46#include <mbedtls/version.h>
49#if (MBEDTLS_VERSION_NUMBER < 0x03000000)
50#define MBEDTLS_2_X_COMPAT
53#ifndef MBEDTLS_ALLOW_PRIVATE_ACCESS
54#define MBEDTLS_ALLOW_PRIVATE_ACCESS
58#include <mbedtls/platform.h>
59#include <mbedtls/net_sockets.h>
60#include <mbedtls/ssl.h>
61#include <mbedtls/entropy.h>
62#include <mbedtls/ctr_drbg.h>
63#include <mbedtls/error.h>
64#include <mbedtls/timing.h>
65#include <mbedtls/ssl_cookie.h>
66#include <mbedtls/oid.h>
67#include <mbedtls/debug.h>
68#include <mbedtls/sha256.h>
69#if defined(ESPIDF_VERSION) && defined(CONFIG_MBEDTLS_DEBUG)
70#include <mbedtls/esp_debug.h>
74#define mbedtls_malloc(a) malloc(a)
75#define mbedtls_realloc(a,b) realloc(a,b)
76#define mbedtls_strdup(a) strdup(a)
77#define mbedtls_strndup(a,b) strndup(a,b)
79#ifndef MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED
81#ifdef MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED
82#define MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED
86#if ! COAP_SERVER_SUPPORT
87#undef MBEDTLS_SSL_SRV_C
89#if ! COAP_CLIENT_SUPPORT
90#undef MBEDTLS_SSL_CLI_C
94#define strcasecmp _stricmp
97#define IS_PSK (1 << 0)
98#define IS_PKI (1 << 1)
99#define IS_CLIENT (1 << 6)
100#define IS_SERVER (1 << 7)
102typedef struct coap_ssl_t {
113typedef struct coap_mbedtls_env_t {
114 mbedtls_ssl_context ssl;
115 mbedtls_entropy_context entropy;
116 mbedtls_ctr_drbg_context ctr_drbg;
117 mbedtls_ssl_config conf;
118 mbedtls_timing_delay_context timer;
119 mbedtls_x509_crt cacert;
120 mbedtls_x509_crt public_cert;
121 mbedtls_pk_context private_key;
122 mbedtls_ssl_cookie_ctx cookie_ctx;
126 int seen_client_hello;
128 unsigned int retry_scalar;
129 coap_ssl_t coap_ssl_data;
132typedef struct pki_sni_entry {
135 mbedtls_x509_crt cacert;
136 mbedtls_x509_crt public_cert;
137 mbedtls_pk_context private_key;
140typedef struct psk_sni_entry {
145typedef struct coap_mbedtls_context_t {
147 size_t pki_sni_count;
148 pki_sni_entry *pki_sni_entry_list;
149 size_t psk_sni_count;
150 psk_sni_entry *psk_sni_entry_list;
154} coap_mbedtls_context_t;
156typedef enum coap_enc_method_t {
161#ifndef MBEDTLS_2_X_COMPAT
165static int coap_rng(
void *ctx
COAP_UNUSED,
unsigned char *buf,
size_t len)
167 return coap_prng(buf, len) ? 0 : MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED;
171static int coap_dgram_read(
void *ctx,
unsigned char *out,
size_t outl)
177 if (!c_session->
tls) {
179 return MBEDTLS_ERR_SSL_WANT_READ;
181 data = &((coap_mbedtls_env_t *)c_session->
tls)->coap_ssl_data;
184 if (data->pdu_len > 0) {
185 if (outl < data->pdu_len) {
186 memcpy(out, data->pdu, outl);
189 data->pdu_len -= outl;
192 memcpy(out, data->pdu, data->pdu_len);
194 if (!data->peekmode) {
201 ret = MBEDTLS_ERR_SSL_WANT_READ;
215coap_dgram_write(
void *ctx,
const unsigned char *send_buffer,
216 size_t send_buffer_length)
222 coap_mbedtls_env_t *m_env = (coap_mbedtls_env_t *)c_session->
tls;
224 if (result != (ssize_t)send_buffer_length) {
226 result, send_buffer_length);
232 m_env->last_timeout = now;
240#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) && defined(MBEDTLS_SSL_SRV_C)
244static int psk_server_callback(
void *p_info, mbedtls_ssl_context *ssl,
245 const unsigned char *identity,
size_t identity_len )
249 coap_mbedtls_env_t *m_env;
253 if (c_session == NULL)
257 lidentity.
s = identity ? (
const uint8_t*)identity : (
const uint8_t*)
"";
258 lidentity.
length = identity ? identity_len : 0;
262 (
int)lidentity.
length, (
const char *)lidentity.
s);
264 m_env = (coap_mbedtls_env_t *)c_session->
tls;
280 mbedtls_ssl_set_hs_psk(ssl, psk_key->
s, psk_key->
length);
281 m_env->seen_client_hello = 1;
287get_san_or_cn_from_cert(mbedtls_x509_crt *crt)
290 const mbedtls_asn1_named_data * cn_data;
292 if (crt->ext_types & MBEDTLS_X509_EXT_SUBJECT_ALT_NAME) {
293 mbedtls_asn1_sequence *seq = &crt->subject_alt_names;
294 while (seq && seq->buf.p == NULL) {
299 return mbedtls_strndup((
const char *)seq->buf.p,
304 cn_data = mbedtls_asn1_find_named_data(&crt->subject,
306 MBEDTLS_OID_SIZE(MBEDTLS_OID_AT_CN));
309 return mbedtls_strndup((
const char *)cn_data->val.p,
317get_error_string(
int ret) {
318 static char buf[128] = {0};
319 mbedtls_strerror(ret, buf,
sizeof(buf)-1);
324self_signed_cert_verify_callback_mbedtls(
void *data,
330 const coap_mbedtls_context_t *m_context =
334 if (*flags & MBEDTLS_X509_BADCERT_EXPIRED) {
335 if (setup_data->allow_expired_certs) {
336 *flags &= ~MBEDTLS_X509_BADCERT_EXPIRED;
347cert_verify_callback_mbedtls(
void *data, mbedtls_x509_crt *crt,
348 int depth, uint32_t *flags)
351 coap_mbedtls_context_t *m_context =
359 cn = get_san_or_cn_from_cert(crt);
361 if (*flags & MBEDTLS_X509_BADCERT_EXPIRED) {
362 if (setup_data->allow_expired_certs) {
363 *flags &= ~MBEDTLS_X509_BADCERT_EXPIRED;
365 " %s: %s: overridden: '%s' depth %d\n",
367 "The certificate has expired", cn ? cn :
"?", depth);
370 if (*flags & MBEDTLS_X509_BADCERT_FUTURE) {
371 if (setup_data->allow_expired_certs) {
372 *flags &= ~MBEDTLS_X509_BADCERT_FUTURE;
374 " %s: %s: overridden: '%s' depth %d\n",
376 "The certificate has a future date", cn ? cn :
"?", depth);
379 if (*flags & MBEDTLS_X509_BADCERT_BAD_MD) {
380 if (setup_data->allow_bad_md_hash) {
381 *flags &= ~MBEDTLS_X509_BADCERT_BAD_MD;
383 " %s: %s: overridden: '%s' depth %d\n",
385 "The certificate has a bad MD hash", cn ? cn :
"?", depth);
388 if (*flags & MBEDTLS_X509_BADCERT_BAD_KEY) {
389 if (setup_data->allow_short_rsa_length) {
390 *flags &= ~MBEDTLS_X509_BADCERT_BAD_KEY;
392 " %s: %s: overridden: '%s' depth %d\n",
394 "The certificate has a short RSA length", cn ? cn :
"?", depth);
397 if (*flags & MBEDTLS_X509_BADCERT_NOT_TRUSTED) {
399 int self_signed = !mbedtls_x509_crt_verify(crt, crt, NULL, NULL, &lflags,
400 self_signed_cert_verify_callback_mbedtls,
402 if (self_signed && depth == 0) {
403 if (setup_data->allow_self_signed &&
404 !setup_data->check_common_ca) {
405 *flags &= ~MBEDTLS_X509_BADCERT_NOT_TRUSTED;
407 " %s: %s: overridden: '%s' depth %d\n",
410 cn ? cn :
"?", depth);
414 if (!setup_data->verify_peer_cert) {
415 *flags &= ~MBEDTLS_X509_BADCERT_NOT_TRUSTED;
417 " %s: %s: overridden: '%s' depth %d\n",
419 "The certificate's CA does not match", cn ? cn :
"?", depth);
423 if (*flags & MBEDTLS_X509_BADCRL_EXPIRED) {
424 if (setup_data->check_cert_revocation && setup_data->allow_expired_crl) {
425 *flags &= ~MBEDTLS_X509_BADCRL_EXPIRED;
427 " %s: %s: overridden: '%s' depth %d\n",
429 "The certificate's CRL has expired", cn ? cn :
