/* * Copyright (c) 2016, The OpenThread Authors. * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. Neither the name of the copyright holder nor the * names of its contributors may be used to endorse or promote products * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. */ #ifndef COAP_SECURE_HPP_ #define COAP_SECURE_HPP_ #include "openthread-core-config.h" #if OPENTHREAD_CONFIG_DTLS_ENABLE #include "coap/coap.hpp" #include "meshcop/dtls.hpp" #include "meshcop/meshcop.hpp" #include /** * @file * This file includes definitions for the secure CoAP agent. */ namespace ot { namespace Coap { class CoapSecure : public CoapBase { public: /** * This function pointer is called once DTLS connection is established. * * @param[in] aConnected TRUE if a connection was established, FALSE otherwise. * @param[in] aContext A pointer to arbitrary context information. * */ typedef void (*ConnectedCallback)(bool aConnected, void *aContext); /** * This constructor initializes the object. * * @param[in] aInstance A reference to the OpenThread instance. * @param[in] aLayerTwoSecurity Specifies whether to use layer two security or not. * */ explicit CoapSecure(Instance &aInstance, bool aLayerTwoSecurity = false); /** * This method starts the secure CoAP agent. * * @param[in] aPort The local UDP port to bind to. * * @retval kErrorNone Successfully started the CoAP agent. * @retval kErrorAlready Already started. * */ Error Start(uint16_t aPort); /** * This method starts the secure CoAP agent, but do not use socket to transmit/receive messages. * * @param[in] aCallback A pointer to a function for sending messages. * @param[in] aContext A pointer to arbitrary context information. * * @retval kErrorNone Successfully started the CoAP agent. * @retval kErrorAlready Already started. * */ Error Start(MeshCoP::Dtls::TransportCallback aCallback, void *aContext); /** * This method sets connected callback of this secure CoAP agent. * * @param[in] aCallback A pointer to a function to get called when connection state changes. * @param[in] aContext A pointer to arbitrary context information. * */ void SetConnectedCallback(ConnectedCallback aCallback, void *aContext) { mConnectedCallback = aCallback; mConnectedContext = aContext; } /** * This method stops the secure CoAP agent. * */ void Stop(void); /** * This method initializes DTLS session with a peer. * * @param[in] aSockAddr A reference to the remote socket address, * @param[in] aCallback A pointer to a function that will be called once DTLS connection is * established. * * @retval kErrorNone Successfully started DTLS connection. * */ Error Connect(const Ip6::SockAddr &aSockAddr, ConnectedCallback aCallback, void *aContext); /** * This method indicates whether or not the DTLS session is active. * * @retval TRUE If DTLS session is active. * @retval FALSE If DTLS session is not active. * */ bool IsConnectionActive(void) const { return mDtls.IsConnectionActive(); } /** * This method indicates whether or not the DTLS session is connected. * * @retval TRUE The DTLS session is connected. * @retval FALSE The DTLS session is not connected. * */ bool IsConnected(void) const { return mDtls.IsConnected(); } /** * This method stops the DTLS connection. * */ void Disconnect(void) { mDtls.Disconnect(); } /** * This method returns a reference to the DTLS object. * * @returns A reference to the DTLS object. * */ MeshCoP::Dtls &GetDtls(void) { return mDtls; } /** * This method gets the UDP port of this agent. * * @returns UDP port number. * */ uint16_t GetUdpPort(void) const { return mDtls.GetUdpPort(); } /** * This method sets the PSK. * * @param[in] aPsk A pointer to the PSK. * @param[in] aPskLength The PSK length. * * @retval kErrorNone Successfully set the PSK. * @retval kErrorInvalidArgs The PSK is invalid. * */ Error SetPsk(const uint8_t *aPsk, uint8_t aPskLength) { return mDtls.SetPsk(aPsk, aPskLength); } /** * This method sets the PSK. * * @param[in] aPskd A Joiner PSKd. * */ void SetPsk(const MeshCoP::JoinerPskd &aPskd); #if OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE #ifdef MBEDTLS_KEY_EXCHANGE_PSK_ENABLED /** * This method sets the Pre-Shared Key (PSK) for DTLS sessions identified by a PSK. * * DTLS mode "TLS with AES 128 CCM 8" for Application CoAPS. * * @param[in] aPsk A pointer to the PSK. * @param[in] aPskLength The PSK char length. * @param[in] aPskIdentity The Identity Name for the PSK. * @param[in] aPskIdLength The PSK Identity Length. * */ void SetPreSharedKey(const uint8_t *aPsk, uint16_t