New initial commit
diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..589e947 --- /dev/null +++ b/.gitignore
@@ -0,0 +1,64 @@ +core +*~ +*.[oa] +*.gz +*.cap +*.pcap +Makefile +autom4te.cache/ +config.h +config.log +config.status +configure +doc/Doxyfile +doc/doxygen.out +doc/html/ +libtinydtls.a +tests/ccm-test +tests/dtls-client +tests/dtls-server +tests/prf-test +tinydtls-0.6.0 +./tinydtls-0.6.0/ +TAGS +*.patch +.gitignore +ecc/testecc +ecc/testfield +*.d +*.hex +*.elf +*.map +obj_* +tinydtls.h +dtls_config.h +*.apple2enh +*.atarixl +*.avr-atmega128rfa1 +*.avr-raven +*.avr-ravenlcd +*.avr-ravenusb +*.avr-rcb +*.avr-zigbit +*.c128 +*.c64 +*.cc2530dk +*.cc2538dk +*.cooja +*.econotag +*.eval-adf7xxxmb4z +*.exp5438 +*.iris +*.mbxxx +*.micaz +*.minimal-net +*.native +*.seedeye +*.sensinode +*.sky +*.stm32test +*.win32 +*.wismote +*.z1 +*.z1sp +.project
diff --git a/ABOUT.md b/ABOUT.md new file mode 100644 index 0000000..894ab36 --- /dev/null +++ b/ABOUT.md
@@ -0,0 +1,60 @@ +# About This Content + +2015-12-18 + +# License + +The Eclipse Foundation makes available all content in this plug-in +("Content"). Unless otherwise indicated below, the Content is provided +to you under the terms and conditions of the Eclipse Public License +Version 1.0 ("EPL") and Eclipse Distribution License Version 1.0 +(“EDL”). A copy of the EPL is available at +http://www.eclipse.org/legal/epl-v10.html and a copy of the EDL is +available at http://www.eclipse.org/org/documents/edl-v10.php. For +purposes of the EPL, "Program" will mean the Content. + +If you did not receive this Content directly from the Eclipse +Foundation, the Content is being redistributed by another party +("Redistributor") and different terms and conditions may apply to your +use of any object code in the Content. Check the Redistributor’s +license that was provided with the Content. If no such license exists, +contact the Redistributor. Unless otherwise indicated below, the terms +and conditions of the EPL and EDL still apply to any source code in +the Content and such source code may be obtained at +http://www.eclipse.org. + +# Third Party Content + +The Content includes items that have been sourced from third parties +as set out below. If you did not receive this Content directly from +the Eclipse Foundation, the following is provided for informational +purposes only, and you should look to the Redistributor’s license for +terms and conditions of use. + +## Uthash 1.9.9 + +[Uthash](https://troydhanson.github.io/uthash/) is an implementation +of hash tables and linked lists for C structures by Troy D. Hanson. +Uthash is licensed under the BSD revised license, see +https://troydhanson.github.io/uthash/license.html, + +## rijndael 3.0 + +The library uses an implementation of the Rijndael algorithm (AES) +from [OpenBSD](http://www.openbsd.org/) by Vincent Rijmen, Antoon +Bosselaers, and Paulo Barreto. The authors have placed the code in the +public domain under the license included in the file rijndael.h (see +http://www.openbsd.org/cgi-bin/cvsweb). + +## SHA-256 1.0 + +The SHA-256 implementation from Aaron D. Gifford is available at +http://www.aarongifford.com/computers/sha2-1.0.1.tgz under a +3-clause BSD license. + +## ECC 1.0 + +The implementation of the ECC curve secp256r1 was originally developed +by Chris K Cockrum and has been put under MIT license for inclusion +with tinydtls. The original source is made available in +https://cockrum.net/Implementation_of_ECC_on_an_8-bit_microcontroller.pdf
diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..f4111b7 --- /dev/null +++ b/LICENSE
@@ -0,0 +1,12 @@ +/******************************************************************************* + * Copyright (c) 2011, 2012, 2013, 2014, 2015, 2016 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * Contributors: + * Olaf Bergmann - initial API and implementation + * Hauke Mehrtens - memory optimization, ECC integration + *******************************************************************************/
diff --git a/Makefile.in b/Makefile.in new file mode 100644 index 0000000..d1d8546 --- /dev/null +++ b/Makefile.in
@@ -0,0 +1,128 @@ +# Makefile for tinydtls +# +# +# Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. +# All rights reserved. This program and the accompanying materials +# are made available under the terms of the Eclipse Public License v1.0 +# and Eclipse Distribution License v. 1.0 which accompanies this distribution. +# +# The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html +# and the Eclipse Distribution License is available at +# http://www.eclipse.org/org/documents/edl-v10.php. +# +# Contributors: +# Olaf Bergmann - initial API and implementation +# + +# the library's version +VERSION:=@PACKAGE_VERSION@ + +# tools +@SET_MAKE@ +SHELL = /bin/sh +MKDIR = mkdir +ETAGS = @ETAGS@ + +prefix = @prefix@ +exec_prefix = @exec_prefix@ +abs_builddir = @abs_builddir@ +top_builddir = @top_builddir@ +libdir = @libdir@ +includedir = @includedir@/@PACKAGE_NAME@ +package = @PACKAGE_TARNAME@-@PACKAGE_VERSION@ + +install := cp + +# files and flags +SOURCES:= dtls.c crypto.c ccm.c hmac.c netq.c peer.c dtls_time.c session.c debug.c +SUB_OBJECTS:=aes/rijndael.o @OPT_OBJS@ +OBJECTS:= $(patsubst %.c, %.o, $(SOURCES)) $(SUB_OBJECTS) +HEADERS:=dtls.h hmac.h debug.h dtls_config.h uthash.h numeric.h crypto.h global.h ccm.h \ + netq.h alert.h utlist.h prng.h peer.h state.h dtls_time.h session.h \ + tinydtls.h +CFLAGS:=-Wall -pedantic -std=c99 @CFLAGS@ +CPPFLAGS:=@CPPFLAGS@ -DDTLS_CHECK_CONTENTTYPE +SUBDIRS:=tests doc platform-specific sha2 aes ecc +DISTSUBDIRS:=$(SUBDIRS) +DISTDIR=$(top_builddir)/$(package) +FILES:=Makefile.in configure configure.in dtls_config.h.in tinydtls.h.in \ + Makefile.tinydtls $(SOURCES) $(HEADERS) +LIB:=libtinydtls.a +LDFLAGS:=@LIBS@ +ARFLAGS:=cru +doc:=doc + +.PHONY: all dirs clean install dist distclean .gitignore doc TAGS + +ifneq ("@WITH_CONTIKI@", "1") +.SUFFIXES: +.SUFFIXES: .c .o + +all: $(LIB) dirs + +check: + echo DISTDIR: $(DISTDIR) + echo top_builddir: $(top_builddir) + $(MAKE) -C tests check + +dirs: $(SUBDIRS) + for dir in $^; do \ + $(MAKE) -C $$dir ; \ + done + +$(SUB_OBJECTS):: + $(MAKE) -C $(@D) $(@F) + +$(LIB): $(OBJECTS) + $(AR) $(ARFLAGS) $@ $^ + ranlib $@ + +clean: + @rm -f $(PROGRAM) main.o $(LIB) $(OBJECTS) + for dir in $(SUBDIRS); do \ + $(MAKE) -C $$dir clean ; \ + done +endif # WITH_CONTIKI + +doc: + $(MAKE) -C doc + +distclean: clean + @rm -rf $(DISTDIR) + @rm -f *~ $(DISTDIR).tar.gz + +dist: $(FILES) $(DISTSUBDIRS) + test -d $(DISTDIR) || mkdir $(DISTDIR) + cp $(FILES) $(DISTDIR) + for dir in $(DISTSUBDIRS); do \ + $(MAKE) -C $$dir dist; \ + done + tar czf $(package).tar.gz $(DISTDIR) + +install: $(LIB) $(HEADERS) $(SUBDIRS) + test -d $(libdir) || mkdir -p $(libdir) + test -d $(includedir) || mkdir -p $(includedir) + $(install) $(LIB) $(libdir)/ + $(install) $(HEADERS) $(includedir)/ + for dir in $(SUBDIRS); do \ + $(MAKE) -C $$dir install="$(install)" includedir=$(includedir) install; \ + done + +TAGS: + $(ETAGS) -o $@.new $(SOURCES) + $(ETAGS) -a -o $@.new $(HEADERS) + mv $@.new $@ + +# files that should be ignored by git +GITIGNOREDS:= core \*~ \*.[oa] \*.gz \*.cap \*.pcap Makefile \ + autom4te.cache/ config.h config.log config.status configure \ + doc/Doxyfile doc/doxygen.out doc/html/ $(LIB) tests/ccm-test \ + tests/dtls-client tests/dtls-server tests/prf-test $(package) \ + $(DISTDIR)/ TAGS \*.patch .gitignore ecc/testecc ecc/testfield \ + \*.d \*.hex \*.elf \*.map obj_\* tinydtls.h dtls_config.h \ + $(addprefix \*., $(notdir $(wildcard ../../platform/*))) \ + .project + +.gitignore: + echo $(GITIGNOREDS) | sed 's/ /\n/g' > $@ +
diff --git a/Makefile.tinydtls b/Makefile.tinydtls new file mode 100644 index 0000000..88affc4 --- /dev/null +++ b/Makefile.tinydtls
@@ -0,0 +1,36 @@ +# This is a -*- Makefile -*- + +ifeq ($(TARGET), redbee-econotag) +CFLAGS += -DSHA2_USE_INTTYPES_H=1 -DLITTLE_ENDIAN=3412 -DBYTE_ORDER=LITTLE_ENDIAN +endif + +ifeq ($(TARGET), wismote) +CFLAGS += -DSHA2_USE_INTTYPES_H=1 -DLITTLE_ENDIAN=3412 -DBYTE_ORDER=LITTLE_ENDIAN +endif + +ifeq ($(TARGET), exp5438) +CFLAGS += -DSHA2_USE_INTTYPES_H=1 -DLITTLE_ENDIAN=3412 -DBYTE_ORDER=LITTLE_ENDIAN +endif + +ifeq ($(TARGET), native) +CFLAGS += -DSHA2_USE_INTTYPES_H=1 +endif + +ifeq ($(TARGET), minimal-net) +CFLAGS += -DSHA2_USE_INTTYPES_H=1 +endif + +CFLAGS += -DDTLSv12 -DWITH_SHA256 +tinydtls_src = dtls.c crypto.c hmac.c rijndael.c sha2.c ccm.c netq.c ecc.c dtls_time.c peer.c session.c + +# This adds support for TLS_PSK_WITH_AES_128_CCM_8 +CFLAGS += -DDTLS_PSK + +# This adds support for TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 +CFLAGS += -DDTLS_ECC +tinydtls_src += ecc.c + +# This activates debugging support +# CFLAGS += -DNDEBUG +tinydtls_src += debug.c +
diff --git a/README b/README new file mode 100644 index 0000000..a7b6093 --- /dev/null +++ b/README
@@ -0,0 +1,26 @@ +CONTENTS + +This library contains functions and structures that can help +constructing a single-threaded UDP server with DTLS support in +C99. The following components are available: + +* dtls + Basic support for DTLS with pre-shared key mode. + +* tests + The subdirectory tests contains test programs that show how each + component is used. + +BUILDING + +When using the code from the git repository at sourceforge, invoke +'autoreconf' to re-create the configure script. To build for Contiki, +place tinydtls into Contiki's apps directory and call + ./configure --with-contiki. + +After configuration, invoke make to build the library and associated +test programs. To add tinydtls as Contiki application, drop it into +the apps directory and add the following line to your Makefile: + + APPS += tinydtls/aes tinydtls/sha2 tinydtls/ecc tinydtls +
diff --git a/aes/Makefile.in b/aes/Makefile.in new file mode 100644 index 0000000..7c9f6ef --- /dev/null +++ b/aes/Makefile.in
@@ -0,0 +1,67 @@ +# Makefile for tinydtls +# +# Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. +# All rights reserved. This program and the accompanying materials +# are made available under the terms of the Eclipse Public License v1.0 +# and Eclipse Distribution License v. 1.0 which accompanies this distribution. +# +# The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html +# and the Eclipse Distribution License is available at +# http://www.eclipse.org/org/documents/edl-v10.php. +# +# Contributors: +# Olaf Bergmann - initial API and implementation +# + +# the library's version +VERSION:=@PACKAGE_VERSION@ + +# tools +@SET_MAKE@ +SHELL = /bin/sh +MKDIR = mkdir + +abs_builddir = @abs_builddir@ +top_builddir = @top_builddir@ +top_srcdir:= @top_srcdir@ + +SOURCES:= rijndael.c +HEADERS:= rijndael.h +OBJECTS:= $(patsubst %.c, %.o, $(SOURCES)) +CPPFLAGS=@CPPFLAGS@ +CFLAGS=-Wall -std=c99 -pedantic @CFLAGS@ +LDLIBS=@LIBS@ +FILES:=Makefile.in $(SOURCES) $(HEADERS) +DISTDIR=$(top_builddir)/@PACKAGE_TARNAME@-@PACKAGE_VERSION@ + +.PHONY: all dirs clean install dist distclean .gitignore doc + +.SUFFIXES: +.SUFFIXES: .c .o + +all: + +check: + echo DISTDIR: $(DISTDIR) + echo top_builddir: $(top_builddir) + +clean: + @rm -f $(PROGRAMS) main.o $(LIB) $(OBJECTS) + for dir in $(SUBDIRS); do \ + $(MAKE) -C $$dir clean ; \ + done + +distclean: clean + @rm -rf $(DISTDIR) + @rm -f *~ $(DISTDIR).tar.gz + +dist: $(FILES) + test -d $(DISTDIR)/aes || mkdir $(DISTDIR)/aes + cp -p $(FILES) $(DISTDIR)/aes + +install: $(HEADERS) + test -d $(includedir)/aes || mkdir -p $(includedir)/aes + $(install) $(HEADERS) $(includedir)/aes + +.gitignore: + echo "core\n*~\n*.[oa]\n*.gz\n*.cap\n$(PROGRAM)\n$(DISTDIR)\n.gitignore" >$@
diff --git a/alert.h b/alert.h new file mode 100644 index 0000000..696c619 --- /dev/null +++ b/alert.h
@@ -0,0 +1,73 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * Hauke Mehrtens - memory optimization, ECC integration + * + *******************************************************************************/ + +/** + * @file alert.h + * @brief DTLS alert protocol + */ + +#ifndef _DTLS_ALERT_H_ +#define _DTLS_ALERT_H_ + +typedef enum { + DTLS_ALERT_LEVEL_WARNING=1, + DTLS_ALERT_LEVEL_FATAL=2 +} dtls_alert_level_t; + +typedef enum { + DTLS_ALERT_CLOSE_NOTIFY = 0, /* close_notify */ + DTLS_ALERT_UNEXPECTED_MESSAGE = 10, /* unexpected_message */ + DTLS_ALERT_BAD_RECORD_MAC = 20, /* bad_record_mac */ + DTLS_ALERT_RECORD_OVERFLOW = 22, /* record_overflow */ + DTLS_ALERT_DECOMPRESSION_FAILURE = 30, /* decompression_failure */ + DTLS_ALERT_HANDSHAKE_FAILURE = 40, /* handshake_failure */ + DTLS_ALERT_BAD_CERTIFICATE = 42, /* bad_certificate */ + DTLS_ALERT_UNSUPPORTED_CERTIFICATE = 43, /* unsupported_certificate */ + DTLS_ALERT_CERTIFICATE_REVOKED = 44, /* certificate_revoked */ + DTLS_ALERT_CERTIFICATE_EXPIRED = 45, /* certificate_expired */ + DTLS_ALERT_CERTIFICATE_UNKNOWN = 46, /* certificate_unknown */ + DTLS_ALERT_ILLEGAL_PARAMETER = 47, /* illegal_parameter */ + DTLS_ALERT_UNKNOWN_CA = 48, /* unknown_ca */ + DTLS_ALERT_ACCESS_DENIED = 49, /* access_denied */ + DTLS_ALERT_DECODE_ERROR = 50, /* decode_error */ + DTLS_ALERT_DECRYPT_ERROR = 51, /* decrypt_error */ + DTLS_ALERT_PROTOCOL_VERSION = 70, /* protocol_version */ + DTLS_ALERT_INSUFFICIENT_SECURITY = 71, /* insufficient_security */ + DTLS_ALERT_INTERNAL_ERROR = 80, /* internal_error */ + DTLS_ALERT_USER_CANCELED = 90, /* user_canceled */ + DTLS_ALERT_NO_RENEGOTIATION = 100, /* no_renegotiation */ + DTLS_ALERT_UNSUPPORTED_EXTENSION = 110 /* unsupported_extension */ +} dtls_alert_t; + +#define DTLS_EVENT_CONNECT 0x01DC /**< initiated handshake */ +#define DTLS_EVENT_CONNECTED 0x01DE /**< handshake or re-negotiation + * has finished */ +#define DTLS_EVENT_RENEGOTIATE 0x01DF /**< re-negotiation has started */ + +static inline int +dtls_alert_create(dtls_alert_level_t level, dtls_alert_t desc) +{ + return -((level << 8) | desc); +} + +static inline int +dtls_alert_fatal_create(dtls_alert_t desc) +{ + return dtls_alert_create(DTLS_ALERT_LEVEL_FATAL, desc); +} + +#endif /* _DTLS_ALERT_H_ */
diff --git a/ccm.c b/ccm.c new file mode 100644 index 0000000..bd6f371 --- /dev/null +++ b/ccm.c
@@ -0,0 +1,303 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * Hauke Mehrtens - memory optimization, ECC integration + * + *******************************************************************************/ + +#include <string.h> + +#include "dtls_config.h" +#include "global.h" +#include "numeric.h" +#include "ccm.h" + +#ifdef HAVE_ASSERT_H +# include <assert.h> +#endif + +#define CCM_FLAGS(A,M,L) (((A > 0) << 6) | (((M - 2)/2) << 3) | (L - 1)) + +#define MASK_L(_L) ((1 << 8 * _L) - 1) + +#define SET_COUNTER(A,L,cnt,C) { \ + int i; \ + memset((A) + DTLS_CCM_BLOCKSIZE - (L), 0, (L)); \ + (C) = (cnt) & MASK_L(L); \ + for (i = DTLS_CCM_BLOCKSIZE - 1; (C) && (i > (L)); --i, (C) >>= 8) \ + (A)[i] |= (C) & 0xFF; \ + } + +static inline void +block0(size_t M, /* number of auth bytes */ + size_t L, /* number of bytes to encode message length */ + size_t la, /* l(a) octets additional authenticated data */ + size_t lm, /* l(m) message length */ + unsigned char nonce[DTLS_CCM_BLOCKSIZE], + unsigned char *result) { + int i; + + result[0] = CCM_FLAGS(la, M, L); + + /* copy the nonce */ + memcpy(result + 1, nonce, DTLS_CCM_BLOCKSIZE - L - 1); + + for (i=0; i < L; i++) { + result[15-i] = lm & 0xff; + lm >>= 8; + } +} + +/** + * Creates the CBC-MAC for the additional authentication data that + * is sent in cleartext. + * + * \param ctx The crypto context for the AES encryption. + * \param msg The message starting with the additional authentication data. + * \param la The number of additional authentication bytes in \p msg. + * \param B The input buffer for crypto operations. When this function + * is called, \p B must be initialized with \c B0 (the first + * authentication block. + * \param X The output buffer where the result of the CBC calculation + * is placed. + * \return The result is written to \p X. + */ +static void +add_auth_data(rijndael_ctx *ctx, const unsigned char *msg, size_t la, + unsigned char B[DTLS_CCM_BLOCKSIZE], + unsigned char X[DTLS_CCM_BLOCKSIZE]) { + size_t i,j; + + rijndael_encrypt(ctx, B, X); + + memset(B, 0, DTLS_CCM_BLOCKSIZE); + + if (!la) + return; + +#ifndef WITH_CONTIKI + if (la < 0xFF00) { /* 2^16 - 2^8 */ + j = 2; + dtls_int_to_uint16(B, la); + } else if (la <= UINT32_MAX) { + j = 6; + dtls_int_to_uint16(B, 0xFFFE); + dtls_int_to_uint32(B+2, la); + } else { + j = 10; + dtls_int_to_uint16(B, 0xFFFF); + dtls_int_to_uint64(B+2, la); + } +#else /* WITH_CONTIKI */ + /* With Contiki, we are building for small devices and thus + * anticipate that the number of additional authentication bytes + * will not exceed 65280 bytes (0xFF00) and we can skip the + * workarounds required for j=6 and j=10 on devices with a word size + * of 32 bits or 64 bits, respectively. + */ + + assert(la < 0xFF00); + j = 2; + dtls_int_to_uint16(B, la); +#endif /* WITH_CONTIKI */ + + i = min(DTLS_CCM_BLOCKSIZE - j, la); + memcpy(B + j, msg, i); + la -= i; + msg += i; + + memxor(B, X, DTLS_CCM_BLOCKSIZE); + + rijndael_encrypt(ctx, B, X); + + while (la > DTLS_CCM_BLOCKSIZE) { + for (i = 0; i < DTLS_CCM_BLOCKSIZE; ++i) + B[i] = X[i] ^ *msg++; + la -= DTLS_CCM_BLOCKSIZE; + + rijndael_encrypt(ctx, B, X); + } + + if (la) { + memset(B, 0, DTLS_CCM_BLOCKSIZE); + memcpy(B, msg, la); + memxor(B, X, DTLS_CCM_BLOCKSIZE); + + rijndael_encrypt(ctx, B, X); + } +} + +static inline void +encrypt(rijndael_ctx *ctx, size_t L, unsigned long counter, + unsigned char *msg, size_t len, + unsigned char A[DTLS_CCM_BLOCKSIZE], + unsigned char S[DTLS_CCM_BLOCKSIZE]) { + + static unsigned long counter_tmp; + + SET_COUNTER(A, L, counter, counter_tmp); + rijndael_encrypt(ctx, A, S); + memxor(msg, S, len); +} + +static inline void +mac(rijndael_ctx *ctx, + unsigned char *msg, size_t len, + unsigned char B[DTLS_CCM_BLOCKSIZE], + unsigned char X[DTLS_CCM_BLOCKSIZE]) { + size_t i; + + for (i = 0; i < len; ++i) + B[i] = X[i] ^ msg[i]; + + rijndael_encrypt(ctx, B, X); + +} + +long int +dtls_ccm_encrypt_message(rijndael_ctx *ctx, size_t M, size_t L, + unsigned char nonce[DTLS_CCM_BLOCKSIZE], + unsigned char *msg, size_t lm, + const unsigned char *aad, size_t la) { + size_t i, len; + unsigned long counter_tmp; + unsigned long counter = 1; /* \bug does not work correctly on ia32 when + lm >= 2^16 */ + unsigned char A[DTLS_CCM_BLOCKSIZE]; /* A_i blocks for encryption input */ + unsigned char B[DTLS_CCM_BLOCKSIZE]; /* B_i blocks for CBC-MAC input */ + unsigned char S[DTLS_CCM_BLOCKSIZE]; /* S_i = encrypted A_i blocks */ + unsigned char X[DTLS_CCM_BLOCKSIZE]; /* X_i = encrypted B_i blocks */ + + len = lm; /* save original length */ + /* create the initial authentication block B0 */ + block0(M, L, la, lm, nonce, B); + add_auth_data(ctx, aad, la, B, X); + + /* initialize block template */ + A[0] = L-1; + + /* copy the nonce */ + memcpy(A + 1, nonce, DTLS_CCM_BLOCKSIZE - L - 1); + + while (lm >= DTLS_CCM_BLOCKSIZE) { + /* calculate MAC */ + mac(ctx, msg, DTLS_CCM_BLOCKSIZE, B, X); + + /* encrypt */ + encrypt(ctx, L, counter, msg, DTLS_CCM_BLOCKSIZE, A, S); + + /* update local pointers */ + lm -= DTLS_CCM_BLOCKSIZE; + msg += DTLS_CCM_BLOCKSIZE; + counter++; + } + + if (lm) { + /* Calculate MAC. The remainder of B must be padded with zeroes, so + * B is constructed to contain X ^ msg for the first lm bytes (done in + * mac() and X ^ 0 for the remaining DTLS_CCM_BLOCKSIZE - lm bytes + * (i.e., we can use memcpy() here). + */ + memcpy(B + lm, X + lm, DTLS_CCM_BLOCKSIZE - lm); + mac(ctx, msg, lm, B, X); + + /* encrypt */ + encrypt(ctx, L, counter, msg, lm, A, S); + + /* update local pointers */ + msg += lm; + } + + /* calculate S_0 */ + SET_COUNTER(A, L, 0, counter_tmp); + rijndael_encrypt(ctx, A, S); + + for (i = 0; i < M; ++i) + *msg++ = X[i] ^ S[i]; + + return len + M; +} + +long int +dtls_ccm_decrypt_message(rijndael_ctx *ctx, size_t M, size_t L, + unsigned char nonce[DTLS_CCM_BLOCKSIZE], + unsigned char *msg, size_t lm, + const unsigned char *aad, size_t la) { + + size_t len; + unsigned long counter_tmp; + unsigned long counter = 1; /* \bug does not work correctly on ia32 when + lm >= 2^16 */ + unsigned char A[DTLS_CCM_BLOCKSIZE]; /* A_i blocks for encryption input */ + unsigned char B[DTLS_CCM_BLOCKSIZE]; /* B_i blocks for CBC-MAC input */ + unsigned char S[DTLS_CCM_BLOCKSIZE]; /* S_i = encrypted A_i blocks */ + unsigned char X[DTLS_CCM_BLOCKSIZE]; /* X_i = encrypted B_i blocks */ + + if (lm < M) + goto error; + + len = lm; /* save original length */ + lm -= M; /* detract MAC size*/ + + /* create the initial authentication block B0 */ + block0(M, L, la, lm, nonce, B); + add_auth_data(ctx, aad, la, B, X); + + /* initialize block template */ + A[0] = L-1; + + /* copy the nonce */ + memcpy(A + 1, nonce, DTLS_CCM_BLOCKSIZE - L - 1); + + while (lm >= DTLS_CCM_BLOCKSIZE) { + /* decrypt */ + encrypt(ctx, L, counter, msg, DTLS_CCM_BLOCKSIZE, A, S); + + /* calculate MAC */ + mac(ctx, msg, DTLS_CCM_BLOCKSIZE, B, X); + + /* update local pointers */ + lm -= DTLS_CCM_BLOCKSIZE; + msg += DTLS_CCM_BLOCKSIZE; + counter++; + } + + if (lm) { + /* decrypt */ + encrypt(ctx, L, counter, msg, lm, A, S); + + /* Calculate MAC. Note that msg ends in the MAC so we must + * construct B to contain X ^ msg for the first lm bytes (done in + * mac() and X ^ 0 for the remaining DTLS_CCM_BLOCKSIZE - lm bytes + * (i.e., we can use memcpy() here). + */ + memcpy(B + lm, X + lm, DTLS_CCM_BLOCKSIZE - lm); + mac(ctx, msg, lm, B, X); + + /* update local pointers */ + msg += lm; + } + + /* calculate S_0 */ + SET_COUNTER(A, L, 0, counter_tmp); + rijndael_encrypt(ctx, A, S); + + memxor(msg, S, M); + + /* return length if MAC is valid, otherwise continue with error handling */ + if (equals(X, msg, M)) + return len - M; + + error: + return -1; +}
diff --git a/ccm.h b/ccm.h new file mode 100644 index 0000000..55efbde --- /dev/null +++ b/ccm.h
@@ -0,0 +1,61 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * Hauke Mehrtens - memory optimization, ECC integration + * + *******************************************************************************/ + +#ifndef _DTLS_CCM_H_ +#define _DTLS_CCM_H_ + +#include "aes/rijndael.h" + +/* implementation of Counter Mode CBC-MAC, RFC 3610 */ + +#define DTLS_CCM_BLOCKSIZE 16 /**< size of hmac blocks */ +#define DTLS_CCM_MAX 16 /**< max number of bytes in digest */ +#define DTLS_CCM_NONCE_SIZE 12 /**< size of nonce */ + +/** + * Authenticates and encrypts a message using AES in CCM mode. Please + * see also RFC 3610 for the meaning of \p M, \p L, \p lm and \p la. + * + * \param ctx The initialized rijndael_ctx object to be used for AES operations. + * \param M The number of authentication octets. + * \param L The number of bytes used to encode the message length. + * \param N The nonce value to use. You must provide \c DTLS_CCM_BLOCKSIZE + * nonce octets, although only the first \c 16 - \p L - 1 are used. + * \param msg The message to encrypt. The first \p la octets are additional + * authentication data that will be cleartext. Note that the + * encryption operation modifies the contents of \p msg and adds + * \p M bytes MAC. Therefore, the buffer must be at least + * \p lm + \p M bytes large. + * \param lm The actual length of \p msg. + * \param aad A pointer to the additional authentication data (can be \c NULL if + * \p la is zero). + * \param la The number of additional authentication octets (may be zero). + * \return FIXME + */ +long int +dtls_ccm_encrypt_message(rijndael_ctx *ctx, size_t M, size_t L, + unsigned char nonce[DTLS_CCM_BLOCKSIZE], + unsigned char *msg, size_t lm, + const unsigned char *aad, size_t la); + +long int +dtls_ccm_decrypt_message(rijndael_ctx *ctx, size_t M, size_t L, + unsigned char nonce[DTLS_CCM_BLOCKSIZE], + unsigned char *msg, size_t lm, + const unsigned char *aad, size_t la); + +#endif /* _DTLS_CCM_H_ */
diff --git a/configure.in b/configure.in new file mode 100644 index 0000000..7ee9f94 --- /dev/null +++ b/configure.in
@@ -0,0 +1,111 @@ +# -*- Autoconf -*- +# Process this file with autoconf to produce a configure script. +# +# Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. +# All rights reserved. This program and the accompanying materials +# are made available under the terms of the Eclipse Public License v1.0 +# and Eclipse Distribution License v. 1.0 which accompanies this distribution. +# +# The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html +# and the Eclipse Distribution License is available at +# http://www.eclipse.org/org/documents/edl-v10.php. +# +# Contributors: +# Olaf Bergmann - initial API and implementation +# Hauke Mehrtens - memory optimization, ECC integration + +AC_PREREQ([2.65]) +AC_INIT([tinydtls], [0.8.2]) +AC_CONFIG_SRCDIR([dtls.c]) +dnl AC_CONFIG_HEADERS([config.h]) + +AC_ARG_WITH(contiki, + [AS_HELP_STRING([--with-contiki],[build libtinydtls for the Contiki OS])], + [AC_DEFINE(WITH_CONTIKI,1,[Define to 1 if building for Contiki.]) + WITH_CONTIKI=1], + []) + +AC_PATH_PROG(DOXYGEN, doxygen, [:]) +AC_PATH_PROG(ETAGS, etags, [/bin/false]) + +if test "${with_contiki}" != "yes" ; then +# Checks for programs. +AC_PROG_MAKE_SET +AC_PROG_CC +AC_PROG_RANLIB + +AC_C_BIGENDIAN + +# Checks for libraries. +AC_SEARCH_LIBS([gethostbyname], [nsl]) +AC_SEARCH_LIBS([socket], [socket]) +fi + +AC_ARG_WITH(debug, + [AS_HELP_STRING([--without-debug],[disable all debug output and assertions])], + [CPPFLAGS="${CPPFLAGS} -DNDEBUG" + NDEBUG=1], + []) + +AC_ARG_WITH(ecc, + [AS_HELP_STRING([--without-ecc],[disable support for TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8])], + [], + [AC_DEFINE(DTLS_ECC, 1, [Define to 1 if building with ECC support.]) + OPT_OBJS="${OPT_OBJS} ecc/ecc.o" + DTLS_ECC=1]) + +AC_ARG_WITH(psk, + [AS_HELP_STRING([--without-psk],[disable support for TLS_PSK_WITH_AES_128_CCM_8])], + [], + [AC_DEFINE(DTLS_PSK, 1, [Define to 1 if building with PSK support]) + DTLS_PSK=1]) + +CPPFLAGS="${CPPFLAGS} -DDTLSv12 -DWITH_SHA256" +OPT_OBJS="${OPT_OBJS} sha2/sha2.o" + +AC_SUBST(OPT_OBJS) +AC_SUBST(NDEBUG) +AC_SUBST(WITH_CONTIKI) +AC_SUBST(DTLS_ECC) +AC_SUBST(DTLS_PSK) + +if test "${with_contiki}" = "yes" ; then + AC_MSG_NOTICE([skipping header checks for Contiki]) +else + # Checks for header files. + AC_CHECK_HEADERS([assert.h arpa/inet.h fcntl.h inttypes.h netdb.h netinet/in.h stddef.h stdint.h stdlib.h string.h strings.h sys/param.h sys/socket.h unistd.h]) + + AC_CHECK_HEADERS([sys/time.h time.h]) + AC_CHECK_HEADERS([sys/types.h sys/stat.h]) + +# Checks for typedefs, structures, and compiler characteristics. +AC_C_INLINE +AC_TYPE_SIZE_T + +AC_CHECK_MEMBER([struct sockaddr_in6.sin6_len], + [AC_DEFINE(HAVE_SOCKADDR_IN6_SIN6_LEN, [1], + [Define to 1 if struct sockaddr_in6 has a member sin6_len.])], [], + [#include <netinet/in.h>]) + +# Checks for library functions. +AC_FUNC_MALLOC +AC_CHECK_FUNCS([memset select socket strdup strerror strnlen fls vprintf]) +fi + +AC_CONFIG_HEADERS([dtls_config.h tinydtls.h]) + +# Adds Contiki-specific definitions to the end of dtls_config.h +AH_BOTTOM([ +#ifdef WITH_CONTIKI +#include "platform-specific/platform.h" +#endif]) + +AC_CONFIG_FILES([Makefile + doc/Makefile + doc/Doxyfile + tests/Makefile + platform-specific/Makefile + sha2/Makefile + aes/Makefile + ecc/Makefile]) +AC_OUTPUT
diff --git a/crypto.c b/crypto.c new file mode 100644 index 0000000..c2c3da5 --- /dev/null +++ b/crypto.c
@@ -0,0 +1,565 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * Hauke Mehrtens - memory optimization, ECC integration + * + *******************************************************************************/ + +#include <stdio.h> + +#include "tinydtls.h" +#include "dtls_config.h" + +#ifdef HAVE_ASSERT_H +#include <assert.h> +#else +#define assert(x) +#endif + +#include "global.h" +#include "debug.h" +#include "numeric.h" +#include "dtls.h" +#include "crypto.h" +#include "ccm.h" +#include "ecc/ecc.h" +#include "prng.h" +#include "netq.h" + +#ifndef WITH_CONTIKI +#include <pthread.h> +#endif + +#define HMAC_UPDATE_SEED(Context,Seed,Length) \ + if (Seed) dtls_hmac_update(Context, (Seed), (Length)) + +static struct dtls_cipher_context_t cipher_context; +#ifndef WITH_CONTIKI +static pthread_mutex_t cipher_context_mutex = PTHREAD_MUTEX_INITIALIZER; +#endif + +static struct dtls_cipher_context_t *dtls_cipher_context_get(void) +{ +#ifndef WITH_CONTIKI + pthread_mutex_lock(&cipher_context_mutex); +#endif + return &cipher_context; +} + +static void dtls_cipher_context_release(void) +{ +#ifndef WITH_CONTIKI + pthread_mutex_unlock(&cipher_context_mutex); +#endif +} + +#ifndef WITH_CONTIKI +void crypto_init() +{ +} + +static dtls_handshake_parameters_t *dtls_handshake_malloc() { + return malloc(sizeof(dtls_handshake_parameters_t)); +} + +static void dtls_handshake_dealloc(dtls_handshake_parameters_t *handshake) { + free(handshake); +} + +static dtls_security_parameters_t *dtls_security_malloc() { + return malloc(sizeof(dtls_security_parameters_t)); +} + +static void dtls_security_dealloc(dtls_security_parameters_t *security) { + free(security); +} +#else /* WITH_CONTIKI */ + +#include "memb.h" +MEMB(handshake_storage, dtls_handshake_parameters_t, DTLS_HANDSHAKE_MAX); +MEMB(security_storage, dtls_security_parameters_t, DTLS_SECURITY_MAX); + +void crypto_init() { + memb_init(&handshake_storage); + memb_init(&security_storage); +} + +static dtls_handshake_parameters_t *dtls_handshake_malloc() { + return memb_alloc(&handshake_storage); +} + +static void dtls_handshake_dealloc(dtls_handshake_parameters_t *handshake) { + memb_free(&handshake_storage, handshake); +} + +static dtls_security_parameters_t *dtls_security_malloc() { + return memb_alloc(&security_storage); +} + +static void dtls_security_dealloc(dtls_security_parameters_t *security) { + memb_free(&security_storage, security); +} +#endif /* WITH_CONTIKI */ + +dtls_handshake_parameters_t *dtls_handshake_new() +{ + dtls_handshake_parameters_t *handshake; + + handshake = dtls_handshake_malloc(); + if (!handshake) { + dtls_crit("can not allocate a handshake struct\n"); + return NULL; + } + + memset(handshake, 0, sizeof(*handshake)); + + if (handshake) { + /* initialize the handshake hash wrt. the hard-coded DTLS version */ + dtls_debug("DTLSv12: initialize HASH_SHA256\n"); + /* TLS 1.2: PRF(secret, label, seed) = P_<hash>(secret, label + seed) */ + /* FIXME: we use the default SHA256 here, might need to support other + hash functions as well */ + dtls_hash_init(&handshake->hs_state.hs_hash); + } + return handshake; +} + +void dtls_handshake_free(dtls_handshake_parameters_t *handshake) +{ + if (!handshake) + return; + + netq_delete_all(&handshake->reorder_queue); + dtls_handshake_dealloc(handshake); +} + +dtls_security_parameters_t *dtls_security_new() +{ + dtls_security_parameters_t *security; + + security = dtls_security_malloc(); + if (!security) { + dtls_crit("can not allocate a security struct\n"); + return NULL; + } + + memset(security, 0, sizeof(*security)); + + if (security) { + security->cipher = TLS_NULL_WITH_NULL_NULL; + security->compression = TLS_COMPRESSION_NULL; + } + return security; +} + +void dtls_security_free(dtls_security_parameters_t *security) +{ + if (!security) + return; + + dtls_security_dealloc(security); +} + +size_t +dtls_p_hash(dtls_hashfunc_t h, + const unsigned char *key, size_t keylen, + const unsigned char *label, size_t labellen, + const unsigned char *random1, size_t random1len, + const unsigned char *random2, size_t random2len, + unsigned char *buf, size_t buflen) { + dtls_hmac_context_t *hmac_a, *hmac_p; + + unsigned char A[DTLS_HMAC_DIGEST_SIZE]; + unsigned char tmp[DTLS_HMAC_DIGEST_SIZE]; + size_t dlen; /* digest length */ + size_t len = 0; /* result length */ + + hmac_a = dtls_hmac_new(key, keylen); + if (!hmac_a) + return 0; + + /* calculate A(1) from A(0) == seed */ + HMAC_UPDATE_SEED(hmac_a, label, labellen); + HMAC_UPDATE_SEED(hmac_a, random1, random1len); + HMAC_UPDATE_SEED(hmac_a, random2, random2len); + + dlen = dtls_hmac_finalize(hmac_a, A); + + hmac_p = dtls_hmac_new(key, keylen); + if (!hmac_p) + goto error; + + while (len + dlen < buflen) { + + /* FIXME: rewrite loop to avoid superflous call to dtls_hmac_init() */ + dtls_hmac_init(hmac_p, key, keylen); + dtls_hmac_update(hmac_p, A, dlen); + + HMAC_UPDATE_SEED(hmac_p, label, labellen); + HMAC_UPDATE_SEED(hmac_p, random1, random1len); + HMAC_UPDATE_SEED(hmac_p, random2, random2len); + + len += dtls_hmac_finalize(hmac_p, tmp); + memcpy(buf, tmp, dlen); + buf += dlen; + + /* calculate A(i+1) */ + dtls_hmac_init(hmac_a, key, keylen); + dtls_hmac_update(hmac_a, A, dlen); + dtls_hmac_finalize(hmac_a, A); + } + + dtls_hmac_init(hmac_p, key, keylen); + dtls_hmac_update(hmac_p, A, dlen); + + HMAC_UPDATE_SEED(hmac_p, label, labellen); + HMAC_UPDATE_SEED(hmac_p, random1, random1len); + HMAC_UPDATE_SEED(hmac_p, random2, random2len); + + dtls_hmac_finalize(hmac_p, tmp); + memcpy(buf, tmp, buflen - len); + + error: + dtls_hmac_free(hmac_a); + dtls_hmac_free(hmac_p); + + return buflen; +} + +size_t +dtls_prf(const unsigned char *key, size_t keylen, + const unsigned char *label, size_t labellen, + const unsigned char *random1, size_t random1len, + const unsigned char *random2, size_t random2len, + unsigned char *buf, size_t buflen) { + + /* Clear the result buffer */ + memset(buf, 0, buflen); + return dtls_p_hash(HASH_SHA256, + key, keylen, + label, labellen, + random1, random1len, + random2, random2len, + buf, buflen); +} + +void +dtls_mac(dtls_hmac_context_t *hmac_ctx, + const unsigned char *record, + const unsigned char *packet, size_t length, + unsigned char *buf) { + uint16 L; + dtls_int_to_uint16(L, length); + + assert(hmac_ctx); + dtls_hmac_update(hmac_ctx, record +3, sizeof(uint16) + sizeof(uint48)); + dtls_hmac_update(hmac_ctx, record, sizeof(uint8) + sizeof(uint16)); + dtls_hmac_update(hmac_ctx, L, sizeof(uint16)); + dtls_hmac_update(hmac_ctx, packet, length); + + dtls_hmac_finalize(hmac_ctx, buf); +} + +static size_t +dtls_ccm_encrypt(aes128_ccm_t *ccm_ctx, const unsigned char *src, size_t srclen, + unsigned char *buf, + unsigned char *nounce, + const unsigned char *aad, size_t la) { + long int len; + + assert(ccm_ctx); + + len = dtls_ccm_encrypt_message(&ccm_ctx->ctx, 8 /* M */, + max(2, 15 - DTLS_CCM_NONCE_SIZE), + nounce, + buf, srclen, + aad, la); + return len; +} + +static size_t +dtls_ccm_decrypt(aes128_ccm_t *ccm_ctx, const unsigned char *src, + size_t srclen, unsigned char *buf, + unsigned char *nounce, + const unsigned char *aad, size_t la) { + long int len; + + assert(ccm_ctx); + + len = dtls_ccm_decrypt_message(&ccm_ctx->ctx, 8 /* M */, + max(2, 15 - DTLS_CCM_NONCE_SIZE), + nounce, + buf, srclen, + aad, la); + return len; +} + +#ifdef DTLS_PSK +int +dtls_psk_pre_master_secret(unsigned char *key, size_t keylen, + unsigned char *result, size_t result_len) { + unsigned char *p = result; + + if (result_len < (2 * (sizeof(uint16) + keylen))) { + return -1; + } + + dtls_int_to_uint16(p, keylen); + p += sizeof(uint16); + + memset(p, 0, keylen); + p += keylen; + + memcpy(p, result, sizeof(uint16)); + p += sizeof(uint16); + + memcpy(p, key, keylen); + + return 2 * (sizeof(uint16) + keylen); +} +#endif /* DTLS_PSK */ + +#ifdef DTLS_ECC +static void dtls_ec_key_to_uint32(const unsigned char *key, size_t key_size, + uint32_t *result) { + int i; + + for (i = (key_size / sizeof(uint32_t)) - 1; i >= 0 ; i--) { + *result = dtls_uint32_to_int(&key[i * sizeof(uint32_t)]); + result++; + } +} + +static void dtls_ec_key_from_uint32(const uint32_t *key, size_t key_size, + unsigned char *result) { + int i; + + for (i = (key_size / sizeof(uint32_t)) - 1; i >= 0 ; i--) { + dtls_int_to_uint32(result, key[i]); + result += 4; + } +} + +int dtls_ec_key_from_uint32_asn1(const uint32_t *key, size_t key_size, + unsigned char *buf) { + int i; + unsigned char *buf_orig = buf; + int first = 1; + + for (i = (key_size / sizeof(uint32_t)) - 1; i >= 0 ; i--) { + if (key[i] == 0) + continue; + /* the first bit has to be set to zero, to indicate a poritive integer */ + if (first && key[i] & 0x80000000) { + *buf = 0; + buf++; + dtls_int_to_uint32(buf, key[i]); + buf += 4; + } else if (first && !(key[i] & 0xFF800000)) { + buf[0] = (key[i] >> 16) & 0xff; + buf[1] = (key[i] >> 8) & 0xff; + buf[2] = key[i] & 0xff; + buf += 3; + } else if (first && !(key[i] & 0xFFFF8000)) { + buf[0] = (key[i] >> 8) & 0xff; + buf[1] = key[i] & 0xff; + buf += 2; + } else if (first && !(key[i] & 0xFFFFFF80)) { + buf[0] = key[i] & 0xff; + buf += 1; + } else { + dtls_int_to_uint32(buf, key[i]); + buf += 4; + } + first = 0; + } + return buf - buf_orig; +} + +int dtls_ecdh_pre_master_secret(unsigned char *priv_key, + unsigned char *pub_key_x, + unsigned char *pub_key_y, + size_t key_size, + unsigned char *result, + size_t result_len) { + uint32_t priv[8]; + uint32_t pub_x[8]; + uint32_t pub_y[8]; + uint32_t result_x[8]; + uint32_t result_y[8]; + + if (result_len < key_size) { + return -1; + } + + dtls_ec_key_to_uint32(priv_key, key_size, priv); + dtls_ec_key_to_uint32(pub_key_x, key_size, pub_x); + dtls_ec_key_to_uint32(pub_key_y, key_size, pub_y); + + ecc_ecdh(pub_x, pub_y, priv, result_x, result_y); + + dtls_ec_key_from_uint32(result_x, key_size, result); + return key_size; +} + +void +dtls_ecdsa_generate_key(unsigned char *priv_key, + unsigned char *pub_key_x, + unsigned char *pub_key_y, + size_t key_size) { + uint32_t priv[8]; + uint32_t pub_x[8]; + uint32_t pub_y[8]; + + do { + dtls_prng((unsigned char *)priv, key_size); + } while (!ecc_is_valid_key(priv)); + + ecc_gen_pub_key(priv, pub_x, pub_y); + + dtls_ec_key_from_uint32(priv, key_size, priv_key); + dtls_ec_key_from_uint32(pub_x, key_size, pub_key_x); + dtls_ec_key_from_uint32(pub_y, key_size, pub_key_y); +} + +/* rfc4492#section-5.4 */ +void +dtls_ecdsa_create_sig_hash(const unsigned char *priv_key, size_t key_size, + const unsigned char *sign_hash, size_t sign_hash_size, + uint32_t point_r[9], uint32_t point_s[9]) { + int ret; + uint32_t priv[8]; + uint32_t hash[8]; + uint32_t rand[8]; + + dtls_ec_key_to_uint32(priv_key, key_size, priv); + dtls_ec_key_to_uint32(sign_hash, sign_hash_size, hash); + do { + dtls_prng((unsigned char *)rand, key_size); + ret = ecc_ecdsa_sign(priv, hash, rand, point_r, point_s); + } while (ret); +} + +void +dtls_ecdsa_create_sig(const unsigned char *priv_key, size_t key_size, + const unsigned char *client_random, size_t client_random_size, + const unsigned char *server_random, size_t server_random_size, + const unsigned char *keyx_params, size_t keyx_params_size, + uint32_t point_r[9], uint32_t point_s[9]) { + dtls_hash_ctx data; + unsigned char sha256hash[DTLS_HMAC_DIGEST_SIZE]; + + dtls_hash_init(&data); + dtls_hash_update(&data, client_random, client_random_size); + dtls_hash_update(&data, server_random, server_random_size); + dtls_hash_update(&data, keyx_params, keyx_params_size); + dtls_hash_finalize(sha256hash, &data); + + dtls_ecdsa_create_sig_hash(priv_key, key_size, sha256hash, + sizeof(sha256hash), point_r, point_s); +} + +/* rfc4492#section-5.4 */ +int +dtls_ecdsa_verify_sig_hash(const unsigned char *pub_key_x, + const unsigned char *pub_key_y, size_t key_size, + const unsigned char *sign_hash, size_t sign_hash_size, + unsigned char *result_r, unsigned char *result_s) { + uint32_t pub_x[8]; + uint32_t pub_y[8]; + uint32_t hash[8]; + uint32_t point_r[8]; + uint32_t point_s[8]; + + dtls_ec_key_to_uint32(pub_key_x, key_size, pub_x); + dtls_ec_key_to_uint32(pub_key_y, key_size, pub_y); + dtls_ec_key_to_uint32(result_r, key_size, point_r); + dtls_ec_key_to_uint32(result_s, key_size, point_s); + dtls_ec_key_to_uint32(sign_hash, sign_hash_size, hash); + + return ecc_ecdsa_validate(pub_x, pub_y, hash, point_r, point_s); +} + +int +dtls_ecdsa_verify_sig(const unsigned char *pub_key_x, + const unsigned char *pub_key_y, size_t key_size, + const unsigned char *client_random, size_t client_random_size, + const unsigned char *server_random, size_t server_random_size, + const unsigned char *keyx_params, size_t keyx_params_size, + unsigned char *result_r, unsigned char *result_s) { + dtls_hash_ctx data; + unsigned char sha256hash[DTLS_HMAC_DIGEST_SIZE]; + + dtls_hash_init(&data); + dtls_hash_update(&data, client_random, client_random_size); + dtls_hash_update(&data, server_random, server_random_size); + dtls_hash_update(&data, keyx_params, keyx_params_size); + dtls_hash_finalize(sha256hash, &data); + + return dtls_ecdsa_verify_sig_hash(pub_key_x, pub_key_y, key_size, sha256hash, + sizeof(sha256hash), result_r, result_s); +} +#endif /* DTLS_ECC */ + +int +dtls_encrypt(const unsigned char *src, size_t length, + unsigned char *buf, + unsigned char *nounce, + unsigned char *key, size_t keylen, + const unsigned char *aad, size_t la) +{ + int ret; + struct dtls_cipher_context_t *ctx = dtls_cipher_context_get(); + + ret = rijndael_set_key_enc_only(&ctx->data.ctx, key, 8 * keylen); + if (ret < 0) { + /* cleanup everything in case the key has the wrong size */ + dtls_warn("cannot set rijndael key\n"); + goto error; + } + + if (src != buf) + memmove(buf, src, length); + ret = dtls_ccm_encrypt(&ctx->data, src, length, buf, nounce, aad, la); + +error: + dtls_cipher_context_release(); + return ret; +} + +int +dtls_decrypt(const unsigned char *src, size_t length, + unsigned char *buf, + unsigned char *nounce, + unsigned char *key, size_t keylen, + const unsigned char *aad, size_t la) +{ + int ret; + struct dtls_cipher_context_t *ctx = dtls_cipher_context_get(); + + ret = rijndael_set_key_enc_only(&ctx->data.ctx, key, 8 * keylen); + if (ret < 0) { + /* cleanup everything in case the key has the wrong size */ + dtls_warn("cannot set rijndael key\n"); + goto error; + } + + if (src != buf) + memmove(buf, src, length); + ret = dtls_ccm_decrypt(&ctx->data, src, length, buf, nounce, aad, la); + +error: + dtls_cipher_context_release(); + return ret; +} +