"?", depth);
431 else if (!setup_data->check_cert_revocation) {
432 *flags &= ~MBEDTLS_X509_BADCRL_EXPIRED;
435 if (*flags & MBEDTLS_X509_BADCRL_FUTURE) {
436 if (setup_data->check_cert_revocation && setup_data->allow_expired_crl) {
437 *flags &= ~MBEDTLS_X509_BADCRL_FUTURE;
439 " %s: %s: overridden: '%s' depth %d\n",
441 "The certificate's CRL has a future date", cn ? cn :
"?", depth);
443 else if (!setup_data->check_cert_revocation) {
444 *flags &= ~MBEDTLS_X509_BADCRL_FUTURE;
447 if (setup_data->cert_chain_validation &&
448 depth > (setup_data->cert_chain_verify_depth + 1)) {
449 *flags |= MBEDTLS_X509_BADCERT_OTHER;
451 " %s: %s: '%s' depth %d\n",
453 "The certificate's verify depth is too long",
454 cn ? cn :
"?", depth);
457 if (*flags & MBEDTLS_X509_BADCERT_CN_MISMATCH) {
458 *flags &= ~MBEDTLS_X509_BADCERT_CN_MISMATCH;
460 if (setup_data->validate_cn_call_back) {
461 if (!setup_data->validate_cn_call_back(cn,
467 setup_data->cn_call_back_arg)) {
468 *flags |= MBEDTLS_X509_BADCERT_CN_MISMATCH;
474 int ret = mbedtls_x509_crt_verify_info(buf,
sizeof(buf),
"", *flags);
477 tcp = strchr(buf,
'\n');
481 " %s: %s: issue 0x%x: '%s' depth %d\n",
483 buf, *flags, cn ? cn :
"?", depth);
484 tcp = strchr(tcp+1,
'\n');
488 coap_log(
LOG_ERR,
"mbedtls_x509_crt_verify_info returned -0x%x: '%s'\n",
489 -ret, get_error_string(ret));
500setup_pki_credentials(mbedtls_x509_crt *cacert,
501 mbedtls_x509_crt *public_cert,
502 mbedtls_pk_context *private_key,
503 coap_mbedtls_env_t *m_env,
504 coap_mbedtls_context_t *m_context,
513 "RPK Support not available in Mbed TLS\n");
523 mbedtls_x509_crt_init(public_cert);
524 mbedtls_pk_init(private_key);
526 ret = mbedtls_x509_crt_parse_file(public_cert,
529 coap_log(
LOG_ERR,
"mbedtls_x509_crt_parse_file returned -0x%x: '%s'\n",
530 -ret, get_error_string(ret));
534#ifdef MBEDTLS_2_X_COMPAT
535 ret = mbedtls_pk_parse_keyfile(private_key,
538 ret = mbedtls_pk_parse_keyfile(private_key,
540 NULL, coap_rng, (
void *)&m_env->ctr_drbg);
544 -ret, get_error_string(ret));
548 ret = mbedtls_ssl_conf_own_cert(&m_env->conf, public_cert, private_key);
551 -ret, get_error_string(ret));
557 "***setup_pki: (D)TLS: No Server Certificate + Private "
564 mbedtls_x509_crt_init(cacert);
565 ret = mbedtls_x509_crt_parse_file(cacert,
569 -ret, get_error_string(ret));
572 mbedtls_ssl_conf_ca_chain(&m_env->conf, cacert, NULL);
583 mbedtls_x509_crt_init(public_cert);
584 mbedtls_pk_init(private_key);
589 buffer = mbedtls_malloc(length + 1);
592 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
595 buffer[length] =
'\000';
597 ret = mbedtls_x509_crt_parse(public_cert, buffer, length);
598 mbedtls_free(buffer);
601 ret = mbedtls_x509_crt_parse(public_cert,
607 -ret, get_error_string(ret));
614 buffer = mbedtls_malloc(length + 1);
617 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
620 buffer[length] =
'\000';
622#ifdef MBEDTLS_2_X_COMPAT
623 ret = mbedtls_pk_parse_key(private_key, buffer, length, NULL, 0);
625 ret = mbedtls_pk_parse_key(private_key, buffer, length,
626 NULL, 0, coap_rng, (
void *)&m_env->ctr_drbg);
628 mbedtls_free(buffer);
631#ifdef MBEDTLS_2_X_COMPAT
632 ret = mbedtls_pk_parse_key(private_key,
636 ret = mbedtls_pk_parse_key(private_key,
639 NULL, 0, coap_rng, (
void *)&m_env->ctr_drbg);
644 -ret, get_error_string(ret));
648 ret = mbedtls_ssl_conf_own_cert(&m_env->conf, public_cert, private_key);
651 -ret, get_error_string(ret));
656 "***setup_pki: (D)TLS: No Server Certificate + Private "
666 mbedtls_x509_crt_init(cacert);
670 buffer = mbedtls_malloc(length + 1);
673 return MBEDTLS_ERR_SSL_ALLOC_FAILED;
676 buffer[length] =
'\000';
678 ret = mbedtls_x509_crt_parse(cacert, buffer, length);
679 mbedtls_free(buffer);
682 ret = mbedtls_x509_crt_parse(cacert,
688 -ret, get_error_string(ret));
691 mbedtls_ssl_conf_ca_chain(&m_env->conf, cacert, NULL);
700 mbedtls_x509_crt_init(public_cert);
701 mbedtls_pk_init(private_key);
702 ret = mbedtls_x509_crt_parse(public_cert,
707 -ret, get_error_string(ret));
711#ifdef MBEDTLS_2_X_COMPAT
712 ret = mbedtls_pk_parse_key(private_key,
716 ret = mbedtls_pk_parse_key(private_key,
719 (
void *)&m_env->ctr_drbg);
723 -ret, get_error_string(ret));
727 ret = mbedtls_ssl_conf_own_cert(&m_env->conf, public_cert, private_key);
730 -ret, get_error_string(ret));
735 "***setup_pki: (D)TLS: No Server Certificate + Private "
742 mbedtls_x509_crt_init(cacert);
743 ret = mbedtls_x509_crt_parse(cacert,
748 -ret, get_error_string(ret));
751 mbedtls_ssl_conf_ca_chain(&m_env->conf, cacert, NULL);
757 "***setup_pki: (D)TLS: PKCS11 not currently supported\n");
762 "***setup_pki: (D)TLS: Unknown key type %d\n",
767 if (m_context->root_ca_file) {
768 ret = mbedtls_x509_crt_parse_file(cacert, m_context->root_ca_file);
771 -ret, get_error_string(ret));
774 mbedtls_ssl_conf_ca_chain(&m_env->conf, cacert, NULL);
776 if (m_context->root_ca_path) {
777 ret = mbedtls_x509_crt_parse_file(cacert, m_context->root_ca_path);
780 -ret, get_error_string(ret));
783 mbedtls_ssl_conf_ca_chain(&m_env->conf, cacert, NULL);
786#if defined(MBEDTLS_SSL_SRV_C)
787 mbedtls_ssl_conf_cert_req_ca_list(&m_env->conf,
789 MBEDTLS_SSL_CERT_REQ_CA_LIST_ENABLED :
790 MBEDTLS_SSL_CERT_REQ_CA_LIST_DISABLED);
793 MBEDTLS_SSL_VERIFY_REQUIRED :
794 MBEDTLS_SSL_VERIFY_NONE);
799 mbedtls_ssl_conf_verify(&m_env->conf,
800 cert_verify_callback_mbedtls, c_session);
805#if defined(MBEDTLS_SSL_SRV_C)
810pki_sni_callback(
void *p_info, mbedtls_ssl_context *ssl,
811 const unsigned char *uname,
size_t name_len)
816 coap_mbedtls_env_t *m_env = (coap_mbedtls_env_t *)c_session->
tls;
817 coap_mbedtls_context_t *m_context =
822 name = mbedtls_malloc(name_len+1);
826 memcpy(name, uname, name_len);
827 name[name_len] =
'\000';
830 for (i = 0; i < m_context->pki_sni_count; i++) {
831 if (strcasecmp(name, m_context->pki_sni_entry_list[i].sni) == 0) {
835 if (i == m_context->pki_sni_count) {
840 pki_sni_entry *pki_sni_entry_list;
843 m_context->setup_data.validate_sni_call_back(name,
844 m_context->setup_data.sni_call_back_arg);
850 pki_sni_entry_list = mbedtls_realloc(m_context->pki_sni_entry_list,
851 (i+1)*
sizeof(pki_sni_entry));
853 if (pki_sni_entry_list == NULL) {
857 m_context->pki_sni_entry_list = pki_sni_entry_list;
858 memset(&m_context->pki_sni_entry_list[i], 0,
859 sizeof(m_context->pki_sni_entry_list[i]));
860 m_context->pki_sni_entry_list[i].sni = name;
861 m_context->pki_sni_entry_list[i].pki_key = *new_entry;
862 sni_setup_data = m_context->setup_data;
863 sni_setup_data.