aPskLength, const uint8_t *aPskIdentity, uint16_t aPskIdLength) { mDtls.SetPreSharedKey(aPsk, aPskLength, aPskIdentity, aPskIdLength); } #endif // MBEDTLS_KEY_EXCHANGE_PSK_ENABLED #ifdef MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED /** * This method sets a X509 certificate with corresponding private key for DTLS session. * * DTLS mode "ECDHE ECDSA with AES 128 CCM 8" for Application CoAPS. * * @param[in] aX509Cert A pointer to the PEM formatted X509 PEM certificate. * @param[in] aX509Length The length of certificate. * @param[in] aPrivateKey A pointer to the PEM formatted private key. * @param[in] aPrivateKeyLength The length of the private key. * */ void SetCertificate(const uint8_t *aX509Cert, uint32_t aX509Length, const uint8_t *aPrivateKey, uint32_t aPrivateKeyLength) { mDtls.SetCertificate(aX509Cert, aX509Length, aPrivateKey, aPrivateKeyLength); } /** * This method sets the trusted top level CAs. It is needed for validate the certificate of the peer. * * DTLS mode "ECDHE ECDSA with AES 128 CCM 8" for Application CoAPS. * * @param[in] aX509CaCertificateChain A pointer to the PEM formatted X509 CA chain. * @param[in] aX509CaCertChainLength The length of chain. * */ void SetCaCertificateChain(const uint8_t *aX509CaCertificateChain, uint32_t aX509CaCertChainLength) { mDtls.SetCaCertificateChain(aX509CaCertificateChain, aX509CaCertChainLength); } #endif // MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED #if defined(MBEDTLS_BASE64_C) && defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) /** * This method returns the peer x509 certificate base64 encoded. * * DTLS mode "ECDHE ECDSA with AES 128 CCM 8" for Application CoAPS. * * @param[out] aPeerCert A pointer to the base64 encoded certificate buffer. * @param[out] aCertLength The length of the base64 encoded peer certificate. * @param[in] aCertBufferSize The buffer size of aPeerCert. * * @retval kErrorNone Successfully get the peer certificate. * @retval kErrorNoBufs Can't allocate memory for certificate. * */ Error GetPeerCertificateBase64(unsigned char *aPeerCert, size_t *aCertLength, size_t aCertBufferSize) { return mDtls.GetPeerCertificateBase64(aPeerCert, aCertLength, aCertBufferSize); } #endif // defined(MBEDTLS_BASE64_C) && defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) /** * This method sets the connected callback to indicate, when a Client connect to the CoAP Secure server. * * @param[in] aCallback A pointer to a function that will be called once DTLS connection is established. * @param[in] aContext A pointer to arbitrary context information. * */ void SetClientConnectedCallback(ConnectedCallback aCallback, void *aContext) { mConnectedCallback = aCallback; mConnectedContext = aContext; } /** * This method sets the authentication mode for the CoAP secure connection. It disables or enables the verification * of peer certificate. * * @param[in] aVerifyPeerCertificate true, if the peer certificate should be verified * */ void SetSslAuthMode(bool aVerifyPeerCertificate) { mDtls.SetSslAuthMode(aVerifyPeerCertificate); } #endif // OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE #if OPENTHREAD_CONFIG_COAP_BLOCKWISE_TRANSFER_ENABLE /** * This method sends a CoAP message over secure DTLS connection. * * If a response for a request is expected, respective function and context information should be provided. * If no response is expected, these arguments should be NULL pointers. * If Message Id was not set in the header (equal to 0), this function will assign unique Message Id to the message. * * @param[in] aMessage A reference to the message to send. * @param[in] aHandler A function pointer that shall be called on response reception or time-out. * @param[in] aContext A pointer to arbitrary context information. * @param[in] aTransmitHook A pointer to a hook function for outgoing block-wise transfer. * @param[in] aReceiveHook A pointer to a hook function for incoming block-wise transfer. * * @retval kErrorNone Successfully sent CoAP message. * @retval kErrorNoBufs Failed to allocate retransmission data. * @retval kErrorInvalidState DTLS connection was not initialized. * */ Error SendMessage(Message & aMessage, ResponseHandler aHandler = nullptr, void * aContext = nullptr, otCoapBlockwiseTransmitHook aTransmitHook = nullptr, otCoapBlockwiseReceiveHook aReceiveHook = nullptr); /** * This method sends a CoAP message over secure DTLS connection. * * If a response for a request is expected, respective function and context information should