53#ifdef COAP_WITH_LIBGNUTLS
55#define MIN_GNUTLS_VERSION "3.3.0"
58#include <gnutls/gnutls.h>
59#include <gnutls/x509.h>
60#include <gnutls/dtls.h>
61#include <gnutls/pkcs11.h>
62#include <gnutls/crypto.h>
63#include <gnutls/abstract.h>
65#if (GNUTLS_VERSION_NUMBER >= 0x030606)
66#define COAP_GNUTLS_KEY_RPK GNUTLS_KEY_DIGITAL_SIGNATURE | \
67 GNUTLS_KEY_NON_REPUDIATION | \
68 GNUTLS_KEY_KEY_ENCIPHERMENT | \
69 GNUTLS_KEY_DATA_ENCIPHERMENT | \
70 GNUTLS_KEY_KEY_AGREEMENT | \
71 GNUTLS_KEY_KEY_CERT_SIGN
75#define GNUTLS_CRT_RAW GNUTLS_CRT_RAWPK
79#define strcasecmp _stricmp
82typedef struct coap_ssl_t {
86 gnutls_datum_t cookie_key;
94typedef struct coap_gnutls_env_t {
95 gnutls_session_t g_session;
96 gnutls_psk_client_credentials_t psk_cl_credentials;
97 gnutls_psk_server_credentials_t psk_sv_credentials;
98 gnutls_certificate_credentials_t pki_credentials;
99 coap_ssl_t coap_ssl_data;
102 int doing_dtls_timeout;
107#define IS_PSK (1 << 0)
108#define IS_PKI (1 << 1)
109#define IS_CLIENT (1 << 6)
110#define IS_SERVER (1 << 7)
112typedef struct pki_sni_entry {
115 gnutls_certificate_credentials_t pki_credentials;
118typedef struct psk_sni_entry {
121 gnutls_psk_server_credentials_t psk_credentials;
124typedef struct coap_gnutls_context_t {
127 size_t pki_sni_count;
128 pki_sni_entry *pki_sni_entry_list;
129 size_t psk_sni_count;
130 psk_sni_entry *psk_sni_entry_list;
131 gnutls_datum_t alpn_proto;
134 gnutls_priority_t priority_cache;
135} coap_gnutls_context_t;
137typedef enum coap_free_bye_t {
138 COAP_FREE_BYE_AS_TCP,
139 COAP_FREE_BYE_AS_UDP,
143#define VARIANTS_3_6_6 "NORMAL:+ECDHE-PSK:+PSK:+ECDHE-ECDSA:+AES-128-CCM-8:+CTYPE-CLI-ALL:+CTYPE-SRV-ALL:+SHA256"
144#define VARIANTS_3_5_5 "NORMAL:+ECDHE-PSK:+PSK:+ECDHE-ECDSA:+AES-128-CCM-8"
145#define VARIANTS_BASE "NORMAL:+ECDHE-PSK:+PSK"
147#define VARIANTS_NO_TLS13_3_6_6 VARIANTS_3_6_6 ":-VERS-TLS1.3"
148#define VARIANTS_NO_TLS13_3_6_4 VARIANTS_3_5_5 ":-VERS-TLS1.3"
150#define G_ACTION(xx) do { \
152 } while (ret == GNUTLS_E_AGAIN || ret == GNUTLS_E_INTERRUPTED)
154#define G_CHECK(xx,func) do { \
155 if ((ret = (xx)) < 0) { \
156 coap_log_warn("%s: '%s'\n", func, gnutls_strerror(ret)); \
161#define G_ACTION_CHECK(xx,func) do { \
168#if COAP_SERVER_SUPPORT
169static int post_client_hello_gnutls_pki(gnutls_session_t g_session);
170static int post_client_hello_gnutls_psk(gnutls_session_t g_session);
171static int psk_server_callback(gnutls_session_t g_session,
172 const char *identity,
173 gnutls_datum_t *key);
182 if (gnutls_check_version(MIN_GNUTLS_VERSION) == NULL) {
183 coap_log_err(
"GnuTLS " MIN_GNUTLS_VERSION
" or later is required\n");
196 if (gnutls_check_version(MIN_GNUTLS_VERSION) == NULL) {
197 coap_log_err(
"GnuTLS " MIN_GNUTLS_VERSION
" or later is required\n");
239#if (GNUTLS_VERSION_NUMBER >= 0x030606)
249 const char *vers = gnutls_check_version(NULL);
255 sscanf(vers,
"%d.%d.%d", &p1, &p2, &p3);
256 version.
version = (p1 << 16) | (p2 << 8) | p3;
264coap_gnutls_audit_log_func(gnutls_session_t g_session,
const char *text) {
265#if COAP_MAX_LOGGING_LEVEL > 0
281coap_gnutls_log_func(
int level,
const char *text) {
299 coap_gnutls_context_t *g_context =
302 if (!g_context || !setup_data)
305 g_context->setup_data = *setup_data;
306 if (!g_context->setup_data.verify_peer_cert) {
308 g_context->setup_data.check_common_ca = 0;
309 if (g_context->setup_data.is_rpk_not_cert) {
311 g_context->setup_data.allow_self_signed = 0;
312 g_context->setup_data.allow_expired_certs = 0;
313 g_context->setup_data.cert_chain_validation = 0;
314 g_context->setup_data.cert_chain_verify_depth = 0;
315 g_context->setup_data.check_cert_revocation = 0;
316 g_context->setup_data.allow_no_crl = 0;
317 g_context->setup_data.allow_expired_crl = 0;
318 g_context->setup_data.allow_bad_md_hash = 0;
319 g_context->setup_data.allow_short_rsa_length = 0;
322 g_context->setup_data.allow_self_signed = 1;
323 g_context->setup_data.allow_expired_certs = 1;
324 g_context->setup_data.cert_chain_validation = 1;
325 g_context->setup_data.cert_chain_verify_depth = 10;
326 g_context->setup_data.check_cert_revocation = 1;
327 g_context->setup_data.allow_no_crl = 1;
328 g_context->setup_data.allow_expired_crl = 1;
329 g_context->setup_data.allow_bad_md_hash = 1;
330 g_context->setup_data.allow_short_rsa_length = 1;
335 g_context->setup_data.pki_key = key;
336 g_context->psk_pki_enabled |= IS_PKI;
347 const char *ca_path) {
348 coap_gnutls_context_t *g_context =
351 coap_log_warn(
"coap_context_set_pki_root_cas: (D)TLS environment "
356 if (ca_file == NULL && ca_path == NULL) {
357 coap_log_warn(
"coap_context_set_pki_root_cas: ca_file and/or ca_path "
361 if (g_context->root_ca_file) {
362 gnutls_free(g_context->root_ca_file);
363 g_context->root_ca_file = NULL;
366 g_context->root_ca_file = gnutls_strdup(ca_file);
368 if (g_context->root_ca_path) {
369 gnutls_free(g_context->root_ca_path);
370 g_context->root_ca_path = NULL;
373#if (GNUTLS_VERSION_NUMBER >= 0x030306)
374 g_context->root_ca_path = gnutls_strdup(ca_path);
376 coap_log_err(
"ca_path not supported in GnuTLS < 3.3.6\n");
382#if COAP_SERVER_SUPPORT
391 coap_gnutls_context_t *g_context =
394 if (!g_context || !setup_data)
397 g_context->psk_pki_enabled |= IS_PSK;
402#if COAP_CLIENT_SUPPORT
411 coap_gnutls_context_t *g_context =
414 if (!g_context || !setup_data)
417 g_context->psk_pki_enabled |= IS_PSK;
428 coap_gnutls_context_t *g_context =
430 return g_context->psk_pki_enabled ? 1 : 0;
435 gnutls_global_set_audit_log_function(coap_gnutls_audit_log_func);
436 gnutls_global_set_log_function(coap_gnutls_log_func);
449 if (c_session && c_session->
tls) {
450 const coap_gnutls_env_t *g_env = (
const coap_gnutls_env_t *)c_session->
tls;
452 return g_env->g_session;
479 coap_gnutls_context_t *g_context =
480 (coap_gnutls_context_t *)
481 gnutls_malloc(
sizeof(coap_gnutls_context_t));
485 const char *priority;
487 G_CHECK(gnutls_global_init(),
"gnutls_global_init");
488 memset(g_context, 0,
sizeof(coap_gnutls_context_t));
489 g_context->alpn_proto.data = gnutls_malloc(4);
490 if (g_context->alpn_proto.data) {
491 memcpy(g_context->alpn_proto.data,
"coap", 4);
492 g_context->alpn_proto.size = 4;
495 if (tls_version->
version >= 0x030606) {
496 priority = VARIANTS_3_6_6;
497 }
else if (tls_version->
version >= 0x030505) {
498 priority = VARIANTS_3_5_5;
500 priority = VARIANTS_BASE;
502 ret = gnutls_priority_init(&g_context->priority_cache, priority, &err);
503 if (ret != GNUTLS_E_SUCCESS) {
504 if (ret == GNUTLS_E_INVALID_REQUEST)
505 coap_log_warn(
"gnutls_priority_init: Syntax error at: %s\n", err);
507 coap_log_warn(
"gnutls_priority_init: %s\n", gnutls_strerror(ret));
522 coap_gnutls_context_t *g_context = (coap_gnutls_context_t *)handle;
524 gnutls_free(g_context->alpn_proto.data);
525 gnutls_free(g_context->root_ca_file);
526 gnutls_free(g_context->root_ca_path);
527 for (i = 0; i < g_context->pki_sni_count; i++) {
528 gnutls_free(g_context->pki_sni_entry_list[i].sni);
529 gnutls_certificate_free_credentials(
530 g_context->pki_sni_entry_list[i].pki_credentials);
532 if (g_context->pki_sni_entry_list)
533 gnutls_free(g_context->pki_sni_entry_list);
535 for (i = 0; i < g_context->psk_sni_count; i++) {
536 gnutls_free(g_context->psk_sni_entry_list[i].sni);
538 gnutls_psk_free_server_credentials(
539 g_context->psk_sni_entry_list[i].psk_credentials);
541 if (g_context->psk_sni_entry_list)
542 gnutls_free(g_context->psk_sni_entry_list);
544 gnutls_priority_deinit(g_context->priority_cache);
546 gnutls_global_deinit();
547 gnutls_free(g_context);
550#if COAP_CLIENT_SUPPORT
559psk_client_callback(gnutls_session_t g_session,
560 char **username, gnutls_datum_t *key) {
563 coap_gnutls_context_t *g_context;
565 const char *hint = gnutls_psk_client_get_hint(g_session);
575 if (c_session == NULL)
579 if (g_context == NULL)
584 temp.