pki_key = *new_entry;
864 if ((ret = setup_pki_credentials(&m_context->pki_sni_entry_list[i].cacert,
865 &m_context->pki_sni_entry_list[i].public_cert,
866 &m_context->pki_sni_entry_list[i].private_key,
875 m_context->pki_sni_count++;
881 mbedtls_ssl_set_hs_ca_chain(ssl, &m_context->pki_sni_entry_list[i].cacert,
883 return mbedtls_ssl_set_hs_own_cert(ssl,
884 &m_context->pki_sni_entry_list[i].public_cert,
885 &m_context->pki_sni_entry_list[i].private_key);
888#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
893psk_sni_callback(
void *p_info, mbedtls_ssl_context *ssl,
894 const unsigned char *uname,
size_t name_len)
898 coap_mbedtls_context_t *m_context =
902 name = mbedtls_malloc(name_len+1);
906 memcpy(name, uname, name_len);
907 name[name_len] =
'\000';
910 for (i = 0; i < m_context->psk_sni_count; i++) {
911 if (strcasecmp(name, m_context->psk_sni_entry_list[i].sni) == 0) {
915 if (i == m_context->psk_sni_count) {
920 psk_sni_entry *psk_sni_entry_list;
931 psk_sni_entry_list = mbedtls_realloc(m_context->psk_sni_entry_list,
932 (i+1)*
sizeof(psk_sni_entry));
934 if (psk_sni_entry_list == NULL) {
938 m_context->psk_sni_entry_list = psk_sni_entry_list;
939 m_context->psk_sni_entry_list[i].sni = name;
940 m_context->psk_sni_entry_list[i].psk_info = *new_entry;
942 m_context->psk_sni_count++;
949 &m_context->psk_sni_entry_list[i].psk_info.hint);
951 &m_context->psk_sni_entry_list[i].psk_info.key);
952 return mbedtls_ssl_set_hs_psk(ssl,
953 m_context->psk_sni_entry_list[i].psk_info.key.s,
954 m_context->psk_sni_entry_list[i].psk_info.key.length);
959 coap_mbedtls_env_t *m_env)
961 coap_mbedtls_context_t *m_context =
964 m_context->psk_pki_enabled |= IS_SERVER;
966 mbedtls_ssl_cookie_init(&m_env->cookie_ctx);
967 if ((ret = mbedtls_ssl_config_defaults(&m_env->conf,
968 MBEDTLS_SSL_IS_SERVER,
970 MBEDTLS_SSL_TRANSPORT_DATAGRAM :
971 MBEDTLS_SSL_TRANSPORT_STREAM,
972 MBEDTLS_SSL_PRESET_DEFAULT)) != 0) {
973 coap_log(
LOG_ERR,
"mbedtls_ssl_config_defaults returned -0x%x: '%s'\n",
974 -ret, get_error_string(ret));
978 mbedtls_ssl_conf_rng(&m_env->conf, mbedtls_ctr_drbg_random, &m_env->ctr_drbg);
980#if defined(MBEDTLS_SSL_PROTO_DTLS)
981 mbedtls_ssl_conf_handshake_timeout(&m_env->conf, COAP_DTLS_RETRANSMIT_MS,
982 COAP_DTLS_RETRANSMIT_TOTAL_MS);
985 if (m_context->psk_pki_enabled & IS_PSK) {
986#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
987 mbedtls_ssl_conf_psk_cb(&m_env->conf, psk_server_callback, c_session);
989 mbedtls_ssl_conf_sni(&m_env->conf, psk_sni_callback, c_session);
996 if (m_context->psk_pki_enabled & IS_PKI) {
997 ret = setup_pki_credentials(&m_env->cacert, &m_env->public_cert,
998 &m_env->private_key, m_env, m_context,
999 c_session, &m_context->setup_data,
1005 if (m_context->setup_data.validate_sni_call_back) {
1006 mbedtls_ssl_conf_sni(&m_env->conf, pki_sni_callback, c_session);
1010 if ((ret = mbedtls_ssl_cookie_setup(&m_env->cookie_ctx,
1011 mbedtls_ctr_drbg_random,
1012 &m_env->ctr_drbg)) != 0) {
1014 -ret, get_error_string(ret));
1018#if defined(MBEDTLS_SSL_PROTO_DTLS)
1019 mbedtls_ssl_conf_dtls_cookies(&m_env->conf, mbedtls_ssl_cookie_write,
1020 mbedtls_ssl_cookie_check,
1021 &m_env->cookie_ctx );
1022#if MBEDTLS_VERSION_NUMBER >= 0x02100100
1023 mbedtls_ssl_set_mtu(&m_env->ssl, (uint16_t)c_session->
mtu);
1031#if COAP_CLIENT_SUPPORT
1032static int *psk_ciphers = NULL;
1033static int *pki_ciphers = NULL;
1034static int processed_ciphers = 0;
1037set_ciphersuites(mbedtls_ssl_config *conf, coap_enc_method_t method)
1039 if (!processed_ciphers) {
1040 const int *list = mbedtls_ssl_list_ciphersuites();
1041 const int *base = list;
1048 const mbedtls_ssl_ciphersuite_t *cur =
1049 mbedtls_ssl_ciphersuite_from_id(*list);
1052 if (cur->max_minor_ver < MBEDTLS_SSL_MINOR_VERSION_3) {
1055#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
1056 else if (mbedtls_ssl_ciphersuite_uses_psk(cur)) {
1068 psk_ciphers = mbedtls_malloc(psk_count *
sizeof(psk_ciphers[0]));
1069 if (psk_ciphers == NULL) {
1070 coap_log(
LOG_ERR,
"set_ciphers: mbedtls_malloc with count %d failed\n", psk_count);
1073 pki_ciphers = mbedtls_malloc(pki_count *
sizeof(pki_ciphers[0]));
1074 if (pki_ciphers == NULL) {
1075 coap_log(
LOG_ERR,
"set_ciphers: mbedtls_malloc with count %d failed\n", pki_count);
1076 mbedtls_free(psk_ciphers);
1081 psk_list = psk_ciphers;
1082 pki_list = pki_ciphers;
1085 const mbedtls_ssl_ciphersuite_t *cur =
1086 mbedtls_ssl_ciphersuite_from_id(*list);
1088 if (cur->max_minor_ver < MBEDTLS_SSL_MINOR_VERSION_3) {
1091#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
1092 else if (mbedtls_ssl_ciphersuite_uses_psk(cur)) {
1107 processed_ciphers = 1;
1109 mbedtls_ssl_conf_ciphersuites(conf, method == COAP_ENC_PSK ? psk_ciphers : pki_ciphers);
1113 coap_mbedtls_env_t *m_env)
1117 coap_mbedtls_context_t *m_context =
1120 m_context->psk_pki_enabled |= IS_CLIENT;