diff --git a/crypto.h b/crypto.h new file mode 100644 index 0000000..6f7e79e --- /dev/null +++ b/crypto.h
@@ -0,0 +1,350 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * Hauke Mehrtens - memory optimization, ECC integration + * + *******************************************************************************/ + +#ifndef _DTLS_CRYPTO_H_ +#define _DTLS_CRYPTO_H_ + +#include <stdlib.h> /* for rand() and srand() */ +#include <stdint.h> + +#include "aes/rijndael.h" + +#include "global.h" +#include "state.h" +#include "numeric.h" +#include "hmac.h" +#include "ccm.h" + +/* TLS_PSK_WITH_AES_128_CCM_8 */ +#define DTLS_MAC_KEY_LENGTH 0 +#define DTLS_KEY_LENGTH 16 /* AES-128 */ +#define DTLS_BLK_LENGTH 16 /* AES-128 */ +#define DTLS_MAC_LENGTH DTLS_HMAC_DIGEST_SIZE +#define DTLS_IV_LENGTH 4 /* length of nonce_explicit */ + +/** + * Maximum size of the generated keyblock. Note that MAX_KEYBLOCK_LENGTH must + * be large enough to hold the pre_master_secret, i.e. twice the length of the + * pre-shared key + 1. + */ +#define MAX_KEYBLOCK_LENGTH \ + (2 * DTLS_MAC_KEY_LENGTH + 2 * DTLS_KEY_LENGTH + 2 * DTLS_IV_LENGTH) + +/** Length of DTLS master_secret */ +#define DTLS_MASTER_SECRET_LENGTH 48 +#define DTLS_RANDOM_LENGTH 32 + +typedef enum { AES128=0 +} dtls_crypto_alg; + +typedef enum { + DTLS_ECDH_CURVE_SECP256R1 +} dtls_ecdh_curve; + +/** Crypto context for TLS_PSK_WITH_AES_128_CCM_8 cipher suite. */ +typedef struct { + rijndael_ctx ctx; /**< AES-128 encryption context */ +} aes128_ccm_t; + +typedef struct dtls_cipher_context_t { + /** numeric identifier of this cipher suite in host byte order. */ + aes128_ccm_t data; /**< The crypto context */ +} dtls_cipher_context_t; + +typedef struct { + uint8 own_eph_priv[32]; + uint8 other_eph_pub_x[32]; + uint8 other_eph_pub_y[32]; + uint8 other_pub_x[32]; + uint8 other_pub_y[32]; +} dtls_handshake_parameters_ecdsa_t; + +/* This is the maximal supported length of the psk client identity and psk + * server identity hint */ +#define DTLS_PSK_MAX_CLIENT_IDENTITY_LEN 32 + +/* This is the maximal supported length of the pre-shared key. */ +#define DTLS_PSK_MAX_KEY_LEN DTLS_KEY_LENGTH + +typedef struct { + uint16_t id_length; + unsigned char identity[DTLS_PSK_MAX_CLIENT_IDENTITY_LEN]; +} dtls_handshake_parameters_psk_t; + +typedef struct { + dtls_compression_t compression; /**< compression method */ + + dtls_cipher_t cipher; /**< cipher type */ + uint16_t epoch; /**< counter for cipher state changes*/ + uint64_t rseq; /**< sequence number of last record sent */ + + /** + * The key block generated from PRF applied to client and server + * random bytes. The actual size is given by the selected cipher and + * can be calculated using dtls_kb_size(). Use \c dtls_kb_ macros to + * access the components of the key block. + */ + uint8 key_block[MAX_KEYBLOCK_LENGTH]; +} dtls_security_parameters_t; + +struct netq_t; + +typedef struct { + union { + struct random_t { + uint8 client[DTLS_RANDOM_LENGTH]; /**< client random gmt and bytes */ + uint8 server[DTLS_RANDOM_LENGTH]; /**< server random gmt and bytes */ + } random; + /** the session's master secret */ + uint8 master_secret[DTLS_MASTER_SECRET_LENGTH]; + } tmp; + struct netq_t *reorder_queue; /**< the packets to reorder */ + dtls_hs_state_t hs_state; /**< handshake protocol status */ + + dtls_compression_t compression; /**< compression method */ + dtls_cipher_t cipher; /**< cipher type */ + unsigned int do_client_auth:1; + union { +#ifdef DTLS_ECC + dtls_handshake_parameters_ecdsa_t ecdsa; +#endif /* DTLS_ECC */ +#ifdef DTLS_PSK + dtls_handshake_parameters_psk_t psk; +#endif /* DTLS_PSK */ + } keyx; +} dtls_handshake_parameters_t; + +/* The following macros provide access to the components of the + * key_block in the security parameters. */ + +#define dtls_kb_client_mac_secret(Param, Role) ((Param)->key_block) +#define dtls_kb_server_mac_secret(Param, Role) \ + (dtls_kb_client_mac_secret(Param, Role) + DTLS_MAC_KEY_LENGTH) +#define dtls_kb_remote_mac_secret(Param, Role) \ + ((Role) == DTLS_SERVER \ + ? dtls_kb_client_mac_secret(Param, Role) \ + : dtls_kb_server_mac_secret(Param, Role)) +#define dtls_kb_local_mac_secret(Param, Role) \ + ((Role) == DTLS_CLIENT \ + ? dtls_kb_client_mac_secret(Param, Role) \ + : dtls_kb_server_mac_secret(Param, Role)) +#define dtls_kb_mac_secret_size(Param, Role) DTLS_MAC_KEY_LENGTH +#define dtls_kb_client_write_key(Param, Role) \ + (dtls_kb_server_mac_secret(Param, Role) + DTLS_MAC_KEY_LENGTH) +#define dtls_kb_server_write_key(Param, Role) \ + (dtls_kb_client_write_key(Param, Role) + DTLS_KEY_LENGTH) +#define dtls_kb_remote_write_key(Param, Role) \ + ((Role) == DTLS_SERVER \ + ? dtls_kb_client_write_key(Param, Role) \ + : dtls_kb_server_write_key(Param, Role)) +#define dtls_kb_local_write_key(Param, Role) \ + ((Role) == DTLS_CLIENT \ + ? dtls_kb_client_write_key(Param, Role) \ + : dtls_kb_server_write_key(Param, Role)) +#define dtls_kb_key_size(Param, Role) DTLS_KEY_LENGTH +#define dtls_kb_client_iv(Param, Role) \ + (dtls_kb_server_write_key(Param, Role) + DTLS_KEY_LENGTH) +#define dtls_kb_server_iv(Param, Role) \ + (dtls_kb_client_iv(Param, Role) + DTLS_IV_LENGTH) +#define dtls_kb_remote_iv(Param, Role) \ + ((Role) == DTLS_SERVER \ + ? dtls_kb_client_iv(Param, Role) \ + : dtls_kb_server_iv(Param, Role)) +#define dtls_kb_local_iv(Param, Role) \ + ((Role) == DTLS_CLIENT \ + ? dtls_kb_client_iv(Param, Role) \ + : dtls_kb_server_iv(Param, Role)) +#define dtls_kb_iv_size(Param, Role) DTLS_IV_LENGTH + +#define dtls_kb_size(Param, Role) \ + (2 * (dtls_kb_mac_secret_size(Param, Role) + \ + dtls_kb_key_size(Param, Role) + dtls_kb_iv_size(Param, Role))) + +/* just for consistency */ +#define dtls_kb_digest_size(Param, Role) DTLS_MAC_LENGTH + +/** + * Expands the secret and key to a block of DTLS_HMAC_MAX + * size according to the algorithm specified in section 5 of + * RFC 4346. + * + * \param h Identifier of the hash function to use. + * \param key The secret. + * \param keylen Length of \p key. + * \param seed The seed. + * \param seedlen Length of \p seed. + * \param buf Output buffer where the result is XORed into + * The buffe must be capable to hold at least + * \p buflen bytes. + * \return The actual number of bytes written to \p buf or 0 + * on error. + */ +size_t dtls_p_hash(dtls_hashfunc_t h, + const unsigned char *key, size_t keylen, + const unsigned char *label, size_t labellen, + const unsigned char *random1, size_t random1len, + const unsigned char *random2, size_t random2len, + unsigned char *buf, size_t buflen); + +/** + * This function implements the TLS PRF for DTLS_VERSION. For version + * 1.0, the PRF is P_MD5 ^ P_SHA1 while version 1.2 uses + * P_SHA256. Currently, the actual PRF is selected at compile time. + */ +size_t dtls_prf(const unsigned char *key, size_t keylen, + const unsigned char *label, size_t labellen, + const unsigned char *random1, size_t random1len, + const unsigned char *random2, size_t random2len, + unsigned char *buf, size_t buflen); + +/** + * Calculates MAC for record + cleartext packet and places the result + * in \p buf. The given \p hmac_ctx must be initialized with the HMAC + * function to use and the proper secret. As the DTLS mac calculation + * requires data from the record header, \p record must point to a + * buffer of at least \c sizeof(dtls_record_header_t) bytes. Usually, + * the remaining packet will be encrypted, therefore, the cleartext + * is passed separately in \p packet. + * + * \param hmac_ctx The HMAC context to use for MAC calculation. + * \param record The record header. + * \param packet Cleartext payload to apply the MAC to. + * \param length Size of \p packet. + * \param buf A result buffer that is large enough to hold + * the generated digest. + */ +void dtls_mac(dtls_hmac_context_t *hmac_ctx, + const unsigned char *record, + const unsigned char *packet, size_t length, + unsigned char *buf); + +/** + * Encrypts the specified \p src of given \p length, writing the + * result to \p buf. The cipher implementation may add more data to + * the result buffer such as an initialization vector or padding + * (e.g. for block cipers in CBC mode). The caller therefore must + * ensure that \p buf provides sufficient storage to hold the result. + * Usually this means ( 2 + \p length / blocksize ) * blocksize. The + * function returns a value less than zero on error or otherwise the + * number of bytes written. + * + * \param ctx The cipher context to use. + * \param src The data to encrypt. + * \param length The actual size of of \p src. + * \param buf The result buffer. \p src and \p buf must not + * overlap. + * \param aad additional data for AEAD ciphers + * \param aad_length actual size of @p aad + * \return The number of encrypted bytes on success, less than zero + * otherwise. + */ +int dtls_encrypt(const unsigned char *src, size_t length, + unsigned char *buf, + unsigned char *nounce, + unsigned char *key, size_t keylen, + const unsigned char *aad, size_t aad_length); + +/** + * Decrypts the given buffer \p src of given \p length, writing the + * result to \p buf. The function returns \c -1 in case of an error, + * or the number of bytes written. Note that for block ciphers, \p + * length must be a multiple of the cipher's block size. A return + * value between \c 0 and the actual length indicates that only \c n-1 + * block have been processed. Unlike dtls_encrypt(), the source + * and destination of dtls_decrypt() may overlap. + * + * \param ctx The cipher context to use. + * \param src The buffer to decrypt. + * \param length The length of the input buffer. + * \param buf The result buffer. + * \param aad additional authentication data for AEAD ciphers + * \param aad_length actual size of @p aad + * \return Less than zero on error, the number of decrypted bytes + * otherwise. + */ +int dtls_decrypt(const unsigned char *src, size_t length, + unsigned char *buf, + unsigned char *nounce, + unsigned char *key, size_t keylen, + const unsigned char *a_data, size_t a_data_length); + +/* helper functions */ + +/** + * Generates pre_master_sercet from given PSK and fills the result + * according to the "plain PSK" case in section 2 of RFC 4279. + * Diffie-Hellman and RSA key exchange are currently not supported. + * + * @param key The shared key. + * @param keylen Length of @p key in bytes. + * @param result The derived pre master secret. + * @return The actual length of @p result. + */ +int dtls_psk_pre_master_secret(unsigned char *key, size_t keylen, + unsigned char *result, size_t result_len); + +#define DTLS_EC_KEY_SIZE 32 + +int dtls_ecdh_pre_master_secret(unsigned char *priv_key, + unsigned char *pub_key_x, + unsigned char *pub_key_y, + size_t key_size, + unsigned char *result, + size_t result_len); + +void dtls_ecdsa_generate_key(unsigned char *priv_key, + unsigned char *pub_key_x, + unsigned char *pub_key_y, + size_t key_size); + +void dtls_ecdsa_create_sig_hash(const unsigned char *priv_key, size_t key_size, + const unsigned char *sign_hash, size_t sign_hash_size, + uint32_t point_r[9], uint32_t point_s[9]); + +void dtls_ecdsa_create_sig(const unsigned char *priv_key, size_t key_size, + const unsigned char *client_random, size_t client_random_size, + const unsigned char *server_random, size_t server_random_size, + const unsigned char *keyx_params, size_t keyx_params_size, + uint32_t point_r[9], uint32_t point_s[9]); + +int dtls_ecdsa_verify_sig_hash(const unsigned char *pub_key_x, + const unsigned char *pub_key_y, size_t key_size, + const unsigned char *sign_hash, size_t sign_hash_size, + unsigned char *result_r, unsigned char *result_s); + +int dtls_ecdsa_verify_sig(const unsigned char *pub_key_x, + const unsigned char *pub_key_y, size_t key_size, + const unsigned char *client_random, size_t client_random_size, + const unsigned char *server_random, size_t server_random_size, + const unsigned char *keyx_params, size_t keyx_params_size, + unsigned char *result_r, unsigned char *result_s); + +int dtls_ec_key_from_uint32_asn1(const uint32_t *key, size_t key_size, + unsigned char *buf); + + +dtls_handshake_parameters_t *dtls_handshake_new(); + +void dtls_handshake_free(dtls_handshake_parameters_t *handshake); + +dtls_security_parameters_t *dtls_security_new(); + +void dtls_security_free(dtls_security_parameters_t *security); +void crypto_init(); + +#endif /* _DTLS_CRYPTO_H_ */ +
diff --git a/debug.c b/debug.c new file mode 100644 index 0000000..6fd820d --- /dev/null +++ b/debug.c
@@ -0,0 +1,373 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * Hauke Mehrtens - memory optimization, ECC integration + * + *******************************************************************************/ + +#include "tinydtls.h" +#include "dtls_config.h" + +#if defined(HAVE_ASSERT_H) && !defined(assert) +#include <assert.h> +#endif + +#include <stdarg.h> +#include <stdio.h> + +#ifdef HAVE_ARPA_INET_H +#include <arpa/inet.h> +#endif + +#ifdef HAVE_TIME_H +#include <time.h> +#endif + +#include "global.h" +#include "debug.h" + +#ifndef min +#define min(a,b) ((a) < (b) ? (a) : (b)) +#endif + +static int maxlog = DTLS_LOG_WARN; /* default maximum log level */ + +const char *dtls_package_name() { + return PACKAGE_NAME; +} + +const char *dtls_package_version() { + return PACKAGE_VERSION; +} + +log_t +dtls_get_log_level() { + return maxlog; +} + +void +dtls_set_log_level(log_t level) { +#ifdef NDEBUG + maxlog = min(level, DTLS_LOG_INFO); +#else /* !NDEBUG */ + maxlog = level; +#endif /* NDEBUG */ +} + +/* this array has the same order as the type log_t */ +static char *loglevels[] = { + "EMRG", "ALRT", "CRIT", "WARN", "NOTE", "INFO", "DEBG" +}; + +#ifdef HAVE_TIME_H + +static inline size_t +print_timestamp(char *s, size_t len, time_t t) { + struct tm *tmp; + tmp = localtime(&t); + return strftime(s, len, "%b %d %H:%M:%S", tmp); +} + +#else /* alternative implementation: just print the timestamp */ + +static inline size_t +print_timestamp(char *s, size_t len, clock_time_t t) { +#ifdef HAVE_SNPRINTF + return snprintf(s, len, "%u.%03u", + (unsigned int)(t / CLOCK_SECOND), + (unsigned int)(t % CLOCK_SECOND)); +#else /* HAVE_SNPRINTF */ + /* @todo do manual conversion of timestamp */ + return 0; +#endif /* HAVE_SNPRINTF */ +} + +#endif /* HAVE_TIME_H */ + +#ifndef NDEBUG + +/** + * A length-safe strlen() fake. + * + * @param s The string to count characters != 0. + * @param maxlen The maximum length of @p s. + * + * @return The length of @p s. + */ +static inline size_t +dtls_strnlen(const char *s, size_t maxlen) { + size_t n = 0; + while(*s++ && n < maxlen) + ++n; + return n; +} + +static size_t +dsrv_print_addr(const session_t *addr, char *buf, size_t len) { +#ifdef HAVE_ARPA_INET_H + const void *addrptr = NULL; + in_port_t port; + char *p = buf; + + switch (addr->addr.sa.sa_family) { + case AF_INET: + if (len < INET_ADDRSTRLEN) + return 0; + + addrptr = &addr->addr.sin.sin_addr; + port = ntohs(addr->addr.sin.sin_port); + break; + case AF_INET6: + if (len < INET6_ADDRSTRLEN + 2) + return 0; + + *p++ = '['; + + addrptr = &addr->addr.sin6.sin6_addr; + port = ntohs(addr->addr.sin6.sin6_port); + + break; + default: + memcpy(buf, "(unknown address type)", min(22, len)); + return min(22, len); + } + + if (inet_ntop(addr->addr.sa.sa_family, addrptr, p, len) == 0) { + perror("dsrv_print_addr"); + return 0; + } + + p += dtls_strnlen(p, len); + + if (addr->addr.sa.sa_family == AF_INET6) { + if (p < buf + len) { + *p++ = ']'; + } else + return 0; + } + + p += snprintf(p, buf + len - p + 1, ":%d", port); + + return p - buf; +#else /* HAVE_ARPA_INET_H */ +# if WITH_CONTIKI + char *p = buf; +# ifdef UIP_CONF_IPV6 + uint8_t i; + const char hex[] = "0123456789ABCDEF"; + + if (len < 41) + return 0; + + *p++ = '['; + + for (i=0; i < 16; i += 2) { + if (i) { + *p++ = ':'; + } + *p++ = hex[(addr->addr.u8[i] & 0xf0) >> 4]; + *p++ = hex[(addr->addr.u8[i] & 0x0f)]; + *p++ = hex[(addr->addr.u8[i+1] & 0xf0) >> 4]; + *p++ = hex[(addr->addr.u8[i+1] & 0x0f)]; + } + *p++ = ']'; +# else /* UIP_CONF_IPV6 */ +# warning "IPv4 network addresses will not be included in debug output" + + if (len < 21) + return 0; +# endif /* UIP_CONF_IPV6 */ + if (buf + len - p < 6) + return 0; + + p += sprintf(p, ":%d", uip_htons(addr->port)); + + return p - buf; +# else /* WITH_CONTIKI */ + /* TODO: output addresses manually */ +# warning "inet_ntop() not available, network addresses will not be included in debug output" +# endif /* WITH_CONTIKI */ + return 0; +#endif +} + +#endif /* NDEBUG */ + +#ifndef WITH_CONTIKI +void +dsrv_log(log_t level, char *format, ...) { + static char timebuf[32]; + va_list ap; + FILE *log_fd; + + if (maxlog < level) + return; + + log_fd = level <= DTLS_LOG_CRIT ? stderr : stdout; + + if (print_timestamp(timebuf,sizeof(timebuf), time(NULL))) + fprintf(log_fd, "%s ", timebuf); + + if (level <= DTLS_LOG_DEBUG) + fprintf(log_fd, "%s ", loglevels[level]); + + va_start(ap, format); + vfprintf(log_fd, format, ap); + va_end(ap); + fflush(log_fd); +} +#elif defined (HAVE_VPRINTF) /* WITH_CONTIKI */ +void +dsrv_log(log_t level, char *format, ...) { + static char timebuf[32]; + va_list ap; + + if (maxlog < level) + return; + + if (print_timestamp(timebuf,sizeof(timebuf), clock_time())) + PRINTF("%s ", timebuf); + + if (level <= DTLS_LOG_DEBUG) + PRINTF("%s ", loglevels[level]); + + va_start(ap, format); + vprintf(format, ap); + va_end(ap); +} +#endif /* WITH_CONTIKI */ + +#ifndef NDEBUG +/** dumps packets in usual hexdump format */ +void hexdump(const unsigned char *packet, int length) { + int n = 0; + + while (length--) { + if (n % 16 == 0) + printf("%08X ",n); + + printf("%02X ", *packet++); + + n++; + if (n % 8 == 0) { + if (n % 16 == 0) + printf("\n"); + else + printf(" "); + } + } +} + +/** dump as narrow string of hex digits */ +void dump(unsigned char *buf, size_t len) { + while (len--) + printf("%02x", *buf++); +} + +void dtls_dsrv_log_addr(log_t level, const char *name, const session_t *addr) +{ + char addrbuf[73]; + int len; + + len = dsrv_print_addr(addr, addrbuf, sizeof(addrbuf)); + if (!len) + return; + dsrv_log(level, "%s: %s\n", name, addrbuf); +} + +#ifndef WITH_CONTIKI +void +dtls_dsrv_hexdump_log(log_t level, const char *name, const unsigned char *buf, size_t length, int extend) { + static char timebuf[32]; + FILE *log_fd; + int n = 0; + + if (maxlog < level) + return; + + log_fd = level <= DTLS_LOG_CRIT ? stderr : stdout; + + if (print_timestamp(timebuf, sizeof(timebuf), time(NULL))) + fprintf(log_fd, "%s ", timebuf); + + if (level <= DTLS_LOG_DEBUG) + fprintf(log_fd, "%s ", loglevels[level]); + + if (extend) { + fprintf(log_fd, "%s: (%zu bytes):\n", name, length); + + while (length--) { + if (n % 16 == 0) + fprintf(log_fd, "%08X ", n); + + fprintf(log_fd, "%02X ", *buf++); + + n++; + if (n % 8 == 0) { + if (n % 16 == 0) + fprintf(log_fd, "\n"); + else + fprintf(log_fd, " "); + } + } + } else { + fprintf(log_fd, "%s: (%zu bytes): ", name, length); + while (length--) + fprintf(log_fd, "%02X", *buf++); + } + fprintf(log_fd, "\n"); + + fflush(log_fd); +} +#else /* WITH_CONTIKI */ +void +dtls_dsrv_hexdump_log(log_t level, const char *name, const unsigned char *buf, size_t length, int extend) { + static char timebuf[32]; + int n = 0; + + if (maxlog < level) + return; + + if (print_timestamp(timebuf,sizeof(timebuf), clock_time())) + PRINTF("%s ", timebuf); + + if (level >= 0 && level <= DTLS_LOG_DEBUG) + PRINTF("%s ", loglevels[level]); + + if (extend) { + PRINTF("%s: (%zu bytes):\n", name, length); + + while (length--) { + if (n % 16 == 0) + PRINTF("%08X ", n); + + PRINTF("%02X ", *buf++); + + n++; + if (n % 8 == 0) { + if (n % 16 == 0) + PRINTF("\n"); + else + PRINTF(" "); + } + } + } else { + PRINTF("%s: (%zu bytes): ", name, length); + while (length--) + PRINTF("%02X", *buf++); + } + PRINTF("\n"); +} +#endif /* WITH_CONTIKI */ + +#endif /* NDEBUG */
diff --git a/debug.h b/debug.h new file mode 100644 index 0000000..32a7b86 --- /dev/null +++ b/debug.h
@@ -0,0 +1,122 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * Hauke Mehrtens - memory optimization, ECC integration + * + *******************************************************************************/ + +#ifndef _DTLS_DEBUG_H_ +#define _DTLS_DEBUG_H_ + +#include <stdlib.h> + +#include "dtls_config.h" +#include "global.h" +#include "session.h" + +#ifdef WITH_CONTIKI +# ifndef DEBUG +# define DEBUG DEBUG_PRINT +# endif /* DEBUG */ +#include "net/ip/uip-debug.h" + +#ifdef CONTIKI_TARGET_MBXXX +extern char __Stack_Init, _estack; + +static inline void check_stack() { + const char *p = &__Stack_Init; + while (p < &_estack && *p == 0x38) { + p++; + } + + PRINTF("Stack: %d bytes used (%d free)\n", &_estack - p, p - &__Stack_Init); +} +#else /* CONTIKI_TARGET_MBXXX */ +static inline void check_stack() { +} +#endif /* CONTIKI_TARGET_MBXXX */ +#else /* WITH_CONTKI */ +#define PRINTF(...) + +static inline void check_stack() { +} +#endif + +/** Pre-defined log levels akin to what is used in \b syslog. */ +typedef enum { DTLS_LOG_EMERG=0, DTLS_LOG_ALERT, DTLS_LOG_CRIT, DTLS_LOG_WARN, + DTLS_LOG_NOTICE, DTLS_LOG_INFO, DTLS_LOG_DEBUG +} log_t; + +/** Returns a zero-terminated string with the name of this library. */ +const char *dtls_package_name(); + +/** Returns a zero-terminated string with the library version. */ +const char *dtls_package_version(); + +/** Returns the current log level. */ +log_t dtls_get_log_level(); + +/** Sets the log level to the specified value. */ +void dtls_set_log_level(log_t level); + +/** + * Writes the given text to \c stdout. The text is output only when \p + * level is below or equal to the log level that set by + * set_log_level(). */ +#ifdef HAVE_VPRINTF +void dsrv_log(log_t level, char *format, ...); +#else +#define dsrv_log(level, format, ...) PRINTF(format, ##__VA_ARGS__) +#endif + +#ifndef NDEBUG +/** dumps packets in usual hexdump format */ +void hexdump(const unsigned char *packet, int length); + +/** dump as narrow string of hex digits */ +void dump(unsigned char *buf, size_t len); + +void dtls_dsrv_hexdump_log(log_t level, const char *name, const unsigned char *buf, size_t length, int extend); + +void dtls_dsrv_log_addr(log_t level, const char *name, const session_t *addr); + +#else /* NDEBUG */ + +static inline void hexdump(const unsigned char *packet, int length) +{} + +static inline void dump(unsigned char *buf, size_t len) +{} + +static inline void +dtls_dsrv_hexdump_log(log_t level, const char *name, const unsigned char *buf, size_t length, int extend) +{} + +static inline void +dtls_dsrv_log_addr(log_t level, const char *name, const session_t *addr) +{} + +#endif /* NDEBUG */ + +/* A set of convenience macros for common log levels. */ +#define dtls_emerg(...) dsrv_log(DTLS_LOG_EMERG, __VA_ARGS__) +#define dtls_alert(...) dsrv_log(DTLS_LOG_ALERT, __VA_ARGS__) +#define dtls_crit(...) dsrv_log(DTLS_LOG_CRIT, __VA_ARGS__) +#define dtls_warn(...) dsrv_log(DTLS_LOG_WARN, __VA_ARGS__) +#define dtls_notice(...) dsrv_log(DTLS_LOG_NOTICE, __VA_ARGS__) +#define dtls_info(...) dsrv_log(DTLS_LOG_INFO, __VA_ARGS__) +#define dtls_debug(...) dsrv_log(DTLS_LOG_DEBUG, __VA_ARGS__) +#define dtls_debug_hexdump(name, buf, length) dtls_dsrv_hexdump_log(DTLS_LOG_DEBUG, name, buf, length, 1) +#define dtls_debug_dump(name, buf, length) dtls_dsrv_hexdump_log(DTLS_LOG_DEBUG, name, buf, length, 0) + +#endif /* _DTLS_DEBUG_H_ */
diff --git a/doc/Doxyfile.in b/doc/Doxyfile.in new file mode 100644 index 0000000..9f7ffdf --- /dev/null +++ b/doc/Doxyfile.in
@@ -0,0 +1,1551 @@ +# Doxyfile 1.6.3 + +# This file describes the settings to be used by the documentation system +# doxygen (www.doxygen.org) for a project +# +# All text after a hash (#) is considered a comment and will be ignored +# The format is: +# TAG = value [value, ...] +# For lists items can also be appended using: +# TAG += value [value, ...] +# Values that contain spaces should be placed between quotes (" ") + +#--------------------------------------------------------------------------- +# Project related configuration options +#--------------------------------------------------------------------------- + +# This tag specifies the encoding used for all characters in the config file +# that follow. The default is UTF-8 which is also the encoding used for all +# text before the first occurrence of this tag. Doxygen uses libiconv (or the +# iconv built into libc) for the transcoding. See +# http://www.gnu.org/software/libiconv for the list of possible encodings. + +DOXYFILE_ENCODING = UTF-8 + +# The PROJECT_NAME tag is a single word (or a sequence of words surrounded +# by quotes) that should identify the project. + +PROJECT_NAME = @PACKAGE_NAME@ + +# The PROJECT_NUMBER tag can be used to enter a project or revision number. +# This could be handy for archiving the generated documentation or +# if some version control system is used. + +PROJECT_NUMBER = @PACKAGE_VERSION@ + +# The OUTPUT_DIRECTORY tag is used to specify the (relative or absolute) +# base path where the generated documentation will be put. +# If a relative path is entered, it will be relative to the location +# where doxygen was started. If left blank the current directory will be used. + +OUTPUT_DIRECTORY = + +# If the CREATE_SUBDIRS tag is set to YES, then doxygen will create +# 4096 sub-directories (in 2 levels) under the output directory of each output +# format and will distribute the generated files over these directories. +# Enabling this option can be useful when feeding doxygen a huge amount of +# source files, where putting all generated files in the same directory would +# otherwise cause performance problems for the file system. + +CREATE_SUBDIRS = NO + +# The OUTPUT_LANGUAGE tag is used to specify the language in which all +# documentation generated by doxygen is written. Doxygen will use this +# information to generate all constant output in the proper language. +# The default language is English, other supported languages are: +# Afrikaans, Arabic, Brazilian, Catalan, Chinese, Chinese-Traditional, +# Croatian, Czech, Danish, Dutch, Esperanto, Farsi, Finnish, French, German, +# Greek, Hungarian, Italian, Japanese, Japanese-en (Japanese with English +# messages), Korean, Korean-en, Lithuanian, Norwegian, Macedonian, Persian, +# Polish, Portuguese, Romanian, Russian, Serbian, Serbian-Cyrilic, Slovak, +# Slovene, Spanish, Swedish, Ukrainian, and Vietnamese. + +OUTPUT_LANGUAGE = English + +# If the BRIEF_MEMBER_DESC tag is set to YES (the default) Doxygen will +# include brief member descriptions after the members that are listed in +# the file and class documentation (similar to JavaDoc). +# Set to NO to disable this. + +BRIEF_MEMBER_DESC = YES + +# If the REPEAT_BRIEF tag is set to YES (the default) Doxygen will prepend +# the brief description of a member or function before the detailed description. +# Note: if both HIDE_UNDOC_MEMBERS and BRIEF_MEMBER_DESC are set to NO, the +# brief descriptions will be completely suppressed. + +REPEAT_BRIEF = YES + +# This tag implements a quasi-intelligent brief description abbreviator +# that is used to form the text in various listings. Each string +# in this list, if found as the leading text of the brief description, will be +# stripped from the text and the result after processing the whole list, is +# used as the annotated text. Otherwise, the brief description is used as-is. +# If left blank, the following values are used ("$name" is automatically +# replaced with the name of the entity): "The $name class" "The $name widget" +# "The $name file" "is" "provides" "specifies" "contains" +# "represents" "a" "an" "the" + +ABBREVIATE_BRIEF = + +# If the ALWAYS_DETAILED_SEC and REPEAT_BRIEF tags are both set to YES then +# Doxygen will generate a detailed section even if there is only a brief +# description. + +ALWAYS_DETAILED_SEC = NO + +# If the INLINE_INHERITED_MEMB tag is set to YES, doxygen will show all +# inherited members of a class in the documentation of that class as if those +# members were ordinary class members. Constructors, destructors and assignment +# operators of the base classes will not be shown. + +INLINE_INHERITED_MEMB = NO + +# If the FULL_PATH_NAMES tag is set to YES then Doxygen will prepend the full +# path before files name in the file list and in the header files. If set +# to NO the shortest path that makes the file name unique will be used. + +FULL_PATH_NAMES = NO + +# If the FULL_PATH_NAMES tag is set to YES then the STRIP_FROM_PATH tag +# can be used to strip a user-defined part of the path. Stripping is +# only done if one of the specified strings matches the left-hand part of +# the path. The tag can be used to show relative paths in the file list. +# If left blank the directory from which doxygen is run is used as the +# path to strip. + +STRIP_FROM_PATH = + +# The STRIP_FROM_INC_PATH tag can be used to strip a user-defined part of +# the path mentioned in the documentation of a class, which tells +# the reader which header file to include in order to use a class. +# If left blank only the name of the header file containing the class +# definition is used. Otherwise one should specify the include paths that +# are normally passed to the compiler using the -I flag. + +STRIP_FROM_INC_PATH = + +# If the SHORT_NAMES tag is set to YES, doxygen will generate much shorter +# (but less readable) file names. This can be useful is your file systems +# doesn't support long names like on DOS, Mac, or CD-ROM. + +SHORT_NAMES = NO + +# If the JAVADOC_AUTOBRIEF tag is set to YES then Doxygen +# will interpret the first line (until the first dot) of a JavaDoc-style +# comment as the brief description. If set to NO, the JavaDoc +# comments will behave just like regular Qt-style comments +# (thus requiring an explicit @brief command for a brief description.) + +JAVADOC_AUTOBRIEF = NO + +# If the QT_AUTOBRIEF tag is set to YES then Doxygen will +# interpret the first line (until the first dot) of a Qt-style +# comment as the brief description. If set to NO, the comments +# will behave just like regular Qt-style comments (thus requiring +# an explicit \brief command for a brief description.) + +QT_AUTOBRIEF = NO + +# The MULTILINE_CPP_IS_BRIEF tag can be set to YES to make Doxygen +# treat a multi-line C++ special comment block (i.e. a block of //! or /// +# comments) as a brief description. This used to be the default behaviour. +# The new default is to treat a multi-line C++ comment block as a detailed +# description. Set this tag to YES if you prefer the old behaviour instead. + +MULTILINE_CPP_IS_BRIEF = NO + +# If the INHERIT_DOCS tag is set to YES (the default) then an undocumented +# member inherits the documentation from any documented member that it +# re-implements. + +INHERIT_DOCS = YES + +# If the SEPARATE_MEMBER_PAGES tag is set to YES, then doxygen will produce +# a new page for each member. If set to NO, the documentation of a member will +# be part of the file/class/namespace that contains it. + +SEPARATE_MEMBER_PAGES = NO + +# The TAB_SIZE tag can be used to set the number of spaces in a tab. +# Doxygen uses this value to replace tabs by spaces in code fragments. + +TAB_SIZE = 4 + +# This tag can be used to specify a number of aliases that acts +# as commands in the documentation. An alias has the form "name=value". +# For example adding "sideeffect=\par Side Effects:\n" will allow you to +# put the command \sideeffect (or @sideeffect) in the documentation, which +# will result in a user-defined paragraph with heading "Side Effects:". +# You can put \n's in the value part of an alias to insert newlines. + +ALIASES = + +# Set the OPTIMIZE_OUTPUT_FOR_C tag to YES if your project consists of C +# sources only. Doxygen will then generate output that is more tailored for C. +# For instance, some of the names that are used will be different. The list +# of all members will be omitted, etc. + +OPTIMIZE_OUTPUT_FOR_C = YES + +# Set the OPTIMIZE_OUTPUT_JAVA tag to YES if your project consists of Java +# sources only. Doxygen will then generate output that is more tailored for +# Java. For instance, namespaces will be presented as packages, qualified +# scopes will look different, etc. + +OPTIMIZE_OUTPUT_JAVA = NO + +# Set the OPTIMIZE_FOR_FORTRAN tag to YES if your project consists of Fortran +# sources only. Doxygen will then generate output that is more tailored for +# Fortran. + +OPTIMIZE_FOR_FORTRAN = NO + +# Set the OPTIMIZE_OUTPUT_VHDL tag to YES if your project consists of VHDL +# sources. Doxygen will then generate output that is tailored for +# VHDL. + +OPTIMIZE_OUTPUT_VHDL = NO + +# Doxygen selects the parser to use depending on the extension of the files it parses. +# With this tag you can assign