s = hint ? (
const uint8_t *)hint : (const uint8_t *)
"";
585 temp.
length = strlen((
const char *)temp.
s);
589 (
const char *)temp.
s);
601 if (cpsk_info == NULL)
606 psk_identity = &cpsk_info->
identity;
607 psk_key = &cpsk_info->
key;
613 if (psk_identity == NULL || psk_key == NULL) {
618 *username = gnutls_malloc(psk_identity->
length+1);
619 if (*username == NULL)
621 memcpy(*username, psk_identity->
s, psk_identity->
length);
622 (*username)[psk_identity->
length] =
'\000';
624 key->data = gnutls_malloc(psk_key->
length);
625 if (key->data == NULL) {
626 gnutls_free(*username);
630 memcpy(key->data, psk_key->
s, psk_key->
length);
631 key->size = psk_key->
length;
637 gnutls_certificate_type_t certificate_type;
639 const gnutls_datum_t *cert_list;
640 unsigned int cert_list_size;
642} coap_gnutls_certificate_info_t;
648static gnutls_certificate_type_t
649get_san_or_cn(gnutls_session_t g_session,
650 coap_gnutls_certificate_info_t *cert_info) {
651 gnutls_x509_crt_t cert;
658#if (GNUTLS_VERSION_NUMBER >= 0x030606)
659 cert_info->certificate_type = gnutls_certificate_type_get2(g_session,
662 cert_info->certificate_type = gnutls_certificate_type_get(g_session);
665 cert_info->san_or_cn = NULL;
667 cert_info->cert_list = gnutls_certificate_get_peers(g_session,
668 &cert_info->cert_list_size);
669 if (cert_info->cert_list_size == 0) {
670 return GNUTLS_CRT_UNKNOWN;
673 if (cert_info->certificate_type != GNUTLS_CRT_X509)
674 return cert_info->certificate_type;
676 G_CHECK(gnutls_x509_crt_init(&cert),
"gnutls_x509_crt_init");
679 G_CHECK(gnutls_x509_crt_import(cert, &cert_info->cert_list[0],
680 GNUTLS_X509_FMT_DER),
"gnutls_x509_crt_import");
682 cert_info->self_signed = gnutls_x509_crt_check_issuer(cert, cert);
684 size =
sizeof(dn) -1;
686 ret = gnutls_x509_crt_get_subject_alt_name(cert, 0, dn, &size, NULL);
689 gnutls_x509_crt_deinit(cert);
690 cert_info->san_or_cn = gnutls_strdup(dn);
691 return cert_info->certificate_type;
695 G_CHECK(gnutls_x509_crt_get_dn(cert, dn, &size),
"gnutls_x509_crt_get_dn");
697 gnutls_x509_crt_deinit(cert);
703 if (((cn[0] ==
'C') || (cn[0] ==
'c')) &&
704 ((cn[1] ==
'N') || (cn[1] ==
'n')) &&
713 char *ecn = strchr(cn,
',');
717 cert_info->san_or_cn = gnutls_strdup(cn);
718 return cert_info->certificate_type;
720 return GNUTLS_CRT_UNKNOWN;
723 return GNUTLS_CRT_UNKNOWN;
726#if (GNUTLS_VERSION_NUMBER >= 0x030606)
727#define OUTPUT_CERT_NAME (cert_type == GNUTLS_CRT_X509 ? \
728 cert_info.san_or_cn : \
729 cert_type == GNUTLS_CRT_RAW ? \
730 COAP_DTLS_RPK_CERT_CN : "?")
732#define OUTPUT_CERT_NAME (cert_type == GNUTLS_CRT_X509 ? \
733 cert_info.san_or_cn : "?")
736#if (GNUTLS_VERSION_NUMBER >= 0x030606)
738check_rpk_cert(coap_gnutls_context_t *g_context,
739 coap_gnutls_certificate_info_t *cert_info,
743 if (g_context->setup_data.validate_cn_call_back) {
744 gnutls_pcert_st pcert;
748 G_CHECK(gnutls_pcert_import_rawpk_raw(&pcert, &cert_info->cert_list[0],
749 GNUTLS_X509_FMT_DER, 0, 0),
750 "gnutls_pcert_import_rawpk_raw");
753 G_CHECK(gnutls_pubkey_export(pcert.pubkey, GNUTLS_X509_FMT_DER, der, &size),
754 "gnutls_pubkey_export");
755 gnutls_pcert_deinit(&pcert);
762 g_context->setup_data.cn_call_back_arg)) {
777cert_verify_gnutls(gnutls_session_t g_session) {
778 unsigned int status = 0;
779 unsigned int fail = 0;
782 coap_gnutls_context_t *g_context =
784 coap_gnutls_env_t *g_env = (coap_gnutls_env_t *)c_session->
tls;
785 int alert = GNUTLS_A_BAD_CERTIFICATE;
787 coap_gnutls_certificate_info_t cert_info;
788 gnutls_certificate_type_t cert_type;
790 memset(&cert_info, 0,
sizeof(cert_info));
791 cert_type = get_san_or_cn(g_session, &cert_info);
792#if (GNUTLS_VERSION_NUMBER >= 0x030606)
793 if (cert_type == GNUTLS_CRT_RAW) {
794 if (!check_rpk_cert(g_context, &cert_info, c_session)) {
795 alert = GNUTLS_A_ACCESS_DENIED;
802 if (cert_info.cert_list_size == 0 && !g_context->setup_data.verify_peer_cert)
805 G_CHECK(gnutls_certificate_verify_peers(g_session, NULL, 0, &status),
806 "gnutls_certificate_verify_peers");
809 status &= ~(GNUTLS_CERT_INVALID);
810 if (status & (GNUTLS_CERT_NOT_ACTIVATED|GNUTLS_CERT_EXPIRED)) {
811 status &= ~(GNUTLS_CERT_NOT_ACTIVATED|GNUTLS_CERT_EXPIRED);
812 if (g_context->setup_data.allow_expired_certs) {
815 "The certificate has an invalid usage date",
821 "The certificate has an invalid usage date",
825 if (status & (GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED|
826 GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE)) {
827 status &= ~(GNUTLS_CERT_REVOCATION_DATA_SUPERSEDED|
828 GNUTLS_CERT_REVOCATION_DATA_ISSUED_IN_FUTURE);
829 if (g_context->setup_data.allow_expired_crl) {
832 "The certificate's CRL entry has an invalid usage date",
838 "The certificate's CRL entry has an invalid usage date",
842 if (status & (GNUTLS_CERT_SIGNER_NOT_FOUND)) {
843 status &= ~(GNUTLS_CERT_SIGNER_NOT_FOUND);
844 if (cert_info.self_signed) {
845 if (g_context->setup_data.allow_self_signed &&
846 !g_context->setup_data.check_common_ca) {
853 alert = GNUTLS_A_UNKNOWN_CA;
860 if (!g_context->setup_data.verify_peer_cert) {
863 "The peer certificate's CA is unknown",
867 alert = GNUTLS_A_UNKNOWN_CA;
870 "The peer certificate's CA is unknown",
875 if (status & (GNUTLS_CERT_INSECURE_ALGORITHM)) {
876 status &= ~(GNUTLS_CERT_INSECURE_ALGORITHM);
880 "The certificate uses an insecure algorithm",
886 coap_log_warn(
" %s: gnutls_certificate_verify_peers() status 0x%x: '%s'\n",
888 status, OUTPUT_CERT_NAME);
895 if (g_context->setup_data.validate_cn_call_back) {
896 gnutls_x509_crt_t cert;
901 const int cert_is_trusted = !status;
903 G_CHECK(gnutls_x509_crt_init(&cert),
"gnutls_x509_crt_init");
906 G_CHECK(gnutls_x509_crt_import(cert, &cert_info.cert_list[0],
907 GNUTLS_X509_FMT_DER),
"gnutls_x509_crt_import");
910 G_CHECK(gnutls_x509_crt_export(cert, GNUTLS_X509_FMT_DER, der, &size),
911 "gnutls_x509_crt_export");
912 gnutls_x509_crt_deinit(cert);
913 if (!g_context->setup_data.validate_cn_call_back(OUTPUT_CERT_NAME,
919 g_context->setup_data.cn_call_back_arg)) {
920 alert = GNUTLS_A_ACCESS_DENIED;
925 if (g_context->setup_data.additional_tls_setup_call_back) {
927 if (!g_context->setup_data.additional_tls_setup_call_back(g_session,
928 &g_context->setup_data)) {
934 if (cert_info.san_or_cn)
935 gnutls_free(cert_info.san_or_cn);
940 if (cert_info.san_or_cn)
941 gnutls_free(cert_info.san_or_cn);
943 if (!g_env->sent_alert) {
944 G_ACTION(gnutls_alert_send(g_session, GNUTLS_AL_FATAL, alert));
945 g_env->sent_alert = 1;
959cert_verify_callback_gnutls(gnutls_session_t g_session) {
960 if (gnutls_auth_get_type(g_session) == GNUTLS_CRD_CERTIFICATE) {
961 if (cert_verify_gnutls(g_session) == 0) {
969#define min(a,b) ((a) < (b) ? (a) : (b))
973pin_callback(
void *user_data,
int attempt,
993check_null_memory(gnutls_datum_t *datum,
994 const uint8_t *buf,
size_t len,
int *alloced) {
997 if (buf[len-1] !=
'\000') {
1000 datum->data = gnutls_malloc(len + 1);
1003 return GNUTLS_E_MEMORY_ERROR;
1005 memcpy(datum->data, buf, len);
1006 datum->data[len] =
'\000';
1010 memcpy(&datum->data,
1011 &buf,
sizeof(datum->data));
1021setup_pki_credentials(gnutls_certificate_credentials_t *pki_credentials,
1022 gnutls_session_t g_session,
1023 coap_gnutls_context_t *g_context,
1027 gnutls_datum_t cert;
1028 gnutls_datum_t pkey;
1030 int alloced_cert_memory = 0;
1031 int alloced_pkey_memory = 0;
1032 int alloced_ca_memory = 0;
