_EVP_GCM_TLS_EXPLICIT_IV_LEN 8
2477#ifndef WOLFSSL_EVP_GCM_TLS_TAG_LEN
2478#define WOLFSSL_EVP_GCM_TLS_TAG_LEN 16
2480 ivlen = WOLFSSL_EVP_GCM_TLS_EXPLICIT_IV_LEN;
2481 maclen = WOLFSSL_EVP_GCM_TLS_TAG_LEN;
2484 case WOLFSSL_EVP_CIPH_CCM_MODE:
2485#ifndef WOLFSSL_EVP_CCM_TLS_EXPLICIT_IV_LEN
2486#define WOLFSSL_EVP_CCM_TLS_EXPLICIT_IV_LEN 8
2488 ivlen = WOLFSSL_EVP_CCM_TLS_EXPLICIT_IV_LEN;
2489 wolfSSL_CIPHER_description(s_ciph, cipher,
sizeof(cipher));
2490 if (strstr(cipher,
"CCM8"))
2496 case WOLFSSL_EVP_CIPH_CBC_MODE:
2497 e_md = wolfSSL_EVP_get_digestbynid(wolfSSL_CIPHER_get_digest_nid(s_ciph));
2498 blocksize = wolfSSL_EVP_CIPHER_block_size(e_ciph);
2499 ivlen = wolfSSL_EVP_CIPHER_iv_length(e_ciph);
2501 maclen = wolfSSL_EVP_MD_size(e_md);
2504 case WOLFSSL_EVP_CIPH_STREAM_CIPHER:
2511 wolfSSL_CIPHER_description(s_ciph, cipher,
sizeof(cipher));
2518#ifndef WOLFSSL_DTLS13_RT_HEADER_LENGTH
2519#define WOLFSSL_DTLS13_RT_HEADER_LENGTH 13
2521 overhead = WOLFSSL_DTLS13_RT_HEADER_LENGTH + ivlen + maclen + blocksize - 1 +
2527#if !COAP_DISABLE_TCP
2528#if COAP_CLIENT_SUPPORT
2531 WOLFSSL *ssl = NULL;
2533 coap_wolfssl_context_t *w_context =
2535 coap_tls_context_t *tls;
2536 coap_wolfssl_env_t *w_env =
2543 if (!setup_tls_context(w_context))
2545 tls = &w_context->tls;
2547 ssl = wolfSSL_new(tls->ctx);
2550 wolfSSL_SetIOWriteCtx(ssl, w_env);
2551 wolfSSL_SetIOReadCtx(ssl, w_env);
2552 wolfSSL_set_app_data(ssl, session);
2553 w_env->data.session = session;
2555 if (!setup_client_ssl_session(session, ssl))
2558 session->
tls = w_env;
2560 r = wolfSSL_connect(ssl);
2562 int ret = wolfSSL_get_error(ssl, r);
2563 if (ret != WOLFSSL_ERROR_WANT_READ && ret != WOLFSSL_ERROR_WANT_WRITE)
2565 if (ret == WOLFSSL_ERROR_WANT_READ)
2567 if (ret == WOLFSSL_ERROR_WANT_WRITE) {
2569#ifdef COAP_EPOLL_SUPPORT
2583 w_env->last_timeout = now;
2584 if (wolfSSL_is_init_finished(ssl)) {
2592 coap_dtls_free_wolfssl_env(w_env);
2599#if COAP_SERVER_SUPPORT
2602 WOLFSSL *ssl = NULL;
2603 coap_wolfssl_context_t *w_context =
2605 coap_tls_context_t *tls;
2608 coap_wolfssl_env_t *w_env =
2615 if (!setup_tls_context(w_context))
2617 tls = &w_context->tls;
2619 ssl = wolfSSL_new(tls->ctx);
2622 wolfSSL_SetIOWriteCtx(ssl, w_env);
2623 wolfSSL_SetIOReadCtx(ssl, w_env);
2624 wolfSSL_set_app_data(ssl, session);
2626 wolfSSL_set_cipher_list(ssl,
"ALL");
2628 if (w_context->psk_pki_enabled & IS_PSK) {
2630 if (psk_hint != NULL && psk_hint->
length) {
2631 char *hint = wolfssl_malloc(psk_hint->
length + 1);
2634 memcpy(hint, psk_hint->
s, psk_hint->
length);
2635 hint[psk_hint->
length] =
'\000';
2636 wolfSSL_use_psk_identity_hint(ssl, hint);
2643 if (w_context->psk_pki_enabled & IS_PKI) {
2647#if defined(HAVE_RPK) && LIBWOLFSSL_VERSION_HEX >= 0x05006004