which parser to use for a given extension. +# Doxygen has a built-in mapping, but you can override or extend it using this tag. +# The format is ext=language, where ext is a file extension, and language is one of +# the parsers supported by doxygen: IDL, Java, Javascript, C#, C, C++, D, PHP, +# Objective-C, Python, Fortran, VHDL, C, C++. For instance to make doxygen treat +# .inc files as Fortran files (default is PHP), and .f files as C (default is Fortran), +# use: inc=Fortran f=C. Note that for custom extensions you also need to set FILE_PATTERNS otherwise the files are not read by doxygen. + +EXTENSION_MAPPING = + +# If you use STL classes (i.e. std::string, std::vector, etc.) but do not want +# to include (a tag file for) the STL sources as input, then you should +# set this tag to YES in order to let doxygen match functions declarations and +# definitions whose arguments contain STL classes (e.g. func(std::string); v.s. +# func(std::string) {}). This also make the inheritance and collaboration +# diagrams that involve STL classes more complete and accurate. + +BUILTIN_STL_SUPPORT = NO + +# If you use Microsoft's C++/CLI language, you should set this option to YES to +# enable parsing support. + +CPP_CLI_SUPPORT = NO + +# Set the SIP_SUPPORT tag to YES if your project consists of sip sources only. +# Doxygen will parse them like normal C++ but will assume all classes use public +# instead of private inheritance when no explicit protection keyword is present. + +SIP_SUPPORT = NO + +# For Microsoft's IDL there are propget and propput attributes to indicate getter +# and setter methods for a property. Setting this option to YES (the default) +# will make doxygen to replace the get and set methods by a property in the +# documentation. This will only work if the methods are indeed getting or +# setting a simple type. If this is not the case, or you want to show the +# methods anyway, you should set this option to NO. + +IDL_PROPERTY_SUPPORT = YES + +# If member grouping is used in the documentation and the DISTRIBUTE_GROUP_DOC +# tag is set to YES, then doxygen will reuse the documentation of the first +# member in the group (if any) for the other members of the group. By default +# all members of a group must be documented explicitly. + +DISTRIBUTE_GROUP_DOC = NO + +# Set the SUBGROUPING tag to YES (the default) to allow class member groups of +# the same type (for instance a group of public functions) to be put as a +# subgroup of that type (e.g. under the Public Functions section). Set it to +# NO to prevent subgrouping. Alternatively, this can be done per class using +# the \nosubgrouping command. + +SUBGROUPING = YES + +# When TYPEDEF_HIDES_STRUCT is enabled, a typedef of a struct, union, or enum +# is documented as struct, union, or enum with the name of the typedef. So +# typedef struct TypeS {} TypeT, will appear in the documentation as a struct +# with name TypeT. When disabled the typedef will appear as a member of a file, +# namespace, or class. And the struct will be named TypeS. This can typically +# be useful for C code in case the coding convention dictates that all compound +# types are typedef'ed and only the typedef is referenced, never the tag name. + +TYPEDEF_HIDES_STRUCT = NO + +# The SYMBOL_CACHE_SIZE determines the size of the internal cache use to +# determine which symbols to keep in memory and which to flush to disk. +# When the cache is full, less often used symbols will be written to disk. +# For small to medium size projects (<1000 input files) the default value is +# probably good enough. For larger projects a too small cache size can cause +# doxygen to be busy swapping symbols to and from disk most of the time +# causing a significant performance penality. +# If the system has enough physical memory increasing the cache will improve the +# performance by keeping more symbols in memory. Note that the value works on +# a logarithmic scale so increasing the size by one will rougly double the +# memory usage. The cache size is given by this formula: +# 2^(16+SYMBOL_CACHE_SIZE). The valid range is 0..9, the default is 0, +# corresponding to a cache size of 2^16 = 65536 symbols + +SYMBOL_CACHE_SIZE = 0 + +#--------------------------------------------------------------------------- +# Build related configuration options +#--------------------------------------------------------------------------- + +# If the EXTRACT_ALL tag is set to YES doxygen will assume all entities in +# documentation are documented, even if no documentation was available. +# Private class members and static file members will be hidden unless +# the EXTRACT_PRIVATE and EXTRACT_STATIC tags are set to YES + +EXTRACT_ALL = YES + +# If the EXTRACT_PRIVATE tag is set to YES all private members of a class +# will be included in the documentation. + +EXTRACT_PRIVATE = NO + +# If the EXTRACT_STATIC tag is set to YES all static members of a file +# will be included in the documentation. + +EXTRACT_STATIC = YES + +# If the EXTRACT_LOCAL_CLASSES tag is set to YES classes (and structs) +# defined locally in source files will be included in the documentation. +# If set to NO only classes defined in header files are included. + +EXTRACT_LOCAL_CLASSES = YES + +# This flag is only useful for Objective-C code. When set to YES local +# methods, which are defined in the implementation section but not in +# the interface are included in the documentation. +# If set to NO (the default) only methods in the interface are included. + +EXTRACT_LOCAL_METHODS = NO + +# If this flag is set to YES, the members of anonymous namespaces will be +# extracted and appear in the documentation as a namespace called +# 'anonymous_namespace{file}', where file will be replaced with the base +# name of the file that contains the anonymous namespace. By default +# anonymous namespace are hidden. + +EXTRACT_ANON_NSPACES = NO + +# If the HIDE_UNDOC_MEMBERS tag is set to YES, Doxygen will hide all +# undocumented members of documented classes, files or namespaces. +# If set to NO (the default) these members will be included in the +# various overviews, but no documentation section is generated. +# This option has no effect if EXTRACT_ALL is enabled. + +HIDE_UNDOC_MEMBERS = NO + +# If the HIDE_UNDOC_CLASSES tag is set to YES, Doxygen will hide all +# undocumented classes that are normally visible in the class hierarchy. +# If set to NO (the default) these classes will be included in the various +# overviews. This option has no effect if EXTRACT_ALL is enabled. + +HIDE_UNDOC_CLASSES = NO + +# If the HIDE_FRIEND_COMPOUNDS tag is set to YES, Doxygen will hide all +# friend (class|struct|union) declarations. +# If set to NO (the default) these declarations will be included in the +# documentation. + +HIDE_FRIEND_COMPOUNDS = NO + +# If the HIDE_IN_BODY_DOCS tag is set to YES, Doxygen will hide any +# documentation blocks found inside the body of a function. +# If set to NO (the default) these blocks will be appended to the +# function's detailed documentation block. + +HIDE_IN_BODY_DOCS = NO + +# The INTERNAL_DOCS tag determines if documentation +# that is typed after a \internal command is included. If the tag is set +# to NO (the default) then the documentation will be excluded. +# Set it to YES to include the internal documentation. + +INTERNAL_DOCS = NO + +# If the CASE_SENSE_NAMES tag is set to NO then Doxygen will only generate +# file names in lower-case letters. If set to YES upper-case letters are also +# allowed. This is useful if you have classes or files whose names only differ +# in case and if your file system supports case sensitive file names. Windows +# and Mac users are advised to set this option to NO. + +CASE_SENSE_NAMES = YES + +# If the HIDE_SCOPE_NAMES tag is set to NO (the default) then Doxygen +# will show members with their full class and namespace scopes in the +# documentation. If set to YES the scope will be hidden. + +HIDE_SCOPE_NAMES = NO + +# If the SHOW_INCLUDE_FILES tag is set to YES (the default) then Doxygen +# will put a list of the files that are included by a file in the documentation +# of that file. + +SHOW_INCLUDE_FILES = YES + +# If the FORCE_LOCAL_INCLUDES tag is set to YES then Doxygen +# will list include files with double quotes in the documentation +# rather than with sharp brackets. + +FORCE_LOCAL_INCLUDES = NO + +# If the INLINE_INFO tag is set to YES (the default) then a tag [inline] +# is inserted in the documentation for inline members. + +INLINE_INFO = YES + +# If the SORT_MEMBER_DOCS tag is set to YES (the default) then doxygen +# will sort the (detailed) documentation of file and class members +# alphabetically by member name. If set to NO the members will appear in +# declaration order. + +SORT_MEMBER_DOCS = YES + +# If the SORT_BRIEF_DOCS tag is set to YES then doxygen will sort the +# brief documentation of file, namespace and class members alphabetically +# by member name. If set to NO (the default) the members will appear in +# declaration order. + +SORT_BRIEF_DOCS = NO + +# If the SORT_MEMBERS_CTORS_1ST tag is set to YES then doxygen will sort the (brief and detailed) documentation of class members so that constructors and destructors are listed first. If set to NO (the default) the constructors will appear in the respective orders defined by SORT_MEMBER_DOCS and SORT_BRIEF_DOCS. This tag will be ignored for brief docs if SORT_BRIEF_DOCS is set to NO and ignored for detailed docs if SORT_MEMBER_DOCS is set to NO. + +SORT_MEMBERS_CTORS_1ST = NO + +# If the SORT_GROUP_NAMES tag is set to YES then doxygen will sort the +# hierarchy of group names into alphabetical order. If set to NO (the default) +# the group names will appear in their defined order. + +SORT_GROUP_NAMES = NO + +# If the SORT_BY_SCOPE_NAME tag is set to YES, the class list will be +# sorted by fully-qualified names, including namespaces. If set to +# NO (the default), the class list will be sorted only by class name, +# not including the namespace part. +# Note: This option is not very useful if HIDE_SCOPE_NAMES is set to YES. +# Note: This option applies only to the class list, not to the +# alphabetical list. + +SORT_BY_SCOPE_NAME = NO + +# The GENERATE_TODOLIST tag can be used to enable (YES) or +# disable (NO) the todo list. This list is created by putting \todo +# commands in the documentation. + +GENERATE_TODOLIST = YES + +# The GENERATE_TESTLIST tag can be used to enable (YES) or +# disable (NO) the test list. This list is created by putting \test +# commands in the documentation. + +GENERATE_TESTLIST = YES + +# The GENERATE_BUGLIST tag can be used to enable (YES) or +# disable (NO) the bug list. This list is created by putting \bug +# commands in the documentation. + +GENERATE_BUGLIST = YES + +# The GENERATE_DEPRECATEDLIST tag can be used to enable (YES) or +# disable (NO) the deprecated list. This list is created by putting +# \deprecated commands in the documentation. + +GENERATE_DEPRECATEDLIST= YES + +# The ENABLED_SECTIONS tag can be used to enable conditional +# documentation sections, marked by \if sectionname ... \endif. + +ENABLED_SECTIONS = + +# The MAX_INITIALIZER_LINES tag determines the maximum number of lines +# the initial value of a variable or define consists of for it to appear in +# the documentation. If the initializer consists of more lines than specified +# here it will be hidden. Use a value of 0 to hide initializers completely. +# The appearance of the initializer of individual variables and defines in the +# documentation can be controlled using \showinitializer or \hideinitializer +# command in the documentation regardless of this setting. + +MAX_INITIALIZER_LINES = 30 + +# Set the SHOW_USED_FILES tag to NO to disable the list of files generated +# at the bottom of the documentation of classes and structs. If set to YES the +# list will mention the files that were used to generate the documentation. + +SHOW_USED_FILES = YES + +# If the sources in your project are distributed over multiple directories +# then setting the SHOW_DIRECTORIES tag to YES will show the directory hierarchy +# in the documentation. The default is NO. + +SHOW_DIRECTORIES = NO + +# Set the SHOW_FILES tag to NO to disable the generation of the Files page. +# This will remove the Files entry from the Quick Index and from the +# Folder Tree View (if specified). The default is YES. + +SHOW_FILES = YES + +# Set the SHOW_NAMESPACES tag to NO to disable the generation of the +# Namespaces page. +# This will remove the Namespaces entry from the Quick Index +# and from the Folder Tree View (if specified). The default is YES. + +SHOW_NAMESPACES = YES + +# The FILE_VERSION_FILTER tag can be used to specify a program or script that +# doxygen should invoke to get the current version for each file (typically from +# the version control system). Doxygen will invoke the program by executing (via +# popen()) the command <command> <input-file>, where <command> is the value of +# the FILE_VERSION_FILTER tag, and <input-file> is the name of an input file +# provided by doxygen. Whatever the program writes to standard output +# is used as the file version. See the manual for examples. + +FILE_VERSION_FILTER = + +# The LAYOUT_FILE tag can be used to specify a layout file which will be parsed by +# doxygen. The layout file controls the global structure of the generated output files +# in an output format independent way. The create the layout file that represents +# doxygen's defaults, run doxygen with the -l option. You can optionally specify a +# file name after the option, if omitted DoxygenLayout.xml will be used as the name +# of the layout file. + +LAYOUT_FILE = + +#--------------------------------------------------------------------------- +# configuration options related to warning and progress messages +#--------------------------------------------------------------------------- + +# The QUIET tag can be used to turn on/off the messages that are generated +# by doxygen. Possible values are YES and NO. If left blank NO is used. + +QUIET = NO + +# The WARNINGS tag can be used to turn on/off the warning messages that are +# generated by doxygen. Possible values are YES and NO. If left blank +# NO is used. + +WARNINGS = YES + +# If WARN_IF_UNDOCUMENTED is set to YES, then doxygen will generate warnings +# for undocumented members. If EXTRACT_ALL is set to YES then this flag will +# automatically be disabled. + +WARN_IF_UNDOCUMENTED = YES + +# If WARN_IF_DOC_ERROR is set to YES, doxygen will generate warnings for +# potential errors in the documentation, such as not documenting some +# parameters in a documented function, or documenting parameters that +# don't exist or using markup commands wrongly. + +WARN_IF_DOC_ERROR = YES + +# This WARN_NO_PARAMDOC option can be abled to get warnings for +# functions that are documented, but have no documentation for their parameters +# or return value. If set to NO (the default) doxygen will only warn about +# wrong or incomplete parameter documentation, but not about the absence of +# documentation. + +WARN_NO_PARAMDOC = NO + +# The WARN_FORMAT tag determines the format of the warning messages that +# doxygen can produce. The string should contain the $file, $line, and $text +# tags, which will be replaced by the file and line number from which the +# warning originated and the warning text. Optionally the format may contain +# $version, which will be replaced by the version of the file (if it could +# be obtained via FILE_VERSION_FILTER) + +WARN_FORMAT = "$file:$line: $text" + +# The WARN_LOGFILE tag can be used to specify a file to which warning +# and error messages should be written. If left blank the output is written +# to stderr. + +WARN_LOGFILE = + +#--------------------------------------------------------------------------- +# configuration options related to the input files +#--------------------------------------------------------------------------- + +# The INPUT tag can be used to specify the files and/or directories that contain +# documented source files. You may enter file names like "myfile.cpp" or +# directories like "/usr/src/myproject". Separate the files or directories +# with spaces. + +INPUT = .. + +# This tag can be used to specify the character encoding of the source files +# that doxygen parses. Internally doxygen uses the UTF-8 encoding, which is +# also the default input encoding. Doxygen uses libiconv (or the iconv built +# into libc) for the transcoding. See http://www.gnu.org/software/libiconv for +# the list of possible encodings. + +INPUT_ENCODING = UTF-8 + +# If the value of the INPUT tag contains directories, you can use the +# FILE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp +# and *.h) to filter out the source-files in the directories. If left +# blank the following patterns are tested: +# *.c *.cc *.cxx *.cpp *.c++ *.java *.ii *.ixx *.ipp *.i++ *.inl *.h *.hh *.hxx +# *.hpp *.h++ *.idl *.odl *.cs *.php *.php3 *.inc *.m *.mm *.py *.f90 + +FILE_PATTERNS = + +# The RECURSIVE tag can be used to turn specify whether or not subdirectories +# should be searched for input files as well. Possible values are YES and NO. +# If left blank NO is used. + +RECURSIVE = NO + +# The EXCLUDE tag can be used to specify files and/or directories that should +# excluded from the INPUT source files. This way you can easily exclude a +# subdirectory from a directory tree whose root is specified with the INPUT tag. + +EXCLUDE = + +# The EXCLUDE_SYMLINKS tag can be used select whether or not files or +# directories that are symbolic links (a Unix filesystem feature) are excluded +# from the input. + +EXCLUDE_SYMLINKS = NO + +# If the value of the INPUT tag contains directories, you can use the +# EXCLUDE_PATTERNS tag to specify one or more wildcard patterns to exclude +# certain files from those directories. Note that the wildcards are matched +# against the file with absolute path, so to exclude all test directories +# for example use the pattern */test/* + +EXCLUDE_PATTERNS = + +# The EXCLUDE_SYMBOLS tag can be used to specify one or more symbol names +# (namespaces, classes, functions, etc.) that should be excluded from the +# output. The symbol name can be a fully qualified name, a word, or if the +# wildcard * is used, a substring. Examples: ANamespace, AClass, +# AClass::ANamespace, ANamespace::*Test + +EXCLUDE_SYMBOLS = + +# The EXAMPLE_PATH tag can be used to specify one or more files or +# directories that contain example code fragments that are included (see +# the \include command). + +EXAMPLE_PATH = + +# If the value of the EXAMPLE_PATH tag contains directories, you can use the +# EXAMPLE_PATTERNS tag to specify one or more wildcard pattern (like *.cpp +# and *.h) to filter out the source-files in the directories. If left +# blank all files are included. + +EXAMPLE_PATTERNS = + +# If the EXAMPLE_RECURSIVE tag is set to YES then subdirectories will be +# searched for input files to be used with the \include or \dontinclude +# commands irrespective of the value of the RECURSIVE tag. +# Possible values are YES and NO. If left blank NO is used. + +EXAMPLE_RECURSIVE = NO + +# The IMAGE_PATH tag can be used to specify one or more files or +# directories that contain image that are included in the documentation (see +# the \image command). + +IMAGE_PATH = + +# The INPUT_FILTER tag can be used to specify a program that doxygen should +# invoke to filter for each input file. Doxygen will invoke the filter program +# by executing (via popen()) the command <filter> <input-file>, where <filter> +# is the value of the INPUT_FILTER tag, and <input-file> is the name of an +# input file. Doxygen will then use the output that the filter program writes +# to standard output. +# If FILTER_PATTERNS is specified, this tag will be +# ignored. + +INPUT_FILTER = + +# The FILTER_PATTERNS tag can be used to specify filters on a per file pattern +# basis. +# Doxygen will compare the file name with each pattern and apply the +# filter if there is a match. +# The filters are a list of the form: +# pattern=filter (like *.cpp=my_cpp_filter). See INPUT_FILTER for further +# info on how filters are used. If FILTER_PATTERNS is empty, INPUT_FILTER +# is applied to all files. + +FILTER_PATTERNS = + +# If the FILTER_SOURCE_FILES tag is set to YES, the input filter (if set using +# INPUT_FILTER) will be used to filter the input files when producing source +# files to browse (i.e. when SOURCE_BROWSER is set to YES). + +FILTER_SOURCE_FILES = NO + +#--------------------------------------------------------------------------- +# configuration options related to source browsing +#--------------------------------------------------------------------------- + +# If the SOURCE_BROWSER tag is set to YES then a list of source files will +# be generated. Documented entities will be cross-referenced with these sources. +# Note: To get rid of all source code in the generated output, make sure also +# VERBATIM_HEADERS is set to NO. + +SOURCE_BROWSER = YES + +# Setting the INLINE_SOURCES tag to YES will include the body +# of functions and classes directly in the documentation. + +INLINE_SOURCES = NO + +# Setting the STRIP_CODE_COMMENTS tag to YES (the default) will instruct +# doxygen to hide any special comment blocks from generated source code +# fragments. Normal C and C++ comments will always remain visible. + +STRIP_CODE_COMMENTS = YES + +# If the REFERENCED_BY_RELATION tag is set to YES +# then for each documented function all documented +# functions referencing it will be listed. + +REFERENCED_BY_RELATION = NO + +# If the REFERENCES_RELATION tag is set to YES +# then for each documented function all documented entities +# called/used by that function will be listed. + +REFERENCES_RELATION = NO + +# If the REFERENCES_LINK_SOURCE tag is set to YES (the default) +# and SOURCE_BROWSER tag is set to YES, then the hyperlinks from +# functions in REFERENCES_RELATION and REFERENCED_BY_RELATION lists will +# link to the source code. +# Otherwise they will link to the documentation. + +REFERENCES_LINK_SOURCE = YES + +# If the USE_HTAGS tag is set to YES then the references to source code +# will point to the HTML generated by the htags(1) tool instead of doxygen +# built-in source browser. The htags tool is part of GNU's global source +# tagging system (see http://www.gnu.org/software/global/global.html). You +# will need version 4.8.6 or higher. + +USE_HTAGS = NO + +# If the VERBATIM_HEADERS tag is set to YES (the default) then Doxygen +# will generate a verbatim copy of the header file for each class for +# which an include is specified. Set to NO to disable this. + +VERBATIM_HEADERS = YES + +#--------------------------------------------------------------------------- +# configuration options related to the alphabetical class index +#--------------------------------------------------------------------------- + +# If the ALPHABETICAL_INDEX tag is set to YES, an alphabetical index +# of all compounds will be generated. Enable this if the project +# contains a lot of classes, structs, unions or interfaces. + +ALPHABETICAL_INDEX = NO + +# If the alphabetical index is enabled (see ALPHABETICAL_INDEX) then +# the COLS_IN_ALPHA_INDEX tag can be used to specify the number of columns +# in which this list will be split (can be a number in the range [1..20]) + +COLS_IN_ALPHA_INDEX = 5 + +# In case all classes in a project start with a common prefix, all +# classes will be put under the same header in the alphabetical index. +# The IGNORE_PREFIX tag can be used to specify one or more prefixes that +# should be ignored while generating the index headers. + +IGNORE_PREFIX = + +#--------------------------------------------------------------------------- +# configuration options related to the HTML output +#--------------------------------------------------------------------------- + +# If the GENERATE_HTML tag is set to YES (the default) Doxygen will +# generate HTML output. + +GENERATE_HTML = YES + +# The HTML_OUTPUT tag is used to specify where the HTML docs will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `html' will be used as the default path. + +HTML_OUTPUT = html + +# The HTML_FILE_EXTENSION tag can be used to specify the file extension for +# each generated HTML page (for example: .htm,.php,.asp). If it is left blank +# doxygen will generate files with .html extension. + +HTML_FILE_EXTENSION = .html + +# The HTML_HEADER tag can be used to specify a personal HTML header for +# each generated HTML page. If it is left blank doxygen will generate a +# standard header. + +HTML_HEADER = + +# The HTML_FOOTER tag can be used to specify a personal HTML footer for +# each generated HTML page. If it is left blank doxygen will generate a +# standard footer. + +HTML_FOOTER = + +# The HTML_STYLESHEET tag can be used to specify a user-defined cascading +# style sheet that is used by each HTML page. It can be used to +# fine-tune the look of the HTML output. If the tag is left blank doxygen +# will generate a default style sheet. Note that doxygen will try to copy +# the style sheet file to the HTML output directory, so don't put your own +# stylesheet in the HTML output directory as well, or it will be erased! + +HTML_STYLESHEET = + +# If the HTML_TIMESTAMP tag is set to YES then the footer of each generated HTML +# page will contain the date and time when the page was generated. Setting +# this to NO can help when comparing the output of multiple runs. + +HTML_TIMESTAMP = YES + +# If the HTML_ALIGN_MEMBERS tag is set to YES, the members of classes, +# files or namespaces will be aligned in HTML using tables. If set to +# NO a bullet list will be used. + +HTML_ALIGN_MEMBERS = YES + +# If the HTML_DYNAMIC_SECTIONS tag is set to YES then the generated HTML +# documentation will contain sections that can be hidden and shown after the +# page has loaded. For this to work a browser that supports +# JavaScript and DHTML is required (for instance Mozilla 1.0+, Firefox +# Netscape 6.0+, Internet explorer 5.0+, Konqueror, or Safari). + +HTML_DYNAMIC_SECTIONS = NO + +# If the GENERATE_DOCSET tag is set to YES, additional index files +# will be generated that can be used as input for Apple's Xcode 3 +# integrated development environment, introduced with OSX 10.5 (Leopard). +# To create a documentation set, doxygen will generate a Makefile in the +# HTML output directory. Running make will produce the docset in that +# directory and running "make install" will install the docset in +# ~/Library/Developer/Shared/Documentation/DocSets so that Xcode will find +# it at startup. +# See http://developer.apple.com/tools/creatingdocsetswithdoxygen.html for more information. + +GENERATE_DOCSET = NO + +# When GENERATE_DOCSET tag is set to YES, this tag determines the name of the +# feed. A documentation feed provides an umbrella under which multiple +# documentation sets from a single provider (such as a company or product suite) +# can be grouped. + +DOCSET_FEEDNAME = "Doxygen generated docs" + +# When GENERATE_DOCSET tag is set to YES, this tag specifies a string that +# should uniquely identify the documentation set bundle. This should be a +# reverse domain-name style string, e.g. com.mycompany.MyDocSet. Doxygen +# will append .docset to the name. + +DOCSET_BUNDLE_ID = org.doxygen.Project + +# If the GENERATE_HTMLHELP tag is set to YES, additional index files +# will be generated that can be used as input for tools like the +# Microsoft HTML help workshop to generate a compiled HTML help file (.chm) +# of the generated HTML documentation. + +GENERATE_HTMLHELP = NO + +# If the GENERATE_HTMLHELP tag is set to YES, the CHM_FILE tag can +# be used to specify the file name of the resulting .chm file. You +# can add a path in front of the file if the result should not be +# written to the html output directory. + +CHM_FILE = + +# If the GENERATE_HTMLHELP tag is set to YES, the HHC_LOCATION tag can +# be used to specify the location (absolute path including file name) of +# the HTML help compiler (hhc.exe). If non-empty doxygen will try to run +# the HTML help compiler on the generated index.hhp. + +HHC_LOCATION = + +# If the GENERATE_HTMLHELP tag is set to YES, the GENERATE_CHI flag +# controls if a separate .chi index file is generated (YES) or that +# it should be included in the master .chm file (NO). + +GENERATE_CHI = NO + +# If the GENERATE_HTMLHELP tag is set to YES, the CHM_INDEX_ENCODING +# is used to encode HtmlHelp index (hhk), content (hhc) and project file +# content. + +CHM_INDEX_ENCODING = + +# If the GENERATE_HTMLHELP tag is set to YES, the BINARY_TOC flag +# controls whether a binary table of contents is generated (YES) or a +# normal table of contents (NO) in the .chm file. + +BINARY_TOC = NO + +# The TOC_EXPAND flag can be set to YES to add extra items for group members +# to the contents of the HTML help documentation and to the tree view. + +TOC_EXPAND = NO + +# If the GENERATE_QHP tag is set to YES and both QHP_NAMESPACE and QHP_VIRTUAL_FOLDER +# are set, an additional index file will be generated that can be used as input for +# Qt's qhelpgenerator to generate a Qt Compressed Help (.qch) of the generated +# HTML documentation. + +GENERATE_QHP = NO + +# If the QHG_LOCATION tag is specified, the QCH_FILE tag can +# be used to specify the file name of the resulting .qch file. +# The path specified is relative to the HTML output folder. + +QCH_FILE = + +# The QHP_NAMESPACE tag specifies the namespace to use when generating +# Qt Help Project output. For more information please see +# http://doc.trolltech.com/qthelpproject.html#namespace + +QHP_NAMESPACE = org.doxygen.Project + +# The QHP_VIRTUAL_FOLDER tag specifies the namespace to use when generating +# Qt Help Project output. For more information please see +# http://doc.trolltech.com/qthelpproject.html#virtual-folders + +QHP_VIRTUAL_FOLDER = doc + +# If QHP_CUST_FILTER_NAME is set, it specifies the name of a custom filter to add. +# For more information please see +# http://doc.trolltech.com/qthelpproject.html#custom-filters + +QHP_CUST_FILTER_NAME = + +# The QHP_CUST_FILT_ATTRS tag specifies the list of the attributes of the custom filter to add.For more information please see +# <a href="http://doc.trolltech.com/qthelpproject.html#custom-filters">Qt Help Project / Custom Filters</a>. + +QHP_CUST_FILTER_ATTRS = + +# The QHP_SECT_FILTER_ATTRS tag specifies the list of the attributes this project's +# filter section matches. +# <a href="http://doc.trolltech.com/qthelpproject.html#filter-attributes">Qt Help Project / Filter Attributes</a>. + +QHP_SECT_FILTER_ATTRS = + +# If the GENERATE_QHP tag is set to YES, the QHG_LOCATION tag can +# be used to specify the location of Qt's qhelpgenerator. +# If non-empty doxygen will try to run qhelpgenerator on the generated +# .qhp file. + +QHG_LOCATION = + +# If the GENERATE_ECLIPSEHELP tag is set to YES, additional index files +# will be generated, which together with the HTML files, form an Eclipse help +# plugin. To install this plugin and make it available under the help contents +# menu in Eclipse, the contents of the directory containing the HTML and XML +# files needs to be copied into the plugins directory of eclipse. The name of +# the directory within the plugins directory should be the same as +# the ECLIPSE_DOC_ID value. After copying Eclipse needs to be restarted before the help appears. + +GENERATE_ECLIPSEHELP = NO + +# A unique identifier for the eclipse help plugin. When installing the plugin +# the directory name containing the HTML and XML files should also have +# this name. + +ECLIPSE_DOC_ID = org.doxygen.Project + +# The DISABLE_INDEX tag can be used to turn on/off the condensed index at +# top of each HTML page. The value NO (the default) enables the index and +# the value YES disables it. + +DISABLE_INDEX = NO + +# This tag can be used to set the number of enum values (range [1..20]) +# that doxygen will group on one line in the generated HTML documentation. + +ENUM_VALUES_PER_LINE = 4 + +# The GENERATE_TREEVIEW tag is used to specify whether a tree-like index +# structure should be generated to display hierarchical information. +# If the tag value is set to YES, a side panel will be generated +# containing a tree-like index structure (just like the one that +# is generated for HTML Help). For this to work a browser that supports +# JavaScript, DHTML, CSS and frames is required (i.e. any modern browser). +# Windows users are probably better off using the HTML help feature. + +GENERATE_TREEVIEW = NO + +# By enabling USE_INLINE_TREES, doxygen will generate the Groups, Directories, +# and Class Hierarchy pages using a tree view instead of an ordered list. + +USE_INLINE_TREES = NO + +# If the treeview is enabled (see GENERATE_TREEVIEW) then this tag can be +# used to set the initial width (in pixels) of the frame in which the tree +# is shown. + +TREEVIEW_WIDTH = 250 + +# Use this tag to change the font size of Latex formulas included +# as images in the HTML documentation. The default is 10. Note that +# when you change the font size after a successful doxygen run you need +# to manually remove any form_*.png images from the HTML output directory +# to force them to be regenerated. + +FORMULA_FONTSIZE = 10 + +# When the SEARCHENGINE tag is enabled doxygen will generate a search box for the HTML output. The underlying search engine uses javascript +# and DHTML and should work on any modern browser. Note that when using HTML help (GENERATE_HTMLHELP), Qt help (GENERATE_QHP), or docsets (GENERATE_DOCSET) there is already a search function so this one should +# typically be disabled. For large projects the javascript based search engine +# can be slow, then enabling SERVER_BASED_SEARCH may provide a better solution. + +SEARCHENGINE = YES + +# When the SERVER_BASED_SEARCH tag is enabled the search engine will be implemented using a PHP enabled web server instead of at the web client using Javascript. Doxygen will generate the search PHP script and index +# file to put on the web server. The advantage of the server based approach is that it scales better to large projects and allows full text search. The disadvances is that it is more difficult to setup +# and does not have live searching capabilities. + +SERVER_BASED_SEARCH = NO + +#--------------------------------------------------------------------------- +# configuration options related to the LaTeX output +#--------------------------------------------------------------------------- + +# If the GENERATE_LATEX tag is set to YES (the default) Doxygen will +# generate Latex output. + +GENERATE_LATEX = NO + +# The LATEX_OUTPUT tag is used to specify where the LaTeX docs will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `latex' will be used as the default path. + +LATEX_OUTPUT = latex + +# The LATEX_CMD_NAME tag can be used to specify the LaTeX command name to be +# invoked. If left blank `latex' will be used as the default command name. +# Note that when enabling USE_PDFLATEX this option is only used for +# generating bitmaps for formulas in the HTML output, but not in the +# Makefile that is written to the output directory. + +LATEX_CMD_NAME = latex + +# The MAKEINDEX_CMD_NAME tag can be used to specify the command name to +# generate index for LaTeX. If left blank `makeindex' will be used as the +# default command name. + +MAKEINDEX_CMD_NAME = makeindex + +# If the COMPACT_LATEX tag is set to YES Doxygen generates more compact +# LaTeX documents. This may be useful for small projects and may help to +# save some trees in general. + +COMPACT_LATEX = NO + +# The PAPER_TYPE tag can be used to set the paper type that is used +# by the printer. Possible values are: a4, a4wide, letter, legal and +# executive. If left blank a4wide will be used. + +PAPER_TYPE = a4wide + +# The EXTRA_PACKAGES tag can be to specify one or more names of LaTeX +# packages that should be included in the LaTeX output. + +EXTRA_PACKAGES = + +# The LATEX_HEADER tag can be used to specify a personal LaTeX header for +# the generated latex document. The header should contain everything until +# the first chapter. If it is left blank doxygen will generate a +# standard header. Notice: only use this tag if you know what you are doing! + +LATEX_HEADER = + +# If the PDF_HYPERLINKS tag is set to YES, the LaTeX that is generated +# is prepared for conversion to pdf (using ps2pdf). The pdf file will +# contain links (just like the HTML output) instead of page references +# This makes the output suitable for online browsing using a pdf viewer. + +PDF_HYPERLINKS = YES + +# If the USE_PDFLATEX tag is set to YES, pdflatex will be used instead of +# plain latex in the generated Makefile. Set this option to YES to get a +# higher quality PDF documentation. + +USE_PDFLATEX = YES + +# If the LATEX_BATCHMODE tag is set to YES, doxygen will add the \\batchmode. +# command to the generated LaTeX files. This will instruct LaTeX to keep +# running if errors occur, instead of asking the user for help. +# This option is also used when generating formulas in HTML. + +LATEX_BATCHMODE = NO + +# If LATEX_HIDE_INDICES is set to YES then doxygen will not +# include the index chapters (such