1033 int have_done_key = 0;
1040 G_CHECK(gnutls_certificate_allocate_credentials(pki_credentials),
1041 "gnutls_certificate_allocate_credentials");
1058#if (GNUTLS_VERSION_NUMBER >= 0x030606)
1062 coap_log_err(
"RPK Support not available (needs gnutls 3.6.6 or later)\n");
1065 &key, role, GNUTLS_E_INSUFFICIENT_CREDENTIALS);
1071 &key, role, GNUTLS_E_INSUFFICIENT_CREDENTIALS);
1078 &key, role, GNUTLS_E_INSUFFICIENT_CREDENTIALS);
1092 &key, role, GNUTLS_E_INSUFFICIENT_CREDENTIALS);
1096 if ((ret = gnutls_certificate_set_x509_key_file(*pki_credentials,
1099 GNUTLS_X509_FMT_PEM) < 0)) {
1106 if ((ret = check_null_memory(&cert,
1109 &alloced_cert_memory)) < 0) {
1114 if ((ret = check_null_memory(&pkey,
1117 &alloced_pkey_memory)) < 0) {
1118 if (alloced_cert_memory)
1119 gnutls_free(cert.data);
1124 if ((ret = gnutls_certificate_set_x509_key_mem(*pki_credentials,
1127 GNUTLS_X509_FMT_PEM)) < 0) {
1128 if (alloced_cert_memory)
1129 gnutls_free(cert.data);
1130 if (alloced_pkey_memory)
1131 gnutls_free(pkey.data);
1136 if (alloced_cert_memory)
1137 gnutls_free(cert.data);
1138 if (alloced_pkey_memory)
1139 gnutls_free(pkey.data);
1142#if (GNUTLS_VERSION_NUMBER >= 0x030606)
1143 if ((ret = check_null_memory(&cert,
1146 &alloced_cert_memory)) < 0) {
1151 if ((ret = check_null_memory(&pkey,
1154 &alloced_pkey_memory)) < 0) {
1155 if (alloced_cert_memory)
1156 gnutls_free(cert.data);
1161 if (strstr((
char *)pkey.data,
"-----BEGIN EC PRIVATE KEY-----")) {
1162 gnutls_datum_t der_private;
1164 if (gnutls_pem_base64_decode2(
"EC PRIVATE KEY", &pkey,
1165 &der_private) == 0) {
1170 gnutls_datum_t tspki;
1172 tspki.data = spki->
s;
1173 tspki.size = spki->
length;
1174 ret = gnutls_certificate_set_rawpk_key_mem(*pki_credentials,
1177 GNUTLS_X509_FMT_DER, NULL,
1178 COAP_GNUTLS_KEY_RPK,
1185 gnutls_free(der_private.data);
1188 if (!have_done_key) {
1189 if ((ret = gnutls_certificate_set_rawpk_key_mem(*pki_credentials,
1192 GNUTLS_X509_FMT_PEM, NULL,
1193 COAP_GNUTLS_KEY_RPK,
1195 if (alloced_cert_memory)
1196 gnutls_free(cert.data);
1197 if (alloced_pkey_memory)
1198 gnutls_free(pkey.data);
1201 &key, role, GNUTLS_E_INSUFFICIENT_CREDENTIALS);
1204 if (alloced_cert_memory)
1205 gnutls_free(cert.data);
1206 if (alloced_pkey_memory)
1207 gnutls_free(pkey.data);
1210 coap_log_err(
"RPK Support not available (needs gnutls 3.6.6 or later)\n");
1213 &key, role, GNUTLS_E_INSUFFICIENT_CREDENTIALS);
1216 if ((ret = gnutls_certificate_set_x509_key_file(*pki_credentials,
1219 GNUTLS_X509_FMT_DER) < 0)) {
1226 if ((ret = check_null_memory(&cert,
1229 &alloced_cert_memory)) < 0) {
1234 if ((ret = check_null_memory(&pkey,
1237 &alloced_pkey_memory)) < 0) {
1238 if (alloced_cert_memory)
1239 gnutls_free(cert.data);
1244 if ((ret = gnutls_certificate_set_x509_key_mem(*pki_credentials,
1247 GNUTLS_X509_FMT_DER)) < 0) {
1248 if (alloced_cert_memory)
1249 gnutls_free(cert.data);
1250 if (alloced_pkey_memory)
1251 gnutls_free(pkey.data);
1256 if (alloced_cert_memory)
1257 gnutls_free(cert.data);
1258 if (alloced_pkey_memory)
1259 gnutls_free(pkey.data);
1262 gnutls_pkcs11_set_pin_function(pin_callback, &setup_data->
pki_key);
1263 if ((ret = gnutls_certificate_set_x509_key_file(*pki_credentials,
1266 GNUTLS_X509_FMT_DER)) < 0) {
1273#if (GNUTLS_VERSION_NUMBER >= 0x030606)
1274 gnutls_pkcs11_set_pin_function(pin_callback, setup_data);
1275 if ((ret = gnutls_certificate_set_rawpk_key_file(*pki_credentials,
1278 GNUTLS_X509_FMT_PEM, NULL,
1279 COAP_GNUTLS_KEY_RPK,
1280 NULL, 0, GNUTLS_PKCS_PLAIN, 0))) {
1286 coap_log_err(
"RPK Support not available (needs gnutls 3.6.6 or later)\n");
1287 return GNUTLS_E_INSUFFICIENT_CREDENTIALS;
1294 &key, role, GNUTLS_E_INSUFFICIENT_CREDENTIALS);
1305 if ((ret = gnutls_certificate_set_x509_trust_file(*pki_credentials,
1307 GNUTLS_X509_FMT_PEM) < 0)) {
1314 if ((ret = check_null_memory(&ca,
1317 &alloced_ca_memory)) < 0) {
1322 if ((ret = gnutls_certificate_set_x509_trust_mem(*pki_credentials,
1324 GNUTLS_X509_FMT_PEM)) < 0) {
1325 if (alloced_ca_memory)
1326 gnutls_free(ca.data);
1331 if (alloced_ca_memory)
1332 gnutls_free(ca.data);
1338 if ((ret = gnutls_certificate_set_x509_trust_file(*pki_credentials,
1340 GNUTLS_X509_FMT_DER) < 0)) {
1347 if ((ret = check_null_memory(&ca,
1350 &alloced_ca_memory)) < 0) {
1355 if ((ret = gnutls_certificate_set_x509_trust_mem(*pki_credentials,
1357 GNUTLS_X509_FMT_DER)) <= 0) {
1358 if (alloced_ca_memory)
1359 gnutls_free(ca.data);
1364 if (alloced_ca_memory)
1365 gnutls_free(ca.data);
1368 if ((ret = gnutls_certificate_set_x509_trust_file(*pki_credentials,
1370 GNUTLS_X509_FMT_DER)) <= 0) {
1383 &key, role, GNUTLS_E_INSUFFICIENT_CREDENTIALS);
1387 if (g_context->root_ca_file) {
1388 ret = gnutls_certificate_set_x509_trust_file(*pki_credentials,
1389 g_context->root_ca_file,
1390 GNUTLS_X509_FMT_PEM);
1392 coap_log_warn(
"gnutls_certificate_set_x509_trust_file: Root CA: No certificates found\n");
1395 if (g_context->root_ca_path) {
1396#if (GNUTLS_VERSION_NUMBER >= 0x030306)
1397 G_CHECK(gnutls_certificate_set_x509_trust_dir(*pki_credentials,
1398 g_context->root_ca_path,
1399 GNUTLS_X509_FMT_PEM),
1400 "gnutls_certificate_set_x509_trust_dir");
1403 gnutls_certificate_send_x509_rdn_sequence(g_session,
1405 if (!(g_context->psk_pki_enabled & IS_PKI)) {
1407 G_CHECK(gnutls_certificate_set_x509_system_trust(*pki_credentials),
1408 "gnutls_certificate_set_x509_system_trust");
1412 gnutls_certificate_set_verify_function(*pki_credentials,
1413 cert_verify_callback_gnutls);
1417 gnutls_certificate_set_verify_limits(*pki_credentials,
1426 gnutls_certificate_set_verify_flags(*pki_credentials,
1428 GNUTLS_VERIFY_DISABLE_CRL_CHECKS : 0)
1431 return GNUTLS_E_SUCCESS;
1437#if COAP_SERVER_SUPPORT
1443setup_psk_credentials(gnutls_psk_server_credentials_t *psk_credentials,
1449 G_CHECK(gnutls_psk_allocate_server_credentials(psk_credentials),
1450 "gnutls_psk_allocate_server_credentials");
1451 gnutls_psk_set_server_credentials_function(*psk_credentials,
1452 psk_server_callback);
1456 G_CHECK(gnutls_psk_set_server_credentials_hint(*psk_credentials, hint),
1457 "gnutls_psk_set_server_credentials_hint");
1460 return GNUTLS_E_SUCCESS;
1471post_client_hello_gnutls_psk(gnutls_session_t g_session) {
1474 coap_gnutls_context_t *g_context =
1476 coap_gnutls_env_t *g_env = (coap_gnutls_env_t *)c_session->
tls;
1477 int ret = GNUTLS_E_SUCCESS;
1487 name = gnutls_malloc(len);
1489 return GNUTLS_E_MEMORY_ERROR;
1492 ret = gnutls_server_name_get(g_session, name, &len, &type, i);
1493 if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) {
1495 new_name = gnutls_realloc(name, len);
1496 if (new_name == NULL) {
1497 ret = GNUTLS_E_MEMORY_ERROR;
1505 if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1508 if (ret != GNUTLS_E_SUCCESS)
1511 if (type != GNUTLS_NAME_DNS)
1522 for (i = 0; i < g_context->psk_sni_count; i++) {
1523 if (strcasecmp(name, g_context->psk_sni_entry_list[i].sni) == 0) {
1527 if (i == g_context->psk_sni_count) {
1536 G_ACTION(gnutls_alert_send(g_session, GNUTLS_AL_FATAL,
1537 GNUTLS_A_UNRECOGNIZED_NAME));
1538 g_env->sent_alert = 1;
1539 ret = GNUTLS_E_NO_CERTIFICATE_FOUND;
1543 g_context->psk_sni_entry_list =
1544 gnutls_realloc(g_context->psk_sni_entry_list,
1545 (i+1)*
sizeof(psk_sni_entry));
1546 g_context->psk_sni_entry_list[i].sni = gnutls_strdup(name);
1547 g_context->psk_sni_entry_list[i].psk_info = *new_entry;
1549 sni_setup_data.