2648 if (w_context->setup_data.is_rpk_not_cert) {
2649 char stype[] = {WOLFSSL_CERT_TYPE_RPK};
2651 wolfSSL_set_server_cert_type(ssl, stype,
sizeof(stype)/
sizeof(stype[0]));
2656 w_env->last_timeout = now;
2658 w_env->data.session = session;
2660 r = wolfSSL_accept(ssl);
2662 int err = wolfSSL_get_error(ssl, r);
2663 if (err != WOLFSSL_ERROR_WANT_READ && err != WOLFSSL_ERROR_WANT_WRITE) {
2666 if (err == WOLFSSL_ERROR_WANT_READ) {
2669 if (err == WOLFSSL_ERROR_WANT_WRITE) {
2671#ifdef COAP_EPOLL_SUPPORT
2684 session->
tls = w_env;
2685 if (wolfSSL_is_init_finished(ssl)) {
2695 coap_dtls_free_wolfssl_env(w_env);
2702 coap_wolfssl_env_t *w_env = (coap_wolfssl_env_t *)session->
tls;
2703 WOLFSSL *ssl = w_env ? w_env->ssl : NULL;
2706 if (!wolfSSL_SSL_in_init(ssl) && !(wolfSSL_get_shutdown(ssl) & WOLFSSL_SENT_SHUTDOWN)) {
2707 int r = wolfSSL_shutdown(ssl);
2709 wolfSSL_shutdown(ssl);
2716 coap_dtls_free_wolfssl_env(w_env);
2726 coap_wolfssl_env_t *w_env = (coap_wolfssl_env_t *)session->
tls;
2727 WOLFSSL *ssl = w_env ? w_env->ssl : NULL;
2733 in_init = !wolfSSL_is_init_finished(ssl);
2735 r = wolfSSL_write(ssl, data, (
int)data_len);
2738 int err = wolfSSL_get_error(ssl, r);
2739 if (err == WOLFSSL_ERROR_WANT_READ || err == WOLFSSL_ERROR_WANT_WRITE) {
2740 if (in_init && wolfSSL_is_init_finished(ssl)) {
2746 if (err == WOLFSSL_ERROR_WANT_READ)
2748 else if (err == WOLFSSL_ERROR_WANT_WRITE) {
2750#ifdef COAP_EPOLL_SUPPORT
2762 if (err == WOLFSSL_ERROR_ZERO_RETURN)
2764 else if (err == WOLFSSL_ERROR_SSL)
2768 }
else if (in_init && wolfSSL_is_init_finished(ssl)) {
2787 if (r == (ssize_t)data_len)
2804 coap_wolfssl_env_t *w_env = (coap_wolfssl_env_t *)session->
tls;
2805 WOLFSSL *ssl = w_env ? w_env->ssl : NULL;
2813 in_init = !wolfSSL_is_init_finished(ssl);
2815 r = wolfSSL_read(ssl, data, (
int)data_len);
2817 int err = wolfSSL_get_error(ssl, r);
2818 if (err == WOLFSSL_ERROR_WANT_READ || err == WOLFSSL_ERROR_WANT_WRITE) {
2819 if (in_init && wolfSSL_is_init_finished(ssl)) {
2825 if (err == WOLFSSL_ERROR_WANT_READ)
2827 if (err == WOLFSSL_ERROR_WANT_WRITE) {
2829#ifdef COAP_EPOLL_SUPPORT
2839 if (err == WOLFSSL_ERROR_ZERO_RETURN) {
2842 }
else if (err == WOLFSSL_ERROR_SSL) {
2844 }
else if (err == FATAL_ERROR) {
2845 WOLFSSL_ALERT_HISTORY h;
2848 if (wolfSSL_get_alert_history(ssl, &h) == WOLFSSL_SUCCESS) {
2849 if (h.last_rx.code != close_notify && h.last_rx.code != -1) {
2852 wolfSSL_alert_desc_string_long(h.last_rx.code));
2858 }
else if (in_init && wolfSSL_is_init_finished(ssl)) {
2884#if COAP_SERVER_SUPPORT
2887 WOLFSSL_EVP_MD_CTX *digest_ctx = wolfSSL_EVP_MD_CTX_new();
2890 wolfSSL_EVP_DigestInit_ex(digest_ctx, wolfSSL_EVP_sha256(), NULL);
2898 wolfSSL_EVP_MD_CTX_free(digest_ctx);
2903 const uint8_t *data,