1122 if ((ret = mbedtls_ssl_config_defaults(&m_env->conf,
1123 MBEDTLS_SSL_IS_CLIENT,
1125 MBEDTLS_SSL_TRANSPORT_DATAGRAM :
1126 MBEDTLS_SSL_TRANSPORT_STREAM,
1127 MBEDTLS_SSL_PRESET_DEFAULT)) != 0) {
1128 coap_log(
LOG_ERR,
"mbedtls_ssl_config_defaults returned -0x%x: '%s'\n",
1129 -ret, get_error_string(ret));
1133#if defined(MBEDTLS_SSL_PROTO_DTLS)
1134 mbedtls_ssl_conf_handshake_timeout(&m_env->conf, COAP_DTLS_RETRANSMIT_MS,
1135 COAP_DTLS_RETRANSMIT_TOTAL_MS);
1138 mbedtls_ssl_conf_authmode(&m_env->conf, MBEDTLS_SSL_VERIFY_REQUIRED);
1139 mbedtls_ssl_conf_rng(&m_env->conf, mbedtls_ctr_drbg_random, &m_env->ctr_drbg);
1141 if (m_context->psk_pki_enabled & IS_PSK) {
1142#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
1150 if (psk_key == NULL || psk_identity == NULL) {
1151 ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
1155 if ((ret = mbedtls_ssl_conf_psk(&m_env->conf, psk_key->
s,
1156 psk_key->
length, psk_identity->
s,
1157 psk_identity->
length)) != 0) {
1159 -ret, get_error_string(ret));
1163 if ((ret = mbedtls_ssl_set_hostname(&m_env->ssl,
1166 -ret, get_error_string(ret));
1172 set_ciphersuites(&m_env->conf, COAP_ENC_PSK);
1177 else if ((m_context->psk_pki_enabled & IS_PKI) ||
1178 (m_context->psk_pki_enabled & (IS_PSK | IS_PKI)) == 0) {
1183 mbedtls_ssl_conf_authmode(&m_env->conf, MBEDTLS_SSL_VERIFY_OPTIONAL);
1184 ret = setup_pki_credentials(&m_env->cacert, &m_env->public_cert,
1185 &m_env->private_key, m_env, m_context,
1186 c_session, &m_context->setup_data,
1192#if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_ALPN)
1194 static const char *alpn_list[] = {
"coap", NULL };
1196 ret = mbedtls_ssl_conf_alpn_protocols(&m_env->conf, alpn_list);
1202 if (m_context->setup_data.client_sni) {
1203 mbedtls_ssl_set_hostname(&m_env->ssl, m_context->setup_data.client_sni);
1205#if defined(MBEDTLS_SSL_PROTO_DTLS)
1206#if MBEDTLS_VERSION_NUMBER >= 0x02100100
1207 mbedtls_ssl_set_mtu(&m_env->ssl, (uint16_t)c_session->
mtu);
1210 set_ciphersuites(&m_env->conf, COAP_ENC_PKI);
1219static void mbedtls_cleanup(coap_mbedtls_env_t *m_env)
1225 mbedtls_x509_crt_free(&m_env->cacert);
1226 mbedtls_x509_crt_free(&m_env->public_cert);
1227 mbedtls_pk_free(&m_env->private_key);
1228 mbedtls_entropy_free(&m_env->entropy);
1229 mbedtls_ssl_config_free(&m_env->conf);
1230 mbedtls_ctr_drbg_free(&m_env->ctr_drbg);
1231 mbedtls_ssl_free(&m_env->ssl);
1232 mbedtls_ssl_cookie_free(&m_env->cookie_ctx);
1236coap_dtls_free_mbedtls_env(coap_mbedtls_env_t *m_env) {
1238 if (!m_env->sent_alert)
1239 mbedtls_ssl_close_notify(&m_env->ssl);
1240 mbedtls_cleanup(m_env);
1241 mbedtls_free(m_env);
1246report_mbedtls_alert(
unsigned char alert) {
1248 case MBEDTLS_SSL_ALERT_MSG_BAD_RECORD_MAC:
return ": Bad Record MAC";
1249 case MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE:
return ": Handshake failure";
1250 case MBEDTLS_SSL_ALERT_MSG_NO_CERT:
return ": No Certificate provided";
1251 case MBEDTLS_SSL_ALERT_MSG_BAD_CERT:
return ": Certificate is bad";
1252 case MBEDTLS_SSL_ALERT_MSG_UNKNOWN_CA:
return ": CA is unknown";
1253 case MBEDTLS_SSL_ALERT_MSG_ACCESS_DENIED:
return ": Access was denied";
1254 case MBEDTLS_SSL_ALERT_MSG_DECRYPT_ERROR:
return ": Decrypt error";
1265 coap_mbedtls_env_t *m_env) {
1269 ret = mbedtls_ssl_handshake(&m_env->ssl);
1272 m_env->established = 1;
1277 case MBEDTLS_ERR_SSL_WANT_READ:
1278 case MBEDTLS_ERR_SSL_WANT_WRITE:
1282 case MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED:
1285 case MBEDTLS_ERR_SSL_INVALID_MAC:
1287 case MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE:
1288 alert = MBEDTLS_SSL_ALERT_MSG_NO_CERT;
1290#ifdef MBEDTLS_2_X_COMPAT
1291 case MBEDTLS_ERR_SSL_BAD_HS_CLIENT_HELLO:
1292 case MBEDTLS_ERR_SSL_BAD_HS_SERVER_HELLO:
1293 alert = MBEDTLS_SSL_ALERT_MSG_HANDSHAKE_FAILURE;
1296 case MBEDTLS_ERR_X509_CERT_VERIFY_FAILED:
1298 case MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE:
1299 if (m_env->ssl.in_msg[1] != MBEDTLS_SSL_ALERT_MSG_CLOSE_NOTIFY)
1302 report_mbedtls_alert(m_env->ssl.in_msg[1]));
1304 case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY:
1305 case MBEDTLS_ERR_SSL_CONN_EOF:
1306 case MBEDTLS_ERR_NET_CONN_RESET:
1312 "do_mbedtls_handshake: session establish "
1313 "returned -0x%x: '%s'\n",
1314 -ret, get_error_string(ret));
1321 mbedtls_ssl_send_alert_message(&m_env->ssl,
1322 MBEDTLS_SSL_ALERT_LEVEL_FATAL,
1324 m_env->sent_alert = 1;
1328 "do_mbedtls_handshake: session establish "
1330 get_error_string(ret));
1332 mbedtls_ssl_session_reset(&m_env->ssl);
1337mbedtls_debug_out(
void *ctx
COAP_UNUSED,
int level,
1338 const char *file,
int line,
const char *str) {
1361 coap_log(log_level,
"%s:%04d: %s", file, line, str);
1364#if !COAP_DISABLE_TCP
1371coap_sock_read(
void *ctx,
unsigned char *out,
size_t outl) {
1372 ssize_t ret = MBEDTLS_ERR_SSL_CONN_EOF;
1377 ret = recv(c_session->
sock.