psk_info = *new_entry;
1550 if ((ret = setup_psk_credentials(
1551 &g_context->psk_sni_entry_list[i].psk_credentials,
1553 &sni_setup_data)) < 0) {
1555 G_ACTION(gnutls_alert_send(g_session, GNUTLS_AL_FATAL,
1556 GNUTLS_A_BAD_CERTIFICATE));
1557 g_env->sent_alert = 1;
1561 g_context->psk_sni_count++;
1563 G_CHECK(gnutls_credentials_set(g_env->g_session, GNUTLS_CRD_PSK,
1564 g_context->psk_sni_entry_list[i].psk_credentials),
1565 "gnutls_credentials_set");
1567 &g_context->psk_sni_entry_list[i].psk_info.hint);
1569 &g_context->psk_sni_entry_list[i].psk_info.key);
1585post_client_hello_gnutls_pki(gnutls_session_t g_session) {
1588 coap_gnutls_context_t *g_context =
1590 coap_gnutls_env_t *g_env = (coap_gnutls_env_t *)c_session->
tls;
1591 int ret = GNUTLS_E_SUCCESS;
1594 if (g_context->setup_data.validate_sni_call_back) {
1601 name = gnutls_malloc(len);
1603 return GNUTLS_E_MEMORY_ERROR;
1606 ret = gnutls_server_name_get(g_session, name, &len, &type, i);
1607 if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) {
1609 new_name = gnutls_realloc(name, len);
1610 if (new_name == NULL) {
1611 ret = GNUTLS_E_MEMORY_ERROR;
1619 if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
1622 if (ret != GNUTLS_E_SUCCESS)
1625 if (type != GNUTLS_NAME_DNS)
1636 for (i = 0; i < g_context->pki_sni_count; i++) {
1637 if (strcasecmp(name, g_context->pki_sni_entry_list[i].sni) == 0) {
1641 if (i == g_context->pki_sni_count) {
1646 g_context->setup_data.validate_sni_call_back(name,
1647 g_context->setup_data.sni_call_back_arg);
1649 G_ACTION(gnutls_alert_send(g_session, GNUTLS_AL_FATAL,
1650 GNUTLS_A_UNRECOGNIZED_NAME));
1651 g_env->sent_alert = 1;
1652 ret = GNUTLS_E_NO_CERTIFICATE_FOUND;
1656 g_context->pki_sni_entry_list = gnutls_realloc(
1657 g_context->pki_sni_entry_list,
1658 (i+1)*
sizeof(pki_sni_entry));
1659 g_context->pki_sni_entry_list[i].sni = gnutls_strdup(name);
1660 g_context->pki_sni_entry_list[i].pki_key = *new_entry;
1661 sni_setup_data = g_context->setup_data;
1662 sni_setup_data.
pki_key = *new_entry;
1663 if ((ret = setup_pki_credentials(
1664 &g_context->pki_sni_entry_list[i].pki_credentials,
1669 G_ACTION(gnutls_alert_send(g_session, GNUTLS_AL_FATAL,
1670 GNUTLS_A_BAD_CERTIFICATE));
1671 g_env->sent_alert = 1;
1675 g_context->pki_sni_count++;
1677 G_CHECK(gnutls_credentials_set(g_env->g_session, GNUTLS_CRD_CERTIFICATE,
1678 g_context->pki_sni_entry_list[i].pki_credentials),
1679 "gnutls_credentials_set");
1691#if COAP_CLIENT_SUPPORT
1697setup_client_ssl_session(
coap_session_t *c_session, coap_gnutls_env_t *g_env) {
1698 coap_gnutls_context_t *g_context =
1702 g_context->psk_pki_enabled |= IS_CLIENT;
1703 if (g_context->psk_pki_enabled & IS_PSK) {
1705 G_CHECK(gnutls_psk_allocate_client_credentials(&g_env->psk_cl_credentials),
1706 "gnutls_psk_allocate_client_credentials");
1707 gnutls_psk_set_client_credentials_function(g_env->psk_cl_credentials,
1708 psk_client_callback);
1709 G_CHECK(gnutls_credentials_set(g_env->g_session, GNUTLS_CRD_PSK,
1710 g_env->psk_cl_credentials),
1711 "gnutls_credentials_set");
1714 G_CHECK(gnutls_server_name_set(g_env->g_session, GNUTLS_NAME_DNS,
1717 "gnutls_server_name_set");
1723 if (tls_version->
version >= 0x030604) {
1725 const char *priority;
1727 if (tls_version->
version >= 0x030606) {
1728 priority = VARIANTS_NO_TLS13_3_6_6;
1730 priority = VARIANTS_NO_TLS13_3_6_4;
1732 ret = gnutls_priority_set_direct(g_env->g_session,
1735 if (ret == GNUTLS_E_INVALID_REQUEST)
1736 coap_log_warn(
"gnutls_priority_set_direct: Syntax error at: %s\n", err);
1738 coap_log_warn(
"gnutls_priority_set_direct: %s\n", gnutls_strerror(ret));
1745 if ((g_context->psk_pki_enabled & IS_PKI) ||
1746 (g_context->psk_pki_enabled & (IS_PSK | IS_PKI)) == 0) {
1752 G_CHECK(setup_pki_credentials(&g_env->pki_credentials, g_env->g_session,
1753 g_context, setup_data,
1755 "setup_pki_credentials");
1757 G_CHECK(gnutls_credentials_set(g_env->g_session, GNUTLS_CRD_CERTIFICATE,
1758 g_env->pki_credentials),
1759 "gnutls_credentials_set");
1762 G_CHECK(gnutls_alpn_set_protocols(g_env->g_session,
1763 &g_context->alpn_proto, 1, 0),
1764 "gnutls_alpn_set_protocols");
1768 G_CHECK(gnutls_server_name_set(g_env->g_session, GNUTLS_NAME_DNS,
1771 "gnutls_server_name_set");
1774 return GNUTLS_E_SUCCESS;
1781#if COAP_SERVER_SUPPORT
1790psk_server_callback(gnutls_session_t g_session,
1791 const char *identity,
1792 gnutls_datum_t *key) {
1795 coap_gnutls_context_t *g_context;
1800 if (c_session == NULL)
1804 if (g_context == NULL)
1810 lidentity.
s = identity ? (
const uint8_t *)identity : (const uint8_t *)
"";
1811 lidentity.
length = strlen((
const char *)lidentity.
s);
1815 (
int)lidentity.
length, (
const char *)lidentity.
s);
1827 if (psk_key == NULL)
1830 key->data = gnutls_malloc(psk_key->
length);
1831 if (key->data == NULL)
1833 memcpy(key->data, psk_key->
s, psk_key->
length);
1834 key->size = psk_key->
length;
1843setup_server_ssl_session(
coap_session_t *c_session, coap_gnutls_env_t *g_env) {
1844 coap_gnutls_context_t *g_context =
1846 int ret = GNUTLS_E_SUCCESS;
1848 g_context->psk_pki_enabled |= IS_SERVER;
1849 if (g_context->psk_pki_enabled & IS_PSK) {
1850 G_CHECK(setup_psk_credentials(
1851 &g_env->psk_sv_credentials,
1854 "setup_psk_credentials\n");
1855 G_CHECK(gnutls_credentials_set(g_env->g_session,
1857 g_env->psk_sv_credentials),
1858 "gnutls_credentials_set\n");
1859 gnutls_handshake_set_post_client_hello_function(g_env->g_session,
1860 post_client_hello_gnutls_psk);
1863 if (g_context->psk_pki_enabled & IS_PKI) {
1865 G_CHECK(setup_pki_credentials(&g_env->pki_credentials, g_env->g_session,
1866 g_context, setup_data,
1868 "setup_pki_credentials");
1871 gnutls_certificate_server_set_request(g_env->g_session,
1872 GNUTLS_CERT_REQUIRE);
1874 gnutls_certificate_server_set_request(g_env->g_session,
1875 GNUTLS_CERT_REQUEST);
1877 gnutls_certificate_server_set_request(g_env->g_session,
1878 GNUTLS_CERT_IGNORE);
1881 gnutls_handshake_set_post_client_hello_function(g_env->g_session,
1882 post_client_hello_gnutls_pki);
1884 G_CHECK(gnutls_credentials_set(g_env->g_session, GNUTLS_CRD_CERTIFICATE,
1885 g_env->pki_credentials),
1886 "gnutls_credentials_set\n");
1888 return GNUTLS_E_SUCCESS;
1901coap_dgram_read(gnutls_transport_ptr_t context,
void *out,
size_t outl) {
1906 if (!c_session->
tls) {
1910 data = &((coap_gnutls_env_t *)c_session->
tls)->coap_ssl_data;
1913 if (data != NULL && data->pdu_len > 0) {
1914 if (outl < data->pdu_len) {
1915 memcpy(out, data->pdu, outl);
1917 if (!data->peekmode) {
1919 data->pdu_len -= outl;
1922 memcpy(out, data->pdu, data->pdu_len);
1923 ret = data->pdu_len;
1924 if (!data->peekmode) {
1944coap_dgram_write(gnutls_transport_ptr_t context,
const void *send_buffer,
1945 size_t send_buffer_length) {
1946 ssize_t result = -1;
1951#if COAP_SERVER_SUPPORT
1960 send_buffer, send_buffer_length);
1961 if (result != (
int)send_buffer_length) {
1962 coap_log_warn(
"coap_netif_dgrm_write failed (%zd != %zu)\n",
1963 result, send_buffer_length);
1978receive_timeout(gnutls_transport_ptr_t context,
unsigned int ms
COAP_UNUSED) {
1982 fd_set readfds, writefds, exceptfds;
1984 int nfds = c_session->
sock.