2905 return wolfSSL_EVP_DigestUpdate(digest_ctx, data, data_len);
2912 int ret = wolfSSL_EVP_DigestFinal_ex(digest_ctx, (uint8_t *)digest_buffer, &size);
2919#if COAP_WS_SUPPORT || COAP_OSCORE_SUPPORT
2921coap_crypto_output_errors(
const char *prefix) {
2922#if COAP_MAX_LOGGING_LEVEL < _COAP_LOG_WARN
2927 while ((e = wolfSSL_ERR_get_error()))
2930 wolfSSL_ERR_reason_error_string(e),
2931 ssl_function_definition(e));
2941static struct hash_algs {
2943 const WOLFSSL_EVP_MD *(*get_hash)(void);
2952static const WOLFSSL_EVP_MD *
2953get_hash_alg(
cose_alg_t alg,
size_t *length) {
2956 for (idx = 0; idx <
sizeof(hashs) /
sizeof(
struct hash_algs); idx++) {
2957 if (hashs[idx].alg == alg) {
2958 *length = hashs[idx].length;
2959 return hashs[idx].get_hash();
2962 coap_log_debug(
"get_hash_alg: COSE hash %d not supported\n", alg);
2970 unsigned int length;
2971 const WOLFSSL_EVP_MD *evp_md;
2972 WOLFSSL_EVP_MD_CTX *evp_ctx = NULL;
2976 if ((evp_md = get_hash_alg(alg, &hash_length)) == NULL) {
2977 coap_log_debug(
"coap_crypto_hash: algorithm %d not supported\n", alg);
2980 evp_ctx = wolfSSL_EVP_MD_CTX_new();
2981 if (evp_ctx == NULL)
2983 if (wolfSSL_EVP_DigestInit_ex(evp_ctx, evp_md, NULL) == 0)
2986 if (wolfSSL_EVP_DigestUpdate(evp_ctx, data->
s, data->
length) == 0)
2992 if (wolfSSL_EVP_DigestFinal_ex(evp_ctx,
dummy->s, &length) == 0)
2994 dummy->length = length;
2995 if (hash_length < dummy->length)
2996 dummy->length = hash_length;
2998 wolfSSL_EVP_MD_CTX_free(evp_ctx);
3002 coap_crypto_output_errors(
"coap_crypto_hash");
3005 wolfSSL_EVP_MD_CTX_free(evp_ctx);
3010#if COAP_OSCORE_SUPPORT
3011#if LIBWOLFSSL_VERSION_HEX < 0x05006000
3012static const WOLFSSL_EVP_CIPHER *
3013EVP_aes_128_ccm(
void) {
3014 return "AES-128-CCM";
3017static const WOLFSSL_EVP_CIPHER *
3018EVP_aes_256_ccm(
void) {
3019 return "AES-256-CCM";
3033static struct cipher_algs {
3035 const WOLFSSL_EVP_CIPHER *(*get_cipher)(void);
3040static const WOLFSSL_EVP_CIPHER *
3044 for (idx = 0; idx <
sizeof(ciphers) /
sizeof(
struct cipher_algs); idx++) {
3045 if (ciphers[idx].alg == alg)
3046 return ciphers[idx].get_cipher();
3048 coap_log_debug(
"get_cipher_alg: COSE cipher %d not supported\n", alg);
3057static struct hmac_algs {
3059 const WOLFSSL_EVP_MD *(*get_hmac)(void);
3066static const WOLFSSL_EVP_MD *
3070 for (idx = 0; idx <
sizeof(hmacs) /
sizeof(
struct hmac_algs); idx++) {
3071 if (hmacs[idx].hmac_alg == hmac_alg)
3072 return hmacs[idx].get_hmac();
3074 coap_log_debug(
"get_hmac_alg: COSE HMAC %d not supported\n", hmac_alg);
3080 return get_cipher_alg(alg) != NULL;
3089 return get_hmac_alg(hmac_alg) != NULL;
3093 if (1 != (Func)) { \
3102 size_t *max_result_len) {
3108 byte *authTag = NULL;
3114 assert(params != NULL);
3120 if (ccm->
key.