be provided. * If no response is expected, these arguments should be NULL pointers. * If Message Id was not set in the header (equal to 0), this function will assign unique Message Id to the message. * * @param[in] aMessage A reference to the message to send. * @param[in] aMessageInfo A reference to the message info associated with @p aMessage. * @param[in] aHandler A function pointer that shall be called on response reception or time-out. * @param[in] aContext A pointer to arbitrary context information. * @param[in] aTransmitHook A pointer to a hook function for outgoing block-wise transfer. * @param[in] aReceiveHook A pointer to a hook function for incoming block-wise transfer. * * @retval kErrorNone Successfully sent CoAP message. * @retval kErrorNoBufs Failed to allocate retransmission data. * @retval kErrorInvalidState DTLS connection was not initialized. * */ Error SendMessage(Message & aMessage, const Ip6::MessageInfo & aMessageInfo, ResponseHandler aHandler = nullptr, void * aContext = nullptr, otCoapBlockwiseTransmitHook aTransmitHook = nullptr, otCoapBlockwiseReceiveHook aReceiveHook = nullptr); #else // OPENTHREAD_CONFIG_COAP_BLOCKWISE_TRANSFER_ENABLE /** * This method sends a CoAP message over secure DTLS connection. * * If a response for a request is expected, respective function and context information should be provided. * If no response is expected, these arguments should be nullptr pointers. * If Message Id was not set in the header (equal to 0), this function will assign unique Message Id to the message. * * @param[in] aMessage A reference to the message to send. * @param[in] aHandler A function pointer that shall be called on response reception or time-out. * @param[in] aContext A pointer to arbitrary context information. * * @retval kErrorNone Successfully sent CoAP message. * @retval kErrorNoBufs Failed to allocate retransmission data. * @retval kErrorInvalidState DTLS connection was not initialized. * */ Error SendMessage(Message &aMessage, ResponseHandler aHandler = nullptr, void *aContext = nullptr); /** * This method sends a CoAP message over secure DTLS connection. * * If a response for a request is expected, respective function and context information should be provided. * If no response is expected, these arguments should be nullptr pointers. * If Message Id was not set in the header (equal to 0), this function will assign unique Message Id to the message. * * @param[in] aMessage A reference to the message to send. * @param[in] aMessageInfo A reference to the message info associated with @p aMessage. * @param[in] aHandler A function pointer that shall be called on response reception or time-out. * @param[in] aContext A pointer to arbitrary context information. * * @retval kErrorNone Successfully sent CoAP message. * @retval kErrorNoBufs Failed to allocate retransmission data. * @retval kErrorInvalidState DTLS connection was not initialized. * */ Error SendMessage(Message & aMessage, const Ip6::MessageInfo &aMessageInfo, ResponseHandler aHandler = nullptr, void * aContext = nullptr); #endif // OPENTHREAD_CONFIG_COAP_BLOCKWISE_TRANSFER_ENABLE /** * This method is used to pass UDP messages to the secure CoAP server. * * @param[in] aMessage A reference to the received message. * @param[in] aMessageInfo A reference to the message info associated with @p aMessage. * */ void HandleUdpReceive(ot::Message &aMessage, const Ip6::MessageInfo &aMessageInfo) { return mDtls.HandleUdpReceive(aMessage, aMessageInfo); } /** * This method returns the DTLS session's peer address. * * @return DTLS session's message info. * */ const Ip6::MessageInfo &GetMessageInfo(void) const { return mDtls.GetMessageInfo(); } private: static Error Send(CoapBase &aCoapBase, ot::Message &aMessage, const Ip6::MessageInfo &aMessageInfo) { return static_cast(aCoapBase).Send(aMessage, aMessageInfo); } Error Send(ot::Message &aMessage, const Ip6::MessageInfo &aMessageInfo); static void HandleDtlsConnected(void *aContext, bool aConnected); void HandleDtlsConnected(bool aConnected); static void HandleDtlsReceive(void *aContext, uint8_t *aBuf, uint16_t aLength); void HandleDtlsReceive(uint8_t *aBuf, uint16_t aLength); static void HandleTransmit(Tasklet &aTasklet); void HandleTransmit(void); MeshCoP::Dtls mDtls; ConnectedCallback mConnectedCallback; void * mConnectedContext; ot::MessageQueue mTransmitQueue; TaskletContext mTransmitTask; }; } // namespace Coap } // namespace ot #endif // OPENTHREAD_CONFIG_DTLS_ENABLE #endif // COAP_SECURE_HPP_