fd +1;
1985 coap_gnutls_env_t *g_env = (coap_gnutls_env_t *)c_session->
tls;
1989 g_env->coap_ssl_data.pdu_len > 0) {
1995 FD_ZERO(&exceptfds);
1996 FD_SET(c_session->
sock.
fd, &readfds);
1997 if (!(g_env && g_env->doing_dtls_timeout)) {
1998 FD_SET(c_session->
sock.
fd, &writefds);
1999 FD_SET(c_session->
sock.
fd, &exceptfds);
2005 return select(nfds, &readfds, &writefds, &exceptfds, &tv);
2010static coap_gnutls_env_t *
2012 coap_gnutls_context_t *g_context =
2014 coap_gnutls_env_t *g_env = (coap_gnutls_env_t *)c_session->
tls;
2015#if (GNUTLS_VERSION_NUMBER >= 0x030606)
2016 int flags = type | GNUTLS_DATAGRAM | GNUTLS_NONBLOCK | GNUTLS_ENABLE_RAWPK;
2018 int flags = type | GNUTLS_DATAGRAM | GNUTLS_NONBLOCK;
2025 g_env = gnutls_malloc(
sizeof(coap_gnutls_env_t));
2029 memset(g_env, 0,
sizeof(coap_gnutls_env_t));
2031 G_CHECK(gnutls_init(&g_env->g_session, flags),
"gnutls_init");
2033 gnutls_transport_set_pull_function(g_env->g_session, coap_dgram_read);
2034 gnutls_transport_set_push_function(g_env->g_session, coap_dgram_write);
2035 gnutls_transport_set_pull_timeout_function(g_env->g_session, receive_timeout);
2037 gnutls_transport_set_ptr(g_env->g_session, c_session);
2039 G_CHECK(gnutls_priority_set(g_env->g_session, g_context->priority_cache),
2040 "gnutls_priority_set");
2042 if (type == GNUTLS_SERVER) {
2043#if COAP_SERVER_SUPPORT
2044 G_CHECK(setup_server_ssl_session(c_session, g_env),
2045 "setup_server_ssl_session");
2050#if COAP_CLIENT_SUPPORT
2051 G_CHECK(setup_client_ssl_session(c_session, g_env),
2052 "setup_client_ssl_session");
2058 gnutls_handshake_set_timeout(g_env->g_session,
2059 GNUTLS_DEFAULT_HANDSHAKE_TIMEOUT);
2060 gnutls_dtls_set_timeouts(g_env->g_session, COAP_DTLS_RETRANSMIT_MS,
2061 COAP_DTLS_RETRANSMIT_TOTAL_MS);
2072coap_dtls_free_gnutls_env(coap_gnutls_context_t *g_context,
2073 coap_gnutls_env_t *g_env,
2074 coap_free_bye_t free_bye) {
2079 if (free_bye != COAP_FREE_BYE_NONE && !g_env->sent_alert) {
2081 gnutls_bye(g_env->g_session, free_bye == COAP_FREE_BYE_AS_UDP ?
2082 GNUTLS_SHUT_WR : GNUTLS_SHUT_RDWR);
2084 gnutls_deinit(g_env->g_session);
2085 g_env->g_session = NULL;
2086 if (g_context->psk_pki_enabled & IS_PSK) {
2087 if ((g_context->psk_pki_enabled & IS_CLIENT) &&
2088 g_env->psk_cl_credentials != NULL) {
2089 gnutls_psk_free_client_credentials(g_env->psk_cl_credentials);
2090 g_env->psk_cl_credentials = NULL;
2093 if (g_env->psk_sv_credentials != NULL)
2094 gnutls_psk_free_server_credentials(g_env->psk_sv_credentials);
2095 g_env->psk_sv_credentials = NULL;
2098 if ((g_context->psk_pki_enabled & IS_PKI) ||
2099 (g_context->psk_pki_enabled &
2100 (IS_PSK | IS_PKI | IS_CLIENT)) == IS_CLIENT) {
2101 gnutls_certificate_free_credentials(g_env->pki_credentials);
2102 g_env->pki_credentials = NULL;
2104 gnutls_free(g_env->coap_ssl_data.cookie_key.data);
2109#if COAP_SERVER_SUPPORT
2112 coap_gnutls_env_t *g_env =
2113 (coap_gnutls_env_t *)c_session->
tls;
2115 gnutls_transport_set_ptr(g_env->g_session, c_session);
2123 gnutls_session_t g_session) {
2124#if COAP_MAX_LOGGING_LEVEL > 0
2125 int last_alert = gnutls_alert_get(g_session);
2127 if (last_alert == GNUTLS_A_CLOSE_NOTIFY)
2130 last_alert, gnutls_alert_get_name(last_alert));
2134 last_alert, gnutls_alert_get_name(last_alert));
2147do_gnutls_handshake(
coap_session_t *c_session, coap_gnutls_env_t *g_env) {
2150 ret = gnutls_handshake(g_env->g_session);
2152 case GNUTLS_E_SUCCESS:
2153 g_env->established = 1;
2158 case GNUTLS_E_INTERRUPTED:
2162 case GNUTLS_E_AGAIN:
2166 case GNUTLS_E_INSUFFICIENT_CREDENTIALS:
2170 case GNUTLS_E_FATAL_ALERT_RECEIVED:
2172 g_env->sent_alert = 1;
2173 log_last_alert(c_session, g_env->g_session);
2175 case GNUTLS_E_UNEXPECTED_HANDSHAKE_PACKET:
2176 case GNUTLS_E_UNEXPECTED_PACKET:
2180 case GNUTLS_E_WARNING_ALERT_RECEIVED:
2181 log_last_alert(c_session, g_env->g_session);
2185 case GNUTLS_E_NO_CERTIFICATE_FOUND:
2186#if (GNUTLS_VERSION_NUMBER > 0x030606)
2187 case GNUTLS_E_CERTIFICATE_REQUIRED:
2189 coap_log_warn(
"Client Certificate requested and required, but not provided\n"
2191 G_ACTION(gnutls_alert_send(g_env->g_session, GNUTLS_AL_FATAL,
2192 GNUTLS_A_BAD_CERTIFICATE));
2193 g_env->sent_alert = 1;
2197 case GNUTLS_E_DECRYPTION_FAILED:
2200 gnutls_strerror(ret));
2201 G_ACTION(gnutls_alert_send(g_env->g_session, GNUTLS_AL_FATAL,
2202 GNUTLS_A_DECRYPT_ERROR));
2203 g_env->sent_alert = 1;
2207 case GNUTLS_E_CERTIFICATE_ERROR:
2208 if (g_env->sent_alert) {
2214 case GNUTLS_E_UNKNOWN_CIPHER_SUITE:
2215 case GNUTLS_E_NO_CIPHER_SUITES:
2216 case GNUTLS_E_INVALID_SESSION:
2219 gnutls_strerror(ret));
2220 if (!g_env->sent_alert) {
2221 G_ACTION(gnutls_alert_send(g_env->g_session, GNUTLS_AL_FATAL,
2222 GNUTLS_A_HANDSHAKE_FAILURE));
2223 g_env->sent_alert = 1;
2228 case GNUTLS_E_SESSION_EOF:
2229 case GNUTLS_E_PREMATURE_TERMINATION:
2230 case GNUTLS_E_TIMEDOUT:
2231 case GNUTLS_E_PULL_ERROR:
2232 case GNUTLS_E_PUSH_ERROR:
2238 "returned %d: '%s'\n",
2239 ret, gnutls_strerror(ret));
2246#if COAP_CLIENT_SUPPORT
2249 coap_gnutls_env_t *g_env = coap_dtls_new_gnutls_env(c_session, GNUTLS_CLIENT);
2253 ret = do_gnutls_handshake(c_session, g_env);
2258 COAP_FREE_BYE_AS_UDP : COAP_FREE_BYE_AS_TCP);
2268 if (c_session && c_session->
context && c_session->
tls) {
2272 COAP_FREE_BYE_AS_UDP : COAP_FREE_BYE_AS_TCP);
2273 c_session->
tls = NULL;
2280 coap_gnutls_env_t *g_env = (coap_gnutls_env_t *)c_session->
tls;
2284 G_CHECK(gnutls_dtls_set_data_mtu(g_env->g_session,
2285 (
unsigned int)c_session->
mtu),
2286 "gnutls_dtls_set_data_mtu");
2298 const uint8_t *data,
size_t data_len) {
2300 coap_gnutls_env_t *g_env = (coap_gnutls_env_t *)c_session->
tls;
2302 assert(g_env != NULL);
2305 if (g_env->established) {
2306 ret = gnutls_record_send(g_env->g_session, data, data_len);
2310 case GNUTLS_E_AGAIN:
2313 case GNUTLS_E_FATAL_ALERT_RECEIVED:
2315 g_env->sent_alert = 1;
2316 log_last_alert(c_session, g_env->g_session);
2322 "returned %d: '%s'\n",
2323 ret, gnutls_strerror(ret));
2332 ret = do_gnutls_handshake(c_session, g_env);
2350 if (ret == (ssize_t)data_len)
2372 coap_gnutls_env_t *g_env = (coap_gnutls_env_t *)c_session->
tls;
2375 if (g_env && g_env->g_session) {
2376 unsigned int rem_ms = gnutls_dtls_get_timeout(g_env->g_session);
2389 g_env->last_timeout = now;
2390 return now + rem_ms;
2402 coap_gnutls_env_t *g_env = (coap_gnutls_env_t *)c_session->
tls;
2405 g_env->doing_dtls_timeout = 1;
2407 (do_gnutls_handshake(c_session, g_env) < 0)) {
2409 g_env->doing_dtls_timeout = 0;
2413 g_env->doing_dtls_timeout = 0;
2426 coap_gnutls_env_t *g_env = (coap_gnutls_env_t *)c_session->
tls;
2428 coap_ssl_t *ssl_data = &g_env->coap_ssl_data;
2432 assert(g_env != NULL);
2434 if (ssl_data->pdu_len)
2435 coap_log_err(
"** %s: Previous data not read %u bytes\n",
2437 ssl_data->pdu = data;
2438 ssl_data->pdu_len = data_len;
2441 if (g_env->established) {
2445 gnutls_transport_set_ptr(g_env->g_session, c_session);
2448 ret = gnutls_record_recv(g_env->g_session, pdu, (
int)
sizeof(pdu));
2451 }
else if (ret == 0) {
2455 case GNUTLS_E_FATAL_ALERT_RECEIVED:
2457 g_env->sent_alert = 1;
2458 log_last_alert(c_session, g_env->g_session);
2462 case GNUTLS_E_WARNING_ALERT_RECEIVED:
2463 log_last_alert(c_session, g_env->g_session);
2468 coap_log_warn(