s == NULL || ccm->
nonce == NULL)
3123 result_len = data->
length;
3124 nonce_length = 15 - ccm->
l;
3126 memset(&aes, 0,
sizeof(aes));
3131 authTag = (
byte *)malloc(ccm->
tag_len *
sizeof(
byte));
3135 ret = wc_AesCcmEncrypt(&aes, result, data->
s, data->
length, ccm->
nonce,
3136 nonce_length, authTag, ccm->
tag_len,
3140 wolfssl_free(authTag);
3144 memcpy(result + result_len, authTag, ccm->
tag_len);
3145 result_len +=
sizeof(authTag);
3146 *max_result_len = result_len;
3147 wolfssl_free(authTag);
3151 coap_crypto_output_errors(
"coap_crypto_aead_encrypt");
3161 size_t *max_result_len) {
3174 assert(params != NULL);
3184 memcpy(authTag, data->
s + data->
length - ccm->
tag_len,
sizeof(authTag));
3188 if (ccm->
key.
s == NULL || ccm->
nonce == NULL)
3191 memset(&aes, 0,
sizeof(aes));
3198 ret = wc_AesCcmDecrypt(&aes, result, data->
s, len, ccm->
nonce,
3199 15 - ccm->
l, authTag,
sizeof(authTag),
3205 *max_result_len = len;
3209 coap_crypto_output_errors(
"coap_crypto_aead_decrypt");
3218 unsigned int result_len;
3219 const WOLFSSL_EVP_MD *evp_md;
3226 if ((evp_md = get_hmac_alg(hmac_alg)) == 0) {
3227 coap_log_debug(
"coap_crypto_hmac: algorithm %d not supported\n", hmac_alg);
3233 result_len = (
unsigned int)
dummy->length;
3234 if (wolfSSL_HMAC(evp_md,
3241 dummy->length = result_len;
3246 coap_crypto_output_errors(
"coap_crypto_hmac");
3258#pragma GCC diagnostic ignored "-Wunused-function"
static size_t strnlen(const char *s, size_t maxlen)
A length-safe strlen() fake.
#define COAP_SERVER_SUPPORT
#define COAP_RXBUFFER_SIZE
#define COAP_SOCKET_WANT_READ
non blocking socket is waiting for reading
#define COAP_SOCKET_WANT_WRITE
non blocking socket is waiting for writing
void coap_epoll_ctl_mod(coap_socket_t *sock, uint32_t events, const char *func)
Epoll specific function to modify the state of events that epoll is tracking on the appropriate file ...
Library specific build wrapper for coap_internal.h.