as File Index, Compound Index, etc.) +# in the output. + +LATEX_HIDE_INDICES = NO + +# If LATEX_SOURCE_CODE is set to YES then doxygen will include source code with syntax highlighting in the LaTeX output. Note that which sources are shown also depends on other settings such as SOURCE_BROWSER. + +LATEX_SOURCE_CODE = NO + +#--------------------------------------------------------------------------- +# configuration options related to the RTF output +#--------------------------------------------------------------------------- + +# If the GENERATE_RTF tag is set to YES Doxygen will generate RTF output +# The RTF output is optimized for Word 97 and may not look very pretty with +# other RTF readers or editors. + +GENERATE_RTF = NO + +# The RTF_OUTPUT tag is used to specify where the RTF docs will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `rtf' will be used as the default path. + +RTF_OUTPUT = rtf + +# If the COMPACT_RTF tag is set to YES Doxygen generates more compact +# RTF documents. This may be useful for small projects and may help to +# save some trees in general. + +COMPACT_RTF = NO + +# If the RTF_HYPERLINKS tag is set to YES, the RTF that is generated +# will contain hyperlink fields. The RTF file will +# contain links (just like the HTML output) instead of page references. +# This makes the output suitable for online browsing using WORD or other +# programs which support those fields. +# Note: wordpad (write) and others do not support links. + +RTF_HYPERLINKS = NO + +# Load stylesheet definitions from file. Syntax is similar to doxygen's +# config file, i.e. a series of assignments. You only have to provide +# replacements, missing definitions are set to their default value. + +RTF_STYLESHEET_FILE = + +# Set optional variables used in the generation of an rtf document. +# Syntax is similar to doxygen's config file. + +RTF_EXTENSIONS_FILE = + +#--------------------------------------------------------------------------- +# configuration options related to the man page output +#--------------------------------------------------------------------------- + +# If the GENERATE_MAN tag is set to YES (the default) Doxygen will +# generate man pages + +GENERATE_MAN = NO + +# The MAN_OUTPUT tag is used to specify where the man pages will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `man' will be used as the default path. + +MAN_OUTPUT = man + +# The MAN_EXTENSION tag determines the extension that is added to +# the generated man pages (default is the subroutine's section .3) + +MAN_EXTENSION = .3 + +# If the MAN_LINKS tag is set to YES and Doxygen generates man output, +# then it will generate one additional man file for each entity +# documented in the real man page(s). These additional files +# only source the real man page, but without them the man command +# would be unable to find the correct page. The default is NO. + +MAN_LINKS = NO + +#--------------------------------------------------------------------------- +# configuration options related to the XML output +#--------------------------------------------------------------------------- + +# If the GENERATE_XML tag is set to YES Doxygen will +# generate an XML file that captures the structure of +# the code including all documentation. + +GENERATE_XML = NO + +# The XML_OUTPUT tag is used to specify where the XML pages will be put. +# If a relative path is entered the value of OUTPUT_DIRECTORY will be +# put in front of it. If left blank `xml' will be used as the default path. + +XML_OUTPUT = xml + +# The XML_SCHEMA tag can be used to specify an XML schema, +# which can be used by a validating XML parser to check the +# syntax of the XML files. + +XML_SCHEMA = + +# The XML_DTD tag can be used to specify an XML DTD, +# which can be used by a validating XML parser to check the +# syntax of the XML files. + +XML_DTD = + +# If the XML_PROGRAMLISTING tag is set to YES Doxygen will +# dump the program listings (including syntax highlighting +# and cross-referencing information) to the XML output. Note that +# enabling this will significantly increase the size of the XML output. + +XML_PROGRAMLISTING = YES + +#--------------------------------------------------------------------------- +# configuration options for the AutoGen Definitions output +#--------------------------------------------------------------------------- + +# If the GENERATE_AUTOGEN_DEF tag is set to YES Doxygen will +# generate an AutoGen Definitions (see autogen.sf.net) file +# that captures the structure of the code including all +# documentation. Note that this feature is still experimental +# and incomplete at the moment. + +GENERATE_AUTOGEN_DEF = NO + +#--------------------------------------------------------------------------- +# configuration options related to the Perl module output +#--------------------------------------------------------------------------- + +# If the GENERATE_PERLMOD tag is set to YES Doxygen will +# generate a Perl module file that captures the structure of +# the code including all documentation. Note that this +# feature is still experimental and incomplete at the +# moment. + +GENERATE_PERLMOD = NO + +# If the PERLMOD_LATEX tag is set to YES Doxygen will generate +# the necessary Makefile rules, Perl scripts and LaTeX code to be able +# to generate PDF and DVI output from the Perl module output. + +PERLMOD_LATEX = NO + +# If the PERLMOD_PRETTY tag is set to YES the Perl module output will be +# nicely formatted so it can be parsed by a human reader. +# This is useful +# if you want to understand what is going on. +# On the other hand, if this +# tag is set to NO the size of the Perl module output will be much smaller +# and Perl will parse it just the same. + +PERLMOD_PRETTY = YES + +# The names of the make variables in the generated doxyrules.make file +# are prefixed with the string contained in PERLMOD_MAKEVAR_PREFIX. +# This is useful so different doxyrules.make files included by the same +# Makefile don't overwrite each other's variables. + +PERLMOD_MAKEVAR_PREFIX = + +#--------------------------------------------------------------------------- +# Configuration options related to the preprocessor +#--------------------------------------------------------------------------- + +# If the ENABLE_PREPROCESSING tag is set to YES (the default) Doxygen will +# evaluate all C-preprocessor directives found in the sources and include +# files. + +ENABLE_PREPROCESSING = YES + +# If the MACRO_EXPANSION tag is set to YES Doxygen will expand all macro +# names in the source code. If set to NO (the default) only conditional +# compilation will be performed. Macro expansion can be done in a controlled +# way by setting EXPAND_ONLY_PREDEF to YES. + +MACRO_EXPANSION = NO + +# If the EXPAND_ONLY_PREDEF and MACRO_EXPANSION tags are both set to YES +# then the macro expansion is limited to the macros specified with the +# PREDEFINED and EXPAND_AS_DEFINED tags. + +EXPAND_ONLY_PREDEF = NO + +# If the SEARCH_INCLUDES tag is set to YES (the default) the includes files +# in the INCLUDE_PATH (see below) will be search if a #include is found. + +SEARCH_INCLUDES = YES + +# The INCLUDE_PATH tag can be used to specify one or more directories that +# contain include files that are not input files but should be processed by +# the preprocessor. + +INCLUDE_PATH = + +# You can use the INCLUDE_FILE_PATTERNS tag to specify one or more wildcard +# patterns (like *.h and *.hpp) to filter out the header-files in the +# directories. If left blank, the patterns specified with FILE_PATTERNS will +# be used. + +INCLUDE_FILE_PATTERNS = + +# The PREDEFINED tag can be used to specify one or more macro names that +# are defined before the preprocessor is started (similar to the -D option of +# gcc). The argument of the tag is a list of macros of the form: name +# or name=definition (no spaces). If the definition and the = are +# omitted =1 is assumed. To prevent a macro definition from being +# undefined via #undef or recursively expanded use the := operator +# instead of the = operator. + +PREDEFINED = DSRV_NO_DTLS DSRV_NO_PROTOCOL_DEMUX + +# If the MACRO_EXPANSION and EXPAND_ONLY_PREDEF tags are set to YES then +# this tag can be used to specify a list of macro names that should be expanded. +# The macro definition that is found in the sources will be used. +# Use the PREDEFINED tag if you want to use a different macro definition. + +EXPAND_AS_DEFINED = + +# If the SKIP_FUNCTION_MACROS tag is set to YES (the default) then +# doxygen's preprocessor will remove all function-like macros that are alone +# on a line, have an all uppercase name, and do not end with a semicolon. Such +# function macros are typically used for boiler-plate code, and will confuse +# the parser if not removed. + +SKIP_FUNCTION_MACROS = YES + +#--------------------------------------------------------------------------- +# Configuration::additions related to external references +#--------------------------------------------------------------------------- + +# The TAGFILES option can be used to specify one or more tagfiles. +# Optionally an initial location of the external documentation +# can be added for each tagfile. The format of a tag file without +# this location is as follows: +# +# TAGFILES = file1 file2 ... +# Adding location for the tag files is done as follows: +# +# TAGFILES = file1=loc1 "file2 = loc2" ... +# where "loc1" and "loc2" can be relative or absolute paths or +# URLs. If a location is present for each tag, the installdox tool +# does not have to be run to correct the links. +# Note that each tag file must have a unique name +# (where the name does NOT include the path) +# If a tag file is not located in the directory in which doxygen +# is run, you must also specify the path to the tagfile here. + +TAGFILES = + +# When a file name is specified after GENERATE_TAGFILE, doxygen will create +# a tag file that is based on the input files it reads. + +GENERATE_TAGFILE = + +# If the ALLEXTERNALS tag is set to YES all external classes will be listed +# in the class index. If set to NO only the inherited external classes +# will be listed. + +ALLEXTERNALS = NO + +# If the EXTERNAL_GROUPS tag is set to YES all external groups will be listed +# in the modules index. If set to NO, only the current project's groups will +# be listed. + +EXTERNAL_GROUPS = YES + +# The PERL_PATH should be the absolute path and name of the perl script +# interpreter (i.e. the result of `which perl'). + +PERL_PATH = /usr/bin/perl + +#--------------------------------------------------------------------------- +# Configuration options related to the dot tool +#--------------------------------------------------------------------------- + +# If the CLASS_DIAGRAMS tag is set to YES (the default) Doxygen will +# generate a inheritance diagram (in HTML, RTF and LaTeX) for classes with base +# or super classes. Setting the tag to NO turns the diagrams off. Note that +# this option is superseded by the HAVE_DOT option below. This is only a +# fallback. It is recommended to install and use dot, since it yields more +# powerful graphs. + +CLASS_DIAGRAMS = NO + +# You can define message sequence charts within doxygen comments using the \msc +# command. Doxygen will then run the mscgen tool (see +# http://www.mcternan.me.uk/mscgen/) to produce the chart and insert it in the +# documentation. The MSCGEN_PATH tag allows you to specify the directory where +# the mscgen tool resides. If left empty the tool is assumed to be found in the +# default search path. + +MSCGEN_PATH = + +# If set to YES, the inheritance and collaboration graphs will hide +# inheritance and usage relations if the target is undocumented +# or is not a class. + +HIDE_UNDOC_RELATIONS = YES + +# If you set the HAVE_DOT tag to YES then doxygen will assume the dot tool is +# available from the path. This tool is part of Graphviz, a graph visualization +# toolkit from AT&T and Lucent Bell Labs. The other options in this section +# have no effect if this option is set to NO (the default) + +HAVE_DOT = NO + +# By default doxygen will write a font called FreeSans.ttf to the output +# directory and reference it in all dot files that doxygen generates. This +# font does not include all possible unicode characters however, so when you need +# these (or just want a differently looking font) you can specify the font name +# using DOT_FONTNAME. You need need to make sure dot is able to find the font, +# which can be done by putting it in a standard location or by setting the +# DOTFONTPATH environment variable or by setting DOT_FONTPATH to the directory +# containing the font. + +DOT_FONTNAME = FreeSans + +# The DOT_FONTSIZE tag can be used to set the size of the font of dot graphs. +# The default size is 10pt. + +DOT_FONTSIZE = 10 + +# By default doxygen will tell dot to use the output directory to look for the +# FreeSans.ttf font (which doxygen will put there itself). If you specify a +# different font using DOT_FONTNAME you can set the path where dot +# can find it using this tag. + +DOT_FONTPATH = + +# If the CLASS_GRAPH and HAVE_DOT tags are set to YES then doxygen +# will generate a graph for each documented class showing the direct and +# indirect inheritance relations. Setting this tag to YES will force the +# the CLASS_DIAGRAMS tag to NO. + +CLASS_GRAPH = YES + +# If the COLLABORATION_GRAPH and HAVE_DOT tags are set to YES then doxygen +# will generate a graph for each documented class showing the direct and +# indirect implementation dependencies (inheritance, containment, and +# class references variables) of the class with other documented classes. + +COLLABORATION_GRAPH = YES + +# If the GROUP_GRAPHS and HAVE_DOT tags are set to YES then doxygen +# will generate a graph for groups, showing the direct groups dependencies + +GROUP_GRAPHS = YES + +# If the UML_LOOK tag is set to YES doxygen will generate inheritance and +# collaboration diagrams in a style similar to the OMG's Unified Modeling +# Language. + +UML_LOOK = NO + +# If set to YES, the inheritance and collaboration graphs will show the +# relations between templates and their instances. + +TEMPLATE_RELATIONS = NO + +# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDE_GRAPH, and HAVE_DOT +# tags are set to YES then doxygen will generate a graph for each documented +# file showing the direct and indirect include dependencies of the file with +# other documented files. + +INCLUDE_GRAPH = YES + +# If the ENABLE_PREPROCESSING, SEARCH_INCLUDES, INCLUDED_BY_GRAPH, and +# HAVE_DOT tags are set to YES then doxygen will generate a graph for each +# documented header file showing the documented files that directly or +# indirectly include this file. + +INCLUDED_BY_GRAPH = YES + +# If the CALL_GRAPH and HAVE_DOT options are set to YES then +# doxygen will generate a call dependency graph for every global function +# or class method. Note that enabling this option will significantly increase +# the time of a run. So in most cases it will be better to enable call graphs +# for selected functions only using the \callgraph command. + +CALL_GRAPH = NO + +# If the CALLER_GRAPH and HAVE_DOT tags are set to YES then +# doxygen will generate a caller dependency graph for every global function +# or class method. Note that enabling this option will significantly increase +# the time of a run. So in most cases it will be better to enable caller +# graphs for selected functions only using the \callergraph command. + +CALLER_GRAPH = NO + +# If the GRAPHICAL_HIERARCHY and HAVE_DOT tags are set to YES then doxygen +# will graphical hierarchy of all classes instead of a textual one. + +GRAPHICAL_HIERARCHY = YES + +# If the DIRECTORY_GRAPH, SHOW_DIRECTORIES and HAVE_DOT tags are set to YES +# then doxygen will show the dependencies a directory has on other directories +# in a graphical way. The dependency relations are determined by the #include +# relations between the files in the directories. + +DIRECTORY_GRAPH = YES + +# The DOT_IMAGE_FORMAT tag can be used to set the image format of the images +# generated by dot. Possible values are png, jpg, or gif +# If left blank png will be used. + +DOT_IMAGE_FORMAT = png + +# The tag DOT_PATH can be used to specify the path where the dot tool can be +# found. If left blank, it is assumed the dot tool can be found in the path. + +DOT_PATH = + +# The DOTFILE_DIRS tag can be used to specify one or more directories that +# contain dot files that are included in the documentation (see the +# \dotfile command). + +DOTFILE_DIRS = + +# The DOT_GRAPH_MAX_NODES tag can be used to set the maximum number of +# nodes that will be shown in the graph. If the number of nodes in a graph +# becomes larger than this value, doxygen will truncate the graph, which is +# visualized by representing a node as a red box. Note that doxygen if the +# number of direct children of the root node in a graph is already larger than +# DOT_GRAPH_MAX_NODES then the graph will not be shown at all. Also note +# that the size of a graph can be further restricted by MAX_DOT_GRAPH_DEPTH. + +DOT_GRAPH_MAX_NODES = 50 + +# The MAX_DOT_GRAPH_DEPTH tag can be used to set the maximum depth of the +# graphs generated by dot. A depth value of 3 means that only nodes reachable +# from the root by following a path via at most 3 edges will be shown. Nodes +# that lay further from the root node will be omitted. Note that setting this +# option to 1 or 2 may greatly reduce the computation time needed for large +# code bases. Also note that the size of a graph can be further restricted by +# DOT_GRAPH_MAX_NODES. Using a depth of 0 means no depth restriction. + +MAX_DOT_GRAPH_DEPTH = 0 + +# Set the DOT_TRANSPARENT tag to YES to generate images with a transparent +# background. This is disabled by default, because dot on Windows does not +# seem to support this out of the box. Warning: Depending on the platform used, +# enabling this option may lead to badly anti-aliased labels on the edges of +# a graph (i.e. they become hard to read). + +DOT_TRANSPARENT = NO + +# Set the DOT_MULTI_TARGETS tag to YES allow dot to generate multiple output +# files in one run (i.e. multiple -o and -T options on the command line). This +# makes dot run faster, but since only newer versions of dot (>1.8.10) +# support this, this feature is disabled by default. + +DOT_MULTI_TARGETS = YES + +# If the GENERATE_LEGEND tag is set to YES (the default) Doxygen will +# generate a legend page explaining the meaning of the various boxes and +# arrows in the dot generated graphs. + +GENERATE_LEGEND = YES + +# If the DOT_CLEANUP tag is set to YES (the default) Doxygen will +# remove the intermediate dot files that are used to generate +# the various graphs. + +DOT_CLEANUP = YES
diff --git a/doc/DoxygenLayout.xml b/doc/DoxygenLayout.xml new file mode 100644 index 0000000..1c8525c --- /dev/null +++ b/doc/DoxygenLayout.xml
@@ -0,0 +1,184 @@ +<doxygenlayout version="1.0"> + <!-- Navigation index tabs for HTML output --> + <navindex> + <tab type="mainpage" visible="yes" title=""/> + <tab type="pages" visible="yes" title=""/> + <tab type="modules" visible="yes" title=""/> + <tab type="namespaces" visible="yes" title=""> + <tab type="namespaces" visible="yes" title=""/> + <tab type="namespacemembers" visible="yes" title=""/> + </tab> + <tab type="classes" visible="yes" title=""> + <tab type="classes" visible="yes" title=""/> + <tab type="classindex" visible="$ALPHABETICAL_INDEX" title=""/> + <tab type="hierarchy" visible="yes" title=""/> + <tab type="classmembers" visible="yes" title=""/> + </tab> + <tab type="files" visible="yes" title=""> + <tab type="files" visible="yes" title=""/> + <tab type="globals" visible="yes" title=""/> + </tab> + <tab type="dirs" visible="yes" title=""/> + <tab type="examples" visible="yes" title=""/> + </navindex> + + <!-- Layout definition for a class page --> + <class> + <briefdescription visible="yes"/> + <includes visible="$SHOW_INCLUDE_FILES"/> + <inheritancegraph visible="$CLASS_GRAPH"/> + <collaborationgraph visible="$COLLABORATION_GRAPH"/> + <allmemberslink visible="yes"/> + <memberdecl> + <nestedclasses visible="yes" title=""/> + <publictypes title=""/> + <publicslots title=""/> + <signals title=""/> + <publicmethods title=""/> + <publicstaticmethods title=""/> + <publicattributes title=""/> + <publicstaticattributes title=""/> + <protectedtypes title=""/> + <protectedslots title=""/> + <protectedmethods title=""/> + <protectedstaticmethods title=""/> + <protectedattributes title=""/> + <protectedstaticattributes title=""/> + <packagetypes title=""/> + <packagemethods title=""/> + <packagestaticmethods title=""/> + <packageattributes title=""/> + <packagestaticattributes title=""/> + <properties title=""/> + <events title=""/> + <privatetypes title=""/> + <privateslots title=""/> + <privatemethods title=""/> + <privatestaticmethods title=""/> + <privateattributes title=""/> + <privatestaticattributes title=""/> + <friends title=""/> + <related title="" subtitle=""/> + <membergroups visible="yes"/> + </memberdecl> + <detaileddescription title=""/> + <memberdef> + <typedefs title=""/> + <enums title=""/> + <constructors title=""/> + <functions title=""/> + <related title=""/> + <variables title=""/> + <properties title=""/> + <events title=""/> + </memberdef> + <usedfiles visible="$SHOW_USED_FILES"/> + <authorsection visible="yes"/> + </class> + + <!-- Layout definition for a namespace page --> + <namespace> + <briefdescription visible="yes"/> + <memberdecl> + <nestednamespaces visible="yes" title=""/> + <classes visible="yes" title=""/> + <typedefs title=""/> + <enums title=""/> + <functions title=""/> + <variables title=""/> + <membergroups visible="yes"/> + </memberdecl> + <detaileddescription title=""/> + <memberdef> + <typedefs title=""/> + <enums title=""/> + <functions title=""/> + <variables title=""/> + </memberdef> + <authorsection visible="yes"/> + </namespace> + + <!-- Layout definition for a file page --> + <file> + <briefdescription visible="yes"/> + <includes visible="$SHOW_INCLUDE_FILES"/> + <includegraph visible="$INCLUDE_GRAPH"/> + <includedbygraph visible="$INCLUDED_BY_GRAPH"/> + <sourcelink visible="yes"/> + <memberdecl> + <classes visible="yes" title=""/> + <namespaces visible="yes" title=""/> + <defines title=""/> + <typedefs title=""/> + <enums title=""/> + <functions title=""/> + <variables title=""/> + <membergroups visible="yes"/> + </memberdecl> + <detaileddescription title=""/> + <memberdef> + <defines title=""/> + <typedefs title=""/> + <enums title=""/> + <functions title=""/> + <variables title=""/> + </memberdef> + <authorsection/> + </file> + + <!-- Layout definition for a group page --> + <group> + <briefdescription visible="yes"/> + <groupgraph visible="$GROUP_GRAPHS"/> + <memberdecl> + <classes visible="yes" title=""/> + <namespaces visible="yes" title=""/> + <dirs visible="yes" title=""/> + <nestedgroups visible="yes" title=""/> + <files visible="yes" title=""/> + <defines title=""/> + <typedefs title=""/> + <enums title=""/> + <enumvalues title=""/> + <functions title=""/> + <variables title=""/> + <signals title=""/> + <publicslots title=""/> + <protectedslots title=""/> + <privateslots title=""/> + <events title=""/> + <properties title=""/> + <friends title=""/> + <membergroups visible="yes"/> + </memberdecl> + <detaileddescription title=""/> + <memberdef> + <pagedocs/> + <defines title=""/> + <typedefs title=""/> + <enums title=""/> + <enumvalues title=""/> + <functions title=""/> + <variables title=""/> + <signals title=""/> + <publicslots title=""/> + <protectedslots title=""/> + <privateslots title=""/> + <events title=""/> + <properties title=""/> + <friends title=""/> + </memberdef> + <authorsection visible="yes"/> + </group> + + <!-- Layout definition for a directory page --> + <directory> + <briefdescription visible="yes"/> + <directorygraph visible="yes"/> + <memberdecl> + <dirs visible="yes"/> + <files visible="yes"/> + </memberdecl> + <detaileddescription title=""/> + </directory> +</doxygenlayout>
diff --git a/doc/Makefile.in b/doc/Makefile.in new file mode 100644 index 0000000..a07101e --- /dev/null +++ b/doc/Makefile.in
@@ -0,0 +1,36 @@ +# the library's version +VERSION:=@PACKAGE_VERSION@ +PACKAGE_TARNAME:=@PACKAGE_TARNAME@ + +# tools +@SET_MAKE@ +SHELL = /bin/sh +MKDIR = mkdir +DOXYGEN= @DOXYGEN@ + +top_builddir = @top_builddir@ +prefix = @prefix@ +datarootdir = @datarootdir@ +docdir = @docdir@ +htmldir = @htmldir@ + +DISTDIR?=$(top_builddir)/@PACKAGE_TARNAME@-@PACKAGE_VERSION@ +FILES:=Makefile.in Doxyfile.in html + +doc: Doxyfile + $(DOXYGEN) $< >./doxygen.out 2>&1 + +clean: + @rm -rf html + +distclean: clean + @rm -rf $(DISTDIR) + @rm -f *~ + +dist: doc + test -d $(DISTDIR)/doc || mkdir $(DISTDIR)/doc + cp -r $(FILES) $(DISTDIR)/doc + +install: $(doc) html + test -d $(htmldir) || mkdir -p $(htmldir) + cp -r html/* $(htmldir)
diff --git a/dtls.c b/dtls.c new file mode 100644 index 0000000..9a5d2dd --- /dev/null +++ b/dtls.c
@@ -0,0 +1,4076 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * Hauke Mehrtens - memory optimization, ECC integration + * Achim Kraus - session recovery + * Sachin Agrawal - rehandshake support + * + *******************************************************************************/ + +#include "tinydtls.h" +#include "dtls_config.h" +#include "dtls_time.h" + +#include <stdio.h> +#include <stdlib.h> +#ifdef HAVE_ASSERT_H +#include <assert.h> +#endif +#ifndef WITH_CONTIKI +#include <stdlib.h> +#include "global.h" +#endif /* WITH_CONTIKI */ + +#include "utlist.h" +#ifndef DTLS_PEERS_NOHASH +#include "uthash.h" +#endif /* DTLS_PEERS_NOHASH */ + +#include "debug.h" +#include "numeric.h" +#include "netq.h" +#include "dtls.h" + +#include "alert.h" +#include "session.h" +#include "prng.h" + +#ifdef WITH_SHA256 +# include "sha2/sha2.h" +#endif + +#define dtls_set_version(H,V) dtls_int_to_uint16((H)->version, (V)) +#define dtls_set_content_type(H,V) ((H)->content_type = (V) & 0xff) +#define dtls_set_length(H,V) ((H)->length = (V)) + +#define dtls_get_content_type(H) ((H)->content_type & 0xff) +#define dtls_get_version(H) dtls_uint16_to_int((H)->version) +#define dtls_get_epoch(H) dtls_uint16_to_int((H)->epoch) +#define dtls_get_sequence_number(H) dtls_uint48_to_ulong((H)->sequence_number) +#define dtls_get_fragment_length(H) dtls_uint24_to_int((H)->fragment_length) + +#ifdef DTLS_PEERS_NOHASH +#define FIND_PEER(head,sess,out) \ + do { \ + dtls_peer_t * tmp; \ + (out) = NULL; \ + LL_FOREACH((head), tmp) { \ + if (dtls_session_equals(&tmp->session, (sess))) { \ + (out) = tmp; \ + break; \ + } \ + } \ + } while (0) +#define DEL_PEER(head,delptr) \ + if ((head) != NULL && (delptr) != NULL) { \ + LL_DELETE(head,delptr); \ + } +#define ADD_PEER(head,sess,add) \ + LL_PREPEND(ctx->peers, peer); +#else /* DTLS_PEERS_NOHASH */ +#define FIND_PEER(head,sess,out) \ + HASH_FIND(hh,head,sess,sizeof(session_t),out) +#define ADD_PEER(head,sess,add) \ + HASH_ADD(hh,head,sess,sizeof(session_t),add) +#define DEL_PEER(head,delptr) \ + if ((head) != NULL && (delptr) != NULL) { \ + HASH_DELETE(hh,head,delptr); \ + } +#endif /* DTLS_PEERS_NOHASH */ + +#define DTLS_RH_LENGTH sizeof(dtls_record_header_t) +#define DTLS_HS_LENGTH sizeof(dtls_handshake_header_t) +#define DTLS_CH_LENGTH sizeof(dtls_client_hello_t) /* no variable length fields! */ +#define DTLS_COOKIE_LENGTH_MAX 32 +#define DTLS_CH_LENGTH_MAX sizeof(dtls_client_hello_t) + DTLS_COOKIE_LENGTH_MAX + 12 + 26 +#define DTLS_HV_LENGTH sizeof(dtls_hello_verify_t) +#define DTLS_SH_LENGTH (2 + DTLS_RANDOM_LENGTH + 1 + 2 + 1) +#define DTLS_CE_LENGTH (3 + 3 + 27 + DTLS_EC_KEY_SIZE + DTLS_EC_KEY_SIZE) +#define DTLS_SKEXEC_LENGTH (1 + 2 + 1 + 1 + DTLS_EC_KEY_SIZE + DTLS_EC_KEY_SIZE + 1 + 1 + 2 + 70) +#define DTLS_SKEXECPSK_LENGTH_MIN 2 +#define DTLS_SKEXECPSK_LENGTH_MAX 2 + DTLS_PSK_MAX_CLIENT_IDENTITY_LEN +#define DTLS_CKXPSK_LENGTH_MIN 2 +#define DTLS_CKXEC_LENGTH (1 + 1 + DTLS_EC_KEY_SIZE + DTLS_EC_KEY_SIZE) +#define DTLS_CV_LENGTH (1 + 1 + 2 + 1 + 1 + 1 + 1 + DTLS_EC_KEY_SIZE + 1 + 1 + DTLS_EC_KEY_SIZE) +#define DTLS_FIN_LENGTH 12 + +#define HS_HDR_LENGTH DTLS_RH_LENGTH + DTLS_HS_LENGTH +#define HV_HDR_LENGTH HS_HDR_LENGTH + DTLS_HV_LENGTH + +#define HIGH(V) (((V) >> 8) & 0xff) +#define LOW(V) ((V) & 0xff) + +#define DTLS_RECORD_HEADER(M) ((dtls_record_header_t *)(M)) +#define DTLS_HANDSHAKE_HEADER(M) ((dtls_handshake_header_t *)(M)) + +#define HANDSHAKE(M) ((dtls_handshake_header_t *)((M) + DTLS_RH_LENGTH)) +#define CLIENTHELLO(M) ((dtls_client_hello_t *)((M) + HS_HDR_LENGTH)) + +/* The length check here should work because dtls_*_to_int() works on + * unsigned char. Otherwise, broken messages could cause severe + * trouble. Note that this macro jumps out of the current program flow + * when the message is too short. Beware! + */ +#define SKIP_VAR_FIELD(P,L,T) { \ + if (L < dtls_ ## T ## _to_int(P) + sizeof(T)) \ + goto error; \ + L -= dtls_ ## T ## _to_int(P) + sizeof(T); \ + P += dtls_ ## T ## _to_int(P) + sizeof(T); \ + } + +/* some constants for the PRF */ +#define PRF_LABEL(Label) prf_label_##Label +#define PRF_LABEL_SIZE(Label) (sizeof(PRF_LABEL(Label)) - 1) + +static const unsigned char prf_label_master[] = "master secret"; +static const unsigned char prf_label_key[] = "key expansion"; +static const unsigned char prf_label_client[] = "client"; +static const unsigned char prf_label_server[] = "server"; +static const unsigned char prf_label_finished[] = " finished"; + +/* first part of Raw public key, the is the start of the Subject Public Key */ +static const unsigned char cert_asn1_header[] = { + 0x30, 0x59, /* SEQUENCE, length 89 bytes */ + 0x30, 0x13, /* SEQUENCE, length 19 bytes */ + 0x06, 0x07, /* OBJECT IDENTIFIER ecPublicKey (1 2 840 10045 2 1) */ + 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x02, 0x01, + 0x06, 0x08, /* OBJECT IDENTIFIER prime256v1 (1 2 840 10045 3 1 7) */ + 0x2A, 0x86, 0x48, 0xCE, 0x3D, 0x03, 0x01, 0x07, + 0x03, 0x42, 0x00, /* BIT STRING, length 66 bytes, 0 bits unused */ + 0x04 /* uncompressed, followed by the r und s values of the public key */ +}; + +#ifdef WITH_CONTIKI +PROCESS(dtls_retransmit_process, "DTLS retransmit process"); + +static dtls_context_t the_dtls_context; + +static inline dtls_context_t * +malloc_context() { + return &the_dtls_context; +} + +static inline void +free_context(dtls_context_t *context) { +} + +#else /* WITH_CONTIKI */ + +static inline dtls_context_t * +malloc_context() { + return (dtls_context_t *)malloc(sizeof(dtls_context_t)); +} + +static inline void +free_context(dtls_context_t *context) { + free(context); +} +#endif + +void +dtls_init() { + dtls_clock_init(); + crypto_init(); + netq_init(); + peer_init(); +} + +/* Calls cb_alert() with given arguments if defined, otherwise an + * error message is logged and the result is -1. This is just an + * internal helper. + */ +#define CALL(Context, which, ...) \ + ((Context)->h && (Context)->h->which \ + ? (Context)->h->which((Context), ##__VA_ARGS__) \ + : -1) + +static int +dtls_send_multi(dtls_context_t *ctx, dtls_peer_t *peer, + dtls_security_parameters_t *security , session_t *session, + unsigned char type, uint8 *buf_array[], + size_t buf_len_array[], size_t buf_array_len); + +/** + * Sends the fragment of length \p buflen given in \p buf to the + * specified \p peer. The data will be MAC-protected and encrypted + * according to the selected cipher and split into one or more DTLS + * records of the specified \p type. This function returns the number + * of bytes that were sent, or \c -1 if an error occurred. + * + * \param ctx The DTLS context to use. + * \param peer The remote peer. + * \param type The content type of the record. + * \param buf The data to send. + * \param buflen The actual length of \p buf. + * \return Less than zero on error, the number of bytes written otherwise. + */ +static int +dtls_send(dtls_context_t *ctx, dtls_peer_t *peer, unsigned char type, + uint8 *buf, size_t buflen) { + return dtls_send_multi(ctx, peer, dtls_security_params(peer), &peer->session, + type, &buf, &buflen, 1); +} + +/** + * Stops ongoing retransmissions of handshake messages for @p peer. + */ +static void dtls_stop_retransmission(dtls_context_t *context, dtls_peer_t *peer); + +dtls_peer_t * +dtls_get_peer(const dtls_context_t *ctx, const session_t *session) { + dtls_peer_t *p; + FIND_PEER(ctx->peers, session, p); + return p; +} + +/** + * Adds @p peer to list of peers in @p ctx. This function returns @c 0 + * on success, or a negative value on error (e.g. due to insufficient + * storage). + */ +static int +dtls_add_peer(dtls_context_t *ctx, dtls_peer_t *peer) { + ADD_PEER(ctx->peers, session, peer); + return 0; +} + +int +dtls_write(struct dtls_context_t *ctx, + session_t *dst, uint8 *buf, size_t len) { + + dtls_peer_t *peer = dtls_get_peer(ctx, dst); + + /* Check if peer connection already exists */ + if (!peer) { /* no ==> create one */ + int res; + + /* dtls_connect() returns a value greater than zero if a new + * connection attempt is made, 0 for session reuse. */ + res = dtls_connect(ctx, dst); + + return (res >= 0) ? 