"coap_dtls_receive: gnutls_record_recv returned %d\n", ret);
2474 ret = do_gnutls_handshake(c_session, g_env);
2479 if (ssl_data->pdu_len && !g_env->sent_alert) {
2481 ret = do_gnutls_handshake(c_session, g_env);
2501 if (ssl_data && ssl_data->pdu_len) {
2503 coap_log_debug(
"coap_dtls_receive: ret %d: remaining data %u\n", ret, ssl_data->pdu_len);
2504 ssl_data->pdu_len = 0;
2505 ssl_data->pdu = NULL;
2514#if COAP_SERVER_SUPPORT
2522 const uint8_t *data,
2525 coap_gnutls_env_t *g_env = (coap_gnutls_env_t *)c_session->
tls;
2526 coap_ssl_t *ssl_data;
2530 g_env = coap_dtls_new_gnutls_env(c_session, GNUTLS_SERVER);
2532 c_session->
tls = g_env;
2533 gnutls_key_generate(&g_env->coap_ssl_data.cookie_key,
2534 GNUTLS_COOKIE_KEY_SIZE);
2541 gnutls_dtls_prestate_st prestate;
2544 memset(&prestate, 0,
sizeof(prestate));
2546 memcpy(&data_rw, &data,
sizeof(data_rw));
2547 ret = gnutls_dtls_cookie_verify(&g_env->coap_ssl_data.cookie_key,
2554 gnutls_dtls_cookie_send(&g_env->coap_ssl_data.cookie_key,
2562 gnutls_dtls_prestate_set(g_env->g_session, &prestate);
2565 ssl_data = &g_env->coap_ssl_data;
2566 ssl_data->pdu = data;
2567 ssl_data->pdu_len = data_len;
2569 ret = do_gnutls_handshake(c_session, g_env);
2576 g_env, COAP_FREE_BYE_NONE);
2577 c_session->
tls = NULL;
2585 if (ssl_data && ssl_data->pdu_len) {
2587 coap_log_debug(
"coap_dtls_hello: ret %d: remaining data %u\n", ret, ssl_data->pdu_len);
2588 ssl_data->pdu_len = 0;
2589 ssl_data->pdu = NULL;
2600#if !COAP_DISABLE_TCP
2608coap_sock_read(gnutls_transport_ptr_t context,
void *out,
size_t outl) {
2630coap_sock_write(gnutls_transport_ptr_t context,
const void *in,
size_t inl) {
2639 (errno == EPIPE || errno == ECONNRESET)) {
2665#if COAP_CLIENT_SUPPORT
2668 coap_gnutls_env_t *g_env = gnutls_malloc(
sizeof(coap_gnutls_env_t));
2669 coap_gnutls_context_t *g_context =
2671#if (GNUTLS_VERSION_NUMBER >= 0x030606)
2672 int flags = GNUTLS_CLIENT | GNUTLS_NONBLOCK | GNUTLS_ENABLE_RAWPK;
2674 int flags = GNUTLS_CLIENT | GNUTLS_NONBLOCK;
2681 memset(g_env, 0,
sizeof(coap_gnutls_env_t));
2683 G_CHECK(gnutls_init(&g_env->g_session, flags),
"gnutls_init");
2685 gnutls_transport_set_pull_function(g_env->g_session, coap_sock_read);
2686 gnutls_transport_set_push_function(g_env->g_session, coap_sock_write);
2687 gnutls_transport_set_pull_timeout_function(g_env->g_session, receive_timeout);
2689 gnutls_transport_set_ptr(g_env->g_session, c_session);
2691 gnutls_priority_set(g_env->g_session, g_context->priority_cache);
2692 setup_client_ssl_session(c_session, g_env);
2694 gnutls_handshake_set_timeout(g_env->g_session, GNUTLS_DEFAULT_HANDSHAKE_TIMEOUT);
2696 c_session->
tls = g_env;
2697 ret = do_gnutls_handshake(c_session, g_env);
2711#if COAP_SERVER_SUPPORT
2714 coap_gnutls_env_t *g_env = gnutls_malloc(
sizeof(coap_gnutls_env_t));
2715 coap_gnutls_context_t *g_context =
2717#if (GNUTLS_VERSION_NUMBER >= 0x030606)
2718 int flags = GNUTLS_SERVER | GNUTLS_NONBLOCK | GNUTLS_ENABLE_RAWPK;
2720 int flags = GNUTLS_SERVER | GNUTLS_NONBLOCK;
2726 memset(g_env, 0,
sizeof(coap_gnutls_env_t));
2728 G_CHECK(gnutls_init(&g_env->g_session, flags),
"gnutls_init");
2730 gnutls_transport_set_pull_function(g_env->g_session, coap_sock_read);
2731 gnutls_transport_set_push_function(g_env->g_session, coap_sock_write);
2732 gnutls_transport_set_pull_timeout_function(g_env->g_session, receive_timeout);
2734 gnutls_transport_set_ptr(g_env->g_session, c_session);
2736 setup_server_ssl_session(c_session, g_env);
2738 gnutls_priority_set(g_env->g_session, g_context->priority_cache);
2739 gnutls_handshake_set_timeout(g_env->g_session,
2740 GNUTLS_DEFAULT_HANDSHAKE_TIMEOUT);
2742 c_session->
tls = g_env;
2743 ret = do_gnutls_handshake(c_session, g_env);
2770 coap_gnutls_env_t *g_env = (coap_gnutls_env_t *)c_session->
tls;
2772 assert(g_env != NULL);
2775 if (g_env->established) {
2776 ret = gnutls_record_send(g_env->g_session, data, data_len);
2780 case GNUTLS_E_AGAIN:
2783 case GNUTLS_E_PUSH_ERROR:
2784 case GNUTLS_E_PULL_ERROR:
2785 case GNUTLS_E_PREMATURE_TERMINATION:
2788 case GNUTLS_E_FATAL_ALERT_RECEIVED:
2790 g_env->sent_alert = 1;
2791 log_last_alert(c_session, g_env->g_session);
2796 "returned %d: '%s'\n",
2797 ret, gnutls_strerror(ret));
2806 ret = do_gnutls_handshake(c_session, g_env);
2829 if (ret == (ssize_t)data_len)
2846 coap_gnutls_env_t *g_env = (coap_gnutls_env_t *)c_session->
tls;
2855 if (!g_env->established && !g_env->sent_alert) {
2856 ret = do_gnutls_handshake(c_session, g_env);
2865 ret = gnutls_record_recv(g_env->g_session, data, (
int)data_len);
2871 case GNUTLS_E_AGAIN:
2875 case GNUTLS_E_PULL_ERROR:
2878 case GNUTLS_E_FATAL_ALERT_RECEIVED:
2880 g_env->sent_alert = 1;
2881 log_last_alert(c_session, g_env->g_session);
2884 case GNUTLS_E_WARNING_ALERT_RECEIVED:
2885 log_last_alert(c_session, g_env->g_session);
2890 "returned %d: '%s'\n",
2891 ret, gnutls_strerror(ret));
2916#if COAP_SERVER_SUPPORT
2919 gnutls_hash_hd_t digest_ctx;
2921 if (gnutls_hash_init(&digest_ctx, GNUTLS_DIG_SHA256)) {
2929 gnutls_hash_deinit(digest_ctx, NULL);
2934 const uint8_t *data,
2936 int ret = gnutls_hash(digest_ctx, data, data_len);
2944 gnutls_hash_output(digest_ctx, (uint8_t *)digest_buffer);
2956static struct hash_algs {
2958 gnutls_digest_algorithm_t dig_type;
2966static gnutls_digest_algorithm_t
2967get_hash_alg(
cose_alg_t alg,
size_t *hash_len) {
2970 for (idx = 0; idx <
sizeof(hashs) /
sizeof(
struct hash_algs); idx++) {
2971 if (hashs[idx].alg == alg) {
2972 *hash_len = hashs[idx].dig_size;
2973 return hashs[idx].dig_type;
2976 coap_log_debug(
"get_hash_alg: COSE hash %d not supported\n", alg);
2977 return GNUTLS_DIG_UNKNOWN;
2985 gnutls_digest_algorithm_t dig_type = get_hash_alg(alg, &hash_length);
2986 gnutls_hash_hd_t digest_ctx;
2990 if (dig_type == GNUTLS_DIG_UNKNOWN) {
2991 coap_log_debug(
"coap_crypto_hash: algorithm %d not supported\n", alg);
2995 if (gnutls_hash_init(&digest_ctx, dig_type)) {
2998 ret = gnutls_hash(digest_ctx, data->
s, data->
length);
3005 gnutls_hash_output(digest_ctx,
dummy->s);
3008 gnutls_hash_deinit(digest_ctx, NULL);
3013 gnutls_hash_deinit(digest_ctx, NULL);
3018#if COAP_OSCORE_SUPPORT
3029static struct cipher_algs {
3031 gnutls_cipher_algorithm_t cipher_type;
3036static gnutls_cipher_algorithm_t
3040 for (idx = 0; idx <
sizeof(ciphers) /
sizeof(
struct cipher_algs); idx++) {
3041 if (ciphers[idx].alg == alg)
3042 return ciphers[idx].cipher_type;
3044 coap_log_debug(
"get_cipher_alg: COSE cipher %d not supported\n", alg);
3053static struct hmac_algs {
3055 gnutls_mac_algorithm_t hmac_type;
3061static gnutls_mac_algorithm_t
3065 for (idx = 0; idx <
sizeof(hmacs) /
sizeof(
struct hmac_algs); idx++) {
3066 if (hmacs[idx].hmac_alg == hmac_alg)
3067 return hmacs[idx].hmac_type;
3069 coap_log_debug(
"get_hmac_alg: COSE HMAC %d not supported\n", hmac_alg);
3075 return get_cipher_alg(alg);
3084 return get_hmac_alg(hmac_alg);
3092 size_t *max_result_len) {
3093 gnutls_aead_cipher_hd_t ctx;
3097 size_t result_len = *max_result_len;
3098 gnutls_cipher_algorithm_t algo;
3100 uint8_t *key_data_rw;
3106 assert(params != NULL);
3110 if ((algo = get_cipher_alg(params->
alg)) == 0) {
3111 coap_log_debug(
"coap_crypto_encrypt: algorithm %d not supported\n",
3115 tag_size = gnutls_cipher_get_tag_size(algo);
3119 memcpy(&key_data_rw, &ccm->
key.