int coap_dtls_context_set_pki(coap_context_t *ctx COAP_UNUSED, const coap_dtls_pki_t *setup_data COAP_UNUSED, const coap_dtls_role_t role COAP_UNUSED)
coap_tick_t coap_dtls_get_timeout(coap_session_t *session COAP_UNUSED, coap_tick_t now COAP_UNUSED)
ssize_t coap_tls_read(coap_session_t *session COAP_UNUSED, uint8_t *data COAP_UNUSED, size_t data_len COAP_UNUSED)
coap_tick_t coap_dtls_get_context_timeout(void *dtls_context COAP_UNUSED)
int coap_dtls_receive(coap_session_t *session COAP_UNUSED, const uint8_t *data COAP_UNUSED, size_t data_len COAP_UNUSED)
void * coap_dtls_get_tls(const coap_session_t *c_session COAP_UNUSED, coap_tls_library_t *tls_lib)
unsigned int coap_dtls_get_overhead(coap_session_t *session COAP_UNUSED)
int coap_dtls_context_load_pki_trust_store(coap_context_t *ctx COAP_UNUSED)
static coap_log_t dtls_log_level
int coap_dtls_context_check_keys_enabled(coap_context_t *ctx COAP_UNUSED)
ssize_t coap_dtls_send(coap_session_t *session COAP_UNUSED, const uint8_t *data COAP_UNUSED, size_t data_len COAP_UNUSED)
ssize_t coap_tls_write(coap_session_t *session COAP_UNUSED, const uint8_t *data COAP_UNUSED, size_t data_len COAP_UNUSED)
void coap_dtls_session_update_mtu(coap_session_t *session COAP_UNUSED)
int coap_dtls_context_set_pki_root_cas(coap_context_t *ctx COAP_UNUSED, const char *ca_file COAP_UNUSED, const char *ca_path COAP_UNUSED)
int coap_dtls_handle_timeout(coap_session_t *session COAP_UNUSED)
void coap_dtls_free_context(void *handle COAP_UNUSED)
void coap_dtls_free_session(coap_session_t *coap_session COAP_UNUSED)
void * coap_dtls_new_context(coap_context_t *coap_context COAP_UNUSED)
void coap_tls_free_session(coap_session_t *coap_session COAP_UNUSED)
coap_binary_t * get_asn1_spki(const uint8_t *data, size_t size)
Abstract SPKI public key from the ASN1.
void coap_digest_free(coap_digest_ctx_t *digest_ctx)
Free off coap_digest_ctx_t.
int coap_digest_final(coap_digest_ctx_t *digest_ctx, coap_digest_t *digest_buffer)
Finalize the coap_digest information into the provided digest_buffer.
int coap_digest_update(coap_digest_ctx_t *digest_ctx, const uint8_t *data, size_t data_len)
Update the coap_digest information with the next chunk of data.
coap_digest_ctx_t * coap_digest_setup(void)
Initialize a coap_digest.
uint64_t coap_tick_t
This data type represents internal timer ticks with COAP_TICKS_PER_SECOND resolution.
int coap_prng_lkd(void *buf, size_t len)
Fills buf with len random bytes using the default pseudo random number generator.
int coap_handle_event_lkd(coap_context_t *context, coap_event_t event, coap_session_t *session)
Invokes the event handler of context for the given event and data.
int coap_handle_dgram(coap_context_t *ctx, coap_session_t *session, uint8_t *msg, size_t msg_len)
Parses and interprets a CoAP datagram with context ctx.
void coap_ticks(coap_tick_t *)
Returns the current value of an internal tick counter.
int coap_crypto_hmac(cose_hmac_alg_t hmac_alg, coap_bin_const_t *key, coap_bin_const_t *data, coap_bin_const_t **hmac)
Create a HMAC hash of the provided data.
int coap_crypto_aead_decrypt(const coap_crypto_param_t *params, coap_bin_const_t *data, coap_bin_const_t *aad, uint8_t *result, size_t *max_result_len)
Decrypt the provided encrypted data into plaintext.
int coap_crypto_aead_encrypt(const coap_crypto_param_t *params, coap_bin_const_t *data, coap_bin_const_t *aad, uint8_t *result, size_t *max_result_len)
Encrypt the provided plaintext data.
int coap_crypto_hash(cose_alg_t alg, const coap_bin_const_t *data, coap_bin_const_t **hash)
Create a hash of the provided data.
int coap_crypto_check_hkdf_alg(cose_hkdf_alg_t hkdf_alg)
Check whether the defined hkdf algorithm is supported by the underlying crypto library.
int coap_crypto_check_cipher_alg(cose_alg_t alg)
Check whether the defined cipher algorithm is supported by the underlying crypto library.
void * coap_tls_new_server_session(coap_session_t *coap_session)
Create a TLS new server-side session.
const coap_bin_const_t * coap_get_session_client_psk_identity(const coap_session_t *coap_session)
Get the current client's PSK identity.
void coap_dtls_startup(void)
Initialize the underlying (D)TLS Library layer.