fd, (
char *)out, (
int)outl, 0);
1379 ret = recv(c_session->
sock.
fd, out, outl, 0);
1384 }
else if (ret < 0 && errno != EAGAIN) {
1391 c_session->
sock.
flags &= ~COAP_SOCKET_CAN_READ;
1392 ret = MBEDTLS_ERR_SSL_CONN_EOF;
1396 int lasterror = WSAGetLastError();
1398 if (lasterror == WSAEWOULDBLOCK) {
1399 ret = MBEDTLS_ERR_SSL_WANT_READ;
1401 else if (lasterror == WSAECONNRESET) {
1402 ret = MBEDTLS_ERR_NET_CONN_RESET;
1405 if (errno == EAGAIN) {
1406 ret = MBEDTLS_ERR_SSL_WANT_READ;
1408 else if (errno == EPIPE || errno == ECONNRESET) {
1409 ret = MBEDTLS_ERR_NET_CONN_RESET;
1413 ret = MBEDTLS_ERR_NET_RECV_FAILED;
1415 c_session->
sock.
flags &= ~COAP_SOCKET_CAN_READ;
1417 else if (ret < (ssize_t)outl) {
1418 c_session->
sock.
flags &= ~COAP_SOCKET_CAN_READ;
1430coap_sock_write(
void *context,
const unsigned char *in,
size_t inl) {
1438 }
else if (ret < 0) {
1441 (errno == EPIPE || errno == ECONNRESET)) {
1457 int lasterror = WSAGetLastError();
1459 if (lasterror == WSAEWOULDBLOCK) {
1460 ret = MBEDTLS_ERR_SSL_WANT_WRITE;
1462 else if (lasterror == WSAECONNRESET) {
1463 ret = MBEDTLS_ERR_NET_CONN_RESET;
1466 if (errno == EAGAIN || errno == EINTR) {
1467 ret = MBEDTLS_ERR_SSL_WANT_WRITE;
1469 else if (errno == EPIPE || errno == ECONNRESET) {
1470 ret = MBEDTLS_ERR_NET_CONN_RESET;
1474 ret = MBEDTLS_ERR_NET_SEND_FAILED;
1483 ret = MBEDTLS_ERR_SSL_WANT_WRITE;
1489static coap_mbedtls_env_t *coap_dtls_new_mbedtls_env(
coap_session_t *c_session,
1494 coap_mbedtls_env_t *m_env = (coap_mbedtls_env_t *)c_session->
tls;
1499 m_env = (coap_mbedtls_env_t *)mbedtls_malloc(
sizeof(coap_mbedtls_env_t));
1503 memset(m_env, 0,
sizeof(coap_mbedtls_env_t));
1505 mbedtls_ssl_init(&m_env->ssl);
1506 mbedtls_ctr_drbg_init(&m_env->ctr_drbg);
1507 mbedtls_ssl_config_init(&m_env->conf);
1508 mbedtls_entropy_init(&m_env->entropy);
1510#if defined(ESPIDF_VERSION) && defined(CONFIG_MBEDTLS_DEBUG)
1511 mbedtls_esp_enable_debug_log(&m_env->conf, CONFIG_MBEDTLS_DEBUG_LEVEL);
1513 if ((ret = mbedtls_ctr_drbg_seed(&m_env->ctr_drbg,
1514 mbedtls_entropy_func, &m_env->entropy, NULL, 0)) != 0) {
1516 -ret, get_error_string(ret));
1521#if COAP_CLIENT_SUPPORT
1522 if (setup_client_ssl_session(c_session, m_env) != 0) {
1529#if defined(MBEDTLS_SSL_SRV_C)
1530 if (setup_server_ssl_session(c_session, m_env) != 0) {
1540 mbedtls_ssl_conf_min_version(&m_env->conf, MBEDTLS_SSL_MAJOR_VERSION_3,
1541 MBEDTLS_SSL_MINOR_VERSION_3);
1543 if ((ret = mbedtls_ssl_setup(&m_env->ssl, &m_env->conf)) != 0) {
1547 mbedtls_ssl_set_bio(&m_env->ssl, c_session, coap_dgram_write,
1548 coap_dgram_read, NULL);
1550#if !COAP_DISABLE_TCP
1553 mbedtls_ssl_set_bio(&m_env->ssl, c_session, coap_sock_write,
1554 coap_sock_read, NULL);
1557 mbedtls_ssl_set_timer_cb(&m_env->ssl, &m_env->timer,
1558 mbedtls_timing_set_delay,
1559 mbedtls_timing_get_delay);
1561 mbedtls_ssl_conf_dbg(&m_env->conf, mbedtls_debug_out, stdout);
1566 mbedtls_free(m_env);
1572#if defined(MBEDTLS_SSL_PROTO_DTLS)
1575 static int reported = 0;
1579 "libcoap not compiled for DTLS with Mbed TLS"
1580 " - update Mbed TLS to include DTLS\n");
1588#if !COAP_DISABLE_TCP
1597 coap_mbedtls_context_t *m_context;
1600 m_context = (coap_mbedtls_context_t *)mbedtls_malloc(
sizeof(coap_mbedtls_context_t));
1602 memset(m_context, 0,
sizeof(coap_mbedtls_context_t));
1607#if COAP_SERVER_SUPPORT
1616 coap_mbedtls_context_t *m_context =
1619#if !defined(MBEDTLS_SSL_SRV_C)
1621 " libcoap not compiled for Server Mode for Mbed TLS"
1622 " - update Mbed TLS to include Server Mode\n");
1625 if (!m_context || !setup_data)
1628 m_context->psk_pki_enabled |= IS_PSK;
1633#if COAP_CLIENT_SUPPORT
1642#if !defined(MBEDTLS_SSL_CLI_C)
1644 " libcoap not compiled for Client Mode for Mbed TLS"
1645 " - update Mbed TLS to include Client Mode\n");
1648 coap_mbedtls_context_t *m_context =
1651 if (!m_context || !setup_data)
1656 "CoAP Client with Mbed TLS does not support Identity Hint selection\n");
1658 m_context->psk_pki_enabled |= IS_PSK;
1668 coap_mbedtls_context_t *m_context =
1671 m_context->setup_data = *setup_data;
1672 if (!m_context->setup_data.verify_peer_cert) {
1676 m_context->setup_data.allow_self_signed = 1;
1677 m_context->setup_data.allow_expired_certs = 1;
1678 m_context->setup_data.cert_chain_validation = 1;
1679 m_context->setup_data.cert_chain_verify_depth = 10;
1680 m_context->setup_data.check_cert_revocation = 1;
1681 m_context->setup_data.allow_no_crl = 1;
1682 m_context->setup_data.allow_expired_crl = 1;
1683 m_context->setup_data.allow_bad_md_hash = 1;
1684 m_context->setup_data.allow_short_rsa_length = 1;
1686 m_context->psk_pki_enabled |= IS_PKI;
1691 const char *ca_file,
1692 const char *ca_path)
1694 coap_mbedtls_context_t *m_context =
1699 "coap_context_set_pki_root_cas: (D)TLS environment "
1704 if (ca_file == NULL && ca_path == NULL) {
1706 "coap_context_set_pki_root_cas: ca_file and/or ca_path "
1710 if (m_context->root_ca_file) {
1711 mbedtls_free(m_context->root_ca_file);
1712 m_context->root_ca_file = NULL;
1716 m_context->root_ca_file = mbedtls_strdup(ca_file);
1719 if (m_context->root_ca_path) {
1720 mbedtls_free(m_context->root_ca_path);
1721 m_context->root_ca_path = NULL;
1725 m_context->root_ca_path = mbedtls_strdup(ca_path);
1732 coap_mbedtls_context_t *m_context =
1734 return m_context->psk_pki_enabled ? 1 : 0;
1739 coap_mbedtls_context_t *m_context = (coap_mbedtls_context_t *)dtls_context;
1742 for (i = 0; i < m_context->pki_sni_count; i++) {
1743 mbedtls_free(m_context->pki_sni_entry_list[i].sni);