0 : res; + } else { /* a session exists, check if it is in state connected */ + + if (peer->state != DTLS_STATE_CONNECTED) { + return 0; + } else { + return dtls_send(ctx, peer, DTLS_CT_APPLICATION_DATA, buf, len); + } + } +} + +static int +dtls_get_cookie(uint8 *msg, size_t msglen, uint8 **cookie) { + /* To access the cookie, we have to determine the session id's + * length and skip the whole thing. */ + if (msglen < DTLS_HS_LENGTH + DTLS_CH_LENGTH + sizeof(uint8)) + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + + if (dtls_uint16_to_int(msg + DTLS_HS_LENGTH) != DTLS_VERSION) + return dtls_alert_fatal_create(DTLS_ALERT_PROTOCOL_VERSION); + + msglen -= DTLS_HS_LENGTH + DTLS_CH_LENGTH; + msg += DTLS_HS_LENGTH + DTLS_CH_LENGTH; + + SKIP_VAR_FIELD(msg, msglen, uint8); /* skip session id */ + + if (msglen < (*msg & 0xff) + sizeof(uint8)) + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + + *cookie = msg + sizeof(uint8); + return dtls_uint8_to_int(msg); + + error: + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); +} + +static int +dtls_create_cookie(dtls_context_t *ctx, + session_t *session, + uint8 *msg, size_t msglen, + uint8 *cookie, int *clen) { + unsigned char buf[DTLS_HMAC_MAX]; + size_t len, e; + + /* create cookie with HMAC-SHA256 over: + * - SECRET + * - session parameters (only IP address?) + * - client version + * - random gmt and bytes + * - session id + * - cipher_suites + * - compression method + */ + + /* We use our own buffer as hmac_context instead of a dynamic buffer + * created by dtls_hmac_new() to separate storage space for cookie + * creation from storage that is used in real sessions. Note that + * the buffer size must fit with the default hash algorithm (see + * implementation of dtls_hmac_context_new()). */ + + dtls_hmac_context_t hmac_context; + dtls_hmac_init(&hmac_context, ctx->cookie_secret, DTLS_COOKIE_SECRET_LENGTH); + + dtls_hmac_update(&hmac_context, + (unsigned char *)&session->addr, session->size); + + /* feed in the beginning of the Client Hello up to and including the + session id */ + e = sizeof(dtls_client_hello_t); + e += (*(msg + DTLS_HS_LENGTH + e) & 0xff) + sizeof(uint8); + if (e + DTLS_HS_LENGTH > msglen) + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + + dtls_hmac_update(&hmac_context, msg + DTLS_HS_LENGTH, e); + + /* skip cookie bytes and length byte */ + e += *(uint8 *)(msg + DTLS_HS_LENGTH + e) & 0xff; + e += sizeof(uint8); + if (e + DTLS_HS_LENGTH > msglen) + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + + dtls_hmac_update(&hmac_context, + msg + DTLS_HS_LENGTH + e, + dtls_get_fragment_length(DTLS_HANDSHAKE_HEADER(msg)) - e); + + len = dtls_hmac_finalize(&hmac_context, buf); + + if (len < *clen) { + memset(cookie + len, 0, *clen - len); + *clen = len; + } + + memcpy(cookie, buf, *clen); + return 0; +} + +#ifdef DTLS_CHECK_CONTENTTYPE +/* used to check if a received datagram contains a DTLS message */ +static char const content_types[] = { + DTLS_CT_CHANGE_CIPHER_SPEC, + DTLS_CT_ALERT, + DTLS_CT_HANDSHAKE, + DTLS_CT_APPLICATION_DATA, + 0 /* end marker */ +}; +#endif + +/** + * Checks if \p msg points to a valid DTLS record. If + * + */ +static unsigned int +is_record(uint8 *msg, size_t msglen) { + unsigned int rlen = 0; + + if (msglen >= DTLS_RH_LENGTH /* FIXME allow empty records? */ +#ifdef DTLS_CHECK_CONTENTTYPE + && strchr(content_types, msg[0]) +#endif + && msg[1] == HIGH(DTLS_VERSION) + && msg[2] == LOW(DTLS_VERSION)) + { + rlen = DTLS_RH_LENGTH + + dtls_uint16_to_int(DTLS_RECORD_HEADER(msg)->length); + + /* we do not accept wrong length field in record header */ + if (rlen > msglen) + rlen = 0; + } + + return rlen; +} + +/** + * Initializes \p buf as record header. The caller must ensure that \p + * buf is capable of holding at least \c sizeof(dtls_record_header_t) + * bytes. Increments sequence number counter of \p security. + * \return pointer to the next byte after the written header. + * The length will be set to 0 and has to be changed before sending. + */ +static inline uint8 * +dtls_set_record_header(uint8 type, dtls_security_parameters_t *security, + uint8 *buf) { + + dtls_int_to_uint8(buf, type); + buf += sizeof(uint8); + + dtls_int_to_uint16(buf, DTLS_VERSION); + buf += sizeof(uint16); + + if (security) { + dtls_int_to_uint16(buf, security->epoch); + buf += sizeof(uint16); + + dtls_int_to_uint48(buf, security->rseq); + buf += sizeof(uint48); + + /* increment record sequence counter by 1 */ + security->rseq++; + } else { + memset(buf, 0, sizeof(uint16) + sizeof(uint48)); + buf += sizeof(uint16) + sizeof(uint48); + } + + memset(buf, 0, sizeof(uint16)); + return buf + sizeof(uint16); +} + +/** + * Initializes \p buf as handshake header. The caller must ensure that \p + * buf is capable of holding at least \c sizeof(dtls_handshake_header_t) + * bytes. Increments message sequence number counter of \p peer. + * \return pointer to the next byte after \p buf + */ +static inline uint8 * +dtls_set_handshake_header(uint8 type, dtls_peer_t *peer, + int length, + int frag_offset, int frag_length, + uint8 *buf) { + + dtls_int_to_uint8(buf, type); + buf += sizeof(uint8); + + dtls_int_to_uint24(buf, length); + buf += sizeof(uint24); + + if (peer && peer->handshake_params) { + /* and copy the result to buf */ + dtls_int_to_uint16(buf, peer->handshake_params->hs_state.mseq_s); + + /* increment handshake message sequence counter by 1 */ + peer->handshake_params->hs_state.mseq_s++; + } else { + memset(buf, 0, sizeof(uint16)); + } + buf += sizeof(uint16); + + dtls_int_to_uint24(buf, frag_offset); + buf += sizeof(uint24); + + dtls_int_to_uint24(buf, frag_length); + buf += sizeof(uint24); + + return buf; +} + +/** only one compression method is currently defined */ +static uint8 compression_methods[] = { + TLS_COMPRESSION_NULL +}; + +/** returns true if the cipher matches TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 */ +static inline int is_tls_ecdhe_ecdsa_with_aes_128_ccm_8(dtls_cipher_t cipher) +{ +#ifdef DTLS_ECC + return cipher == TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8; +#else + return 0; +#endif /* DTLS_ECC */ +} + +/** returns true if the cipher matches TLS_PSK_WITH_AES_128_CCM_8 */ +static inline int is_tls_psk_with_aes_128_ccm_8(dtls_cipher_t cipher) +{ +#ifdef DTLS_PSK + return cipher == TLS_PSK_WITH_AES_128_CCM_8; +#else + return 0; +#endif /* DTLS_PSK */ +} + +/** returns true if the application is configured for psk */ +static inline int is_psk_supported(dtls_context_t *ctx) +{ +#ifdef DTLS_PSK + return ctx && ctx->h && ctx->h->get_psk_info; +#else + return 0; +#endif /* DTLS_PSK */ +} + +/** returns true if the application is configured for ecdhe_ecdsa */ +static inline int is_ecdsa_supported(dtls_context_t *ctx, int is_client) +{ +#ifdef DTLS_ECC + return ctx && ctx->h && ((!is_client && ctx->h->get_ecdsa_key) || + (is_client && ctx->h->verify_ecdsa_key)); +#else + return 0; +#endif /* DTLS_ECC */ +} + +/** Returns true if the application is configured for ecdhe_ecdsa with + * client authentication */ +static inline int is_ecdsa_client_auth_supported(dtls_context_t *ctx) +{ +#ifdef DTLS_ECC + return ctx && ctx->h && ctx->h->get_ecdsa_key && ctx->h->verify_ecdsa_key; +#else + return 0; +#endif /* DTLS_ECC */ +} + +/** + * Returns @c 1 if @p code is a cipher suite other than @c + * TLS_NULL_WITH_NULL_NULL that we recognize. + * + * @param ctx The current DTLS context + * @param code The cipher suite identifier to check + * @param is_client 1 for a dtls client, 0 for server + * @return @c 1 iff @p code is recognized, + */ +static int +known_cipher(dtls_context_t *ctx, dtls_cipher_t code, int is_client) { + int psk; + int ecdsa; + + psk = is_psk_supported(ctx); + ecdsa = is_ecdsa_supported(ctx, is_client); + return (psk && is_tls_psk_with_aes_128_ccm_8(code)) || + (ecdsa && is_tls_ecdhe_ecdsa_with_aes_128_ccm_8(code)); +} + +/** + * This method detects if we already have a established DTLS session with + * peer and the peer is attempting to perform a fresh handshake by sending + * messages with epoch = 0. This is to handle situations mentioned in + * RFC 6347 - section 4.2.8. + * + * @param msg The packet received from Client + * @param msglen Packet length + * @param peer peer who is the sender for this packet + * @return @c 1 if this is a rehandshake attempt by + * client + */ +static int +hs_attempt_with_existing_peer(uint8_t *msg, size_t msglen, + dtls_peer_t *peer) +{ + if ((peer) && (peer->state == DTLS_STATE_CONNECTED)) { + if (msg[0] == DTLS_CT_HANDSHAKE) { + uint16_t msg_epoch = dtls_uint16_to_int(DTLS_RECORD_HEADER(msg)->epoch); + if (msg_epoch == 0) { + dtls_handshake_header_t * hs_header = DTLS_HANDSHAKE_HEADER(msg + DTLS_RH_LENGTH); + if (hs_header->msg_type == DTLS_HT_CLIENT_HELLO || + hs_header->msg_type == DTLS_HT_HELLO_REQUEST) { + return 1; + } + } + } + } + return 0; +} +/** Dump out the cipher keys and IVs used for the symetric cipher. */ +static void dtls_debug_keyblock(dtls_security_parameters_t *config) +{ + dtls_debug("key_block (%d bytes):\n", dtls_kb_size(config, peer->role)); + dtls_debug_dump(" client_MAC_secret", + dtls_kb_client_mac_secret(config, peer->role), + dtls_kb_mac_secret_size(config, peer->role)); + + dtls_debug_dump(" server_MAC_secret", + dtls_kb_server_mac_secret(config, peer->role), + dtls_kb_mac_secret_size(config, peer->role)); + + dtls_debug_dump(" client_write_key", + dtls_kb_client_write_key(config, peer->role), + dtls_kb_key_size(config, peer->role)); + + dtls_debug_dump(" server_write_key", + dtls_kb_server_write_key(config, peer->role), + dtls_kb_key_size(config, peer->role)); + + dtls_debug_dump(" client_IV", + dtls_kb_client_iv(config, peer->role), + dtls_kb_iv_size(config, peer->role)); + + dtls_debug_dump(" server_IV", + dtls_kb_server_iv(config, peer->role), + dtls_kb_iv_size(config, peer->role)); +} + +/** returns the name of the goven handshake type number. + * see IANA for a full list of types: + * https://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-7 + */ +static char *dtls_handshake_type_to_name(int type) +{ + switch (type) { + case DTLS_HT_HELLO_REQUEST: + return "hello_request"; + case DTLS_HT_CLIENT_HELLO: + return "client_hello"; + case DTLS_HT_SERVER_HELLO: + return "server_hello"; + case DTLS_HT_HELLO_VERIFY_REQUEST: + return "hello_verify_request"; + case DTLS_HT_CERTIFICATE: + return "certificate"; + case DTLS_HT_SERVER_KEY_EXCHANGE: + return "server_key_exchange"; + case DTLS_HT_CERTIFICATE_REQUEST: + return "certificate_request"; + case DTLS_HT_SERVER_HELLO_DONE: + return "server_hello_done"; + case DTLS_HT_CERTIFICATE_VERIFY: + return "certificate_verify"; + case DTLS_HT_CLIENT_KEY_EXCHANGE: + return "client_key_exchange"; + case DTLS_HT_FINISHED: + return "finished"; + default: + return "unknown"; + } +} + +/** + * Calculate the pre master secret and after that calculate the master-secret. + */ +static int +calculate_key_block(dtls_context_t *ctx, + dtls_handshake_parameters_t *handshake, + dtls_peer_t *peer, + session_t *session, + dtls_peer_type role) { + unsigned char *pre_master_secret; + int pre_master_len = 0; + dtls_security_parameters_t *security = dtls_security_params_next(peer); + uint8 master_secret[DTLS_MASTER_SECRET_LENGTH]; + + if (!security) { + return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR); + } + + pre_master_secret = security->key_block; + + switch (handshake->cipher) { +#ifdef DTLS_PSK + case TLS_PSK_WITH_AES_128_CCM_8: { + unsigned char psk[DTLS_PSK_MAX_KEY_LEN]; + int len; + + len = CALL(ctx, get_psk_info, session, DTLS_PSK_KEY, + handshake->keyx.psk.identity, + handshake->keyx.psk.id_length, + psk, DTLS_PSK_MAX_KEY_LEN); + if (len < 0) { + dtls_crit("no psk key for session available\n"); + return len; + } + /* Temporarily use the key_block storage space for the pre master secret. */ + pre_master_len = dtls_psk_pre_master_secret(psk, len, + pre_master_secret, + MAX_KEYBLOCK_LENGTH); + + dtls_debug_hexdump("psk", psk, len); + + memset(psk, 0, DTLS_PSK_MAX_KEY_LEN); + if (pre_master_len < 0) { + dtls_crit("the psk was too long, for the pre master secret\n"); + return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR); + } + + break; + } +#endif /* DTLS_PSK */ +#ifdef DTLS_ECC + case TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8: { + pre_master_len = dtls_ecdh_pre_master_secret(handshake->keyx.ecdsa.own_eph_priv, + handshake->keyx.ecdsa.other_eph_pub_x, + handshake->keyx.ecdsa.other_eph_pub_y, + sizeof(handshake->keyx.ecdsa.own_eph_priv), + pre_master_secret, + MAX_KEYBLOCK_LENGTH); + if (pre_master_len < 0) { + dtls_crit("the curve was too long, for the pre master secret\n"); + return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR); + } + break; + } +#endif /* DTLS_ECC */ + default: + dtls_crit("calculate_key_block: unknown cipher\n"); + return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR); + } + + dtls_debug_dump("client_random", handshake->tmp.random.client, DTLS_RANDOM_LENGTH); + dtls_debug_dump("server_random", handshake->tmp.random.server, DTLS_RANDOM_LENGTH); + dtls_debug_dump("pre_master_secret", pre_master_secret, pre_master_len); + + dtls_prf(pre_master_secret, pre_master_len, + PRF_LABEL(master), PRF_LABEL_SIZE(master), + handshake->tmp.random.client, DTLS_RANDOM_LENGTH, + handshake->tmp.random.server, DTLS_RANDOM_LENGTH, + master_secret, + DTLS_MASTER_SECRET_LENGTH); + + dtls_debug_dump("master_secret", master_secret, DTLS_MASTER_SECRET_LENGTH); + + /* create key_block from master_secret + * key_block = PRF(master_secret, + "key expansion" + tmp.random.server + tmp.random.client) */ + + dtls_prf(master_secret, + DTLS_MASTER_SECRET_LENGTH, + PRF_LABEL(key), PRF_LABEL_SIZE(key), + handshake->tmp.random.server, DTLS_RANDOM_LENGTH, + handshake->tmp.random.client, DTLS_RANDOM_LENGTH, + security->key_block, + dtls_kb_size(security, role)); + + memcpy(handshake->tmp.master_secret, master_secret, DTLS_MASTER_SECRET_LENGTH); + dtls_debug_keyblock(security); + + security->cipher = handshake->cipher; + security->compression = handshake->compression; + security->rseq = 0; + + return 0; +} + +/* TODO: add a generic method which iterates over a list and searches for a specific key */ +static int verify_ext_eliptic_curves(uint8 *data, size_t data_length) { + int i, curve_name; + + /* length of curve list */ + i = dtls_uint16_to_int(data); + data += sizeof(uint16); + if (i + sizeof(uint16) != data_length) { + dtls_warn("the list of the supported elliptic curves should be tls extension length - 2\n"); + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + } + + for (i = data_length - sizeof(uint16); i > 0; i -= sizeof(uint16)) { + /* check if this curve is supported */ + curve_name = dtls_uint16_to_int(data); + data += sizeof(uint16); + + if (curve_name == TLS_EXT_ELLIPTIC_CURVES_SECP256R1) + return 0; + } + + dtls_warn("no supported elliptic curve found\n"); + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); +} + +static int verify_ext_cert_type(uint8 *data, size_t data_length) { + int i, cert_type; + + /* length of cert type list */ + i = dtls_uint8_to_int(data); + data += sizeof(uint8); + if (i + sizeof(uint8) != data_length) { + dtls_warn("the list of the supported certificate types should be tls extension length - 1\n"); + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + } + + for (i = data_length - sizeof(uint8); i > 0; i -= sizeof(uint8)) { + /* check if this cert type is supported */ + cert_type = dtls_uint8_to_int(data); + data += sizeof(uint8); + + if (cert_type == TLS_CERT_TYPE_RAW_PUBLIC_KEY) + return 0; + } + + dtls_warn("no supported certificate type found\n"); + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); +} + +static int verify_ext_ec_point_formats(uint8 *data, size_t data_length) { + int i, cert_type; + + /* length of ec_point_formats list */ + i = dtls_uint8_to_int(data); + data += sizeof(uint8); + if (i + sizeof(uint8) != data_length) { + dtls_warn("the list of the supported ec_point_formats should be tls extension length - 1\n"); + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + } + + for (i = data_length - sizeof(uint8); i > 0; i -= sizeof(uint8)) { + /* check if this ec_point_format is supported */ + cert_type = dtls_uint8_to_int(data); + data += sizeof(uint8); + + if (cert_type == TLS_EXT_EC_POINT_FORMATS_UNCOMPRESSED) + return 0; + } + + dtls_warn("no supported ec_point_format found\n"); + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); +} + +/* + * Check for some TLS Extensions used by the ECDHE_ECDSA cipher. + */ +static int +dtls_check_tls_extension(dtls_peer_t *peer, + uint8 *data, size_t data_length, int client_hello) +{ + uint16_t i, j; + int ext_elliptic_curve = 0; + int ext_client_cert_type = 0; + int ext_server_cert_type = 0; + int ext_ec_point_formats = 0; + dtls_handshake_parameters_t *handshake = peer->handshake_params; + + if (data_length < sizeof(uint16)) { + /* no tls extensions specified */ + if (is_tls_ecdhe_ecdsa_with_aes_128_ccm_8(handshake->cipher)) { + goto error; + } + return 0; + } + + /* get the length of the tls extension list */ + j = dtls_uint16_to_int(data); + data += sizeof(uint16); + data_length -= sizeof(uint16); + + if (data_length < j) + goto error; + + /* check for TLS extensions needed for this cipher */ + while (data_length) { + if (data_length < sizeof(uint16) * 2) + goto error; + + /* get the tls extension type */ + i = dtls_uint16_to_int(data); + data += sizeof(uint16); + data_length -= sizeof(uint16); + + /* get the length of the tls extension */ + j = dtls_uint16_to_int(data); + data += sizeof(uint16); + data_length -= sizeof(uint16); + + if (data_length < j) + goto error; + + switch (i) { + case TLS_EXT_ELLIPTIC_CURVES: + ext_elliptic_curve = 1; + if (verify_ext_eliptic_curves(data, j)) + goto error; + break; + case TLS_EXT_CLIENT_CERTIFICATE_TYPE: + ext_client_cert_type = 1; + if (client_hello) { + if (verify_ext_cert_type(data, j)) + goto error; + } else { + if (dtls_uint8_to_int(data) != TLS_CERT_TYPE_RAW_PUBLIC_KEY) + goto error; + } + break; + case TLS_EXT_SERVER_CERTIFICATE_TYPE: + ext_server_cert_type = 1; + if (client_hello) { + if (verify_ext_cert_type(data, j)) + goto error; + } else { + if (dtls_uint8_to_int(data) != TLS_CERT_TYPE_RAW_PUBLIC_KEY) + goto error; + } + break; + case TLS_EXT_EC_POINT_FORMATS: + ext_ec_point_formats = 1; + if (verify_ext_ec_point_formats(data, j)) + goto error; + break; + case TLS_EXT_ENCRYPT_THEN_MAC: + /* As only AEAD cipher suites are currently available, this + * extension can be skipped. + */ + dtls_info("skipped encrypt-then-mac extension\n"); + break; + default: + dtls_warn("unsupported tls extension: %i\n", i); + break; + } + data += j; + data_length -= j; + } + if (is_tls_ecdhe_ecdsa_with_aes_128_ccm_8(handshake->cipher) && client_hello) { + if (!ext_elliptic_curve || !ext_client_cert_type || !ext_server_cert_type + || !ext_ec_point_formats) { + dtls_warn("not all required tls extensions found in client hello\n"); + goto error; + } + } else if (is_tls_ecdhe_ecdsa_with_aes_128_ccm_8(handshake->cipher) && !client_hello) { + if (!ext_client_cert_type || !ext_server_cert_type) { + dtls_warn("not all required tls extensions found in server hello\n"); + goto error; + } + } + return 0; + +error: + if (client_hello && peer->state == DTLS_STATE_CONNECTED) { + return dtls_alert_create(DTLS_ALERT_LEVEL_WARNING, DTLS_ALERT_NO_RENEGOTIATION); + } else { + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + } +} + +/** + * Parses the ClientHello from the client and updates the internal handshake + * parameters with the new data for the given \p peer. When the ClientHello + * handshake message in \p data does not contain a cipher suite or + * compression method, it is copied from the the current security parameters. + * + * \param ctx The current DTLS context. + * \param peer The remote peer whose security parameters are about to change. + * \param data The handshake message with a ClientHello. + * \param data_length The actual size of \p data. + * \return \c -Something if an error occurred, \c 0 on success. + */ +static int +dtls_update_parameters(dtls_context_t *ctx, + dtls_peer_t *peer, + uint8 *data, size_t data_length) { + int i, j; + int ok; + dtls_handshake_parameters_t *config = peer->handshake_params; + dtls_security_parameters_t *security = dtls_security_params(peer); + + assert(config); + assert(data_length > DTLS_HS_LENGTH + DTLS_CH_LENGTH); + + /* skip the handshake header and client version information */ + data += DTLS_HS_LENGTH + sizeof(uint16); + data_length -= DTLS_HS_LENGTH + sizeof(uint16); + + /* store client random in config */ + memcpy(config->tmp.random.client, data, DTLS_RANDOM_LENGTH); + data += DTLS_RANDOM_LENGTH; + data_length -= DTLS_RANDOM_LENGTH; + + /* Caution: SKIP_VAR_FIELD may jump to error: */ + SKIP_VAR_FIELD(data, data_length, uint8); /* skip session id */ + SKIP_VAR_FIELD(data, data_length, uint8); /* skip cookie */ + + i = dtls_uint16_to_int(data); + if (data_length < i + sizeof(uint16)) { + /* Looks like we do not have a cipher nor compression. This is ok + * for renegotiation, but not for the initial handshake. */ + + if (!security || security->cipher == TLS_NULL_WITH_NULL_NULL) + goto error; + + config->cipher = security->cipher; + config->compression = security->compression; + + return 0; + } + + data += sizeof(uint16); + data_length -= sizeof(uint16) + i; + + ok = 0; + while (i && !ok) { + config->cipher = dtls_uint16_to_int(data); + ok = known_cipher(ctx, config->cipher, 0); + i -= sizeof(uint16); + data += sizeof(uint16); + } + + /* skip remaining ciphers */ + data += i; + + if (!ok) { + /* reset config cipher to a well-defined value */ + config->cipher = TLS_NULL_WITH_NULL_NULL; + dtls_warn("No matching cipher found\n"); + goto error; + } + + if (data_length < sizeof(uint8)) { + /* no compression specified, take the current compression method */ + if (security) + config->compression = security->compression; + else + config->compression = TLS_COMPRESSION_NULL; + return 0; + } + + i = dtls_uint8_to_int(data); + if (data_length < i + sizeof(uint8)) + goto error; + + data += sizeof(uint8); + data_length -= sizeof(uint8) + i; + + ok = 0; + while (i && !ok) { + for (j = 0; j < sizeof(compression_methods) / sizeof(uint8); ++j) + if (dtls_uint8_to_int(data) == compression_methods[j]) { + config->compression = compression_methods[j]; + ok = 1; + } + i -= sizeof(uint8); + data += sizeof(uint8); + } + + if (!ok) { + /* reset config cipher to a well-defined value */ + goto error; + } + + return dtls_check_tls_extension(peer, data, data_length, 1); +error: + if (peer->state == DTLS_STATE_CONNECTED) { + return dtls_alert_create(DTLS_ALERT_LEVEL_WARNING, DTLS_ALERT_NO_RENEGOTIATION); + } else { + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + } +} + +/** + * Parse the ClientKeyExchange and update the internal handshake state with + * the new data. + */ +static inline int +check_client_keyexchange(dtls_context_t *ctx, + dtls_handshake_parameters_t *handshake, + uint8 *data, size_t length) { + +#ifdef DTLS_ECC + if (is_tls_ecdhe_ecdsa_with_aes_128_ccm_8(handshake->cipher)) { + + if (length < DTLS_HS_LENGTH + DTLS_CKXEC_LENGTH) { + dtls_debug("The client key exchange is too short\n"); + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + } + data += DTLS_HS_LENGTH; + + if (dtls_uint8_to_int(data) != 1 + 2 * DTLS_EC_KEY_SIZE) { + dtls_alert("expected 65 bytes long public point\n"); + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + } + data += sizeof(uint8); + + if (dtls_uint8_to_int(data) != 4) { + dtls_alert("expected uncompressed public point\n"); + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + } + data += sizeof(uint8); + + memcpy(handshake->keyx.ecdsa.other_eph_pub_x, data, + sizeof(handshake->keyx.ecdsa.other_eph_pub_x)); + data += sizeof(handshake->keyx.ecdsa.other_eph_pub_x); + + memcpy(handshake->keyx.ecdsa.other_eph_pub_y, data, + sizeof(handshake->keyx.ecdsa.other_eph_pub_y)); + data += sizeof(handshake->keyx.ecdsa.other_eph_pub_y); + } +#endif /* DTLS_ECC */ +#ifdef DTLS_PSK + if (is_tls_psk_with_aes_128_ccm_8(handshake->cipher)) { + int id_length; + + if (length < DTLS_HS_LENGTH + DTLS_CKXPSK_LENGTH_MIN) { + dtls_debug("The client key exchange is too short\n"); + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + } + data += DTLS_HS_LENGTH; + + id_length = dtls_uint16_to_int(data); + data += sizeof(uint16); + + if (DTLS_HS_LENGTH + DTLS_CKXPSK_LENGTH_MIN + id_length != length) { + dtls_debug("The identity has a wrong length\n"); + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + } + + if (id_length > DTLS_PSK_MAX_CLIENT_IDENTITY_LEN) { + dtls_warn("please use a smaller client identity\n"); + return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR); + } + + handshake->keyx.psk.id_length = id_length; + memcpy(handshake->keyx.psk.identity, data, id_length); + } +#endif /* DTLS_PSK */ + return 0; +} + +static inline void +update_hs_hash(dtls_peer_t *peer, uint8 *data, size_t length) { + dtls_debug_dump("add MAC data", data, length); + dtls_hash_update(&peer->handshake_params->hs_state.hs_hash, data, length); +} + +static void +copy_hs_hash(dtls_peer_t *peer, dtls_hash_ctx *hs_hash) { + memcpy(hs_hash, &peer->handshake_params->hs_state.hs_hash, + sizeof(peer->handshake_params->hs_state.hs_hash)); +} + +static inline size_t +finalize_hs_hash(dtls_peer_t *peer, uint8 *buf) { + return dtls_hash_finalize(buf, &peer->handshake_params->hs_state.hs_hash); +} + +static inline void +clear_hs_hash(dtls_peer_t *peer) { + assert(peer); + dtls_debug("clear MAC\n"); + dtls_hash_init(&peer->handshake_params->hs_state.hs_hash); +} + +/** + * Checks if \p record + \p data contain a Finished message with valid + * verify_data. + * + * \param ctx The current DTLS context. + * \param peer The remote peer of the security association. + * \param data The cleartext payload of the message. + * \param data_length Actual length of \p data. + * \return \c 0 if the Finished message is valid, \c negative number otherwise. + */ +static int +check_finished(dtls_context_t *ctx, dtls_peer_t *peer, + uint8 *data, size_t data_length) { + size_t digest_length, label_size; + const unsigned char *label; + unsigned char buf[DTLS_HMAC_MAX]; + + if (data_length < DTLS_HS_LENGTH + DTLS_FIN_LENGTH) + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + + /* Use a union here to ensure that sufficient stack space is + * reserved. As statebuf and verify_data are not used at the same + * time, we can re-use the storage safely. + */ + union { + unsigned char statebuf[DTLS_HASH_CTX_SIZE]; + unsigned char verify_data[DTLS_FIN_LENGTH]; + } b; + + /* temporarily store hash status for roll-back after finalize */ + memcpy(b.statebuf, &peer->handshake_params->hs_state.hs_hash, DTLS_HASH_CTX_SIZE); + + digest_length = finalize_hs_hash(peer, buf); + /* clear_hash(); */ + + /* restore hash status */ + memcpy(&peer->handshake_params->hs_state.hs_hash, b.statebuf, DTLS_HASH_CTX_SIZE); + + if (peer->role == DTLS_CLIENT) { + label = PRF_LABEL(server); + label_size = PRF_LABEL_SIZE(server); + } else { /* server */ + label = PRF_LABEL(client); + label_size = PRF_LABEL_SIZE(client); + } + + dtls_prf(peer->handshake_params->tmp.master_secret, + DTLS_MASTER_SECRET_LENGTH, + label, label_size, + PRF_LABEL(finished), PRF_LABEL_SIZE(finished), + buf, digest_length, + b.verify_data, sizeof(b.verify_data)); + + dtls_debug_dump("d:", data + DTLS_HS_LENGTH, sizeof(b.verify_data)); + dtls_debug_dump("v:", b.verify_data, sizeof(b.verify_data)); + + /* compare verify data and create DTLS alert code when they differ */ + return equals(data + DTLS_HS_LENGTH, b.verify_data, sizeof(b.verify_data)) + ? 0 + : dtls_alert_create(DTLS_ALERT_LEVEL_FATAL, DTLS_ALERT_HANDSHAKE_FAILURE); +} + +/** + * Prepares the payload given in \p data for sending with + * dtls_send(). The \p data is encrypted and compressed according to + * the current security parameters of \p peer. The result of this + * operation is put into \p sendbuf with a prepended record header of + * type \p type ready for sending. As some cipher suites add a MAC + * before encryption, \p data must be large enough to hold this data + * as well (usually \c dtls_kb_digest_size(CURRENT_CONFIG(peer)). + * + * \param peer The remote peer the packet will be sent to. + * \param security The encryption paramater used to encrypt + * \param type The content type of this record. + * \param data_array Array with payloads in correct order. + * \param data_len_array sizes of the payloads in correct order. + * \param data_array_len The number of payloads given. + * \param sendbuf The output buffer where the encrypted record + * will be placed. + * \param rlen This parameter must be initialized with the + * maximum size of \p sendbuf and will be updated + * to hold the actual size of the stored packet + * on success. On error, the value of \p rlen is + * undefined. + * \return Less than zero on error, or greater than zero success. + */ +static int +dtls_prepare_record(dtls_peer_t *peer, dtls_security_parameters_t *security, + unsigned char type, + uint8 *data_array[], size_t data_len_array[], + size_t data_array_len, + uint8 *sendbuf, size_t *rlen) { + uint8 *p, *start; + int res; + unsigned int i; + + if (*rlen < DTLS_RH_LENGTH) { + dtls_alert("The sendbuf (%zu bytes) is too small\n", *rlen); + return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR); + } + + p = dtls_set_record_header(type, security, sendbuf); + start = p; + + if (!security || security->cipher == TLS_NULL_WITH_NULL_NULL) { + /* no cipher suite */ + + res = 0; + for (i = 0; i < data_array_len; i++) { + /* check the minimum that we need for packets that are not encrypted */ + if (*rlen < res + DTLS_RH_LENGTH + data_len_array[i]) { + dtls_debug("dtls_prepare_record: send buffer too small\n"); + return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR); + } + + memcpy(p, data_array[i], data_len_array[i]); + p += data_len_array[i]; + res += data_len_array[i]; + } + } else { /* TLS_PSK_WITH_AES_128_CCM_8 or TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 */ + /** + * length of additional_data for the AEAD cipher which consists of + * seq_num(2+6) + type(1) + version(2) + length(2) + */ +#define A_DATA_LEN 13 + unsigned char nonce[DTLS_CCM_BLOCKSIZE]; + unsigned char A_DATA[A_DATA_LEN]; + + if (is_tls_psk_with_aes_128_ccm_8(security->cipher)) { + dtls_debug("dtls_prepare_record(): encrypt using TLS_PSK_WITH_AES_128_CCM_8\n"); + } else if (is_tls_ecdhe_ecdsa_with_aes_128_ccm_8(security->cipher)) { + dtls_debug("dtls_prepare_record(): encrypt using TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8\n"); + } else { + dtls_debug("dtls_prepare_record(): encrypt using unknown cipher\n"); + } + + /* set nonce + from RFC 6655: + The "nonce" input to the AEAD algorithm is exactly that of [RFC5288]: + the "nonce" SHALL be 12 bytes long and is constructed as follows: + (this is an example of a "partially explicit" nonce; see Section + 3.2.1 in [RFC5116]). + + struct { + opaque salt[4]; + opaque nonce_explicit[8]; + } CCMNonce; + + [...] + + In DTLS, the 64-bit seq_num is the 16-bit epoch concatenated with the + 48-bit seq_num. + + When the nonce_explicit is equal to the sequence number, the CCMNonce + will have the structure of the CCMNonceExample given below. + + struct { + uint32 client_write_IV; // low order 32-bits + uint64 seq_num; // TLS sequence number + } CCMClientNonce. + + + struct { + uint32 server_write_IV; // low order 32-bits + uint64 seq_num; // TLS sequence number + } CCMServerNonce. + + + struct { + case client: + CCMClientNonce; + case server: + CCMServerNonce: + } CCMNonceExample; + */ + + memcpy(p, &DTLS_RECORD_HEADER(sendbuf)->epoch, 8); + p += 8; + res = 8; + + for (i = 0; i < data_array_len; i++) { + /* check the minimum that we need for packets that are not encrypted */ + if (*rlen < res + DTLS_RH_LENGTH + data_len_array[i]) { + dtls_debug("dtls_prepare_record: send buffer too small\n"); + return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR); + } + + memcpy(p, data_array[i], data_len_array[i]); + p += data_len_array[i]; + res += data_len_array[i]; + } + + memset(nonce, 0, DTLS_CCM_BLOCKSIZE); + memcpy(nonce, dtls_kb_local_iv(security, peer->role), + dtls_kb_iv_size(security, peer->role)); + memcpy(nonce + dtls_kb_iv_size(security, peer->role), start, 8); /* epoch + seq_num */ + + dtls_debug_dump("nonce:", nonce, DTLS_CCM_BLOCKSIZE); + dtls_debug_dump("key:", dtls_kb_local_write_key(security, peer->role), + dtls_kb_key_size(security, peer->role)); + + /* re-use N to create additional data according to RFC 5246, Section 6.2.3.3: + * + * additional_data = seq_num + TLSCompressed.type + + * TLSCompressed.version + TLSCompressed.length; + */ + memcpy(A_DATA, &DTLS_RECORD_HEADER(sendbuf)->epoch, 8); /* epoch and seq_num */ + memcpy(A_DATA + 8, &DTLS_RECORD_HEADER(sendbuf)->content_type, 3); /* type and version */ + dtls_int_to_uint16(A_DATA + 11, res - 8); /* length */ + + res = dtls_encrypt(start + 8, res - 8, start + 8, nonce, + dtls_kb_local_write_key(security, peer->role), + dtls_kb_key_size(security, peer->role), + A_DATA, A_DATA_LEN); + + if (res < 0) + return res; + + res += 8; /* increment res by size of nonce_explicit */ + dtls_debug_dump("message:", start, res); + } + + /* fix length of fragment in sendbuf */ + dtls_int_to_uint16(sendbuf + 11, res); + + *rlen = DTLS_RH_LENGTH + res; + return 0; +} + +static int +dtls_send_handshake_msg_hash(dtls_context_t *ctx, + dtls_peer_t *peer, + session_t *session, + uint8 header_type, + uint8 *data, size_t data_length, + int add_hash) +{ + uint8 buf[DTLS_HS_LENGTH]; + uint8 *data_array[2]; + size_t data_len_array[2]; + int i = 0; + dtls_security_parameters_t *security = peer ? dtls_security_params(peer) : NULL; + + dtls_set_handshake_header(header_type, peer, data_length, 0, + data_length, buf); + + if (add_hash) { + update_hs_hash(peer, buf, sizeof(buf)); + } + data_array[i] = buf; + data_len_array[i] = sizeof(buf); + i++; + + if (data != NULL) { + if (add_hash) { + update_hs_hash(peer, data, data_length); + } + data_array[i] = data; + data_len_array[i] = data_length; + i++; + } + dtls_debug("send handshake packet of type: %s (%i)\n", + dtls_handshake_type_to_name(header_type), header_type); + return dtls_send_multi(ctx, peer, security, session, DTLS_CT_HANDSHAKE, + data_array, data_len_array, i); +} + +static int +dtls_send_handshake_msg(dtls_context_t *ctx, + dtls_peer_t *peer, + uint8 header_type, + uint8 *data, size_t data_length) +{ + return dtls_send_handshake_msg_hash(ctx, peer, &peer->session, + header_type, data, data_length, 1); +} + +/** + * Returns true if the message @p Data is a handshake message that + * must be included in the calculation of verify_data in the Finished + * message. + * + * @param Type The message type. Only handshake messages but the initial + * Client Hello and Hello Verify Request are included in the hash, + * @param Data The PDU to examine. + * @param Length The length of @p Data. + * + * @return @c 1 if @p Data must be included in hash, @c 0 otherwise. + * + * @hideinitializer + */ +#define MUST_HASH(Type, Data, Length) \ + ((Type) == DTLS_CT_HANDSHAKE && \ + ((Data) != NULL) && ((Length) > 0) && \ + ((Data)[0] != DTLS_HT_HELLO_VERIFY_REQUEST) && \ + ((Data)[0] != DTLS_HT_CLIENT_HELLO || \ + ((Length) >= HS_HDR_LENGTH && \ + (dtls_uint16_to_int(DTLS_RECORD_HEADER(Data)->epoch > 0) || \ + (dtls_uint16_to_int(HANDSHAKE(Data)->message_seq) > 0))))) + +/** + * Sends the data passed in @p buf as a DTLS record of type @p type to + * the given peer. The data will be encrypted and compressed according + * to the security parameters for @p peer. + * + * @param ctx The DTLS context in effect. + * @param peer The remote party where the packet is sent. + * @param type The content type of this record. + * @param buf The data to send. + * @param buflen The number of bytes to send from @p buf. + * @return Less than zero in case of an error or the number of + * bytes that have been sent otherwise. + */ +static int +dtls_send_multi(dtls_context_t *ctx, dtls_peer_t *peer, + dtls_security_parameters_t *security , session_t *session, + unsigned char type, uint8 *buf_array[], + size_t buf_len_array[], size_t buf_array_len) +{ + /* We cannot use ctx->sendbuf here as it is reserved for collecting + * the input for this function, i.e. buf == ctx->sendbuf. + * + * TODO: check if we can use the receive buf here. This would mean + * that we might not be able to handle multiple records stuffed in + * one UDP datagram */ + unsigned char sendbuf[DTLS_MAX_BUF]; + size_t len = sizeof(sendbuf); + int res; + unsigned int i; + size_t overall_len = 0; + + res = dtls_prepare_record(peer, security, type, buf_array, buf_len_array, buf_array_len, sendbuf, &len); + + if (res < 0) + return res; + + /* if (peer && MUST_HASH(peer, type, buf, buflen)) */ + /* update_hs_hash(peer, buf, buflen); */ + + dtls_debug_hexdump("send header", sendbuf, sizeof(dtls_record_header_t)); + for (i = 0; i < buf_array_len; i++) { + dtls_debug_hexdump("send unencrypted", buf_array[i], buf_len_array[i]); + overall_len += buf_len_array[i]; + } + + if ((type == DTLS_CT_HANDSHAKE && buf_array[0][0] != DTLS_HT_HELLO_VERIFY_REQUEST) || + type == DTLS_CT_CHANGE_CIPHER_SPEC) { + /* copy handshake messages other than HelloVerify into retransmit buffer */ + netq_t *n = netq_node_new(overall_len); + if (n) { + dtls_tick_t now; + dtls_ticks(&now); + n->t = now + 2 * CLOCK_SECOND; + n->retransmit_cnt = 0; + n->timeout = 2 * CLOCK_SECOND; + n->peer = peer; + n->epoch = (security) ? security->epoch : 0; + n->type = type; + n->length = 0; + for (i = 0; i < buf_array_len; i++) { + memcpy(n->data + n->length, buf_array[i], buf_len_array[i]); + n->length += buf_len_array[i]; + } + + if (!netq_insert_node(&ctx->sendqueue, n)) { + dtls_warn("cannot add packet to retransmit buffer\n"); + netq_node_free(n); +#ifdef WITH_CONTIKI + } else { + /* must set timer within the context of the retransmit process */ + PROCESS_CONTEXT_BEGIN(&dtls_retransmit_process); + etimer_set(&ctx->retransmit_timer, n->timeout); + PROCESS_CONTEXT_END(&dtls_retransmit_process); +#else /* WITH_CONTIKI */ + dtls_debug("copied to sendqueue\n"); +#endif /* WITH_CONTIKI */ + } + } else + dtls_warn("retransmit buffer full\n"); + } + + /* FIXME: copy to peer's sendqueue (after fragmentation if + * necessary) and initialize retransmit timer */ + res = CALL(ctx, write, session, sendbuf, len); + + /* Guess number of bytes application data actually sent: + * dtls_prepare_record() tells us in len the number of bytes to + * send, res will contain the bytes actually sent. */ + return res <= 0 ? res : overall_len - (len - res); +} + +static inline int +dtls_send_alert(dtls_context_t *ctx, dtls_peer_t *peer, dtls_alert_level_t level, + dtls_alert_t description) { + uint8_t msg[] = { level, description }; + + dtls_send(ctx, peer, DTLS_CT_ALERT, msg, sizeof(msg)); + return 0; +} + +int +dtls_close(dtls_context_t *ctx, const session_t *remote) { + int res = -1; + dtls_peer_t *peer; + + peer = dtls_get_peer(ctx, remote); + + if (peer) { + res = dtls_send_alert(ctx, peer, DTLS_ALERT_LEVEL_FATAL, DTLS_ALERT_CLOSE_NOTIFY); + /* indicate tear down */ + peer->state = DTLS_STATE_CLOSING; + } + return res; +} + +static void dtls_destroy_peer(dtls_context_t *ctx, dtls_peer_t *peer, int unlink) +{ + if (peer->state != DTLS_STATE_CLOSED && peer->state != DTLS_STATE_CLOSING) + dtls_close(ctx, &peer->session); + if (unlink) { + DEL_PEER(ctx->peers, peer); + dtls_dsrv_log_addr(DTLS_LOG_DEBUG, "removed peer", &peer->session); + } + dtls_free_peer(peer); +} + +/** + * Checks a received Client Hello message for a valid cookie. When the + * Client Hello contains no cookie, the function fails and a Hello + * Verify Request is sent to the peer (using the write callback function + * registered with \p ctx). The return value is \c -1 on error, \c 0 when + * undecided, and \c 1 if the Client Hello was good. + * + * \param ctx The DTLS context. + * \param peer The remote party we are talking to, if any. + * \param session Transport address of the remote peer. + * \param state Current state of the connection. + * \param msg The received datagram. + * \param msglen Length of \p msg. + * \return \c 1 if msg is a Client Hello with a valid cookie, \c 0 or + * \c -1 otherwise. + */ +static int +dtls_verify_peer(dtls_context_t *ctx, + dtls_peer_t *peer, + session_t *session, + const dtls_state_t state, + uint8 *data, size_t data_length) +{ + uint8 buf[DTLS_HV_LENGTH + DTLS_COOKIE_LENGTH]; + uint8 *p = buf; + int len = DTLS_COOKIE_LENGTH; + uint8 *cookie = NULL; + int err; +#undef mycookie +#define mycookie (buf + DTLS_HV_LENGTH) + + /* Store cookie where we can reuse it for the HelloVerify request. */ + err = dtls_create_cookie(ctx, session, data, data_length, mycookie, &len); + if (err < 0) + return err; + + dtls_debug_dump("create cookie", mycookie, len); + + assert(len == DTLS_COOKIE_LENGTH); + + /* Perform cookie check. */ + len = dtls_get_cookie(data, data_length, &cookie); + if (len < 0) { + dtls_warn("error while fetching the cookie, err: %i\n", err); + return err; + } + + dtls_debug_dump("compare with cookie", cookie, len); + + /* check if cookies match */ + if (len == DTLS_COOKIE_LENGTH && memcmp(cookie, mycookie, len) == 0) { + dtls_debug("found matching cookie\n"); + return 0; + } + + if (len > 0) { + dtls_debug_dump("invalid cookie", cookie, len); + } else { + dtls_debug("cookie len is 0!