int coap_dtls_define_issue(coap_define_issue_key_t type, coap_define_issue_fail_t fail, coap_dtls_key_t *key, const coap_dtls_role_t role, int ret)
Report PKI DEFINE type issue.
void * coap_dtls_new_client_session(coap_session_t *coap_session)
Create a new client-side session.
void * coap_dtls_new_server_session(coap_session_t *coap_session)
Create a new DTLS server-side session.
int coap_dtls_hello(coap_session_t *coap_session, const uint8_t *data, size_t data_len)
Handling client HELLO messages from a new candiate peer.
int coap_dtls_set_cid_tuple_change(coap_context_t *context, uint8_t every)
Set the Connection ID client tuple frequency change for testing CIDs.
int coap_dtls_is_context_timeout(void)
Check if timeout is handled per CoAP session or per CoAP context.
int coap_dtls_context_set_cpsk(coap_context_t *coap_context, coap_dtls_cpsk_t *setup_data)
Set the DTLS context's default client PSK information.
int coap_dtls_context_set_spsk(coap_context_t *coap_context, coap_dtls_spsk_t *setup_data)
Set the DTLS context's default server PSK information.
void coap_dtls_shutdown(void)
Close down the underlying (D)TLS Library layer.
const coap_bin_const_t * coap_get_session_client_psk_key(const coap_session_t *coap_session)
Get the current client's PSK key.
void * coap_tls_new_client_session(coap_session_t *coap_session)
Create a new TLS client-side session.
#define COAP_DTLS_RETRANSMIT_COAP_TICKS
void coap_dtls_map_key_type_to_define(const coap_dtls_pki_t *setup_data, coap_dtls_key_t *key)
Map the PKI key definitions to the new DEFINE format.
const coap_bin_const_t * coap_get_session_server_psk_key(const coap_session_t *coap_session)
Get the current server's PSK key.
const coap_bin_const_t * coap_get_session_server_psk_hint(const coap_session_t *coap_session)
Get the current server's PSK identity hint.
@ COAP_DEFINE_KEY_PRIVATE
@ COAP_DEFINE_FAIL_NOT_SUPPORTED
#define COAP_DTLS_HINT_LENGTH
coap_tls_version_t * coap_get_tls_library_version(void)
Determine the type and version of the underlying (D)TLS library.
@ COAP_PKI_KEY_DEF_PKCS11
The PKI key type is PKCS11 (pkcs11:...).
@ COAP_PKI_KEY_DEF_DER_BUF
The PKI key type is DER buffer (ASN.1).
@ COAP_PKI_KEY_DEF_PEM_BUF
The PKI key type is PEM buffer.
@ COAP_PKI_KEY_DEF_PEM
The PKI key type is PEM file.
@ COAP_PKI_KEY_DEF_ENGINE
The PKI key type is to be passed to ENGINE.
@ COAP_PKI_KEY_DEF_RPK_BUF
The PKI key type is RPK in buffer.
@ COAP_PKI_KEY_DEF_DER
The PKI key type is DER file.
@ COAP_PKI_KEY_DEF_PKCS11_RPK
The PKI key type is PKCS11 w/ RPK (pkcs11:...).
@ COAP_DTLS_ROLE_SERVER
Internal function invoked for server.
@ COAP_DTLS_ROLE_CLIENT
Internal function invoked for client.
@ COAP_PKI_KEY_DEFINE
The individual PKI key types are Definable.
@ COAP_TLS_LIBRARY_WOLFSSL
Using wolfSSL library.
@ COAP_EVENT_DTLS_CLOSED
Triggerred when (D)TLS session closed.
@ COAP_EVENT_DTLS_CONNECTED
Triggered when (D)TLS session connected.
@ COAP_EVENT_DTLS_RENEGOTIATE
Triggered when (D)TLS session renegotiated.
@ COAP_EVENT_DTLS_ERROR
Triggered when (D)TLS error occurs.
#define coap_lock_callback_ret(r, c, func)
Dummy for no thread-safe code.
#define coap_log_debug(...)
coap_log_t coap_dtls_get_log_level(void)
Get the current (D)TLS logging.