1745 mbedtls_x509_crt_free(&m_context->pki_sni_entry_list[i].public_cert);
1747 mbedtls_pk_free(&m_context->pki_sni_entry_list[i].private_key);
1749 mbedtls_x509_crt_free(&m_context->pki_sni_entry_list[i].cacert);
1751 if (m_context->pki_sni_entry_list)
1752 mbedtls_free(m_context->pki_sni_entry_list);
1754 for (i = 0; i < m_context->psk_sni_count; i++) {
1755 mbedtls_free(m_context->psk_sni_entry_list[i].sni);
1757 if (m_context->psk_sni_entry_list)
1758 mbedtls_free(m_context->psk_sni_entry_list);
1760 if (m_context->root_ca_path)
1761 mbedtls_free(m_context->root_ca_path);
1762 if (m_context->root_ca_file)
1763 mbedtls_free(m_context->root_ca_file);
1765 mbedtls_free(m_context);
1768#if COAP_CLIENT_SUPPORT
1771#if !defined(MBEDTLS_SSL_CLI_C)
1774 " libcoap not compiled for Client Mode for Mbed TLS"
1775 " - update Mbed TLS to include Client Mode\n");
1778 coap_mbedtls_env_t *m_env = coap_dtls_new_mbedtls_env(c_session,
1786 m_env->last_timeout = now;
1787 ret = do_mbedtls_handshake(c_session, m_env);
1789 coap_dtls_free_mbedtls_env(m_env);
1798#if COAP_SERVER_SUPPORT
1801#if !defined(MBEDTLS_SSL_SRV_C)
1804 " libcoap not compiled for Server Mode for Mbed TLS"
1805 " - update Mbed TLS to include Server Mode\n");
1808 coap_mbedtls_env_t *m_env =
1809 (coap_mbedtls_env_t *)c_session->
tls;
1811#if defined(MBEDTLS_SSL_PROTO_DTLS)
1812#if MBEDTLS_VERSION_NUMBER >= 0x02100100
1813 mbedtls_ssl_set_mtu(&m_env->ssl, (uint16_t)c_session->
mtu);
1824 if (c_session && c_session->
context && c_session->
tls) {
1825 coap_dtls_free_mbedtls_env(c_session->
tls);
1826 c_session->
tls = NULL;
1834#if defined(MBEDTLS_SSL_PROTO_DTLS)
1835 coap_mbedtls_env_t *m_env =
1836 (coap_mbedtls_env_t *)c_session->
tls;
1838#if MBEDTLS_VERSION_NUMBER >= 0x02100100
1839 mbedtls_ssl_set_mtu(&m_env->ssl, (uint16_t)c_session->
mtu);
1848 const uint8_t *data,
1852 coap_mbedtls_env_t *m_env = (coap_mbedtls_env_t *)c_session->
tls;
1854 assert(m_env != NULL);
1860 if (m_env->established) {
1861 ret = mbedtls_ssl_write(&m_env->ssl, (
const unsigned char*) data, data_len);
1864 case MBEDTLS_ERR_SSL_WANT_READ:
1865 case MBEDTLS_ERR_SSL_WANT_WRITE:
1868 case MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE:
1875 "returned -0x%x: '%s'\n",
1876 -ret, get_error_string(ret));
1885 ret = do_mbedtls_handshake(c_session, m_env);
1918 coap_mbedtls_env_t *m_env = (coap_mbedtls_env_t *)c_session->
tls;
1919 int ret = mbedtls_timing_get_delay(&m_env->timer);
1920 unsigned int scalar = 1 << m_env->retry_scalar;
1930 m_env->last_timeout = now;
1943 m_env->last_timeout = now;
1962 coap_mbedtls_env_t *m_env = (coap_mbedtls_env_t *)c_session->
tls;
1965 m_env->retry_scalar++;
1967 (do_mbedtls_handshake(c_session, m_env) < 0)) {
1981 const uint8_t *data,
1987 coap_mbedtls_env_t *m_env = (coap_mbedtls_env_t *)c_session->
tls;
1988 coap_ssl_t *ssl_data;
1990 assert(m_env != NULL);
1992 ssl_data = &m_env->coap_ssl_data;
1993 if (ssl_data->pdu_len) {
1997 ssl_data->pdu = data;
1998 ssl_data->pdu_len = (unsigned)data_len;
2000 if (m_env->established) {
2001#if COAP_CONSTRAINED_STACK
2002 static coap_mutex_t b_static_mutex = COAP_MUTEX_INITIALIZER;
2008#if COAP_CONSTRAINED_STACK
2009 coap_mutex_lock(&b_static_mutex);
2018 ret = mbedtls_ssl_read(&m_env->ssl, pdu,
sizeof(pdu));
2021#if COAP_CONSTRAINED_STACK
2022 coap_mutex_unlock(&b_static_mutex);
2028 case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY:
2029 case MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE:
2032 case MBEDTLS_ERR_SSL_WANT_READ:
2036 "coap_dtls_receive: "
2037 "returned -0x%x: '%s' (length %zd)\n",
2038 -ret, get_error_string(ret), data_len);
2041#if COAP_CONSTRAINED_STACK
2042 coap_mutex_unlock(&b_static_mutex);
2047 ret = do_mbedtls_handshake(c_session, m_env);
2052 if (ssl_data->pdu_len) {
2054 ret = do_mbedtls_handshake(c_session, m_env);
2077 if (ssl_data && ssl_data->pdu_len) {
2079 coap_log(
LOG_DEBUG,
"coap_dtls_receive: ret %d: remaining data %u\n", ret, ssl_data->pdu_len);
2080 ssl_data->pdu_len = 0;
2081 ssl_data->pdu = NULL;
2086#if COAP_SERVER_SUPPORT
2093 const uint8_t *data,
2096#if !defined(MBEDTLS_SSL_PROTO_DTLS) || !defined(MBEDTLS_SSL_SRV_C)
2101 " libcoap not compiled for DTLS or Server Mode for Mbed TLS"
2102 " - update Mbed TLS to include DTLS and Server Mode\n");
2105 coap_mbedtls_env_t *m_env = (coap_mbedtls_env_t *)c_session->
tls;
2106 coap_ssl_t *ssl_data;
2113 c_session->
tls = m_env;
2121 if((ret = mbedtls_ssl_set_client_transport_id(&m_env->ssl,
2125 "mbedtls_ssl_set_client_transport_id() returned -0x%x: '%s'\n",
2126 -ret, get_error_string(ret));
2130 ssl_data = &m_env->coap_ssl_data;
2131 if (ssl_data->pdu_len) {
2135 ssl_data->pdu = data;
2136 ssl_data->pdu_len = (unsigned)data_len;
2138 ret = do_mbedtls_handshake(c_session, m_env);
2139 if (ret == 0 || m_env->seen_client_hello) {
2145 m_env->seen_client_hello = 0;
2152 if (ssl_data->pdu_len) {
2154 coap_log(
LOG_DEBUG,
"coap_dtls_hello: ret %d: remaining data %u\n", ret, ssl_data->pdu_len);
2155 ssl_data->pdu_len = 0;
2156 ssl_data->pdu = NULL;
2165 coap_mbedtls_env_t *m_env = (coap_mbedtls_env_t *)c_session->
tls;
2166 int expansion = mbedtls_ssl_get_record_expansion(&m_env->ssl);
2168 if (expansion == MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE) {
2174#if !COAP_DISABLE_TCP
2175#if COAP_CLIENT_SUPPORT
2179#if !defined(MBEDTLS_SSL_CLI_C)
2183 " libcoap not compiled for Client Mode for Mbed TLS"
2184 " - update Mbed TLS to include Client Mode\n");
2187 coap_mbedtls_env_t *m_env = coap_dtls_new_mbedtls_env(c_session,
2198 m_env->last_timeout = now;