s,
sizeof(key_data_rw));
3120 key.data = key_data_rw;
3130 G_CHECK(gnutls_aead_cipher_init(&ctx, algo, &key),
"gnutls_aead_cipher_init");
3132 G_CHECK(gnutls_aead_cipher_encrypt(ctx,
3142 "gnutls_aead_cipher_encrypt");
3143 *max_result_len = result_len;
3146 gnutls_aead_cipher_deinit(ctx);
3147 return ret == 1 ? 1 : 0;
3155 size_t *max_result_len) {
3156 gnutls_aead_cipher_hd_t ctx;
3160 size_t result_len = *max_result_len;
3161 gnutls_cipher_algorithm_t algo;
3163 uint8_t *key_data_rw;
3169 assert(params != NULL);
3174 if ((algo = get_cipher_alg(params->
alg)) == 0) {
3175 coap_log_debug(
"coap_crypto_decrypt: algorithm %d not supported\n",
3179 tag_size = gnutls_cipher_get_tag_size(algo);
3183 memcpy(&key_data_rw, &ccm->
key.
s,
sizeof(key_data_rw));
3184 key.data = key_data_rw;
3194 G_CHECK(gnutls_aead_cipher_init(&ctx, algo, &key),
"gnutls_aead_cipher_init");
3196 G_CHECK(gnutls_aead_cipher_decrypt(ctx,
3206 "gnutls_aead_cipher_decrypt");
3207 *max_result_len = result_len;
3210 gnutls_aead_cipher_deinit(ctx);
3211 return ret == 1 ? 1 : 0;
3219 gnutls_hmac_hd_t ctx;
3222 gnutls_mac_algorithm_t mac_algo;
3228 if ((mac_algo = get_hmac_alg(hmac_alg)) == 0) {
3229 coap_log_debug(
"coap_crypto_hmac: algorithm %d not supported\n", hmac_alg);
3232 len = gnutls_hmac_get_len(mac_algo);
3239 G_CHECK(gnutls_hmac_init(&ctx, mac_algo, key->
s, key->
length),
3240 "gnutls_hmac_init");
3241 G_CHECK(gnutls_hmac(ctx, data->
s, data->
length),
"gnutls_hmac");
3242 gnutls_hmac_output(ctx,
dummy->s);
3248 gnutls_hmac_deinit(ctx, NULL);
3249 return ret == 1 ? 1 : 0;
3260#pragma GCC diagnostic ignored "-Wunused-function"
const char * coap_socket_strerror(void)
#define COAP_RXBUFFER_SIZE
Library specific build wrapper for coap_internal.h.
int coap_dtls_context_set_pki(coap_context_t *ctx COAP_UNUSED, const coap_dtls_pki_t *setup_data COAP_UNUSED, const coap_dtls_role_t role COAP_UNUSED)
coap_tick_t coap_dtls_get_timeout(coap_session_t *session COAP_UNUSED, coap_tick_t now COAP_UNUSED)
ssize_t coap_tls_read(coap_session_t *session COAP_UNUSED, uint8_t *data COAP_UNUSED, size_t data_len COAP_UNUSED)
coap_tick_t coap_dtls_get_context_timeout(void *dtls_context COAP_UNUSED)
int coap_dtls_receive(coap_session_t *session COAP_UNUSED, const uint8_t *data COAP_UNUSED, size_t data_len COAP_UNUSED)
void * coap_dtls_get_tls(const coap_session_t *c_session COAP_UNUSED, coap_tls_library_t *tls_lib)
unsigned int coap_dtls_get_overhead(coap_session_t *session COAP_UNUSED)
static coap_log_t dtls_log_level
int coap_dtls_context_check_keys_enabled(coap_context_t *ctx COAP_UNUSED)
ssize_t coap_dtls_send(coap_session_t *session COAP_UNUSED, const uint8_t *data COAP_UNUSED, size_t data_len COAP_UNUSED)
ssize_t coap_tls_write(coap_session_t *session COAP_UNUSED, const uint8_t *data COAP_UNUSED, size_t data_len COAP_UNUSED)
void coap_dtls_session_update_mtu(coap_session_t *session COAP_UNUSED)
int coap_dtls_context_set_pki_root_cas(coap_context_t *ctx COAP_UNUSED, const char *ca_file COAP_UNUSED, const char *ca_path COAP_UNUSED)
int coap_dtls_handle_timeout(coap_session_t *session COAP_UNUSED)
void coap_dtls_free_context(void *handle COAP_UNUSED)
void coap_dtls_free_session(coap_session_t *coap_session COAP_UNUSED)
void * coap_dtls_new_context(coap_context_t *coap_context COAP_UNUSED)
void coap_tls_free_session(coap_session_t *coap_session COAP_UNUSED)
coap_binary_t * get_asn1_spki(const uint8_t *data, size_t size)
Abstract SPKI public key from the ASN1.
void coap_digest_free(coap_digest_ctx_t *digest_ctx)
Free off coap_digest_ctx_t.
int coap_digest_final(coap_digest_ctx_t *digest_ctx, coap_digest_t *digest_buffer)
Finalize the coap_digest information into the provided digest_buffer.
int coap_digest_update(coap_digest_ctx_t *digest_ctx, const uint8_t *data, size_t data_len)
Update the coap_digest information with the next chunk of data.
coap_digest_ctx_t * coap_digest_setup(void)
Initialize a coap_digest.
uint64_t coap_tick_t
This data type represents internal timer ticks with COAP_TICKS_PER_SECOND resolution.
int coap_handle_event_lkd(coap_context_t *context, coap_event_t event, coap_session_t *session)
Invokes the event handler of context for the given event and data.
int coap_handle_dgram(coap_context_t *ctx, coap_session_t *session, uint8_t *msg, size_t msg_len)
Parses and interprets a CoAP datagram with context ctx.
int coap_crypto_hmac(cose_hmac_alg_t hmac_alg, coap_bin_const_t *key, coap_bin_const_t *data, coap_bin_const_t **hmac)
Create a HMAC hash of the provided data.
int coap_crypto_aead_decrypt(const coap_crypto_param_t *params, coap_bin_const_t *data, coap_bin_const_t *aad, uint8_t *result, size_t *max_result_len)
Decrypt the provided encrypted data into plaintext.
int coap_crypto_aead_encrypt(const coap_crypto_param_t *params, coap_bin_const_t *data, coap_bin_const_t *aad, uint8_t *result, size_t *max_result_len)
Encrypt the provided plaintext data.
int coap_crypto_hash(cose_alg_t alg, const coap_bin_const_t *data, coap_bin_const_t **hash)
Create a hash of the provided data.
int coap_crypto_check_hkdf_alg(cose_hkdf_alg_t hkdf_alg)
Check whether the defined hkdf algorithm is supported by the underlying crypto library.
int coap_crypto_check_cipher_alg(cose_alg_t alg)
Check whether the defined cipher algorithm is supported by the underlying crypto library.
void * coap_tls_new_server_session(coap_session_t *coap_session)
Create a TLS new server-side session.
const coap_bin_const_t * coap_get_session_client_psk_identity(const coap_session_t *session)
Get the current client's PSK identity.
void coap_dtls_startup(void)
Initialize the underlying (D)TLS Library layer.
int coap_dtls_define_issue(coap_define_issue_key_t type, coap_define_issue_fail_t fail, coap_dtls_key_t *key, const coap_dtls_role_t role, int ret)
Report PKI DEFINE type issue.
void * coap_dtls_new_client_session(coap_session_t *coap_session)
Create a new client-side session.
void * coap_dtls_new_server_session(coap_session_t *coap_session)
Create a new DTLS server-side session.
int coap_dtls_hello(coap_session_t *coap_session, const uint8_t *data, size_t data_len)
Handling client HELLO messages from a new candiate peer.
int coap_dtls_is_context_timeout(void)
Check if timeout is handled per CoAP session or per CoAP context.
int coap_dtls_context_set_cpsk(coap_context_t *coap_context, coap_dtls_cpsk_t *setup_data)
Set the DTLS context's default client PSK information.
int coap_dtls_context_set_spsk(coap_context_t *coap_context, coap_dtls_spsk_t *setup_data)
Set the DTLS context's default server PSK information.
void coap_dtls_shutdown(void)
Close down the underlying (D)TLS Library layer.
const coap_bin_const_t * coap_get_session_client_psk_key(const coap_session_t *coap_session)
Get the current client's PSK key.
void * coap_tls_new_client_session(coap_session_t *coap_session)
Create a new TLS client-side session.