#define coap_dtls_log(level,...)
Logging function.
void coap_dtls_set_log_level(coap_log_t level)
Sets the (D)TLS logging level to the specified level.
const char * coap_session_str(const coap_session_t *session)
Get session description.
#define coap_log_info(...)
#define coap_log_warn(...)
#define coap_log_err(...)
#define coap_log(level,...)
Logging function.
int coap_netif_available(coap_session_t *session)
Function interface to check whether netif for session is still available.
int cose_get_hmac_alg_for_hkdf(cose_hkdf_alg_t hkdf_alg, cose_hmac_alg_t *hmac_alg)
@ COSE_HMAC_ALG_HMAC384_384
@ COSE_HMAC_ALG_HMAC256_256
@ COSE_HMAC_ALG_HMAC512_512
@ COSE_ALGORITHM_SHA_256_64
@ COSE_ALGORITHM_SHA_256_256
@ COSE_ALGORITHM_AES_CCM_16_64_128
@ COSE_ALGORITHM_AES_CCM_16_64_256
int coap_session_refresh_psk_hint(coap_session_t *session, const coap_bin_const_t *psk_hint)
Refresh the session's current Identity Hint (PSK).
int coap_session_refresh_psk_key(coap_session_t *session, const coap_bin_const_t *psk_key)
Refresh the session's current pre-shared key (PSK).
int coap_session_refresh_psk_identity(coap_session_t *session, const coap_bin_const_t *psk_identity)
Refresh the session's current pre-shared identity (PSK).
void coap_session_disconnected_lkd(coap_session_t *session, coap_nack_reason_t reason)
Notify session that it has failed.
@ COAP_SESSION_TYPE_CLIENT
client-side
@ COAP_SESSION_STATE_HANDSHAKE
coap_binary_t * coap_new_binary(size_t size)
Returns a new binary object with at least size bytes storage allocated.
coap_bin_const_t * coap_new_bin_const(const uint8_t *data, size_t size)
Take the specified byte array (text) and create a coap_bin_const_t * Returns a new const binary objec...
void coap_delete_binary(coap_binary_t *s)
Deletes the given coap_binary_t object and releases any memory allocated.
int coap_dtls_cid_is_supported(void)
Check whether (D)TLS CID is available.
int coap_dtls_psk_is_supported(void)
Check whether (D)TLS PSK is available.
int coap_tls_is_supported(void)
Check whether TLS is available.
int coap_oscore_is_supported(void)
Check whether OSCORE is available.
int coap_dtls_is_supported(void)
Check whether DTLS is available.
int coap_dtls_pki_is_supported(void)
Check whether (D)TLS PKI is available.
int coap_dtls_rpk_is_supported(void)
Check whether (D)TLS RPK is available.
int coap_dtls_pkcs11_is_supported(void)
Check whether (D)TLS PKCS11 is available.
CoAP binary data definition with const data.
size_t length
length of binary data
const uint8_t * s
read-only binary data
CoAP binary data definition.
size_t length
length of binary data
The CoAP stack's global state is stored in a coap_context_t object.
uint8_t testing_cids
Change client's source port every testing_cids.
coap_dtls_spsk_t spsk_setup_data
Contains the initial PSK server setup data.
The structure that holds the AES Crypto information.
size_t l
The number of bytes in the length field.
const uint8_t * nonce
must be exactly 15 - l bytes
coap_crypto_key_t key
The Key to use.
size_t tag_len
The size of the Tag.
The common structure that holds the Crypto information.
union coap_crypto_param_t::@2 params
coap_crypto_aes_ccm_t aes
Used if AES type encryption.
The structure that holds the Client PSK information.
coap_bin_const_t identity
The structure used for defining the Client PSK setup data to be used.
uint8_t use_cid
Set to 1 if DTLS Connection ID is to be used.
void * ih_call_back_arg
Passed in to the Identity Hint callback function.
char * client_sni
If not NULL, SNI to use in client TLS setup.
coap_dtls_ih_callback_t validate_ih_call_back
Identity Hint check callback function.
uint8_t ec_jpake
Set to COAP_DTLS_CPSK_SETUP_VERSION to support this version of the struct.