\n"); + } + + /* ClientHello did not contain any valid cookie, hence we send a + * HelloVerify request. */ + + dtls_int_to_uint16(p, DTLS_VERSION); + p += sizeof(uint16); + + dtls_int_to_uint8(p, DTLS_COOKIE_LENGTH); + p += sizeof(uint8); + + assert(p == mycookie); + + p += DTLS_COOKIE_LENGTH; + + /* TODO use the same record sequence number as in the ClientHello, + see 4.2.1. Denial-of-Service Countermeasures */ + err = dtls_send_handshake_msg_hash(ctx, + state == DTLS_STATE_CONNECTED ? peer : NULL, + session, + DTLS_HT_HELLO_VERIFY_REQUEST, + buf, p - buf, 0); + if (err < 0) { + dtls_warn("cannot send HelloVerify request\n"); + } + return err; /* HelloVerify is sent, now we cannot do anything but wait */ + +#undef mycookie +} + +#ifdef DTLS_ECC +static int +dtls_check_ecdsa_signature_elem(uint8 *data, size_t data_length, + unsigned char **result_r, + unsigned char **result_s) +{ + int i; + uint8 *data_orig = data; + + if (dtls_uint8_to_int(data) != TLS_EXT_SIG_HASH_ALGO_SHA256) { + dtls_alert("only sha256 is supported in certificate verify\n"); + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + } + data += sizeof(uint8); + data_length -= sizeof(uint8); + + if (dtls_uint8_to_int(data) != TLS_EXT_SIG_HASH_ALGO_ECDSA) { + dtls_alert("only ecdsa signature is supported in client verify\n"); + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + } + data += sizeof(uint8); + data_length -= sizeof(uint8); + + if (data_length < dtls_uint16_to_int(data)) { + dtls_alert("signature length wrong\n"); + return dtls_alert_fatal_create(DTLS_ALERT_DECODE_ERROR); + } + data += sizeof(uint16); + data_length -= sizeof(uint16); + + if (dtls_uint8_to_int(data) != 0x30) { + dtls_alert("wrong ASN.1 struct, expected SEQUENCE\n"); + return dtls_alert_fatal_create(DTLS_ALERT_DECODE_ERROR); + } + data += sizeof(uint8); + data_length -= sizeof(uint8); + + if (data_length < dtls_uint8_to_int(data)) { + dtls_alert("signature length wrong\n"); + return dtls_alert_fatal_create(DTLS_ALERT_DECODE_ERROR); + } + data += sizeof(uint8); + data_length -= sizeof(uint8); + + if (dtls_uint8_to_int(data) != 0x02) { + dtls_alert("wrong ASN.1 struct, expected Integer\n"); + return dtls_alert_fatal_create(DTLS_ALERT_DECODE_ERROR); + } + data += sizeof(uint8); + data_length -= sizeof(uint8); + + i = dtls_uint8_to_int(data); + data += sizeof(uint8); + data_length -= sizeof(uint8); + + /* Sometimes these values have a leeding 0 byte */ + *result_r = data + i - DTLS_EC_KEY_SIZE; + + data += i; + data_length -= i; + + if (dtls_uint8_to_int(data) != 0x02) { + dtls_alert("wrong ASN.1 struct, expected Integer\n"); + return dtls_alert_fatal_create(DTLS_ALERT_DECODE_ERROR); + } + data += sizeof(uint8); + data_length -= sizeof(uint8); + + i = dtls_uint8_to_int(data); + data += sizeof(uint8); + data_length -= sizeof(uint8); + + /* Sometimes these values have a leeding 0 byte */ + *result_s = data + i - DTLS_EC_KEY_SIZE; + + data += i; + data_length -= i; + + return data - data_orig; +} + +static int +check_client_certificate_verify(dtls_context_t *ctx, + dtls_peer_t *peer, + uint8 *data, size_t data_length) +{ + dtls_handshake_parameters_t *config = peer->handshake_params; + int ret; + unsigned char *result_r; + unsigned char *result_s; + dtls_hash_ctx hs_hash; + unsigned char sha256hash[DTLS_HMAC_DIGEST_SIZE]; + + assert(is_tls_ecdhe_ecdsa_with_aes_128_ccm_8(config->cipher)); + + data += DTLS_HS_LENGTH; + + if (data_length < DTLS_HS_LENGTH + DTLS_CV_LENGTH) { + dtls_alert("the packet length does not match the expected\n"); + return dtls_alert_fatal_create(DTLS_ALERT_DECODE_ERROR); + } + + ret = dtls_check_ecdsa_signature_elem(data, data_length, &result_r, &result_s); + if (ret < 0) { + return ret; + } + data += ret; + data_length -= ret; + + copy_hs_hash(peer, &hs_hash); + + dtls_hash_finalize(sha256hash, &hs_hash); + + ret = dtls_ecdsa_verify_sig_hash(config->keyx.ecdsa.other_pub_x, config->keyx.ecdsa.other_pub_y, + sizeof(config->keyx.ecdsa.other_pub_x), + sha256hash, sizeof(sha256hash), + result_r, result_s); + + if (ret < 0) { + dtls_alert("wrong signature err: %i\n", ret); + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + } + return 0; +} +#endif /* DTLS_ECC */ + +static int +dtls_send_server_hello(dtls_context_t *ctx, dtls_peer_t *peer) +{ + /* Ensure that the largest message to create fits in our source + * buffer. (The size of the destination buffer is checked by the + * encoding function, so we do not need to guess.) */ + uint8 buf[DTLS_SH_LENGTH + 2 + 5 + 5 + 8 + 6]; + uint8 *p; + int ecdsa; + uint8 extension_size; + dtls_handshake_parameters_t *handshake = peer->handshake_params; + dtls_tick_t now; + + ecdsa = is_tls_ecdhe_ecdsa_with_aes_128_ccm_8(handshake->cipher); + + extension_size = (ecdsa) ? 2 + 5 + 5 + 6 : 0; + + /* Handshake header */ + p = buf; + + /* ServerHello */ + dtls_int_to_uint16(p, DTLS_VERSION); + p += sizeof(uint16); + + /* Set server random: First 4 bytes are the server's Unix timestamp, + * followed by 28 bytes of generate random data. */ + dtls_ticks(&now); + dtls_int_to_uint32(handshake->tmp.random.server, now / CLOCK_SECOND); + dtls_prng(handshake->tmp.random.server + 4, 28); + + memcpy(p, handshake->tmp.random.server, DTLS_RANDOM_LENGTH); + p += DTLS_RANDOM_LENGTH; + + *p++ = 0; /* no session id */ + + if (handshake->cipher != TLS_NULL_WITH_NULL_NULL) { + /* selected cipher suite */ + dtls_int_to_uint16(p, handshake->cipher); + p += sizeof(uint16); + + /* selected compression method */ + *p++ = compression_methods[handshake->compression]; + } + + if (extension_size) { + /* length of the extensions */ + dtls_int_to_uint16(p, extension_size - 2); + p += sizeof(uint16); + } + + if (ecdsa) { + /* client certificate type extension */ + dtls_int_to_uint16(p, TLS_EXT_CLIENT_CERTIFICATE_TYPE); + p += sizeof(uint16); + + /* length of this extension type */ + dtls_int_to_uint16(p, 1); + p += sizeof(uint16); + + dtls_int_to_uint8(p, TLS_CERT_TYPE_RAW_PUBLIC_KEY); + p += sizeof(uint8); + + /* client certificate type extension */ + dtls_int_to_uint16(p, TLS_EXT_SERVER_CERTIFICATE_TYPE); + p += sizeof(uint16); + + /* length of this extension type */ + dtls_int_to_uint16(p, 1); + p += sizeof(uint16); + + dtls_int_to_uint8(p, TLS_CERT_TYPE_RAW_PUBLIC_KEY); + p += sizeof(uint8); + + /* ec_point_formats */ + dtls_int_to_uint16(p, TLS_EXT_EC_POINT_FORMATS); + p += sizeof(uint16); + + /* length of this extension type */ + dtls_int_to_uint16(p, 2); + p += sizeof(uint16); + + /* number of supported formats */ + dtls_int_to_uint8(p, 1); + p += sizeof(uint8); + + dtls_int_to_uint8(p, TLS_EXT_EC_POINT_FORMATS_UNCOMPRESSED); + p += sizeof(uint8); + } + + assert(p - buf <= sizeof(buf)); + + /* TODO use the same record sequence number as in the ClientHello, + see 4.2.1. Denial-of-Service Countermeasures */ + return dtls_send_handshake_msg(ctx, peer, DTLS_HT_SERVER_HELLO, + buf, p - buf); +} + +#ifdef DTLS_ECC +#define DTLS_EC_SUBJECTPUBLICKEY_SIZE (2 * DTLS_EC_KEY_SIZE + sizeof(cert_asn1_header)) + +static int +dtls_send_certificate_ecdsa(dtls_context_t *ctx, dtls_peer_t *peer, + const dtls_ecdsa_key_t *key) +{ + uint8 buf[DTLS_CE_LENGTH]; + uint8 *p; + + /* Certificate + * + * Start message construction at beginning of buffer. */ + p = buf; + + /* length of this certificate */ + dtls_int_to_uint24(p, DTLS_EC_SUBJECTPUBLICKEY_SIZE); + p += sizeof(uint24); + + memcpy(p, &cert_asn1_header, sizeof(cert_asn1_header)); + p += sizeof(cert_asn1_header); + + memcpy(p, key->pub_key_x, DTLS_EC_KEY_SIZE); + p += DTLS_EC_KEY_SIZE; + + memcpy(p, key->pub_key_y, DTLS_EC_KEY_SIZE); + p += DTLS_EC_KEY_SIZE; + + assert(p - buf <= sizeof(buf)); + + return dtls_send_handshake_msg(ctx, peer, DTLS_HT_CERTIFICATE, + buf, p - buf); +} + +static uint8 * +dtls_add_ecdsa_signature_elem(uint8 *p, uint32_t *point_r, uint32_t *point_s) +{ + int len_r; + int len_s; + +#define R_KEY_OFFSET (1 + 1 + 2 + 1 + 1 + 1 + 1) +#define S_KEY_OFFSET(len_s) (R_KEY_OFFSET + (len_s) + 1 + 1) + /* store the pointer to the r component of the signature and make space */ + len_r = dtls_ec_key_from_uint32_asn1(point_r, DTLS_EC_KEY_SIZE, p + R_KEY_OFFSET); + len_s = dtls_ec_key_from_uint32_asn1(point_s, DTLS_EC_KEY_SIZE, p + S_KEY_OFFSET(len_r)); + +#undef R_KEY_OFFSET +#undef S_KEY_OFFSET + + /* sha256 */ + dtls_int_to_uint8(p, TLS_EXT_SIG_HASH_ALGO_SHA256); + p += sizeof(uint8); + + /* ecdsa */ + dtls_int_to_uint8(p, TLS_EXT_SIG_HASH_ALGO_ECDSA); + p += sizeof(uint8); + + /* length of signature */ + dtls_int_to_uint16(p, len_r + len_s + 2 + 2 + 2); + p += sizeof(uint16); + + /* ASN.1 SEQUENCE */ + dtls_int_to_uint8(p, 0x30); + p += sizeof(uint8); + + dtls_int_to_uint8(p, len_r + len_s + 2 + 2); + p += sizeof(uint8); + + /* ASN.1 Integer r */ + dtls_int_to_uint8(p, 0x02); + p += sizeof(uint8); + + dtls_int_to_uint8(p, len_r); + p += sizeof(uint8); + + /* the pint r was added here */ + p += len_r; + + /* ASN.1 Integer s */ + dtls_int_to_uint8(p, 0x02); + p += sizeof(uint8); + + dtls_int_to_uint8(p, len_s); + p += sizeof(uint8); + + /* the pint s was added here */ + p += len_s; + + return p; +} + +static int +dtls_send_server_key_exchange_ecdh(dtls_context_t *ctx, dtls_peer_t *peer, + const dtls_ecdsa_key_t *key) +{ + /* The ASN.1 Integer representation of an 32 byte unsigned int could be + * 33 bytes long add space for that */ + uint8 buf[DTLS_SKEXEC_LENGTH + 2]; + uint8 *p; + uint8 *key_params; + uint8 *ephemeral_pub_x; + uint8 *ephemeral_pub_y; + uint32_t point_r[9]; + uint32_t point_s[9]; + dtls_handshake_parameters_t *config = peer->handshake_params; + + /* ServerKeyExchange + * + * Start message construction at beginning of buffer. */ + p = buf; + + key_params = p; + /* ECCurveType curve_type: named_curve */ + dtls_int_to_uint8(p, 3); + p += sizeof(uint8); + + /* NamedCurve namedcurve: secp256r1 */ + dtls_int_to_uint16(p, TLS_EXT_ELLIPTIC_CURVES_SECP256R1); + p += sizeof(uint16); + + dtls_int_to_uint8(p, 1 + 2 * DTLS_EC_KEY_SIZE); + p += sizeof(uint8); + + /* This should be an uncompressed point, but I do not have access to the spec. */ + dtls_int_to_uint8(p, 4); + p += sizeof(uint8); + + /* store the pointer to the x component of the pub key and make space */ + ephemeral_pub_x = p; + p += DTLS_EC_KEY_SIZE; + + /* store the pointer to the y component of the pub key and make space */ + ephemeral_pub_y = p; + p += DTLS_EC_KEY_SIZE; + + dtls_ecdsa_generate_key(config->keyx.ecdsa.own_eph_priv, + ephemeral_pub_x, ephemeral_pub_y, + DTLS_EC_KEY_SIZE); + + /* sign the ephemeral and its paramaters */ + dtls_ecdsa_create_sig(key->priv_key, DTLS_EC_KEY_SIZE, + config->tmp.random.client, DTLS_RANDOM_LENGTH, + config->tmp.random.server, DTLS_RANDOM_LENGTH, + key_params, p - key_params, + point_r, point_s); + + p = dtls_add_ecdsa_signature_elem(p, point_r, point_s); + + assert(p - buf <= sizeof(buf)); + + return dtls_send_handshake_msg(ctx, peer, DTLS_HT_SERVER_KEY_EXCHANGE, + buf, p - buf); +} +#endif /* DTLS_ECC */ + +#ifdef DTLS_PSK +static int +dtls_send_server_key_exchange_psk(dtls_context_t *ctx, dtls_peer_t *peer, + const unsigned char *psk_hint, size_t len) +{ + uint8 buf[DTLS_SKEXECPSK_LENGTH_MAX]; + uint8 *p; + + p = buf; + + assert(len <= DTLS_PSK_MAX_CLIENT_IDENTITY_LEN); + if (len > DTLS_PSK_MAX_CLIENT_IDENTITY_LEN) { + /* should never happen */ + dtls_warn("psk identity hint is too long\n"); + return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR); + } + + dtls_int_to_uint16(p, len); + p += sizeof(uint16); + + memcpy(p, psk_hint, len); + p += len; + + assert(p - buf <= sizeof(buf)); + + return dtls_send_handshake_msg(ctx, peer, DTLS_HT_SERVER_KEY_EXCHANGE, + buf, p - buf); +} +#endif /* DTLS_PSK */ + +#ifdef DTLS_ECC +static int +dtls_send_server_certificate_request(dtls_context_t *ctx, dtls_peer_t *peer) +{ + uint8 buf[8]; + uint8 *p; + + /* ServerHelloDone + * + * Start message construction at beginning of buffer. */ + p = buf; + + /* certificate_types */ + dtls_int_to_uint8(p, 1); + p += sizeof(uint8); + + /* ecdsa_sign */ + dtls_int_to_uint8(p, TLS_CLIENT_CERTIFICATE_TYPE_ECDSA_SIGN); + p += sizeof(uint8); + + /* supported_signature_algorithms */ + dtls_int_to_uint16(p, 2); + p += sizeof(uint16); + + /* sha256 */ + dtls_int_to_uint8(p, TLS_EXT_SIG_HASH_ALGO_SHA256); + p += sizeof(uint8); + + /* ecdsa */ + dtls_int_to_uint8(p, TLS_EXT_SIG_HASH_ALGO_ECDSA); + p += sizeof(uint8); + + /* certificate_authoritiess */ + dtls_int_to_uint16(p, 0); + p += sizeof(uint16); + + assert(p - buf <= sizeof(buf)); + + return dtls_send_handshake_msg(ctx, peer, DTLS_HT_CERTIFICATE_REQUEST, + buf, p - buf); +} +#endif /* DTLS_ECC */ + +static int +dtls_send_server_hello_done(dtls_context_t *ctx, dtls_peer_t *peer) +{ + + /* ServerHelloDone + * + * Start message construction at beginning of buffer. */ + + return dtls_send_handshake_msg(ctx, peer, DTLS_HT_SERVER_HELLO_DONE, + NULL, 0); +} + +static int +dtls_send_server_hello_msgs(dtls_context_t *ctx, dtls_peer_t *peer) +{ + int res; + + res = dtls_send_server_hello(ctx, peer); + + if (res < 0) { + dtls_debug("dtls_server_hello: cannot prepare ServerHello record\n"); + return res; + } + +#ifdef DTLS_ECC + if (is_tls_ecdhe_ecdsa_with_aes_128_ccm_8(peer->handshake_params->cipher)) { + const dtls_ecdsa_key_t *ecdsa_key; + + res = CALL(ctx, get_ecdsa_key, &peer->session, &ecdsa_key); + if (res < 0) { + dtls_crit("no ecdsa certificate to send in certificate\n"); + return res; + } + + res = dtls_send_certificate_ecdsa(ctx, peer, ecdsa_key); + + if (res < 0) { + dtls_debug("dtls_server_hello: cannot prepare Certificate record\n"); + return res; + } + + res = dtls_send_server_key_exchange_ecdh(ctx, peer, ecdsa_key); + + if (res < 0) { + dtls_debug("dtls_server_hello: cannot prepare Server Key Exchange record\n"); + return res; + } + + if (is_tls_ecdhe_ecdsa_with_aes_128_ccm_8(peer->handshake_params->cipher) && + is_ecdsa_client_auth_supported(ctx)) { + res = dtls_send_server_certificate_request(ctx, peer); + + if (res < 0) { + dtls_debug("dtls_server_hello: cannot prepare certificate Request record\n"); + return res; + } + } + } +#endif /* DTLS_ECC */ + +#ifdef DTLS_PSK + if (is_tls_psk_with_aes_128_ccm_8(peer->handshake_params->cipher)) { + unsigned char psk_hint[DTLS_PSK_MAX_CLIENT_IDENTITY_LEN]; + int len; + + /* The identity hint is optional, therefore we ignore the result + * and check psk only. */ + len = CALL(ctx, get_psk_info, &peer->session, DTLS_PSK_HINT, + NULL, 0, psk_hint, DTLS_PSK_MAX_CLIENT_IDENTITY_LEN); + + if (len < 0) { + dtls_debug("dtls_server_hello: cannot create ServerKeyExchange\n"); + return len; + } + + if (len > 0) { + res = dtls_send_server_key_exchange_psk(ctx, peer, psk_hint, (size_t)len); + + if (res < 0) { + dtls_debug("dtls_server_key_exchange_psk: cannot send server key exchange record\n"); + return res; + } + } + } +#endif /* DTLS_PSK */ + + res = dtls_send_server_hello_done(ctx, peer); + + if (res < 0) { + dtls_debug("dtls_server_hello: cannot prepare ServerHelloDone record\n"); + return res; + } + return 0; +} + +static inline int +dtls_send_ccs(dtls_context_t *ctx, dtls_peer_t *peer) { + uint8 buf[1] = {1}; + + return dtls_send(ctx, peer, DTLS_CT_CHANGE_CIPHER_SPEC, buf, 1); +} + + +static int +dtls_send_client_key_exchange(dtls_context_t *ctx, dtls_peer_t *peer) +{ + uint8 buf[DTLS_CKXEC_LENGTH]; + uint8 *p; + dtls_handshake_parameters_t *handshake = peer->handshake_params; + + p = buf; + + switch (handshake->cipher) { +#ifdef DTLS_PSK + case TLS_PSK_WITH_AES_128_CCM_8: { + int len; + + len = CALL(ctx, get_psk_info, &peer->session, DTLS_PSK_IDENTITY, + handshake->keyx.psk.identity, handshake->keyx.psk.id_length, + buf + sizeof(uint16), + min(sizeof(buf) - sizeof(uint16), + sizeof(handshake->keyx.psk.identity))); + if (len < 0) { + dtls_crit("no psk identity set in kx\n"); + return len; + } + + if (len + sizeof(uint16) > DTLS_CKXEC_LENGTH) { + memset(&handshake->keyx.psk, 0, sizeof(dtls_handshake_parameters_psk_t)); + dtls_warn("the psk identity is too long\n"); + return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR); + } + handshake->keyx.psk.id_length = (unsigned int)len; + memcpy(handshake->keyx.psk.identity, p + sizeof(uint16), len); + + dtls_int_to_uint16(p, handshake->keyx.psk.id_length); + p += sizeof(uint16); + + memcpy(p, handshake->keyx.psk.identity, handshake->keyx.psk.id_length); + p += handshake->keyx.psk.id_length; + + break; + } +#endif /* DTLS_PSK */ +#ifdef DTLS_ECC + case TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8: { + uint8 *ephemeral_pub_x; + uint8 *ephemeral_pub_y; + + dtls_int_to_uint8(p, 1 + 2 * DTLS_EC_KEY_SIZE); + p += sizeof(uint8); + + /* This should be an uncompressed point, but I do not have access to the spec. */ + dtls_int_to_uint8(p, 4); + p += sizeof(uint8); + + ephemeral_pub_x = p; + p += DTLS_EC_KEY_SIZE; + ephemeral_pub_y = p; + p += DTLS_EC_KEY_SIZE; + + dtls_ecdsa_generate_key(peer->handshake_params->keyx.ecdsa.own_eph_priv, + ephemeral_pub_x, ephemeral_pub_y, + DTLS_EC_KEY_SIZE); + + break; + } +#endif /* DTLS_ECC */ + default: + dtls_crit("cipher not supported\n"); + return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR); + } + + assert(p - buf <= sizeof(buf)); + + return dtls_send_handshake_msg(ctx, peer, DTLS_HT_CLIENT_KEY_EXCHANGE, + buf, p - buf); +} + +#ifdef DTLS_ECC +static int +dtls_send_certificate_verify_ecdh(dtls_context_t *ctx, dtls_peer_t *peer, + const dtls_ecdsa_key_t *key) +{ + /* The ASN.1 Integer representation of an 32 byte unsigned int could be + * 33 bytes long add space for that */ + uint8 buf[DTLS_CV_LENGTH + 2]; + uint8 *p; + uint32_t point_r[9]; + uint32_t point_s[9]; + dtls_hash_ctx hs_hash; + unsigned char sha256hash[DTLS_HMAC_DIGEST_SIZE]; + + /* ServerKeyExchange + * + * Start message construction at beginning of buffer. */ + p = buf; + + copy_hs_hash(peer, &hs_hash); + + dtls_hash_finalize(sha256hash, &hs_hash); + + /* sign the ephemeral and its paramaters */ + dtls_ecdsa_create_sig_hash(key->priv_key, DTLS_EC_KEY_SIZE, + sha256hash, sizeof(sha256hash), + point_r, point_s); + + p = dtls_add_ecdsa_signature_elem(p, point_r, point_s); + + assert(p - buf <= sizeof(buf)); + + return dtls_send_handshake_msg(ctx, peer, DTLS_HT_CERTIFICATE_VERIFY, + buf, p - buf); +} +#endif /* DTLS_ECC */ + +static int +dtls_send_finished(dtls_context_t *ctx, dtls_peer_t *peer, + const unsigned char *label, size_t labellen) +{ + int length; + uint8 hash[DTLS_HMAC_MAX]; + uint8 buf[DTLS_FIN_LENGTH]; + dtls_hash_ctx hs_hash; + uint8 *p = buf; + + copy_hs_hash(peer, &hs_hash); + + length = dtls_hash_finalize(hash, &hs_hash); + + dtls_prf(peer->handshake_params->tmp.master_secret, + DTLS_MASTER_SECRET_LENGTH, + label, labellen, + PRF_LABEL(finished), PRF_LABEL_SIZE(finished), + hash, length, + p, DTLS_FIN_LENGTH); + + dtls_debug_dump("server finished MAC", p, DTLS_FIN_LENGTH); + + p += DTLS_FIN_LENGTH; + + assert(p - buf <= sizeof(buf)); + + return dtls_send_handshake_msg(ctx, peer, DTLS_HT_FINISHED, + buf, p - buf); +} + +static int +dtls_send_client_hello(dtls_context_t *ctx, dtls_peer_t *peer, + uint8 cookie[], size_t cookie_length) { + uint8 buf[DTLS_CH_LENGTH_MAX]; + uint8 *p = buf; + uint8_t cipher_size; + uint8_t extension_size; + int psk; + int ecdsa; + dtls_handshake_parameters_t *handshake = peer->handshake_params; + dtls_tick_t now; + + psk = is_psk_supported(ctx); + ecdsa = is_ecdsa_supported(ctx, 1); + + cipher_size = 2 + ((ecdsa) ? 2 : 0) + ((psk) ? 2 : 0); + extension_size = (ecdsa) ? 2 + 6 + 6 + 8 + 6: 0; + + if (cipher_size == 0) { + dtls_crit("no cipher callbacks implemented\n"); + } + + dtls_int_to_uint16(p, DTLS_VERSION); + p += sizeof(uint16); + + if (cookie_length > DTLS_COOKIE_LENGTH_MAX) { + dtls_warn("the cookie is too long\n"); + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + } + + if (cookie_length == 0) { + /* Set client random: First 4 bytes are the client's Unix timestamp, + * followed by 28 bytes of generate random data. */ + dtls_ticks(&now); + dtls_int_to_uint32(handshake->tmp.random.client, now / CLOCK_SECOND); + dtls_prng(handshake->tmp.random.client + sizeof(uint32), + DTLS_RANDOM_LENGTH - sizeof(uint32)); + } + /* we must use the same Client Random as for the previous request */ + memcpy(p, handshake->tmp.random.client, DTLS_RANDOM_LENGTH); + p += DTLS_RANDOM_LENGTH; + + /* session id (length 0) */ + dtls_int_to_uint8(p, 0); + p += sizeof(uint8); + + /* cookie */ + dtls_int_to_uint8(p, cookie_length); + p += sizeof(uint8); + if (cookie_length != 0) { + memcpy(p, cookie, cookie_length); + p += cookie_length; + } + + /* add known cipher(s) */ + dtls_int_to_uint16(p, cipher_size - 2); + p += sizeof(uint16); + + if (ecdsa) { + dtls_int_to_uint16(p, TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8); + p += sizeof(uint16); + } + if (psk) { + dtls_int_to_uint16(p, TLS_PSK_WITH_AES_128_CCM_8); + p += sizeof(uint16); + } + + /* compression method */ + dtls_int_to_uint8(p, 1); + p += sizeof(uint8); + + dtls_int_to_uint8(p, TLS_COMPRESSION_NULL); + p += sizeof(uint8); + + if (extension_size) { + /* length of the extensions */ + dtls_int_to_uint16(p, extension_size - 2); + p += sizeof(uint16); + } + + if (ecdsa) { + /* client certificate type extension */ + dtls_int_to_uint16(p, TLS_EXT_CLIENT_CERTIFICATE_TYPE); + p += sizeof(uint16); + + /* length of this extension type */ + dtls_int_to_uint16(p, 2); + p += sizeof(uint16); + + /* length of the list */ + dtls_int_to_uint8(p, 1); + p += sizeof(uint8); + + dtls_int_to_uint8(p, TLS_CERT_TYPE_RAW_PUBLIC_KEY); + p += sizeof(uint8); + + /* client certificate type extension */ + dtls_int_to_uint16(p, TLS_EXT_SERVER_CERTIFICATE_TYPE); + p += sizeof(uint16); + + /* length of this extension type */ + dtls_int_to_uint16(p, 2); + p += sizeof(uint16); + + /* length of the list */ + dtls_int_to_uint8(p, 1); + p += sizeof(uint8); + + dtls_int_to_uint8(p, TLS_CERT_TYPE_RAW_PUBLIC_KEY); + p += sizeof(uint8); + + /* elliptic_curves */ + dtls_int_to_uint16(p, TLS_EXT_ELLIPTIC_CURVES); + p += sizeof(uint16); + + /* length of this extension type */ + dtls_int_to_uint16(p, 4); + p += sizeof(uint16); + + /* length of the list */ + dtls_int_to_uint16(p, 2); + p += sizeof(uint16); + + dtls_int_to_uint16(p, TLS_EXT_ELLIPTIC_CURVES_SECP256R1); + p += sizeof(uint16); + + /* ec_point_formats */ + dtls_int_to_uint16(p, TLS_EXT_EC_POINT_FORMATS); + p += sizeof(uint16); + + /* length of this extension type */ + dtls_int_to_uint16(p, 2); + p += sizeof(uint16); + + /* number of supported formats */ + dtls_int_to_uint8(p, 1); + p += sizeof(uint8); + + dtls_int_to_uint8(p, TLS_EXT_EC_POINT_FORMATS_UNCOMPRESSED); + p += sizeof(uint8); + } + + assert(p - buf <= sizeof(buf)); + + if (cookie_length != 0) + clear_hs_hash(peer); + + return dtls_send_handshake_msg_hash(ctx, peer, &peer->session, + DTLS_HT_CLIENT_HELLO, + buf, p - buf, cookie_length != 0); +} + +static int +check_server_hello(dtls_context_t *ctx, + dtls_peer_t *peer, + uint8 *data, size_t data_length) +{ + dtls_handshake_parameters_t *handshake = peer->handshake_params; + + /* This function is called when we expect a ServerHello (i.e. we + * have sent a ClientHello). We might instead receive a HelloVerify + * request containing a cookie. If so, we must repeat the + * ClientHello with the given Cookie. + */ + if (data_length < DTLS_HS_LENGTH + DTLS_HS_LENGTH) + return dtls_alert_fatal_create(DTLS_ALERT_DECODE_ERROR); + + update_hs_hash(peer, data, data_length); + + /* FIXME: check data_length before accessing fields */ + + /* Get the server's random data and store selected cipher suite + * and compression method (like dtls_update_parameters(). + * Then calculate master secret and wait for ServerHelloDone. When received, + * send ClientKeyExchange (?) and ChangeCipherSpec + ClientFinished. */ + + /* check server version */ + data += DTLS_HS_LENGTH; + data_length -= DTLS_HS_LENGTH; + + if (dtls_uint16_to_int(data) != DTLS_VERSION) { + dtls_alert("unknown DTLS version\n"); + return dtls_alert_fatal_create(DTLS_ALERT_PROTOCOL_VERSION); + } + + data += sizeof(uint16); /* skip version field */ + data_length -= sizeof(uint16); + + /* store server random data */ + memcpy(handshake->tmp.random.server, data, DTLS_RANDOM_LENGTH); + /* skip server random */ + data += DTLS_RANDOM_LENGTH; + data_length -= DTLS_RANDOM_LENGTH; + + SKIP_VAR_FIELD(data, data_length, uint8); /* skip session id */ + + /* Check cipher suite. As we offer all we have, it is sufficient + * to check if the cipher suite selected by the server is in our + * list of known cipher suites. Subsets are not supported. */ + handshake->cipher = dtls_uint16_to_int(data); + if (!known_cipher(ctx, handshake->cipher, 1)) { + dtls_alert("unsupported cipher 0x%02x 0x%02x\n", + data[0], data[1]); + return dtls_alert_fatal_create(DTLS_ALERT_INSUFFICIENT_SECURITY); + } + data += sizeof(uint16); + data_length -= sizeof(uint16); + + /* Check if NULL compression was selected. We do not know any other. */ + if (dtls_uint8_to_int(data) != TLS_COMPRESSION_NULL) { + dtls_alert("unsupported compression method 0x%02x\n", data[0]); + return dtls_alert_fatal_create(DTLS_ALERT_INSUFFICIENT_SECURITY); + } + data += sizeof(uint8); + data_length -= sizeof(uint8); + + return dtls_check_tls_extension(peer, data, data_length, 0); + +error: + return dtls_alert_fatal_create(DTLS_ALERT_DECODE_ERROR); +} + +static int +check_server_hello_verify_request(dtls_context_t *ctx, + dtls_peer_t *peer, + uint8 *data, size_t data_length) +{ + dtls_hello_verify_t *hv; + int res; + + if (data_length < DTLS_HS_LENGTH + DTLS_HV_LENGTH) + return dtls_alert_fatal_create(DTLS_ALERT_DECODE_ERROR); + + hv = (dtls_hello_verify_t *)(data + DTLS_HS_LENGTH); + + res = dtls_send_client_hello(ctx, peer, hv->cookie, hv->cookie_length); + + if (res < 0) + dtls_warn("cannot send ClientHello\n"); + + return res; +} + +#ifdef DTLS_ECC +static int +check_server_certificate(dtls_context_t *ctx, + dtls_peer_t *peer, + uint8 *data, size_t data_length) +{ + int err; + dtls_handshake_parameters_t *config = peer->handshake_params; + + update_hs_hash(peer, data, data_length); + + assert(is_tls_ecdhe_ecdsa_with_aes_128_ccm_8(config->cipher)); + + data += DTLS_HS_LENGTH; + + if (dtls_uint24_to_int(data) != DTLS_EC_SUBJECTPUBLICKEY_SIZE) { + dtls_alert("expect length of %d bytes for certificate\n", + DTLS_EC_SUBJECTPUBLICKEY_SIZE); + return dtls_alert_fatal_create(DTLS_ALERT_DECODE_ERROR); + } + data += sizeof(uint24); + + if (memcmp(data, cert_asn1_header, sizeof(cert_asn1_header))) { + dtls_alert("got an unexpected Subject public key format\n"); + return dtls_alert_fatal_create(DTLS_ALERT_DECODE_ERROR); + } + data += sizeof(cert_asn1_header); + + memcpy(config->keyx.ecdsa.other_pub_x, data, + sizeof(config->keyx.ecdsa.other_pub_x)); + data += sizeof(config->keyx.ecdsa.other_pub_x); + + memcpy(config->keyx.ecdsa.other_pub_y, data, + sizeof(config->keyx.ecdsa.other_pub_y)); + data += sizeof(config->keyx.ecdsa.other_pub_y); + + err = CALL(ctx, verify_ecdsa_key, &peer->session, + config->keyx.ecdsa.other_pub_x, + config->keyx.ecdsa.other_pub_y, + sizeof(config->keyx.ecdsa.other_pub_x)); + if (err < 0) { + dtls_warn("The certificate was not accepted\n"); + return err; + } + + return 0; +} + +static int +check_server_key_exchange_ecdsa(dtls_context_t *ctx, + dtls_peer_t *peer, + uint8 *data, size_t data_length) +{ + dtls_handshake_parameters_t *config = peer->handshake_params; + int ret; + unsigned char *result_r; + unsigned char *result_s; + unsigned char *key_params; + + update_hs_hash(peer, data, data_length); + + assert(is_tls_ecdhe_ecdsa_with_aes_128_ccm_8(config->cipher)); + + data += DTLS_HS_LENGTH; + + if (data_length < DTLS_HS_LENGTH + DTLS_SKEXEC_LENGTH) { + dtls_alert("the packet length does not match the expected\n"); + return dtls_alert_fatal_create(DTLS_ALERT_DECODE_ERROR); + } + key_params = data; + + if (dtls_uint8_to_int(data) != TLS_EC_CURVE_TYPE_NAMED_CURVE) { + dtls_alert("Only named curves supported\n"); + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + } + data += sizeof(uint8); + data_length -= sizeof(uint8); + + if (dtls_uint16_to_int(data) != TLS_EXT_ELLIPTIC_CURVES_SECP256R1) { + dtls_alert("secp256r1 supported\n"); + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + } + data += sizeof(uint16); + data_length -= sizeof(uint16); + + if (dtls_uint8_to_int(data) != 1 + 2 * DTLS_EC_KEY_SIZE) { + dtls_alert("expected 65 bytes long public point\n"); + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + } + data += sizeof(uint8); + data_length -= sizeof(uint8); + + if (dtls_uint8_to_int(data) != 4) { + dtls_alert("expected uncompressed public point\n"); + return dtls_alert_fatal_create(DTLS_ALERT_DECODE_ERROR); + } + data += sizeof(uint8); + data_length -= sizeof(uint8); + + memcpy(config->keyx.ecdsa.other_eph_pub_x, data, sizeof(config->keyx.ecdsa.other_eph_pub_y)); + data += sizeof(config->keyx.ecdsa.other_eph_pub_y); + data_length -= sizeof(config->keyx.ecdsa.other_eph_pub_y); + + memcpy(config->keyx.ecdsa.other_eph_pub_y, data, sizeof(config->keyx.ecdsa.other_eph_pub_y)); + data += sizeof(config->keyx.ecdsa.other_eph_pub_y); + data_length -= sizeof(config->keyx.ecdsa.other_eph_pub_y); + + ret = dtls_check_ecdsa_signature_elem(data, data_length, &result_r, &result_s); + if (ret < 0) { + return ret; + } + data += ret; + data_length -= ret; + + ret = dtls_ecdsa_verify_sig(config->keyx.ecdsa.other_pub_x, config->keyx.ecdsa.other_pub_y, + sizeof(config->keyx.ecdsa.other_pub_x), + config->tmp.random.client, DTLS_RANDOM_LENGTH, + config->tmp.random.server, DTLS_RANDOM_LENGTH, + key_params, + 1 + 2 + 1 + 1 + (2 * DTLS_EC_KEY_SIZE), + result_r, result_s); + + if (ret < 0) { + dtls_alert("wrong signature\n"); + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + } + return 0; +} +#endif /* DTLS_ECC */ + +#ifdef DTLS_PSK +static int +check_server_key_exchange_psk(dtls_context_t *ctx, + dtls_peer_t *peer, + uint8 *data, size_t data_length) +{ + dtls_handshake_parameters_t *config = peer->handshake_params; + uint16_t len; + + update_hs_hash(peer, data, data_length); + + assert(is_tls_psk_with_aes_128_ccm_8(config->cipher)); + + data += DTLS_HS_LENGTH; + + if (data_length < DTLS_HS_LENGTH + DTLS_SKEXECPSK_LENGTH_MIN) { + dtls_alert("the packet length does not match the expected\n"); + return dtls_alert_fatal_create(DTLS_ALERT_DECODE_ERROR); + } + + len = dtls_uint16_to_int(data); + data += sizeof(uint16); + + if (len != data_length - DTLS_HS_LENGTH - sizeof(uint16)) { + dtls_warn("the length of the server identity hint is worng\n"); + return dtls_alert_fatal_create(DTLS_ALERT_DECODE_ERROR); + } + + if (len > DTLS_PSK_MAX_CLIENT_IDENTITY_LEN) { + dtls_warn("please use a smaller server identity hint\n"); + return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR); + } + + /* store the psk_identity_hint in config->keyx.psk for later use */ + config->keyx.psk.id_length = len; + memcpy(config->keyx.psk.identity, data, len); + return 0; +} +#endif /* DTLS_PSK */ + +static int +check_certificate_request(dtls_context_t *ctx, + dtls_peer_t *peer, + uint8 *data, size_t data_length) +{ + unsigned int i; + int auth_alg; + int sig_alg; + int hash_alg; + + update_hs_hash(peer, data, data_length); + + assert(is_tls_ecdhe_ecdsa_with_aes_128_ccm_8(peer->handshake_params->cipher)); + + data += DTLS_HS_LENGTH; + + if (data_length < DTLS_HS_LENGTH + 5) { + dtls_alert("the packet length does not match the expected\n"); + return dtls_alert_fatal_create(DTLS_ALERT_DECODE_ERROR); + } + + i = dtls_uint8_to_int(data); + data += sizeof(uint8); + if (i + 1 > data_length) { + dtls_alert("the cerfificate types are too long\n"); + return dtls_alert_fatal_create(DTLS_ALERT_DECODE_ERROR); + } + + auth_alg = 0; + for (; i > 0 ; i -= sizeof(uint8)) { + if (dtls_uint8_to_int(data) == TLS_CLIENT_CERTIFICATE_TYPE_ECDSA_SIGN + && auth_alg == 0) + auth_alg = dtls_uint8_to_int(data); + data += sizeof(uint8); + } + + if (auth_alg != TLS_CLIENT_CERTIFICATE_TYPE_ECDSA_SIGN) { + dtls_alert("the request authentication algorithm is not supproted\n"); + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + } + + i = dtls_uint16_to_int(data); + data += sizeof(uint16); + if (i + 1 > data_length) { + dtls_alert("the signature and hash algorithm list is too long\n"); + return dtls_alert_fatal_create(DTLS_ALERT_DECODE_ERROR); + } + + hash_alg = 0; + sig_alg = 0; + for (; i > 0 ; i -= sizeof(uint16)) { + int current_hash_alg; + int current_sig_alg; + + current_hash_alg = dtls_uint8_to_int(data); + data += sizeof(uint8); + current_sig_alg = dtls_uint8_to_int(data); + data += sizeof(uint8); + + if (current_hash_alg == TLS_EXT_SIG_HASH_ALGO_SHA256 && hash_alg == 0 && + current_sig_alg == TLS_EXT_SIG_HASH_ALGO_ECDSA && sig_alg == 0) { + hash_alg = current_hash_alg; + sig_alg = current_sig_alg; + } + } + + if (hash_alg != TLS_EXT_SIG_HASH_ALGO_SHA256 || + sig_alg != TLS_EXT_SIG_HASH_ALGO_ECDSA) { + dtls_alert("no supported hash and signature algorithem\n"); + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + } + + /* common names are ignored */ + + peer->handshake_params->do_client_auth = 1; + return 0; +} + +static int +check_server_hellodone(dtls_context_t *ctx, + dtls_peer_t *peer, + uint8 *data, size_t data_length) +{ + int res; +#ifdef DTLS_ECC + const dtls_ecdsa_key_t *ecdsa_key; +#endif /* DTLS_ECC */ + + dtls_handshake_parameters_t *handshake = peer->handshake_params; + + /* calculate master key, send CCS */ + + update_hs_hash(peer, data, data_length); + +#ifdef DTLS_ECC + if (handshake->do_client_auth) { + + res = CALL(ctx, get_ecdsa_key, &peer->session, &ecdsa_key); + if (res < 0) { + dtls_crit("no ecdsa certificate to send in certificate\n"); + return res; + } + + res = dtls_send_certificate_ecdsa(ctx, peer, ecdsa_key); + + if (res < 0) { + dtls_debug("dtls_server_hello: cannot prepare Certificate record\n"); + return res; + } + } +#endif /* DTLS_ECC */ + + /* send ClientKeyExchange */ + res = dtls_send_client_key_exchange(ctx, peer); + + if (res < 0) { + dtls_debug("cannot send KeyExchange message\n"); + return res; + } + +#ifdef DTLS_ECC + if (handshake->do_client_auth) { + + res = dtls_send_certificate_verify_ecdh(ctx, peer, ecdsa_key); + + if (res < 0) { + dtls_debug("dtls_server_hello: cannot prepare Certificate record\n"); + return res; + } + } +#endif /* DTLS_ECC */ + + res = calculate_key_block(ctx, handshake, peer, + &peer->session, peer->role); + if (res < 0) { + return res; + } + + res = dtls_send_ccs(ctx, peer); + if (res < 0) { + dtls_debug("cannot send CCS message\n"); + return res; + } + + /* and switch cipher suite */ + dtls_security_params_switch(peer); + + /* Client Finished */ + return dtls_send_finished(ctx, peer, PRF_LABEL(client), PRF_LABEL_SIZE(client)); +} + +static int +decrypt_verify(dtls_peer_t *peer, uint8 *packet, size_t length, + uint8 **cleartext) +{ + dtls_record_header_t *header = DTLS_RECORD_HEADER(packet); + dtls_security_parameters_t *security = dtls_security_params_epoch(peer, dtls_get_epoch(header)); + int clen; + + *cleartext = (uint8 *)packet + sizeof(dtls_record_header_t); + clen = length - sizeof(dtls_record_header_t); + + if (!security) { + dtls_alert("No security context for epoch: %i\n", dtls_get_epoch(header)); + return -1; + } + + if (security->cipher == TLS_NULL_WITH_NULL_NULL) { + /* no cipher suite selected */ + return clen; + } else { /* TLS_PSK_WITH_AES_128_CCM_8 or TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 */ + /** + * length of additional_data for the AEAD cipher which consists of + * seq_num(2+6) + type(1) + version(2) + length(2) + */ +#define A_DATA_LEN 13 + unsigned char nonce[DTLS_CCM_BLOCKSIZE]; + unsigned char A_DATA[A_DATA_LEN]; + + if (clen < 16) /* need at least IV and MAC */ + return -1; + + memset(nonce, 0, DTLS_CCM_BLOCKSIZE); + memcpy(nonce, dtls_kb_remote_iv(security, peer->role), + dtls_kb_iv_size(security, peer->role)); + + /* read epoch and seq_num from message */ + memcpy(nonce + dtls_kb_iv_size(security, peer->role), *cleartext, 8); + *cleartext += 8; + clen -= 8; + + dtls_debug_dump("nonce", nonce, DTLS_CCM_BLOCKSIZE); + dtls_debug_dump("key", dtls_kb_remote_write_key(security, peer->role), + dtls_kb_key_size(security, peer->role)); + dtls_debug_dump("ciphertext", *cleartext, clen); + + /* re-use N to create additional data according to RFC 5246, Section 6.2.3.3: + * + * additional_data = seq_num + TLSCompressed.type + + * TLSCompressed.version + TLSCompressed.length; + */ + memcpy(A_DATA, &DTLS_RECORD_HEADER(packet)->epoch, 8); /* epoch and seq_num */ + memcpy(A_DATA + 8, &DTLS_RECORD_HEADER(packet)->content_type, 3); /* type and version */ + dtls_int_to_uint16(A_DATA + 11, clen - 8); /* length without nonce_explicit */ + + clen = dtls_decrypt(*cleartext, clen, *cleartext, nonce, + dtls_kb_remote_write_key(security, peer->role), + dtls_kb_key_size(security, peer->role), + A_DATA, A_DATA_LEN); + if (clen < 0) + dtls_warn("decryption failed\n"); + else { +#ifndef NDEBUG + printf("decrypt_verify(): found %i bytes cleartext\n", clen); +#endif + dtls_security_params_free_other(peer); + dtls_debug_dump("cleartext", *cleartext, clen); + } + } + return clen; +} + +static int +dtls_send_hello_request(dtls_context_t *ctx, dtls_peer_t *peer) +{ + return dtls_send_handshake_msg_hash(ctx, peer, &peer->session, + DTLS_HT_HELLO_REQUEST, + NULL, 0, 0); +} + +int +dtls_renegotiate(dtls_context_t *ctx, const session_t *dst) +{ + dtls_peer_t *peer = NULL; + int err; + + peer = dtls_get_peer(ctx, dst); + + if (!peer) { + return -1; + } + if (peer->state != DTLS_STATE_CONNECTED) + return -1; + + peer->handshake_params = dtls_handshake_new(); + if (!peer->handshake_params) + return -1; + + peer->handshake_params->hs_state.mseq_r = 0; + peer->handshake_params->hs_state.mseq_s = 0; + + if (peer->role == DTLS_CLIENT) { + /* send ClientHello with empty Cookie */ + err = dtls_send_client_hello(ctx, peer, NULL, 0); + if (err < 0) + dtls_warn("cannot send ClientHello\n"); + else + peer->state = DTLS_STATE_CLIENTHELLO; + return err; + } else if (peer->role == DTLS_SERVER) { + return dtls_send_hello_request(ctx, peer); + } + + return -1; +} + +static int +handle_handshake_msg(dtls_context_t *ctx, dtls_peer_t *peer, session_t *session, + const dtls_peer_type role, const dtls_state_t state, + uint8 *data, size_t data_length) { + + int err = 0; + + /* This will clear the retransmission buffer if we get an expected + * handshake message. We have to make sure that no handshake message + * should get expected when we still should retransmit something, when + * we do everything accordingly to the DTLS 1.2 standard this should + * not be a problem. */ + if (peer) { + dtls_stop_retransmission(ctx, peer); + } + + /* The following switch construct handles the given message with + * respect to the current internal state for this peer. In case of + * error, it is left with return 0. */ + + dtls_debug("handle handshake packet of type: %s (%i)\n", + dtls_handshake_type_to_name(data[0]), data[0]); + switch (data[0]) { + + /************************************************************************ + * Client states + ************************************************************************/ + case DTLS_HT_HELLO_VERIFY_REQUEST: + + if (state != DTLS_STATE_CLIENTHELLO) { + return dtls_alert_fatal_create(DTLS_ALERT_UNEXPECTED_MESSAGE); + } + + err = check_server_hello_verify_request(ctx, peer, data, data_length); + if (err < 0) { + dtls_warn("error in check_server_hello_verify_request err: %i\n", err); + return err; + } + + break; + case DTLS_HT_SERVER_HELLO: + + if (state != DTLS_STATE_CLIENTHELLO) { + return dtls_alert_fatal_create(DTLS_ALERT_UNEXPECTED_MESSAGE); + } + + err = check_server_hello(ctx, peer, data, data_length); + if (err < 0) { + dtls_warn("error in check_server_hello err: %i\n", err); + return err; + } + if (is_tls_ecdhe_ecdsa_with_aes_128_ccm_8(peer->handshake_params->cipher)) + peer->state = DTLS_STATE_WAIT_SERVERCERTIFICATE; + else + peer->state = DTLS_STATE_WAIT_SERVERHELLODONE; + /* update_hs_hash(peer, data, data_length); */ + + break; + +#ifdef DTLS_ECC + case DTLS_HT_CERTIFICATE: + + if ((role == DTLS_CLIENT && state != DTLS_STATE_WAIT_SERVERCERTIFICATE) || + (role == DTLS_SERVER && state != DTLS_STATE_WAIT_CLIENTCERTIFICATE)) { + return dtls_alert_fatal_create(DTLS_ALERT_UNEXPECTED_MESSAGE); + } + err = check_server_certificate(ctx, peer, data, data_length); + if (err < 0) { + dtls_warn("error in check_server_certificate err: %i\n", err); + return err; + } + if (role == DTLS_CLIENT) { + peer->state = DTLS_STATE_WAIT_SERVERKEYEXCHANGE; + } else if (role == DTLS_SERVER){ + peer->state = DTLS_STATE_WAIT_CLIENTKEYEXCHANGE; + } + /* update_hs_hash(peer, data, data_length); */ + + break; +#endif /* DTLS_ECC */ + + case DTLS_HT_SERVER_KEY_EXCHANGE: + +#ifdef DTLS_ECC + if (is_tls_ecdhe_ecdsa_with_aes_128_ccm_8(peer->handshake_params->cipher)) { + if (state != DTLS_STATE_WAIT_SERVERKEYEXCHANGE) { + return dtls_alert_fatal_create(DTLS_ALERT_UNEXPECTED_MESSAGE); + } + err = check_server_key_exchange_ecdsa(ctx, peer, data, data_length); + } +#endif /* DTLS_ECC */ +#ifdef DTLS_PSK + if (is_tls_psk_with_aes_128_ccm_8(peer->handshake_params->cipher)) { + if (state != DTLS_STATE_WAIT_SERVERHELLODONE) { + return dtls_alert_fatal_create(DTLS_ALERT_UNEXPECTED_MESSAGE); + } + err = check_server_key_exchange_psk(ctx, peer, data, data_length); + } +#endif /* DTLS_PSK */ + + if (err < 0) { + dtls_warn("error in check_server_key_exchange err: %i\n", err); + return err; + } + peer->state = DTLS_STATE_WAIT_SERVERHELLODONE; + /* update_hs_hash(peer, data, data_length); */ + + break; + + case DTLS_HT_SERVER_HELLO_DONE: + + if (state != DTLS_STATE_WAIT_SERVERHELLODONE) { + return dtls_alert_fatal_create(DTLS_ALERT_UNEXPECTED_MESSAGE); + } + + err = check_server_hellodone(ctx, peer, data, data_length); + if (err < 0) { + dtls_warn("error in check_server_hellodone err: %i\n", err); + return err; + } + peer->state = DTLS_STATE_WAIT_CHANGECIPHERSPEC; + /* update_hs_hash(peer, data, data_length); */ + + break; + + case DTLS_HT_CERTIFICATE_REQUEST: + + if (state != DTLS_STATE_WAIT_SERVERHELLODONE) { + return dtls_alert_fatal_create(DTLS_ALERT_UNEXPECTED_MESSAGE); + } + + err = check_certificate_request(ctx, peer, data, data_length); + if (err < 0) { + dtls_warn("error in check_certificate_request err: %i\n", err); + return err; + } + + break; + + case DTLS_HT_FINISHED: + /* expect a Finished message from server */ + + if (state != DTLS_STATE_WAIT_FINISHED) { + return dtls_alert_fatal_create(DTLS_ALERT_UNEXPECTED_MESSAGE); + } + + err = check_finished(ctx, peer, data, data_length); + if (err < 0) { + dtls_warn("error in check_finished err: %i\n", err); + return err; + } + if (role == DTLS_SERVER) { + /* send ServerFinished */ + update_hs_hash(peer, data, data_length); + + /* send change cipher spec message and switch to new configuration */ + err = dtls_send_ccs(ctx, peer); + if (err < 0) { + dtls_warn("cannot send CCS message\n"); + return err; + } + + dtls_security_params_switch(peer); + + err = dtls_send_finished(ctx, peer, PRF_LABEL(server), PRF_LABEL_SIZE(server)); + if (err < 0) { + dtls_warn("sending server Finished failed\n"); + return err; + } + } + dtls_handshake_free(peer->handshake_params); + peer->handshake_params = NULL; + dtls_debug("Handshake complete\n"); + check_stack(); + peer->state = DTLS_STATE_CONNECTED; + + /* return here to not increase the message receive counter */ + return err; + + /************************************************************************ + * Server states + ************************************************************************/ + + case DTLS_HT_CLIENT_KEY_EXCHANGE: + /* handle ClientHello, update msg and msglen and goto next if not finished */ + + if (state != DTLS_STATE_WAIT_CLIENTKEYEXCHANGE) { + return dtls_alert_fatal_create(DTLS_ALERT_UNEXPECTED_MESSAGE); + } + + err = check_client_keyexchange(ctx, peer->handshake_params, data, data_length); + if (err < 0) { + dtls_warn("error in check_client_keyexchange err: %i\n", err); + return err; + } + update_hs_hash(peer, data, data_length); + + if (is_tls_ecdhe_ecdsa_with_aes_128_ccm_8(peer->handshake_params->cipher) && + is_ecdsa_client_auth_supported(ctx)) + peer->state = DTLS_STATE_WAIT_CERTIFICATEVERIFY; + else + peer->state = DTLS_STATE_WAIT_CHANGECIPHERSPEC; + break; + +#ifdef DTLS_ECC + case DTLS_HT_CERTIFICATE_VERIFY: + + if (state != DTLS_STATE_WAIT_CERTIFICATEVERIFY) { + return dtls_alert_fatal_create(DTLS_ALERT_UNEXPECTED_MESSAGE); + } + + err = check_client_certificate_verify(ctx, peer, data, data_length); + if (err < 0) { + dtls_warn("error in check_client_certificate_verify err: %i\n", err); + return err; + } + + update_hs_hash(peer, data, data_length); + peer->state = DTLS_STATE_WAIT_CHANGECIPHERSPEC; + break; +#endif /* DTLS_ECC */ + + case DTLS_HT_CLIENT_HELLO: + + if ((peer && state != DTLS_STATE_CONNECTED && state != DTLS_STATE_WAIT_CLIENTHELLO) || + (!peer && state != DTLS_STATE_WAIT_CLIENTHELLO)) { + return dtls_alert_fatal_create(DTLS_ALERT_UNEXPECTED_MESSAGE); + } + + /* When no DTLS state exists for this peer, we only allow a + Client Hello message with + + a) a valid cookie, or + b) no cookie. + + Anything else will be rejected. Fragementation is not allowed + here as it would require peer state as well. + */ + err = dtls_verify_peer(ctx, peer, session, state, data, data_length); + if (err < 0) { + dtls_warn("error in dtls_verify_peer err: %i\n", err); + return err; + } + + if (err > 0) { + dtls_debug("server hello verify was sent\n"); + break; + } + + /* At this point, we have a good relationship with this peer. This + * state is left for re-negotiation of key material. */ + /* As per RFC 6347 - section 4.2.8 if this is an attempt to + * rehandshake, we can delete the existing key material + * as the client has demonstrated reachibility by completing + * the cookie exchange */ + if (peer && state == DTLS_STATE_WAIT_CLIENTHELLO) { + dtls_debug("removing the peer\n"); + DEL_PEER(ctx->peers, peer); + + dtls_free_peer(peer); + peer = NULL; + } + if (!peer) { + dtls_debug("creating new peer\n"); + dtls_security_parameters_t *security; + + /* msg contains a Client Hello with a valid cookie, so we can + * safely create the server state machine and continue with + * the handshake. */ + peer = dtls_new_peer(session); + if (!peer) { + dtls_alert("cannot create peer\n"); + return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR); + } + peer->role = DTLS_SERVER; + + /* Initialize record sequence number to 1 for new peers. The first + * record with sequence number 0 is a stateless Hello Verify Request. + */ + security = dtls_security_params(peer); + security->rseq = 1; + + if (dtls_add_peer(ctx, peer) < 0) { + dtls_alert("cannot add peer\n"); + dtls_free_peer(peer); + return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR); + } + } + if (peer && !peer->handshake_params) { + dtls_handshake_header_t *hs_header = DTLS_HANDSHAKE_HEADER(data); + + peer->handshake_params = dtls_handshake_new(); + if (!peer->handshake_params) + return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR); + + peer->handshake_params->hs_state.mseq_r = dtls_uint16_to_int(hs_header->message_seq); + peer->handshake_params->hs_state.mseq_s = 1; + } + + clear_hs_hash(peer); + + /* First negotiation step: check for PSK + * + * Note that we already have checked that msg is a Handshake + * message containing a ClientHello. dtls_get_cipher() therefore + * does not check again. + */ + err = dtls_update_parameters(ctx, peer, data, data_length); + if (err < 0) { + dtls_warn("error updating security parameters\n"); + return err; + } + + /* update finish MAC */ + update_hs_hash(peer, data, data_length); + + err = dtls_send_server_hello_msgs(ctx, peer); + if (err < 0) { + return err; + } + if (is_tls_ecdhe_ecdsa_with_aes_128_ccm_8(peer->handshake_params->cipher) && + is_ecdsa_client_auth_supported(ctx)) + peer->state = DTLS_STATE_WAIT_CLIENTCERTIFICATE; + else + peer->state = DTLS_STATE_WAIT_CLIENTKEYEXCHANGE; + + /* after sending the ServerHelloDone, we expect the + * ClientKeyExchange (possibly containing the PSK id), + * followed by a ChangeCipherSpec and an encrypted Finished. + */ + + break; + + case DTLS_HT_HELLO_REQUEST: + + if (state != DTLS_STATE_CONNECTED) { + /* we should just ignore such packets when in handshake */ + return 0; + } + + if (peer && !peer->handshake_params) { + peer->handshake_params = dtls_handshake_new(); + if (!peer->handshake_params) + return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR); + + peer->handshake_params->hs_state.mseq_r = 0; + peer->handshake_params->hs_state.mseq_s = 0; + } + + /* send ClientHello with empty Cookie */ + err = dtls_send_client_hello(ctx, peer, NULL, 0); + if (err < 0) { + dtls_warn("cannot send ClientHello\n"); + return err; + } + peer->state = DTLS_STATE_CLIENTHELLO; + break; + + default: + dtls_crit("unhandled message %d\n", data[0]); + return dtls_alert_fatal_create(DTLS_ALERT_UNEXPECTED_MESSAGE); + } + + if (peer && peer->handshake_params && err >= 0) { + peer->handshake_params->hs_state.mseq_r++; + } + + return err; +} + +static int +handle_handshake(dtls_context_t *ctx, dtls_peer_t *peer, session_t *session, + const dtls_peer_type role, const dtls_state_t state, + uint8 *data, size_t data_length) +{ + dtls_handshake_header_t *hs_header; + int res; + + if (data_length < DTLS_HS_LENGTH) { + dtls_warn("handshake message too short\n"); + return dtls_alert_fatal_create(DTLS_ALERT_DECODE_ERROR); + } + hs_header = DTLS_HANDSHAKE_HEADER(data); + + dtls_debug("received handshake packet of type: %s (%i)\n", + dtls_handshake_type_to_name(hs_header->msg_type), hs_header->msg_type); + + if (!peer || !peer->handshake_params) { + /* This is the initial ClientHello */ + if (hs_header->msg_type != DTLS_HT_CLIENT_HELLO && !peer) { + dtls_warn("If there is no peer only ClientHello is allowed\n"); + return dtls_alert_fatal_create(DTLS_ALERT_HANDSHAKE_FAILURE); + } + + /* This is a ClientHello or Hello Request send when doing TLS renegotiation */ + if (hs_header->msg_type == DTLS_HT_CLIENT_HELLO || + hs_header->msg_type == DTLS_HT_HELLO_REQUEST) { + return handle_handshake_msg(ctx, peer, session, role, state, data, + data_length); + } else { + dtls_warn("ignore unexpected handshake message\n"); + return 0; + } + } + + if (dtls_uint16_to_int(hs_header->message_seq) < peer->handshake_params->hs_state.mseq_r) { + dtls_warn("The message sequence number is too small, expected %i, got: %i\n", + peer->handshake_params->hs_state.mseq_r, dtls_uint16_to_int(hs_header->message_seq)); + return 0; + } else if (dtls_uint16_to_int(hs_header->message_seq) > peer->handshake_params->hs_state.mseq_r) { + /* A packet in between is missing, buffer this packet. */ + netq_t *n; + + /* TODO: only add packet that are not too new. */ + if (data_length > DTLS_MAX_BUF) { + dtls_warn("the packet is too big to buffer for reoder\n"); + return 0; + } + + netq_t *node = netq_head(&peer->handshake_params->reorder_queue); + while (node) { + dtls_handshake_header_t *node_header = DTLS_HANDSHAKE_HEADER(node->data); + if (dtls_uint16_to_int(node_header->message_seq) == dtls_uint16_to_int(hs_header->message_seq)) { + dtls_warn("a packet with this sequence number is already stored\n"); + return 0; + } + node = netq_next(node); + } + + n = netq_node_new(data_length); + if (!n) { + dtls_warn("no space in reoder buffer\n"); + return 0; + } + + n->peer = peer; + n->length = data_length; + memcpy(n->data, data, data_length); + + if (!netq_insert_node(&peer->handshake_params->reorder_queue, n)) { + dtls_warn("cannot add packet to reoder buffer\n"); + netq_node_free(n); + } + dtls_info("Added packet for reordering\n"); + return 0; + } else if (dtls_uint16_to_int(hs_header->message_seq) == peer->handshake_params->hs_state.mseq_r) { + /* Found the expected packet, use this and all the buffered packet */ + int next = 1; + + res = handle_handshake_msg(ctx, peer, session, role, state, data, data_length); + if (res < 0) + return res; + + /* We do not know in which order the packet are in the list just search the list for every packet. */ + while (next && peer->handshake_params) { + next = 0; + netq_t *node = netq_head(&peer->handshake_params->reorder_queue); + while (node) { + dtls_handshake_header_t *node_header = DTLS_HANDSHAKE_HEADER(node->data); + + if (dtls_uint16_to_int(node_header->message_seq) == peer->handshake_params->hs_state.mseq_r) { + netq_remove(&peer->handshake_params->reorder_queue, node); + next = 1; + res = handle_handshake_msg(ctx, peer, session, role, peer->state, node->data, node->length); + if (res < 0) { + return res; + } + + break; + } else { + node = netq_next(node); + } + } + } + return res; + } + assert(0); + return 0; +} + +static int +handle_ccs(dtls_context_t *ctx, dtls_peer_t *peer, + uint8 *record_header, uint8 *data, size_t data_length) +{ + int err; + dtls_handshake_parameters_t *handshake = peer->handshake_params; + + /* A CCS message is handled after a KeyExchange message was + * received from the client. When security parameters have been + * updated successfully and a ChangeCipherSpec message was sent + * by ourself, the security context is switched and the record + * sequence number is reset. */ + + if (!peer || peer->state != DTLS_STATE_WAIT_CHANGECIPHERSPEC) { + dtls_warn("expected ChangeCipherSpec during handshake\n"); + return 0; + } + + if (data_length < 1 || data[0] != 1) + return dtls_alert_fatal_create(DTLS_ALERT_DECODE_ERROR); + + /* Just change the cipher when we are on the same epoch */ + if (peer->role == DTLS_SERVER) { + err = calculate_key_block(ctx, handshake, peer, + &peer->session, peer->role); + if (err < 0) { + return err; + } + } + + peer->state = DTLS_STATE_WAIT_FINISHED; + + return 0; +} + +/** + * Handles incoming Alert messages. This function returns \c 1 if the + * connection should be closed and the peer is to be invalidated. + */ +static int +handle_alert(dtls_context_t *ctx, dtls_peer_t *peer, + uint8 *record_header, uint8 *data, size_t data_length) { + int free_peer = 0; /* indicates whether to free peer */ + + if (data_length < 2) + return dtls_alert_fatal_create(DTLS_ALERT_DECODE_ERROR); + + dtls_info("** Alert: level %d, description %d\n", data[0], data[1]); + + if (!peer) { + dtls_warn("got an alert for an unknown peer, we probably already removed it, ignore it\n"); + return 0; + } + + /* The peer object is invalidated for FATAL alerts and close + * notifies. This is done in two steps.: First, remove the object + * from our list of peers. After that, the event handler callback is + * invoked with the still existing peer object. Finally, the storage + * used by peer is released. + */ + if (data[0] == DTLS_ALERT_LEVEL_FATAL || data[1] == DTLS_ALERT_CLOSE_NOTIFY) { + dtls_alert("%d invalidate peer\n", data[1]); + + DEL_PEER(ctx->peers, peer); + +#ifdef WITH_CONTIKI +#ifndef NDEBUG + PRINTF("removed peer ["); + PRINT6ADDR(&peer->session.addr); + PRINTF("]:%d\n", uip_ntohs(peer->session.port)); +#endif +#endif /* WITH_CONTIKI */ + + free_peer = 1; + + } + + (void)CALL(ctx, event, &peer->session, + (dtls_alert_level_t)data[0], (unsigned short)data[1]); + switch (data[1]) { + case DTLS_ALERT_CLOSE_NOTIFY: + /* If state is DTLS_STATE_CLOSING, we have already sent a + * close_notify so, do not send that again. */ + if (peer->state != DTLS_STATE_CLOSING) { + peer->state = DTLS_STATE_CLOSING; + dtls_send_alert(ctx, peer, DTLS_ALERT_LEVEL_FATAL, DTLS_ALERT_CLOSE_NOTIFY); + } else + peer->state = DTLS_STATE_CLOSED; + break; + default: + ; + } + + if (free_peer) { + dtls_stop_retransmission(ctx, peer); + dtls_destroy_peer(ctx, peer, 1); + } + + return free_peer; +} + +static int dtls_alert_send_from_err(dtls_context_t *ctx, dtls_peer_t *peer, + session_t *session, int err) +{ + int level; + int desc; + + if (err < -(1 << 8) && err > -(3 << 8)) { + level = ((-err) & 0xff00) >> 8; + desc = (-err) & 0xff; + if (!peer) { + peer = dtls_get_peer(ctx, session); + } + if (peer) { + peer->state = DTLS_STATE_CLOSING; + return dtls_send_alert(ctx, peer, level, desc); + } + } else if (err == -1) { + if (!peer) { + peer = dtls_get_peer(ctx, session); + } + if (peer) { + peer->state = DTLS_STATE_CLOSING; + return dtls_send_alert(ctx, peer, DTLS_ALERT_LEVEL_FATAL, DTLS_ALERT_INTERNAL_ERROR); + } + } + return -1; +} + +/** + * Handles incoming data as DTLS message from given peer. + */ +int +dtls_handle_message(dtls_context_t *ctx, + session_t *session, + uint8 *msg, int msglen) { + dtls_peer_t *peer = NULL; + unsigned int rlen; /* record length */ + uint8 *data; /* (decrypted) payload */ + int data_length; /* length of decrypted payload + (without MAC and padding) */ + int err; + + /* check if we have DTLS state for addr/port/ifindex */ + peer = dtls_get_peer(ctx, session); + + if (!peer) { + dtls_debug("dtls_handle_message: PEER NOT FOUND\n"); + dtls_dsrv_log_addr(DTLS_LOG_DEBUG, "peer addr", session); + } else { + dtls_debug("dtls_handle_message: FOUND PEER\n"); + } + + while ((rlen = is_record(msg,msglen))) { + dtls_peer_type role; + dtls_state_t state; + + dtls_debug("got packet %d (%d bytes)\n", msg[0], rlen); + if (peer) { + data_length = decrypt_verify(peer, msg, rlen, &data); + if (data_length < 0) { + if (hs_attempt_with_existing_peer(msg, rlen, peer)) { + data = msg + DTLS_RH_LENGTH; + data_length = rlen - DTLS_RH_LENGTH; + state = DTLS_STATE_WAIT_CLIENTHELLO; + role = DTLS_SERVER; + } else { + int err = dtls_alert_fatal_create(DTLS_ALERT_DECRYPT_ERROR); + dtls_info("decrypt_verify() failed\n"); + if (peer->state < DTLS_STATE_CONNECTED) { + dtls_alert_send_from_err(ctx, peer, &peer->session, err); + peer->state = DTLS_STATE_CLOSED; + dtls_stop_retransmission(ctx, peer); + dtls_destroy_peer(ctx, peer, 1); + } + return err; + } + } else { + role = peer->role; + state = peer->state; + } + } else { + /* is_record() ensures that msg contains at least a record header */ + data = msg + DTLS_RH_LENGTH; + data_length = rlen - DTLS_RH_LENGTH; + state = DTLS_STATE_WAIT_CLIENTHELLO; + role = DTLS_SERVER; + } + + dtls_debug_hexdump("receive header", msg, sizeof(dtls_record_header_t)); + dtls_debug_hexdump("receive unencrypted", data, data_length); + + /* Handle received record according to the first byte of the + * message, i.e. the subprotocol. We currently do not support + * combining multiple fragments of one type into a single + * record. */ + + switch (msg[0]) { + + case DTLS_CT_CHANGE_CIPHER_SPEC: + if (peer) { + dtls_stop_retransmission(ctx, peer); + } + err = handle_ccs(ctx, peer, msg, data, data_length); + if (err < 0) { + dtls_warn("error while handling ChangeCipherSpec message\n"); + dtls_alert_send_from_err(ctx, peer, session, err); + + /* invalidate peer */ + dtls_destroy_peer(ctx, peer, 1); + peer = NULL; + + return err; + } + break; + + case DTLS_CT_ALERT: + if (peer) { + dtls_stop_retransmission(ctx, peer); + } + err = handle_alert(ctx, peer, msg, data, data_length); + if (err < 0 || err == 1) { + dtls_warn("received alert, peer has been invalidated\n"); + /* handle alert has invalidated peer */ + peer = NULL; + return err < 0 ?err:-1; + } + break; + + case DTLS_CT_HANDSHAKE: + /* Handshake messages other than Finish must use the current + * epoch, Finish has epoch + 1. */ + + if (peer) { + uint16_t expected_epoch = dtls_security_params(peer)->epoch; + uint16_t msg_epoch = + dtls_uint16_to_int(DTLS_RECORD_HEADER(msg)->epoch); + + /* The new security parameters must be used for all messages + * that are sent after the ChangeCipherSpec message. This + * means that the client's Finished message uses epoch + 1 + * while the server is still in the old epoch. + */ + if (role == DTLS_SERVER && state == DTLS_STATE_WAIT_FINISHED) { + expected_epoch++; + } + + if (expected_epoch != msg_epoch) { + if (hs_attempt_with_existing_peer(msg, rlen, peer)) { + state = DTLS_STATE_WAIT_CLIENTHELLO; + role = DTLS_SERVER; + } else { + dtls_warn("Wrong epoch, expected %i, got: %i\n", + expected_epoch, msg_epoch); + break; + } + } + } + + err = handle_handshake(ctx, peer, session, role, state, data, data_length); + if (err < 0) { + dtls_warn("error while handling handshake packet\n"); + dtls_alert_send_from_err(ctx, peer, session, err); + return err; + } + if (peer && peer->state == DTLS_STATE_CONNECTED) { + /* stop retransmissions */ + dtls_stop_retransmission(ctx, peer); + CALL(ctx, event, &peer->session, 0, DTLS_EVENT_CONNECTED); + } + break; + + case DTLS_CT_APPLICATION_DATA: + dtls_info("** application data:\n"); + if (!peer) { + dtls_warn("no peer available, send an alert\n"); + // TODO: should we send a alert here? + return -1; + } + dtls_stop_retransmission(ctx, peer); + CALL(ctx, read, &peer->session, data, data_length); + break; + default: + dtls_info("dropped unknown message of type %d\n",msg[0]); + } + + /* advance msg by length of ciphertext */ + msg += rlen; + msglen -= rlen; + } + + return 0; +} + +dtls_context_t * +dtls_new_context(void *app_data) { + dtls_context_t *c; + dtls_tick_t now; +#ifndef WITH_CONTIKI + FILE *urandom = fopen("/dev/urandom", "r"); + unsigned char buf[sizeof(unsigned long)]; +#endif /* WITH_CONTIKI */ + + dtls_ticks(&now); +#ifdef WITH_CONTIKI + /* FIXME: need something better to init PRNG here */ + dtls_prng_init(now); +#else /* WITH_CONTIKI */ + if (!urandom) { + dtls_emerg("cannot initialize PRNG\n"); + return NULL; + } + + if (fread(buf, 1, sizeof(buf), urandom) != sizeof(buf)) { + dtls_emerg("cannot initialize PRNG\n"); + return NULL; + } + + fclose(urandom); + dtls_prng_init((unsigned long)*buf); +#endif /* WITH_CONTIKI */ + + c = malloc_context(); + if (!c) + goto error; + + memset(c, 0, sizeof(dtls_context_t)); + c->app = app_data; + +#ifdef WITH_CONTIKI + process_start(&dtls_retransmit_process, (char *)c); + PROCESS_CONTEXT_BEGIN(&dtls_retransmit_process); + /* the retransmit timer must be initialized to some large value */ + etimer_set(&c->retransmit_timer, 0xFFFF); + PROCESS_CONTEXT_END(&coap_retransmit_process); +#endif /* WITH_CONTIKI */ + + if (dtls_prng(c->cookie_secret, DTLS_COOKIE_SECRET_LENGTH)) + c->cookie_secret_age = now; + else + goto error; + + return c; + + error: + dtls_alert("cannot create DTLS context\n"); + if (c) + dtls_free_context(c); + return NULL; +} + +void dtls_reset_peer(dtls_context_t *ctx, dtls_peer_t *peer) +{ + dtls_stop_retransmission(ctx, peer); + dtls_destroy_peer(ctx, peer, 1); +} + +void +dtls_free_context(dtls_context_t *ctx) { + dtls_peer_t *p, *tmp; + + if (!ctx) { + return; + } + + if (ctx->peers) { +#ifdef DTLS_PEERS_NOHASH + LL_FOREACH_SAFE(ctx->peers, p, tmp) { +#else /* DTLS_PEERS_NOHASH */ + HASH_ITER(hh, ctx->peers, p, tmp) { +#endif /* DTLS_PEERS_NOHASH */ + dtls_destroy_peer(ctx, p, 1); + } + } + + free_context(ctx); +} + +int +dtls_connect_peer(dtls_context_t *ctx, dtls_peer_t *peer) { + int res; + + assert(peer); + if (!peer) + return -1; + + /* check if the same peer is already in our list */ + if (peer == dtls_get_peer(ctx, &peer->session)) { + dtls_debug("found peer, try to re-connect\n"); + return dtls_renegotiate(ctx, &peer->session); + } + + /* set local peer role to client, remote is server */ + peer->role = DTLS_CLIENT; + + if (dtls_add_peer(ctx, peer) < 0) { + dtls_alert("cannot add peer\n"); + return -1; + } + + /* send ClientHello with empty Cookie */ + peer->handshake_params = dtls_handshake_new(); + if (!peer->handshake_params) + return -1; + + peer->handshake_params->hs_state.mseq_r = 0; + peer->handshake_params->hs_state.mseq_s = 0; + res = dtls_send_client_hello(ctx, peer, NULL, 0); + if (res < 0) + dtls_warn("cannot send ClientHello\n"); + else + peer->state = DTLS_STATE_CLIENTHELLO; + + return res; +} + +int +dtls_connect(dtls_context_t *ctx, const session_t *dst) { + dtls_peer_t *peer; + int res; + + peer = dtls_get_peer(ctx, dst); + + if (!peer) + peer = dtls_new_peer(dst); + + if (!peer) { + dtls_crit("cannot create new peer\n"); + return -1; + } + + res = dtls_connect_peer(ctx, peer); + + /* Invoke event callback to indicate connection attempt or + * re-negotiation. */ + if (res > 0) { + CALL(ctx, event, &peer->session, 0, DTLS_EVENT_CONNECT); + } else if (res == 0) { + CALL(ctx, event, &peer->session, 0, DTLS_EVENT_RENEGOTIATE); + } + + return res; +} + +static void +dtls_retransmit(dtls_context_t *context, netq_t *node) { + if (!context || !node) + return; + + /* re-initialize timeout when maximum number of retransmissions are not reached yet */ + if (node->retransmit_cnt < DTLS_DEFAULT_MAX_RETRANSMIT) { + unsigned char sendbuf[DTLS_MAX_BUF]; + size_t len = sizeof(sendbuf); + int err; + unsigned char *data = node->data; + size_t length = node->length; + dtls_tick_t now; + dtls_security_parameters_t *security = dtls_security_params_epoch(node->peer, node->epoch); + + dtls_ticks(&now); + node->retransmit_cnt++; + node->t = now + (node->timeout << node->retransmit_cnt); + netq_insert_node(&context->sendqueue, node); + + if (node->type == DTLS_CT_HANDSHAKE) { + dtls_handshake_header_t *hs_header = DTLS_HANDSHAKE_HEADER(data); + + dtls_debug("** retransmit handshake packet of type: %s (%i)\n", + dtls_handshake_type_to_name(hs_header->msg_type), hs_header->msg_type); + } else { + dtls_debug("** retransmit packet\n"); + } + + err = dtls_prepare_record(node->peer, security, node->type, &data, &length, + 1, sendbuf, &len); + if (err < 0) { + dtls_warn("can not retransmit packet, err: %i\n", err); + return; + } + dtls_debug_hexdump("retransmit header", sendbuf, + sizeof(dtls_record_header_t)); + dtls_debug_hexdump("retransmit unencrypted", node->data, node->length); + + (void)CALL(context, write, &node->peer->session, sendbuf, len); + return; + } + + /* no more retransmissions, remove node from system */ + + dtls_debug("** removed transaction\n"); + + /* And finally delete the node */ + netq_node_free(node); +} + +static void +dtls_stop_retransmission(dtls_context_t *context, dtls_peer_t *peer) { + netq_t *node; + node = netq_head(&context->sendqueue); + + while (node) { + if (dtls_session_equals(&node->peer->session, &peer->session)) { + netq_t *tmp = node; + node = netq_next(node); + netq_remove(&context->sendqueue, tmp); + netq_node_free(tmp); + } else + node = netq_next(node); + } +} + +void +dtls_check_retransmit(dtls_context_t *context, clock_time_t *next) { + dtls_tick_t now; + netq_t *node = netq_head(&context->sendqueue); + + dtls_ticks(&now); + while (node && node->t <= now) { + netq_pop_first(&context->sendqueue); + dtls_retransmit(context, node); + node = netq_head(&context->sendqueue); + } + + if (next) { + *next = node ? node->t : 0; + } +} + +#ifdef WITH_CONTIKI +/*---------------------------------------------------------------------------*/ +/* message retransmission */ +/*---------------------------------------------------------------------------*/ +PROCESS_THREAD(dtls_retransmit_process, ev, data) +{ + clock_time_t now; + netq_t *node; + + PROCESS_BEGIN(); + + dtls_debug("Started DTLS retransmit process\r\n"); + + while(1) { + PROCESS_YIELD(); + if (ev == PROCESS_EVENT_TIMER) { + if (etimer_expired(&the_dtls_context.retransmit_timer)) { + + node = netq_head(&the_dtls_context.sendqueue); + + now = clock_time(); + if (node && node->t <= now) { + dtls_retransmit(&the_dtls_context, node); + + netq_node_free(node); + node = netq_head(&the_dtls_context.sendqueue); + } + + /* need to set timer to some value even if no nextpdu is available */ + if (node) { + etimer_set(&the_dtls_context.retransmit_timer, + node->t <= now ? 1 : node->t - now); + } else { + etimer_set(&the_dtls_context.retransmit_timer, 0xFFFF); + } + } + } + } + + PROCESS_END(); +} +#endif /* WITH_CONTIKI */
diff --git a/dtls.h b/dtls.h new file mode 100644 index 0000000..273315f --- /dev/null +++ b/dtls.h
@@ -0,0 +1,740 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * Hauke Mehrtens - memory optimization, ECC integration + * Achim Kraus - session recovery + * + *******************************************************************************/ + +/** + * @file dtls.h + * @brief High level DTLS API and visible structures. + */ + +#ifndef _DTLS_DTLS_H_ +#define _DTLS_DTLS_H_ + +#include <stdint.h> + +#include "state.h" +#include "peer.h" + +#include "uthash.h" + +#include "alert.h" +#include "crypto.h" +#include "hmac.h" + +#include "global.h" +#include "dtls_time.h" + +#ifndef DTLSv12 +#define DTLS_VERSION 0xfeff /* DTLS v1.1 */ +#else +#define DTLS_VERSION 0xfefd /* DTLS v1.2 */ +#endif + +typedef enum dtls_credentials_type_t { + DTLS_PSK_HINT, DTLS_PSK_IDENTITY, DTLS_PSK_KEY +} dtls_credentials_type_t; + +typedef struct dtls_ecdsa_key_t { + dtls_ecdh_curve curve; + const unsigned char *priv_key; /** < private key as bytes > */ + const unsigned char *pub_key_x; /** < x part of the public key for the given private key > */ + const unsigned char *pub_key_y; /** < y part of the public key for the given private key > */ +} dtls_ecdsa_key_t; + +/** Length of the secret that is used for generating Hello Verify cookies. */ +#define DTLS_COOKIE_SECRET_LENGTH 12 + +struct dtls_context_t; + +/** + * This structure contains callback functions used by tinydtls to + * communicate with the application. At least the write function must + * be provided. It is called by the DTLS state machine to send packets + * over the network. The read function is invoked to deliver decrypted + * and verfified application data. The third callback is an event + * handler function that is called when alert messages are encountered + * or events generated by the library have occured. + */ +typedef struct { + /** + * Called from dtls_handle_message() to send DTLS packets over the + * network. The callback function must use the network interface + * denoted by session->ifindex to send the data. + * + * @param ctx The current DTLS context. + * @param session The session object, including the address of the + * remote peer where the data shall be sent. + * @param buf The data to send. + * @param len The actual length of @p buf. + * @return The callback function must return the number of bytes + * that were sent, or a value less than zero to indicate an + * error. + */ + int (*write)(struct dtls_context_t *ctx, + session_t *session, uint8 *buf, size_t len); + + /** + * Called from dtls_handle_message() deliver application data that was + * received on the given session. The data is delivered only after + * decryption and verification have succeeded. + * + * @param ctx The current DTLS context. + * @param session The session object, including the address of the + * data's origin. + * @param buf The received data packet. + * @param len The actual length of @p buf. + * @return ignored + */ + int (*read)(struct dtls_context_t *ctx, + session_t *session, uint8 *buf, size_t len); + + /** + * The event handler is called when a message from the alert + * protocol is received or the state of the DTLS session changes. + * + * @param ctx The current dtls context. + * @param session The session object that was affected. + * @param level The alert level or @c 0 when an event ocurred that + * is not an alert. + * @param code Values less than @c 256 indicate alerts, while + * @c 256 or greater indicate internal DTLS session changes. + * @return ignored + */ + int (*event)(struct dtls_context_t *ctx, session_t *session, + dtls_alert_level_t level, unsigned short code); + +#ifdef DTLS_PSK + /** + * Called during handshake to get information related to the + * psk key exchange. The type of information requested is + * indicated by @p type which will be one of DTLS_PSK_HINT, + * DTLS_PSK_IDENTITY, or DTLS_PSK_KEY. The called function + * must store the requested item in the buffer @p result of + * size @p result_length. On success, the function must return + * the actual number of bytes written to @p result, of a + * value less than zero on error. The parameter @p desc may + * contain additional request information (e.g. the psk_identity + * for which a key is requested when @p type == @c DTLS_PSK_KEY. + * + * @param ctx The current dtls context. + * @param session The session where the key will be used. + * @param type The type of the requested information. + * @param desc Additional request information + * @param desc_len The actual length of desc. + * @param result Must be filled with the requested information. + * @param result_length Maximum size of @p result. + * @return The number of bytes written to @p result or a value + * less than zero on error. + */ + int (*get_psk_info)(struct dtls_context_t *ctx, + const session_t *session, + dtls_credentials_type_t type, + const unsigned char *desc, size_t desc_len, + unsigned char *result, size_t result_length); + +#endif /* DTLS_PSK */ + +#ifdef DTLS_ECC + /** + * Called during handshake to get the server's or client's ecdsa + * key used to authenticate this server or client in this + * session. If found, the key must be stored in @p result and + * the return value must be @c 0. If not found, @p result is + * undefined and the return value must be less than zero. + * + * If ECDSA should not be supported, set this pointer to NULL. + * + * Implement this if you want to provide your own certificate to + * the other peer. This is mandatory for a server providing ECDSA + * support and optional for a client. A client doing DTLS client + * authentication has to implementing this callback. + * + * @param ctx The current dtls context. + * @param session The session where the key will be used. + * @param result Must be set to the key object to used for the given + * session. + * @return @c 0 if result is set, or less than zero on error. + */ + int (*get_ecdsa_key)(struct dtls_context_t *ctx, + const session_t *session, + const dtls_ecdsa_key_t **result); + + /** + * Called during handshake to check the peer's pubic key in this + * session. If the public key matches the session and should be + * considerated valid the return value must be @c 0. If not valid, + * the return value must be less than zero. + * + * If ECDSA should not be supported, set this pointer to NULL. + * + * Implement this if you want to verify the other peers public key. + * This is mandatory for a DTLS client doing based ECDSA + * authentication. A server implementing this will request the + * client to do DTLS client authentication. + * + * @param ctx The current dtls context. + * @param session The session where the key will be used. + * @param other_pub_x x component of the public key. + * @param other_pub_y y component of the public key. + * @return @c 