2199 c_session->
tls = m_env;
2200 ret = do_mbedtls_handshake(c_session, m_env);
2211#if COAP_SERVER_SUPPORT
2215#if !defined(MBEDTLS_SSL_SRV_C)
2218 " libcoap not compiled for Server Mode for Mbed TLS"
2219 " - update Mbed TLS to include Server Mode\n");
2222 coap_mbedtls_env_t *m_env = coap_dtls_new_mbedtls_env(c_session,
2227 c_session->
tls = m_env;
2228 ret = do_mbedtls_handshake(c_session, m_env);
2249 const uint8_t *data,
2254 coap_mbedtls_env_t *m_env = (coap_mbedtls_env_t *)c_session->
tls;
2256 assert(m_env != NULL);
2262 if (m_env->established) {
2263 ret = mbedtls_ssl_write(&m_env->ssl, (
const unsigned char*) data, data_len);
2266 case MBEDTLS_ERR_SSL_WANT_READ:
2267 case MBEDTLS_ERR_SSL_WANT_WRITE:
2270 case MBEDTLS_ERR_NET_CONN_RESET:
2271 case MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE:
2278 "returned -0x%x: '%s'\n",
2279 -ret, get_error_string(ret));
2288 ret = do_mbedtls_handshake(c_session, m_env);
2324 coap_mbedtls_env_t *m_env = (coap_mbedtls_env_t *)c_session->
tls;
2331 if (!m_env->established && !m_env->sent_alert) {
2332 ret = do_mbedtls_handshake(c_session, m_env);
2341 ret = mbedtls_ssl_read(&m_env->ssl, data, data_len);
2345 case MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY:
2349 case MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE:
2351 m_env->sent_alert = 1;
2355 case MBEDTLS_ERR_SSL_WANT_READ:
2362 "returned -0x%x: '%s' (length %zd)\n",
2363 -ret, get_error_string(ret), data_len);
2389#if COAP_CLIENT_SUPPORT
2390 mbedtls_free(psk_ciphers);
2391 mbedtls_free(pki_ciphers);
2394 processed_ciphers = 0;
2403 if (c_session && c_session->
tls) {
2404 coap_mbedtls_env_t *m_env;
2407 memcpy(&m_env, &c_session->
tls,
sizeof(m_env));
2409 return (
void *)&m_env->ssl;
2414static int keep_log_level = 0;
2418#if !defined(ESPIDF_VERSION)
2435 mbedtls_debug_set_threshold(use_level);
2437 keep_log_level = level;
2442 return keep_log_level;
2448 version.
version = mbedtls_version_get_number();
2454#if COAP_SERVER_SUPPORT
2457 mbedtls_sha256_context *digest_ctx = mbedtls_malloc(
sizeof(mbedtls_sha256_context));
2460 mbedtls_sha256_init(digest_ctx);
2461#ifdef MBEDTLS_2_X_COMPAT
2462 if (mbedtls_sha256_starts_ret(digest_ctx, 0) != 0) {
2464 if (mbedtls_sha256_starts(digest_ctx, 0) != 0) {
2474 mbedtls_sha256_free(digest_ctx);
2475 mbedtls_free(digest_ctx);
2480 const uint8_t *data,
2482#ifdef MBEDTLS_2_X_COMPAT
2483 int ret = mbedtls_sha256_update_ret(digest_ctx, data, data_len);
2485 int ret = mbedtls_sha256_update(digest_ctx, data, data_len);
2494#ifdef MBEDTLS_2_X_COMPAT
2495 int ret = mbedtls_sha256_finish_ret(digest_ctx, (uint8_t*)digest_buffer);
2497 int ret = mbedtls_sha256_finish(digest_ctx, (uint8_t*)digest_buffer);
2511#pragma GCC diagnostic ignored "-Wunused-function"
Pulls together all the internal only header files.
const char * coap_socket_strerror(void)
ssize_t coap_socket_write(coap_socket_t *sock, const uint8_t *data, size_t data_len)
#define COAP_RXBUFFER_SIZE
#define COAP_SOCKET_ERROR
int coap_dtls_context_set_pki(coap_context_t *ctx COAP_UNUSED, const coap_dtls_pki_t *setup_data COAP_UNUSED, const coap_dtls_role_t role COAP_UNUSED)
coap_tick_t coap_dtls_get_timeout(coap_session_t *session COAP_UNUSED, coap_tick_t now COAP_UNUSED)
int coap_dtls_send(coap_session_t *session COAP_UNUSED, const uint8_t *data COAP_UNUSED, size_t data_len COAP_UNUSED)
ssize_t coap_tls_read(coap_session_t *session COAP_UNUSED, uint8_t *data COAP_UNUSED, size_t data_len COAP_UNUSED)
coap_tick_t coap_dtls_get_context_timeout(void *dtls_context COAP_UNUSED)
int coap_dtls_receive(coap_session_t *session COAP_UNUSED, const uint8_t *data COAP_UNUSED, size_t data_len COAP_UNUSED)
void * coap_dtls_get_tls(const coap_session_t *c_session COAP_UNUSED, coap_tls_library_t *tls_lib)
unsigned int coap_dtls_get_overhead(coap_session_t *session COAP_UNUSED)
int coap_dtls_context_check_keys_enabled(coap_context_t *ctx COAP_UNUSED)
ssize_t coap_tls_write(coap_session_t *session COAP_UNUSED, const uint8_t *data COAP_UNUSED, size_t data_len COAP_UNUSED)
void coap_dtls_session_update_mtu(coap_session_t *session COAP_UNUSED)
int coap_dtls_context_set_pki_root_cas(coap_context_t *ctx COAP_UNUSED, const char *ca_file COAP_UNUSED, const char *ca_path COAP_UNUSED)
int coap_dtls_handle_timeout(coap_session_t *session COAP_UNUSED)
void coap_dtls_free_context(void *handle COAP_UNUSED)
void coap_dtls_free_session(coap_session_t *coap_session COAP_UNUSED)
void * coap_dtls_new_context(coap_context_t *coap_context COAP_UNUSED)
void coap_tls_free_session(coap_session_t *coap_session COAP_UNUSED)
void coap_digest_free(coap_digest_ctx_t *digest_ctx)
Free off coap_digest_ctx_t.
int coap_digest_final(coap_digest_ctx_t *digest_ctx, coap_digest_t *digest_buffer)
Finalize the coap_digest information into the provided digest_buffer.
int coap_digest_update(coap_digest_ctx_t *digest_ctx, const uint8_t *data, size_t data_len)
Update the coap_digest information with the next chunk of data.
coap_digest_ctx_t * coap_digest_setup(void)
Initialize a coap_digest.
void coap_ticks(coap_tick_t *t)
Sets t to the internal time with COAP_TICKS_PER_SECOND resolution.
uint64_t coap_tick_t
This data type represents internal timer ticks with COAP_TICKS_PER_SECOND resolution.
int coap_prng(void *buf, size_t len)
Fills buf with len random bytes using the default pseudo random number generator.
int coap_handle_dgram(coap_context_t *ctx, coap_session_t *session, uint8_t *msg, size_t msg_len)
Parses and interprets a CoAP datagram with context ctx.