The structure that holds the PKI key information.
coap_pki_key_define_t define
for definable type keys
union coap_dtls_key_t::@3 key
coap_pki_key_t key_type
key format type
The structure used for defining the PKI setup data to be used.
uint8_t allow_no_crl
1 ignore if CRL not there
void * cn_call_back_arg
Passed in to the CN callback function.
uint8_t cert_chain_validation
1 if to check cert_chain_verify_depth
uint8_t use_cid
1 if DTLS Connection ID is to be used (Client only, server always enabled) if supported
uint8_t check_cert_revocation
1 if revocation checks wanted
coap_dtls_pki_sni_callback_t validate_sni_call_back
SNI check callback function.
uint8_t cert_chain_verify_depth
recommended depth is 3
uint8_t allow_expired_certs
1 if expired certs are allowed
uint8_t verify_peer_cert
Set to COAP_DTLS_PKI_SETUP_VERSION to support this version of the struct.
char * client_sni
If not NULL, SNI to use in client TLS setup.
uint8_t allow_self_signed
1 if self-signed certs are allowed.
void * sni_call_back_arg
Passed in to the sni callback function.
coap_dtls_cn_callback_t validate_cn_call_back
CN check callback function.
uint8_t allow_expired_crl
1 if expired crl is allowed
uint8_t is_rpk_not_cert
1 is RPK instead of Public Certificate.
uint8_t check_common_ca
1 if peer cert is to be signed by the same CA as the local cert
coap_dtls_key_t pki_key
PKI key definition.
The structure that holds the Server Pre-Shared Key and Identity Hint information.
The structure used for defining the Server PSK setup data to be used.
coap_dtls_psk_sni_callback_t validate_sni_call_back
SNI check callback function.
coap_dtls_id_callback_t validate_id_call_back
Identity check callback function.
void * id_call_back_arg
Passed in to the Identity callback function.
uint8_t ec_jpake
Set to COAP_DTLS_SPSK_SETUP_VERSION to support this version of the struct.
void * sni_call_back_arg
Passed in to the SNI callback function.
coap_dtls_spsk_info_t psk_info
Server PSK definition.
coap_layer_write_t l_write
coap_layer_establish_t l_establish
coap_const_char_ptr_t public_cert
define: Public Cert
coap_const_char_ptr_t private_key
define: Private Key
coap_const_char_ptr_t ca
define: Common CA Certificate
size_t public_cert_len
define Public Cert length (if needed)
size_t ca_len
define CA Cert length (if needed)
coap_pki_define_t private_key_def
define: Private Key type definition
size_t private_key_len
define Private Key length (if needed)
coap_pki_define_t ca_def
define: Common CA type definition
coap_pki_define_t public_cert_def
define: Public Cert type definition
Abstraction of virtual session that can be attached to coap_context_t (client) or coap_endpoint_t (se...
unsigned int dtls_timeout_count
dtls setup retry counter
coap_socket_t sock
socket object for the session, if any
coap_session_state_t state
current state of relationship with peer
coap_bin_const_t * client_cid
Contains client CID or NULL.
coap_proto_t proto
protocol used
uint8_t is_dtls13
Set if session is DTLS1.3.
coap_dtls_cpsk_t cpsk_setup_data
client provided PSK initial setup data
size_t mtu
path or CSM mtu (xmt)
uint8_t negotiated_cid
Set for a client if CID negotiated.
int dtls_event
Tracking any (D)TLS events on this session.
void * tls
security parameters
uint16_t max_retransmit
maximum re-transmit count (default 4)
coap_session_type_t type
client or server side socket
coap_context_t * context
session's context
coap_layer_func_t lfunc[COAP_LAYER_LAST]
Layer functions to use.
coap_socket_flags_t flags
1 or more of COAP_SOCKET* flag values
CoAP string data definition with const data.
const uint8_t * s
read-only string data
size_t length
length of string
The structure used for returning the underlying (D)TLS library information.
uint64_t built_version
(D)TLS Built against Library Version
coap_tls_library_t type
Library type.
uint64_t version
(D)TLS runtime Library Version
const char * s_byte
signed char ptr
const uint8_t * u_byte
unsigned char ptr