#define COAP_DTLS_RETRANSMIT_COAP_TICKS
void coap_dtls_map_key_type_to_define(const coap_dtls_pki_t *setup_data, coap_dtls_key_t *key)
Map the PKI key definitions to the new DEFINE format.
const coap_bin_const_t * coap_get_session_server_psk_key(const coap_session_t *coap_session)
Get the current server's PSK key.
@ COAP_DEFINE_KEY_PRIVATE
@ COAP_DEFINE_FAIL_NOT_SUPPORTED
#define COAP_DTLS_HINT_LENGTH
coap_tls_version_t * coap_get_tls_library_version(void)
Determine the type and version of the underlying (D)TLS library.
int coap_dtls_psk_is_supported(void)
Check whether (D)TLS PSK is available.
int coap_tls_is_supported(void)
Check whether TLS is available.
#define COAP_DTLS_RPK_CERT_CN
int coap_dtls_is_supported(void)
Check whether DTLS is available.
int coap_dtls_pki_is_supported(void)
Check whether (D)TLS PKI is available.
int coap_dtls_rpk_is_supported(void)
Check whether (D)TLS RPK is available.
int coap_dtls_pkcs11_is_supported(void)
Check whether (D)TLS PKCS11 is available.
@ COAP_PKI_KEY_DEF_PKCS11
The PKI key type is PKCS11 (pkcs11:...).
@ COAP_PKI_KEY_DEF_DER_BUF
The PKI key type is DER buffer (ASN.1).
@ COAP_PKI_KEY_DEF_PEM_BUF
The PKI key type is PEM buffer.
@ COAP_PKI_KEY_DEF_PEM
The PKI key type is PEM file.
@ COAP_PKI_KEY_DEF_ENGINE
The PKI key type is to be passed to ENGINE.
@ COAP_PKI_KEY_DEF_RPK_BUF
The PKI key type is RPK in buffer.
@ COAP_PKI_KEY_DEF_DER
The PKI key type is DER file.
@ COAP_PKI_KEY_DEF_PKCS11_RPK
The PKI key type is PKCS11 w/ RPK (pkcs11:...).
@ COAP_DTLS_ROLE_SERVER
Internal function invoked for server.
@ COAP_DTLS_ROLE_CLIENT
Internal function invoked for client.
@ COAP_PKI_KEY_DEFINE
The individual PKI key types are Definable.
@ COAP_TLS_LIBRARY_GNUTLS
Using GnuTLS library.
@ COAP_EVENT_DTLS_CLOSED
Triggerred when (D)TLS session closed.
@ COAP_EVENT_DTLS_CONNECTED
Triggered when (D)TLS session connected.
@ COAP_EVENT_DTLS_ERROR
Triggered when (D)TLS error occurs.
#define coap_log_debug(...)
coap_log_t coap_dtls_get_log_level(void)
Get the current (D)TLS logging.
#define coap_dtls_log(level,...)
Logging function.
void coap_dtls_set_log_level(coap_log_t level)
Sets the (D)TLS logging level to the specified level.
const char * coap_session_str(const coap_session_t *session)
Get session description.
#define coap_log_info(...)
#define coap_log_warn(...)
#define coap_log_err(...)
int coap_netif_available(coap_session_t *session)
Function interface to check whether netif for session is still available.
int cose_get_hmac_alg_for_hkdf(cose_hkdf_alg_t hkdf_alg, cose_hmac_alg_t *hmac_alg)
@ COSE_HMAC_ALG_HMAC256_256
@ COSE_HMAC_ALG_HMAC512_512
@ COSE_ALGORITHM_SHA_256_256
@ COSE_ALGORITHM_AES_CCM_16_64_128
@ COSE_ALGORITHM_AES_CCM_16_64_256
int coap_oscore_is_supported(void)
Check whether OSCORE is available.
int coap_session_refresh_psk_hint(coap_session_t *session, const coap_bin_const_t *psk_hint)
Refresh the session's current Identity Hint (PSK).
int coap_session_refresh_psk_key(coap_session_t *session, const coap_bin_const_t *psk_key)
Refresh the session's current pre-shared key (PSK).
void coap_session_connected(coap_session_t *session)
Notify session that it has just connected or reconnected.
int coap_session_refresh_psk_identity(coap_session_t *session, const coap_bin_const_t *psk_identity)
Refresh the session's current pre-shared identity (PSK).
void coap_session_disconnected_lkd(coap_session_t *session, coap_nack_reason_t reason)
Notify session that it has failed.
#define COAP_PROTO_NOT_RELIABLE(p)
@ COAP_SESSION_STATE_HANDSHAKE
@ COAP_SESSION_STATE_NONE
coap_binary_t * coap_new_binary(size_t size)
Returns a new binary object with at least size bytes storage allocated.
void coap_delete_binary(coap_binary_t *s)
Deletes the given coap_binary_t object and releases any memory allocated.
CoAP binary data definition with const data.
size_t length
length of binary data
const uint8_t * s
read-only binary data
CoAP binary data definition.
size_t length
length of binary data
The CoAP stack's global state is stored in a coap_context_t object.
coap_dtls_spsk_t spsk_setup_data
Contains the initial PSK server setup data.
The structure that holds the AES Crypto information.
size_t l
The number of bytes in the length field.
const uint8_t * nonce
must be exactly 15 - l bytes
coap_crypto_key_t key
The Key to use.
The common structure that holds the Crypto information.
union coap_crypto_param_t::@2 params
coap_crypto_aes_ccm_t aes
Used if AES type encryption.
cose_alg_t alg
The COSE algorith to use.
The structure that holds the Client PSK information.
coap_bin_const_t identity
The structure used for defining the Client PSK setup data to be used.
void * ih_call_back_arg
Passed in to the Identity Hint callback function.
char * client_sni
If not NULL, SNI to use in client TLS setup.
coap_dtls_ih_callback_t validate_ih_call_back
Identity Hint check callback function.
The structure that holds the PKI key information.
coap_pki_key_define_t define
for definable type keys
union coap_dtls_key_t::@3 key
coap_pki_key_t key_type
key format type
The structure used for defining the PKI setup data to be used.
uint8_t cert_chain_validation
1 if to check cert_chain_verify_depth
uint8_t check_cert_revocation
1 if revocation checks wanted
uint8_t cert_chain_verify_depth
recommended depth is 3
uint8_t verify_peer_cert
Set to COAP_DTLS_PKI_SETUP_VERSION to support this version of the struct.
char * client_sni
If not NULL, SNI to use in client TLS setup.
uint8_t is_rpk_not_cert
1 is RPK instead of Public Certificate.
uint8_t check_common_ca
1 if peer cert is to be signed by the same CA as the local cert
coap_dtls_key_t pki_key
PKI key definition.
The structure that holds the Server Pre-Shared Key and Identity Hint information.
The structure used for defining the Server PSK setup data to be used.
coap_dtls_psk_sni_callback_t validate_sni_call_back
SNI check callback function.
coap_dtls_id_callback_t validate_id_call_back
Identity check callback function.
void * id_call_back_arg
Passed in to the Identity callback function.
void * sni_call_back_arg
Passed in to the SNI callback function.
coap_dtls_spsk_info_t psk_info
Server PSK definition.
coap_layer_write_t l_write
coap_layer_establish_t l_establish
coap_const_char_ptr_t public_cert
define: Public Cert
const char * user_pin
define: User pin to access type PKCS11.
coap_const_char_ptr_t private_key
define: Private Key
coap_const_char_ptr_t ca
define: Common CA Certificate
size_t public_cert_len
define Public Cert length (if needed)
size_t ca_len
define CA Cert length (if needed)
coap_pki_define_t private_key_def
define: Private Key type definition
size_t private_key_len
define Private Key length (if needed)
coap_pki_define_t ca_def
define: Common CA type definition
coap_pki_define_t public_cert_def
define: Public Cert type definition
Abstraction of virtual session that can be attached to coap_context_t (client) or coap_endpoint_t (se...
unsigned int dtls_timeout_count
dtls setup retry counter
coap_endpoint_t * endpoint
session's endpoint
coap_socket_t sock
socket object for the session, if any
coap_session_state_t state
current state of relationship with peer
coap_addr_tuple_t addr_info
remote/local address info
coap_proto_t proto
protocol used
coap_dtls_cpsk_t cpsk_setup_data
client provided PSK initial setup data
size_t mtu
path or CSM mtu (xmt)
int dtls_event
Tracking any (D)TLS events on this session.
void * tls
security parameters
uint16_t max_retransmit
maximum re-transmit count (default 4)
coap_context_t * context
session's context
coap_layer_func_t lfunc[COAP_LAYER_LAST]
Layer functions to use.
CoAP string data definition with const data.
const uint8_t * s
read-only string data
size_t length
length of string
The structure used for returning the underlying (D)TLS library information.
uint64_t built_version
(D)TLS Built against Library Version
coap_tls_library_t type
Library type.
uint64_t version
(D)TLS runtime Library Version
const char * s_byte
signed char ptr
const uint8_t * u_byte
unsigned char ptr