int coap_handle_event(coap_context_t *context, coap_event_t event, coap_session_t *session)
Invokes the event handler of context for the given event and data.
const coap_bin_const_t * coap_get_session_client_psk_identity(const coap_session_t *session)
Get the current client's PSK identity.
void coap_dtls_startup(void)
Initialize the underlying (D)TLS Library layer.
void * coap_dtls_new_client_session(coap_session_t *coap_session)
Create a new client-side session.
void * coap_tls_new_client_session(coap_session_t *coap_session, int *connected)
Create a new TLS client-side session.
void * coap_tls_new_server_session(coap_session_t *coap_session, int *connected)
Create a TLS new server-side session.
void * coap_dtls_new_server_session(coap_session_t *coap_session)
Create a new DTLS server-side session.
int coap_dtls_hello(coap_session_t *coap_session, const uint8_t *data, size_t data_len)
Handling client HELLO messages from a new candiate peer.
int coap_dtls_is_context_timeout(void)
Check if timeout is handled per CoAP session or per CoAP context.
int coap_dtls_context_set_cpsk(coap_context_t *coap_context, coap_dtls_cpsk_t *setup_data)
Set the DTLS context's default client PSK information.
int coap_dtls_context_set_spsk(coap_context_t *coap_context, coap_dtls_spsk_t *setup_data)
Set the DTLS context's default server PSK information.
void coap_dtls_shutdown(void)
Close down the underlying (D)TLS Library layer.
const coap_bin_const_t * coap_get_session_client_psk_key(const coap_session_t *coap_session)
Get the current client's PSK key.
#define COAP_DTLS_RETRANSMIT_COAP_TICKS
const coap_bin_const_t * coap_get_session_server_psk_key(const coap_session_t *coap_session)
Get the current server's PSK key.
coap_tls_version_t * coap_get_tls_library_version(void)
Determine the type and version of the underlying (D)TLS library.
int coap_tls_is_supported(void)
Check whether TLS is available.
int coap_dtls_is_supported(void)
Check whether DTLS is available.
@ COAP_DTLS_ROLE_SERVER
Internal function invoked for server.
@ COAP_DTLS_ROLE_CLIENT
Internal function invoked for client.
@ COAP_PKI_KEY_PKCS11
The PKI key type is PKCS11 (DER)
@ COAP_PKI_KEY_PEM_BUF
The PKI key type is PEM buffer.
@ COAP_PKI_KEY_PEM
The PKI key type is PEM file.
@ COAP_PKI_KEY_ASN1
The PKI key type is ASN.1 (DER) buffer.
@ COAP_TLS_LIBRARY_MBEDTLS
Using Mbed TLS library.
@ COAP_EVENT_DTLS_CLOSED
(D)TLS events for COAP_PROTO_DTLS and COAP_PROTO_TLS
@ COAP_EVENT_DTLS_CONNECTED
void coap_dtls_set_log_level(int level)
Sets the (D)TLS logging level to the specified level.
int coap_dtls_get_log_level(void)
Get the current (D)TLS logging.
const char * coap_session_str(const coap_session_t *session)
Get session description.
#define coap_log(level,...)
Logging function.
coap_proto_t
CoAP protocol types.
int coap_session_refresh_psk_hint(coap_session_t *session, const coap_bin_const_t *psk_hint)
Refresh the session's current Identity Hint (PSK).
void coap_session_send_csm(coap_session_t *session)
Notify session transport has just connected and CSM exchange can now start.
ssize_t coap_session_send(coap_session_t *session, const uint8_t *data, size_t datalen)
Function interface for datagram data transmission.
int coap_session_refresh_psk_key(coap_session_t *session, const coap_bin_const_t *psk_key)
Refresh the session's current pre-shared key (PSK).
void coap_session_connected(coap_session_t *session)
Notify session that it has just connected or reconnected.
int coap_session_refresh_psk_identity(coap_session_t *session, const coap_bin_const_t *psk_identity)
Refresh the session's current pre-shared identity (PSK).
void coap_session_disconnected(coap_session_t *session, coap_nack_reason_t reason)
Notify session that it has failed.
@ COAP_SESSION_STATE_HANDSHAKE
@ COAP_SESSION_STATE_NONE
coap_address_t remote
remote address and port
CoAP binary data definition with const data.
size_t length
length of binary data
const uint8_t * s
read-only binary data
The CoAP stack's global state is stored in a coap_context_t object.
coap_dtls_spsk_t spsk_setup_data
Contains the initial PSK server setup data.
The structure used for defining the Client PSK setup data to be used.
char * client_sni
If not NULL, SNI to use in client TLS setup.
coap_dtls_ih_callback_t validate_ih_call_back
Identity Hint check callback function.
The structure that holds the PKI key information.
coap_pki_key_pem_t pem
for PEM file keys
union coap_dtls_key_t::@2 key
coap_pki_key_pem_buf_t pem_buf
for PEM memory keys
coap_pki_key_t key_type
key format type
coap_pki_key_asn1_t asn1
for ASN.1 (DER) memory keys
The structure used for defining the PKI setup data to be used.
uint8_t verify_peer_cert
Set to COAP_DTLS_PKI_SETUP_VERSION to support this version of the struct.
uint8_t is_rpk_not_cert
1 is RPK instead of Public Certificate.
uint8_t check_common_ca
1 if peer cert is to be signed by the same CA as the local cert
coap_dtls_key_t pki_key
PKI key definition.
The structure that holds the Server Pre-Shared Key and Identity Hint information.
The structure used for defining the Server PSK setup data to be used.
coap_dtls_psk_sni_callback_t validate_sni_call_back
SNI check callback function.
coap_dtls_id_callback_t validate_id_call_back
Identity check callback function.
void * id_call_back_arg
Passed in to the Identity callback function.
void * sni_call_back_arg
Passed in to the SNI callback function.
const uint8_t * private_key
ASN1 (DER) Private Key.
size_t public_cert_len
ASN1 Public Cert length.
size_t private_key_len
ASN1 Private Key length.
const uint8_t * ca_cert
ASN1 (DER) Common CA Cert.
size_t ca_cert_len
ASN1 CA Cert length.
const uint8_t * public_cert
ASN1 (DER) Public Cert, or Public Key if RPK.
size_t ca_cert_len
PEM buffer CA Cert length.
const uint8_t * ca_cert
PEM buffer Common CA Cert.
size_t private_key_len
PEM buffer Private Key length.
const uint8_t * private_key
PEM buffer Private Key If RPK and 'EC PRIVATE KEY' this can be used for both the public_cert and priv...
size_t public_cert_len
PEM buffer Public Cert length.
const uint8_t * public_cert
PEM buffer Public Cert, or Public Key if RPK.
const char * ca_file
File location of Common CA in PEM format.
const char * public_cert
File location of Public Cert.
const char * private_key
File location of Private Key in PEM format.
Abstraction of virtual session that can be attached to coap_context_t (client) or coap_endpoint_t (se...
unsigned int dtls_timeout_count
dtls setup retry counter
coap_socket_t sock
socket object for the session, if any
coap_session_state_t state
current state of relationaship with peer
coap_addr_tuple_t addr_info
key: remote/local address info
coap_proto_t proto
protocol used
coap_dtls_cpsk_t cpsk_setup_data
client provided PSK initial setup data
size_t mtu
path or CSM mtu (xmt)
int dtls_event
Tracking any (D)TLS events on this sesison.
void * tls
security parameters
uint16_t max_retransmit
maximum re-transmit count (default 4)
coap_context_t * context
session's context
coap_socket_flags_t flags
The structure used for returning the underlying (D)TLS library information.
uint64_t built_version
(D)TLS Built against Library Version
coap_tls_library_t type
Library type.
uint64_t version
(D)TLS runtime Library Version