0 if public key matches, or less than zero on error. + * error codes: + * return dtls_alert_fatal_create(DTLS_ALERT_BAD_CERTIFICATE); + * return dtls_alert_fatal_create(DTLS_ALERT_UNSUPPORTED_CERTIFICATE); + * return dtls_alert_fatal_create(DTLS_ALERT_CERTIFICATE_REVOKED); + * return dtls_alert_fatal_create(DTLS_ALERT_CERTIFICATE_EXPIRED); + * return dtls_alert_fatal_create(DTLS_ALERT_CERTIFICATE_UNKNOWN); + * return dtls_alert_fatal_create(DTLS_ALERT_UNKNOWN_CA); + */ + int (*verify_ecdsa_key)(struct dtls_context_t *ctx, + const session_t *session, + const unsigned char *other_pub_x, + const unsigned char *other_pub_y, + size_t key_size); +#endif /* DTLS_ECC */ +} dtls_handler_t; + +struct netq_t; + +/** Holds global information of the DTLS engine. */ +typedef struct dtls_context_t { + unsigned char cookie_secret[DTLS_COOKIE_SECRET_LENGTH]; + clock_time_t cookie_secret_age; /**< the time the secret has been generated */ + + dtls_peer_t *peers; /**< peer hash map */ +#ifdef WITH_CONTIKI + struct etimer retransmit_timer; /**< fires when the next packet must be sent */ +#endif /* WITH_CONTIKI */ + + struct netq_t *sendqueue; /**< the packets to send */ + + void *app; /**< application-specific data */ + + dtls_handler_t *h; /**< callback handlers */ + + unsigned char readbuf[DTLS_MAX_BUF]; +} dtls_context_t; + +/** + * This function initializes the tinyDTLS memory management and must + * be called first. + */ +void dtls_init(); + +/** + * Creates a new context object. The storage allocated for the new + * object must be released with dtls_free_context(). */ +dtls_context_t *dtls_new_context(void *app_data); + +/** Releases any storage that has been allocated for \p ctx. */ +void dtls_free_context(dtls_context_t *ctx); + +#define dtls_set_app_data(CTX,DATA) ((CTX)->app = (DATA)) +#define dtls_get_app_data(CTX) ((CTX)->app) + +/** Sets the callback handler object for @p ctx to @p h. */ +static inline void dtls_set_handler(dtls_context_t *ctx, dtls_handler_t *h) { + ctx->h = h; +} + +/** + * Establishes a DTLS channel with the specified remote peer @p dst. + * This function returns @c 0 if that channel already exists, a value + * greater than zero when a new ClientHello message was sent, and + * a value less than zero on error. + * + * @param ctx The DTLS context to use. + * @param dst The remote party to connect to. + * @return A value less than zero on error, greater or equal otherwise. + */ +int dtls_connect(dtls_context_t *ctx, const session_t *dst); + +/** + * Establishes a DTLS channel with the specified remote peer. + * This function returns @c 0 if that channel already exists, a value + * greater than zero when a new ClientHello message was sent, and + * a value less than zero on error. + * + * @param ctx The DTLS context to use. + * @param peer The peer object that describes the session. + * @return A value less than zero on error, greater or equal otherwise. + */ +int dtls_connect_peer(dtls_context_t *ctx, dtls_peer_t *peer); + +/** + * Closes the DTLS connection associated with @p remote. This function + * returns zero on success, and a value less than zero on error. + */ +int dtls_close(dtls_context_t *ctx, const session_t *remote); + +int dtls_renegotiate(dtls_context_t *ctx, const session_t *dst); + +/** + * Writes the application data given in @p buf to the peer specified + * by @p session. + * + * @param ctx The DTLS context to use. + * @param session The remote transport address and local interface. + * @param buf The data to write. + * @param len The actual length of @p data. + * + * @return The number of bytes written or @c -1 on error. + */ +int dtls_write(struct dtls_context_t *ctx, session_t *session, + uint8 *buf, size_t len); + +/** + * Checks sendqueue of given DTLS context object for any outstanding + * packets to be transmitted. + * + * @param context The DTLS context object to use. + * @param next If not NULL, @p next is filled with the timestamp + * of the next scheduled retransmission, or @c 0 when no packets are + * waiting. + */ +void dtls_check_retransmit(dtls_context_t *context, clock_time_t *next); + +#define DTLS_COOKIE_LENGTH 16 + +#define DTLS_CT_CHANGE_CIPHER_SPEC 20 +#define DTLS_CT_ALERT 21 +#define DTLS_CT_HANDSHAKE 22 +#define DTLS_CT_APPLICATION_DATA 23 + +/** Generic header structure of the DTLS record layer. */ +typedef struct __attribute__((__packed__)) { + uint8 content_type; /**< content type of the included message */ + uint16 version; /**< Protocol version */ + uint16 epoch; /**< counter for cipher state changes */ + uint48 sequence_number; /**< sequence number */ + uint16 length; /**< length of the following fragment */ + /* fragment */ +} dtls_record_header_t; + +/* Handshake types */ + +#define DTLS_HT_HELLO_REQUEST 0 +#define DTLS_HT_CLIENT_HELLO 1 +#define DTLS_HT_SERVER_HELLO 2 +#define DTLS_HT_HELLO_VERIFY_REQUEST 3 +#define DTLS_HT_CERTIFICATE 11 +#define DTLS_HT_SERVER_KEY_EXCHANGE 12 +#define DTLS_HT_CERTIFICATE_REQUEST 13 +#define DTLS_HT_SERVER_HELLO_DONE 14 +#define DTLS_HT_CERTIFICATE_VERIFY 15 +#define DTLS_HT_CLIENT_KEY_EXCHANGE 16 +#define DTLS_HT_FINISHED 20 + +/** Header structure for the DTLS handshake protocol. */ +typedef struct __attribute__((__packed__)) { + uint8 msg_type; /**< Type of handshake message (one of DTLS_HT_) */ + uint24 length; /**< length of this message */ + uint16 message_seq; /**< Message sequence number */ + uint24 fragment_offset; /**< Fragment offset. */ + uint24 fragment_length; /**< Fragment length. */ + /* body */ +} dtls_handshake_header_t; + +/** Structure of the Client Hello message. */ +typedef struct __attribute__((__packed__)) { + uint16 version; /**< Client version */ + uint32 gmt_random; /**< GMT time of the random byte creation */ + unsigned char random[28]; /**< Client random bytes */ + /* session id (up to 32 bytes) */ + /* cookie (up to 32 bytes) */ + /* cipher suite (2 to 2^16 -1 bytes) */ + /* compression method */ +} dtls_client_hello_t; + +/** Structure of the Hello Verify Request. */ +typedef struct __attribute__((__packed__)) { + uint16 version; /**< Server version */ + uint8 cookie_length; /**< Length of the included cookie */ + uint8 cookie[]; /**< up to 32 bytes making up the cookie */ +} dtls_hello_verify_t; + +#if 0 +/** + * Checks a received DTLS record for consistency and eventually decrypt, + * verify, decompress and reassemble the contained fragment for + * delivery to high-lever clients. + * + * \param state The DTLS record state for the current session. + * \param + */ +int dtls_record_read(dtls_state_t *state, uint8 *msg, int msglen); +#endif + +/** + * Handles incoming data as DTLS message from given peer. + * + * @param ctx The dtls context to use. + * @param session The current session + * @param msg The received data + * @param msglen The actual length of @p msg. + * @return A value less than zero on error, zero on success. + */ +int dtls_handle_message(dtls_context_t *ctx, session_t *session, + uint8 *msg, int msglen); + +/** + * Check if @p session is associated with a peer object in @p context. + * This function returns a pointer to the peer if found, NULL otherwise. + * + * @param context The DTLS context to search. + * @param session The remote address and local interface + * @return A pointer to the peer associated with @p session or NULL if + * none exists. + */ +dtls_peer_t *dtls_get_peer(const dtls_context_t *context, + const session_t *session); + +/** + * Resets all connections with @p peer. + * + * @param context The active DTLS context. + * @param peer The peer to reset. + */ +void dtls_reset_peer(dtls_context_t *context, dtls_peer_t *peer); + +#endif /* _DTLS_DTLS_H_ */ + +/** + * @mainpage + * + * @author Olaf Bergmann, TZI Uni Bremen + * + * This library provides a very simple datagram server with DTLS + * support. It is designed to support session multiplexing in + * single-threaded applications and thus targets specifically on + * embedded systems. + * + * @section license License + * + * This software is under the <a + * href="http://www.opensource.org/licenses/mit-license.php">MIT License</a>. + * + * @subsection uthash UTHash + * + * This library uses <a href="http://uthash.sourceforge.net/">uthash</a> to manage + * its peers (not used for Contiki). @b uthash uses the <b>BSD revised license</b>, see + * <a href="http://uthash.sourceforge.net/license.html">http://uthash.sourceforge.net/license.html</a>. + * + * @subsection sha256 Aaron D. Gifford's SHA256 Implementation + * + * tinyDTLS provides HMAC-SHA256 with BSD-licensed code from Aaron D. Gifford, + * see <a href="http://www.aarongifford.com/">www.aarongifford.com</a>. + * + * @subsection aes Rijndael Implementation From OpenBSD + * + * The AES implementation is taken from rijndael.{c,h} contained in the crypto + * sub-system of the OpenBSD operating system. It is copyright by Vincent Rijmen, * + * Antoon Bosselaers and Paulo Barreto. See <a + * href="http://www.openbsd.org/cgi-bin/cvsweb/src/sys/crypto/rijndael.c">rijndael.c</a> + * for License info. + * + * @section download Getting the Files + * + * You can get the sources either from the <a + * href="http://sourceforge.net/projects/tinydtls/files">downloads</a> section or + * through git from the <a + * href="http://sourceforge.net/projects/tinydtls/develop">project develop page</a>. + * + * @section config Configuration + * + * Use @c configure to set up everything for a successful build. For Contiki, use the + * option @c --with-contiki. + * + * @section build Building + * + * After configuration, just type + * @code +make + * @endcode + * optionally followed by + * @code +make install + * @endcode + * The Contiki version is integrated with the Contiki build system, hence you do not + * need to invoke @c make explicitely. Just add @c tinydtls to the variable @c APPS + * in your @c Makefile. + * + * @addtogroup dtls_usage DTLS Usage + * + * @section dtls_server_example DTLS Server Example + * + * This section shows how to use the DTLS library functions to setup a + * simple secure UDP echo server. The application is responsible for the + * entire network communication and thus will look like a usual UDP + * server with socket creation and binding and a typical select-loop as + * shown below. The minimum configuration required for DTLS is the + * creation of the dtls_context_t using dtls_new_context(), and a callback + * for sending data. Received packets are read by the application and + * passed to dtls_handle_message() as shown in @ref dtls_read_cb. + * For any useful communication to happen, read and write call backs + * and a key management function should be registered as well. + * + * @code + dtls_context_t *the_context = NULL; + int fd, result; + + static dtls_handler_t cb = { + .write = send_to_peer, + .read = read_from_peer, + .event = NULL, + .get_psk_key = get_psk_key + }; + + fd = socket(...); + if (fd < 0 || bind(fd, ...) < 0) + exit(-1); + + the_context = dtls_new_context(&fd); + dtls_set_handler(the_context, &cb); + + while (1) { + ...initialize fd_set rfds and timeout ... + result = select(fd+1, &rfds, NULL, 0, NULL); + + if (FD_ISSET(fd, &rfds)) + dtls_handle_read(the_context); + } + + dtls_free_context(the_context); + * @endcode + * + * @subsection dtls_read_cb The Read Callback + * + * The DTLS library expects received raw data to be passed to + * dtls_handle_message(). The application is responsible for + * filling a session_t structure with the address data of the + * remote peer as illustrated by the following example: + * + * @code +int dtls_handle_read(struct dtls_context_t *ctx) { + int *fd; + session_t session; + static uint8 buf[DTLS_MAX_BUF]; + int len; + + fd = dtls_get_app_data(ctx); + + assert(fd); + + session.size = sizeof(session.addr); + len = recvfrom(*fd, buf, sizeof(buf), 0, &session.addr.sa, &session.size); + + return len < 0 ? len : dtls_handle_message(ctx, &session, buf, len); +} + * @endcode + * + * Once a new DTLS session was established and DTLS ApplicationData has been + * received, the DTLS server invokes the read callback with the MAC-verified + * cleartext data as its argument. A read callback for a simple echo server + * could look like this: + * @code +int read_from_peer(struct dtls_context_t *ctx, session_t *session, uint8 *data, size_t len) { + return dtls_write(ctx, session, data, len); +} + * @endcode + * + * @subsection dtls_send_cb The Send Callback + * + * The callback function send_to_peer() is called whenever data must be + * sent over the network. Here, the sendto() system call is used to + * transmit data within the given session. The socket descriptor required + * by sendto() has been registered as application data when the DTLS context + * was created with dtls_new_context(). + * Note that it is on the application to buffer the data when it cannot be + * sent at the time this callback is invoked. The following example thus + * is incomplete as it would have to deal with EAGAIN somehow. + * @code +int send_to_peer(struct dtls_context_t *ctx, session_t *session, uint8 *data, size_t len) { + int fd = *(int *)dtls_get_app_data(ctx); + return sendto(fd, data, len, MSG_DONTWAIT, &session->addr.sa, session->size); +} + * @endcode + * + * @subsection dtls_get_psk_info The Key Storage + * + * When a new DTLS session is created, the library must ask the application + * for keying material. To do so, it invokes the registered call-back function + * get_psk_info() with the current context and session information as parameter. + * When the call-back function is invoked with the parameter @p type set to + * @c DTLS_PSK_IDENTITY, the result parameter @p result must be filled with + * the psk_identity_hint in case of a server, or the actual psk_identity in + * case of a client. When @p type is @c DTLS_PSK_KEY, the result parameter + * must be filled with a key for the given identity @p id. The function must + * return the number of bytes written to @p result which must not exceed + * @p result_length. + * In case of an error, the function must return a negative value that + * corresponds to a valid error code defined in alert.h. + * + * @code +int get_psk_info(struct dtls_context_t *ctx UNUSED_PARAM, + const session_t *session UNUSED_PARAM, + dtls_credentials_type_t type, + const unsigned char *id, size_t id_len, + unsigned char *result, size_t result_length) { + + switch (type) { + case DTLS_PSK_IDENTITY: + if (result_length < psk_id_length) { + dtls_warn("cannot set psk_identity -- buffer too small\n"); + return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR); + } + + memcpy(result, psk_id, psk_id_length); + return psk_id_length; + case DTLS_PSK_KEY: + if (id_len != psk_id_length || memcmp(psk_id, id, id_len) != 0) { + dtls_warn("PSK for unknown id requested, exiting\n"); + return dtls_alert_fatal_create(DTLS_ALERT_ILLEGAL_PARAMETER); + } else if (result_length < psk_key_length) { + dtls_warn("cannot set psk -- buffer too small\n"); + return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR); + } + + memcpy(result, psk_key, psk_key_length); + return psk_key_length; + default: + dtls_warn("unsupported request type: %d\n", type); + } + + return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR); +} + * @endcode + * + * @subsection dtls_events The Event Notifier + * + * Applications that want to be notified whenever the status of a DTLS session + * has changed can register an event handling function with the field @c event + * in the dtls_handler_t structure (see \ref dtls_server_example). The call-back + * function is called for alert messages and internal state changes. For alert + * messages, the argument @p level will be set to a value greater than zero, and + * @p code will indicate the notification code. For internal events, @p level + * is @c 0, and @p code a value greater than @c 255. + * + * Internal events are DTLS_EVENT_CONNECTED, @c DTLS_EVENT_CONNECT, and + * @c DTLS_EVENT_RENEGOTIATE. + * + * @code +int handle_event(struct dtls_context_t *ctx, session_t *session, + dtls_alert_level_t level, unsigned short code) { + ... do something with event ... + return 0; +} + * @endcode + * + * @section dtls_client_example DTLS Client Example + * + * A DTLS client is constructed like a server but needs to actively setup + * a new session by calling dtls_connect() at some point. As this function + * usually returns before the new DTLS channel is established, the application + * must register an event handler and wait for @c DTLS_EVENT_CONNECT before + * it can send data over the DTLS channel. + * + */ + +/** + * @addtogroup contiki Contiki + * + * To use tinyDTLS as Contiki application, place the source code in the directory + * @c apps/tinydtls in the Contiki source tree and invoke configure with the option + * @c --with-contiki. This will define WITH_CONTIKI in tinydtls.h and include + * @c Makefile.contiki in the main Makefile. To cross-compile for another platform + * you will need to set your host and build system accordingly. For example, + * when configuring for ARM, you would invoke + * @code +./configure --with-contiki --build=x86_64-linux-gnu --host=arm-none-eabi + * @endcode + * on an x86_64 linux host. + * + * Then, create a Contiki project with @c APPS += tinydtls in its Makefile. A sample + * server could look like this (with read_from_peer() and get_psk_key() as shown above). + * + * @code +#include "contiki.h" + +#include "tinydtls.h" +#include "dtls.h" + +#define UIP_IP_BUF ((struct uip_ip_hdr *)&uip_buf[UIP_LLH_LEN]) +#define UIP_UDP_BUF ((struct uip_udp_hdr *)&uip_buf[UIP_LLIPH_LEN]) + +int send_to_peer(struct dtls_context_t *, session_t *, uint8 *, size_t); + +static struct uip_udp_conn *server_conn; +static dtls_context_t *dtls_context; + +static dtls_handler_t cb = { + .write = send_to_peer, + .read = read_from_peer, + .event = NULL, + .get_psk_key = get_psk_key +}; + +PROCESS(server_process, "DTLS server process"); +AUTOSTART_PROCESSES(&server_process); + +PROCESS_THREAD(server_process, ev, data) +{ + PROCESS_BEGIN(); + + dtls_init(); + + server_conn = udp_new(NULL, 0, NULL); + udp_bind(server_conn, UIP_HTONS(5684)); + + dtls_context = dtls_new_context(server_conn); + if (!dtls_context) { + dtls_emerg("cannot create context\n"); + PROCESS_EXIT(); + } + + dtls_set_handler(dtls_context, &cb); + + while(1) { + PROCESS_WAIT_EVENT(); + if(ev == tcpip_event && uip_newdata()) { + session_t session; + + uip_ipaddr_copy(&session.addr, &UIP_IP_BUF->srcipaddr); + session.port = UIP_UDP_BUF->srcport; + session.size = sizeof(session.addr) + sizeof(session.port); + + dtls_handle_message(ctx, &session, uip_appdata, uip_datalen()); + } + } + + PROCESS_END(); +} + +int send_to_peer(struct dtls_context_t *ctx, session_t *session, uint8 *data, size_t len) { + struct uip_udp_conn *conn = (struct uip_udp_conn *)dtls_get_app_data(ctx); + + uip_ipaddr_copy(&conn->ripaddr, &session->addr); + conn->rport = session->port; + + uip_udp_packet_send(conn, data, len); + + memset(&conn->ripaddr, 0, sizeof(server_conn->ripaddr)); + memset(&conn->rport, 0, sizeof(conn->rport)); + + return len; +} + * @endcode + */
diff --git a/dtls_time.c b/dtls_time.c new file mode 100644 index 0000000..c40b44d --- /dev/null +++ b/dtls_time.c
@@ -0,0 +1,71 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * + *******************************************************************************/ + +/** + * @file dtls_time.c + * @brief Clock Handling + */ + +#include "tinydtls.h" +#include "dtls_config.h" +#include "dtls_time.h" + +#ifdef WITH_CONTIKI +clock_time_t dtls_clock_offset; + +void +dtls_clock_init(void) { + clock_init(); + dtls_clock_offset = clock_time(); +} + +void +dtls_ticks(dtls_tick_t *t) { + *t = clock_time(); +} + +#else /* WITH_CONTIKI */ + +time_t dtls_clock_offset; + +void +dtls_clock_init(void) { +#ifdef HAVE_TIME_H + dtls_clock_offset = time(NULL); +#else +# ifdef __GNUC__ + /* Issue a warning when using gcc. Other prepropressors do + * not seem to have a similar feature. */ +# warning "cannot initialize clock" +# endif + dtls_clock_offset = 0; +#endif +} + +void dtls_ticks(dtls_tick_t *t) { +#ifdef HAVE_SYS_TIME_H + struct timeval tv; + gettimeofday(&tv, NULL); + *t = (tv.tv_sec - dtls_clock_offset) * DTLS_TICKS_PER_SECOND + + (tv.tv_usec * DTLS_TICKS_PER_SECOND / 1000000); +#else +#error "clock not implemented" +#endif +} + +#endif /* WITH_CONTIKI */ + +
diff --git a/dtls_time.h b/dtls_time.h new file mode 100644 index 0000000..982bed1 --- /dev/null +++ b/dtls_time.h
@@ -0,0 +1,60 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * + *******************************************************************************/ + +/** + * @file dtls_time.h + * @brief Clock Handling + */ + +#ifndef _DTLS_DTLS_TIME_H_ +#define _DTLS_DTLS_TIME_H_ + +#include <stdint.h> +#include <sys/time.h> + +#include "tinydtls.h" + +/** + * @defgroup clock Clock Handling + * Default implementation of internal clock. You should redefine this if + * you do not have time() and gettimeofday(). + * @{ + */ + +#ifdef WITH_CONTIKI +#include "clock.h" +#else /* WITH_CONTIKI */ +#include <time.h> + +#ifndef CLOCK_SECOND +# define CLOCK_SECOND 1000 +#endif + +typedef uint32_t clock_time_t; +#endif /* WITH_CONTIKI */ + +typedef clock_time_t dtls_tick_t; + +#ifndef DTLS_TICKS_PER_SECOND +#define DTLS_TICKS_PER_SECOND CLOCK_SECOND +#endif /* DTLS_TICKS_PER_SECOND */ + +void dtls_clock_init(void); +void dtls_ticks(dtls_tick_t *t); + +/** @} */ + +#endif /* _DTLS_DTLS_TIME_H_ */
diff --git a/ecc/Makefile.contiki b/ecc/Makefile.contiki new file mode 100644 index 0000000..7787d2d --- /dev/null +++ b/ecc/Makefile.contiki
@@ -0,0 +1,7 @@ +CONTIKI=../../.. + +APPS += ecc + +CFLAGS += -DTEST_INCLUDE + +include $(CONTIKI)/Makefile.include
diff --git a/ecc/Makefile.ecc b/ecc/Makefile.ecc new file mode 100644 index 0000000..382e48f --- /dev/null +++ b/ecc/Makefile.ecc
@@ -0,0 +1,3 @@ +# This is a -*- Makefile -*- + +ecc_src = ecc.c test_helper.c
diff --git a/ecc/Makefile.in b/ecc/Makefile.in new file mode 100644 index 0000000..2ba17a1 --- /dev/null +++ b/ecc/Makefile.in
@@ -0,0 +1,81 @@ +# Makefile for tinydtls +# +# Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. +# All rights reserved. This program and the accompanying materials +# are made available under the terms of the Eclipse Public License v1.0 +# and Eclipse Distribution License v. 1.0 which accompanies this distribution. +# +# The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html +# and the Eclipse Distribution License is available at +# http://www.eclipse.org/org/documents/edl-v10.php. +# +# Contributors: +# Olaf Bergmann - initial API and implementation +# Hauke Mehrtens - memory optimization, ECC integration +# + +# the library's version +VERSION:=@PACKAGE_VERSION@ + +# tools +@SET_MAKE@ +SHELL = /bin/sh +MKDIR = mkdir + +abs_builddir = @abs_builddir@ +top_builddir = @top_builddir@ +top_srcdir:= @top_srcdir@ + +ECC_SOURCES:= ecc.c testecc.c testfield.c test_helper.c +ECC_HEADERS:= ecc.h test_helper.h +FILES:=Makefile.in Makefile.contiki $(ECC_SOURCES) $(ECC_HEADERS) +DISTDIR=$(top_builddir)/@PACKAGE_TARNAME@-@PACKAGE_VERSION@ + +ifeq ("@WITH_CONTIKI@", "1") +include Makefile.contiki +else +ECC_OBJECTS:= $(patsubst %.c, %.o, $(ECC_SOURCES)) ecc_test.o +PROGRAMS:= testecc testfield +CPPFLAGS=@CPPFLAGS@ +CFLAGS=-Wall -std=c99 -pedantic @CFLAGS@ -DTEST_INCLUDE +LDLIBS=@LIBS@ + +.PHONY: all dirs clean install distclean .gitignore doc + +.SUFFIXES: +.SUFFIXES: .c .o + +all: $(PROGRAMS) + +ecc_test.o: ecc.c ecc.h + $(CC) $(CFLAGS) $(CPPFLAGS) -c -o $@ $< + +testecc: ecc_test.o test_helper.o + +testfield: ecc_test.o test_helper.o + +check: + echo DISTDIR: $(DISTDIR) + echo top_builddir: $(top_builddir) + +clean: + @rm -f $(PROGRAMS) main.o $(LIB) $(OBJECTS) + for dir in $(SUBDIRS); do \ + $(MAKE) -C $$dir clean ; \ + done + +distclean: clean + @rm -rf $(DISTDIR) + @rm -f *~ $(DISTDIR).tar.gz +endif # WITH_CONTIKI + +dist: $(FILES) + test -d $(DISTDIR)/ecc || mkdir $(DISTDIR)/ecc + cp -p $(FILES) $(DISTDIR)/ecc + +install: $(ECC_HEADERS) + test -d $(includedir)/ecc || mkdir -p $(includedir)/ecc + $(install) $(ECC_HEADERS) $(includedir)/ecc + +.gitignore: + echo "core\n*~\n*.[oa]\n*.gz\n*.cap\n$(PROGRAM)\n$(DISTDIR)\n.gitignore" >$@
diff --git a/global.h b/global.h new file mode 100644 index 0000000..c2ce904 --- /dev/null +++ b/global.h
@@ -0,0 +1,141 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * Hauke Mehrtens - memory optimization, ECC integration + * + *******************************************************************************/ + +#ifndef _DTLS_GLOBAL_H_ +#define _DTLS_GLOBAL_H_ + +#include <stdlib.h> +#include <sys/types.h> + +#include "tinydtls.h" + +#ifndef DTLSv12 +/* The current version of tinyDTLS supports DTLSv1.2 only. */ +#define DTLSv12 1 +#endif + +#ifndef WITH_SHA256 +/* The current version of tinyDTLS supports DTLSv1.2 with SHA256 PRF + only. */ +#define WITH_SHA256 1 +#endif + +/* Define our own types as at least uint32_t does not work on my amd64. */ + +typedef unsigned char uint8; +typedef unsigned char uint16[2]; +typedef unsigned char uint24[3]; +typedef unsigned char uint32[4]; +typedef unsigned char uint48[6]; + +#ifndef DTLS_MAX_BUF +/** Maximum size of DTLS message. + When Peers are sending bigger messages this causes problems. Californium + with ECDSA needs at least 220 */ +#ifdef WITH_CONTIKI +#ifdef DTLS_ECC +#define DTLS_MAX_BUF 200 +#else /* DTLS_ECC */ +#define DTLS_MAX_BUF 100 +#endif /* DTLS_ECC */ +#else /* WITH_CONTIKI */ +#define DTLS_MAX_BUF 1400 +#endif /* WITH_CONTIKI */ +#endif + +#ifndef DTLS_DEFAULT_MAX_RETRANSMIT +/** Number of message retransmissions. */ +#define DTLS_DEFAULT_MAX_RETRANSMIT 7 +#endif + +/** Known cipher suites.*/ +typedef enum { + TLS_NULL_WITH_NULL_NULL = 0x0000, /**< NULL cipher */ + TLS_PSK_WITH_AES_128_CCM_8 = 0xC0A8, /**< see RFC 6655 */ + TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 = 0xC0AE /**< see RFC 7251 */ +} dtls_cipher_t; + +/** Known compression suites.*/ +typedef enum { + TLS_COMPRESSION_NULL = 0x0000 /* NULL compression */ +} dtls_compression_t; + +#define TLS_EXT_ELLIPTIC_CURVES 10 /* see RFC 4492 */ +#define TLS_EXT_EC_POINT_FORMATS 11 /* see RFC 4492 */ +#define TLS_EXT_SIG_HASH_ALGO 13 /* see RFC 5246 */ +#define TLS_EXT_CLIENT_CERTIFICATE_TYPE 19 /* see RFC 7250 */ +#define TLS_EXT_SERVER_CERTIFICATE_TYPE 20 /* see RFC 7250 */ +#define TLS_EXT_ENCRYPT_THEN_MAC 22 /* see RFC 7366 */ + +#define TLS_CERT_TYPE_RAW_PUBLIC_KEY 2 /* see RFC 7250 */ + +#define TLS_EXT_ELLIPTIC_CURVES_SECP256R1 23 /* see RFC 4492 */ + +#define TLS_EXT_EC_POINT_FORMATS_UNCOMPRESSED 0 /* see RFC 4492 */ + +#define TLS_EC_CURVE_TYPE_NAMED_CURVE 3 /* see RFC 4492 */ + +#define TLS_CLIENT_CERTIFICATE_TYPE_ECDSA_SIGN 64 /* see RFC 4492 */ + +#define TLS_EXT_SIG_HASH_ALGO_SHA256 4 /* see RFC 5246 */ +#define TLS_EXT_SIG_HASH_ALGO_ECDSA 3 /* see RFC 5246 */ + +/** + * XORs \p n bytes byte-by-byte starting at \p y to the memory area + * starting at \p x. */ +static inline void +memxor(unsigned char *x, const unsigned char *y, size_t n) { + while(n--) { + *x ^= *y; + x++; y++; + } +} + +/** + * Compares \p len bytes from @p a with @p b in constant time. This + * functions always traverses the entire length to prevent timing + * attacks. + * + * \param a Byte sequence to compare + * \param b Byte sequence to compare + * \param len Number of bytes to compare. + * \return \c 1 if \p a and \p b are equal, \c 0 otherwise. + */ +static inline int +equals(unsigned char *a, unsigned char *b, size_t len) { + int result = 1; + while (len--) { + result &= (*a++ == *b++); + } + return result; +} + +#ifdef HAVE_FLS +#define dtls_fls(i) fls(i) +#else +static inline int +dtls_fls(unsigned int i) { + int n; + for (n = 0; i; n++) + i >>= 1; + return n; +} +#endif /* HAVE_FLS */ + +#define uthash_fatal(msg) return(-1) /* fatal error in uthash */ + +#endif /* _DTLS_GLOBAL_H_ */
diff --git a/hmac.c b/hmac.c new file mode 100644 index 0000000..ef385a7 --- /dev/null +++ b/hmac.c
@@ -0,0 +1,165 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * Hauke Mehrtens - memory optimization, ECC integration + * + *******************************************************************************/ + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> + +#include "dtls_config.h" + +#ifdef HAVE_ASSERT_H +#include <assert.h> +#else +#define assert(x) +#endif + +#include "debug.h" +#include "hmac.h" + +/* use malloc()/free() on platforms other than Contiki */ +#ifndef WITH_CONTIKI +#include <stdlib.h> + +static inline dtls_hmac_context_t * +dtls_hmac_context_new() { + return (dtls_hmac_context_t *)malloc(sizeof(dtls_hmac_context_t)); +} + +static inline void +dtls_hmac_context_free(dtls_hmac_context_t *ctx) { + free(ctx); +} + +#else /* WITH_CONTIKI */ +#include "memb.h" +MEMB(hmac_context_storage, dtls_hmac_context_t, DTLS_HASH_MAX); + +static inline dtls_hmac_context_t * +dtls_hmac_context_new() { + return (dtls_hmac_context_t *)memb_alloc(&hmac_context_storage); +} + +static inline void +dtls_hmac_context_free(dtls_hmac_context_t *ctx) { + memb_free(&hmac_context_storage, ctx); +} + +void +dtls_hmac_storage_init() { + memb_init(&hmac_context_storage); +} +#endif /* WITH_CONTIKI */ + +void +dtls_hmac_update(dtls_hmac_context_t *ctx, + const unsigned char *input, size_t ilen) { + assert(ctx); + dtls_hash_update(&ctx->data, input, ilen); +} + +dtls_hmac_context_t * +dtls_hmac_new(const unsigned char *key, size_t klen) { + dtls_hmac_context_t *ctx; + + ctx = dtls_hmac_context_new(); + if (ctx) + dtls_hmac_init(ctx, key, klen); + + return ctx; +} + +void +dtls_hmac_init(dtls_hmac_context_t *ctx, const unsigned char *key, size_t klen) { + int i; + + assert(ctx); + + memset(ctx, 0, sizeof(dtls_hmac_context_t)); + + if (klen > DTLS_HMAC_BLOCKSIZE) { + dtls_hash_init(&ctx->data); + dtls_hash_update(&ctx->data, key, klen); + dtls_hash_finalize(ctx->pad, &ctx->data); + } else + memcpy(ctx->pad, key, klen); + + /* create ipad: */ + for (i=0; i < DTLS_HMAC_BLOCKSIZE; ++i) + ctx->pad[i] ^= 0x36; + + dtls_hash_init(&ctx->data); + dtls_hmac_update(ctx, ctx->pad, DTLS_HMAC_BLOCKSIZE); + + /* create opad by xor-ing pad[i] with 0x36 ^ 0x5C: */ + for (i=0; i < DTLS_HMAC_BLOCKSIZE; ++i) + ctx->pad[i] ^= 0x6A; +} + +void +dtls_hmac_free(dtls_hmac_context_t *ctx) { + if (ctx) + dtls_hmac_context_free(ctx); +} + +int +dtls_hmac_finalize(dtls_hmac_context_t *ctx, unsigned char *result) { + unsigned char buf[DTLS_HMAC_DIGEST_SIZE]; + size_t len; + + assert(ctx); + assert(result); + + len = dtls_hash_finalize(buf, &ctx->data); + + dtls_hash_init(&ctx->data); + dtls_hash_update(&ctx->data, ctx->pad, DTLS_HMAC_BLOCKSIZE); + dtls_hash_update(&ctx->data, buf, len); + + len = dtls_hash_finalize(result, &ctx->data); + + return len; +} + +#ifdef HMAC_TEST +#include <stdio.h> + +int main(int argc, char **argv) { + static unsigned char buf[DTLS_HMAC_DIGEST_SIZE]; + size_t len, i; + dtls_hmac_context_t *ctx; + + if (argc < 3) { + fprintf(stderr, "usage: %s key text", argv[0]); + return -1; + } + + dtls_hmac_storage_init(); + ctx = dtls_hmac_new(argv[1], strlen(argv[1])); + assert(ctx); + dtls_hmac_update(ctx, argv[2], strlen(argv[2])); + + len = dtls_hmac_finalize(ctx, buf); + + for(i = 0; i < len; i++) + printf("%02x", buf[i]); + printf("\n"); + + dtls_hmac_free(ctx); + + return 0; +} +#endif
diff --git a/hmac.h b/hmac.h new file mode 100644 index 0000000..d5e72a8 --- /dev/null +++ b/hmac.h
@@ -0,0 +1,146 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * Hauke Mehrtens - memory optimization, ECC integration + * + *******************************************************************************/ + +#ifndef _DTLS_HMAC_H_ +#define _DTLS_HMAC_H_ + +#include <sys/types.h> + +#include "global.h" + +#ifdef WITH_SHA256 +/** Aaron D. Gifford's implementation of SHA256 + * see http://www.aarongifford.com/ */ +#include "sha2/sha2.h" + +typedef SHA256_CTX dtls_hash_ctx; +typedef dtls_hash_ctx *dtls_hash_t; +#define DTLS_HASH_CTX_SIZE sizeof(SHA256_CTX) + +static inline void +dtls_hash_init(dtls_hash_t ctx) { + SHA256_Init((SHA256_CTX *)ctx); +} + +static inline void +dtls_hash_update(dtls_hash_t ctx, const unsigned char *input, size_t len) { + SHA256_Update((SHA256_CTX *)ctx, input, len); +} + +static inline size_t +dtls_hash_finalize(unsigned char *buf, dtls_hash_t ctx) { + SHA256_Final(buf, (SHA256_CTX *)ctx); + return SHA256_DIGEST_LENGTH; +} +#endif /* WITH_SHA256 */ + +#ifndef WITH_CONTIKI +static inline void dtls_hmac_storage_init() +{ } +#else +void dtls_hmac_storage_init(); +#endif + +/** + * \defgroup HMAC Keyed-Hash Message Authentication Code (HMAC) + * NIST Standard FIPS 198 describes the Keyed-Hash Message Authentication + * Code (HMAC) which is used as hash function for the DTLS PRF. + * @{ + */ + +#define DTLS_HMAC_BLOCKSIZE 64 /**< size of hmac blocks */ +#define DTLS_HMAC_DIGEST_SIZE 32 /**< digest size (for SHA-256) */ +#define DTLS_HMAC_MAX 64 /**< max number of bytes in digest */ + +/** + * List of known hash functions for use in dtls_hmac_init(). The + * identifiers are the same as the HashAlgorithm defined in + * <a href="http://tools.ietf.org/html/rfc5246#section-7.4.1.4.1" + * >Section 7.4.1.4.1 of RFC 5246</a>. + */ +typedef enum { + HASH_NONE=0, HASH_MD5=1, HASH_SHA1=2, HASH_SHA224=3, + HASH_SHA256=4, HASH_SHA384=5, HASH_SHA512=6 +} dtls_hashfunc_t; + +/** + * Context for HMAC generation. This object is initialized with + * dtls_hmac_init() and must be passed to dtls_hmac_update() and + * dtls_hmac_finalize(). Once, finalized, the component \c H is + * invalid and must be initialized again with dtls_hmac_init() before + * the structure can be used again. + */ +typedef struct { + unsigned char pad[DTLS_HMAC_BLOCKSIZE]; /**< ipad and opad storage */ + dtls_hash_ctx data; /**< context for hash function */ +} dtls_hmac_context_t; + +/** + * Initializes an existing HMAC context. + * + * @param ctx The HMAC context to initialize. + * @param key The secret key. + * @param klen The length of @p key. + */ +void dtls_hmac_init(dtls_hmac_context_t *ctx, const unsigned char *key, size_t klen); + +/** + * Allocates a new HMAC context \p ctx with the given secret key. + * This function returns \c 1 if \c ctx has been set correctly, or \c + * 0 or \c -1 otherwise. Note that this function allocates new storage + * that must be released by dtls_hmac_free(). + * + * \param key The secret key. + * \param klen The length of \p key. + * \return A new dtls_hmac_context_t object or @c NULL on error + */ +dtls_hmac_context_t *dtls_hmac_new(const unsigned char *key, size_t klen); + +/** + * Releases the storage for @p ctx that has been allocated by + * dtls_hmac_new(). + * + * @param ctx The dtls_hmac_context_t to free. + */ +void dtls_hmac_free(dtls_hmac_context_t *ctx); + +/** + * Updates the HMAC context with data from \p input. + * + * \param ctx The HMAC context. + * \param input The input data. + * \param ilen Size of \p input. + */ +void dtls_hmac_update(dtls_hmac_context_t *ctx, + const unsigned char *input, size_t ilen); + +/** + * Completes the HMAC generation and writes the result to the given + * output parameter \c result. The buffer must be large enough to hold + * the message digest created by the actual hash function. If in + * doubt, use \c DTLS_HMAC_MAX. The function returns the number of + * bytes written to \c result. + * + * \param ctx The HMAC context. + * \param result Output parameter where the MAC is written to. + * \return Length of the MAC written to \p result. + */ +int dtls_hmac_finalize(dtls_hmac_context_t *ctx, unsigned char *result); + +/**@}*/ + +#endif /* _DTLS_HMAC_H_ */
diff --git a/netq.c b/netq.c new file mode 100644 index 0000000..d223c14 --- /dev/null +++ b/netq.c
@@ -0,0 +1,147 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * Hauke Mehrtens - memory optimization, ECC integration + * + *******************************************************************************/ + +#include "dtls_config.h" +#include "debug.h" +#include "netq.h" +#include "utlist.h" + +#ifdef HAVE_ASSERT_H +#include <assert.h> +#else +#ifndef assert +#warning "assertions are disabled" +# define assert(x) +#endif +#endif + +#ifndef WITH_CONTIKI +#include <stdlib.h> + +static inline netq_t * +netq_malloc_node(size_t size) { + return (netq_t *)malloc(sizeof(netq_t) + size); +} + +static inline void +netq_free_node(netq_t *node) { + free(node); +} + +#else /* WITH_CONTIKI */ +#include "memb.h" + +MEMB(netq_storage, netq_t, NETQ_MAXCNT); + +static inline netq_t * +netq_malloc_node(size_t size) { + return (netq_t *)memb_alloc(&netq_storage); +} + +static inline void +netq_free_node(netq_t *node) { + memb_free(&netq_storage, node); +} + +void +netq_init() { + memb_init(&netq_storage); +} +#endif /* WITH_CONTIKI */ + +int +netq_insert_node(netq_t **queue, netq_t *node) { + netq_t *p; + + assert(queue); + assert(node); + + p = *queue; + while(p && p->t <= node->t) + p = p->next; + + if (p) + LL_PREPEND_ELEM(*queue, p, node); + else + LL_APPEND(*queue, node); + + return 1; +} + +netq_t * +netq_head(netq_t **queue) { + return queue ? *queue : NULL; +} + +netq_t * +netq_next(netq_t *p) { + if (!p) + return NULL; + + return p->next; +} + +void +netq_remove(netq_t **queue, netq_t *p) { + if (!queue || !p) + return; + + LL_DELETE(*queue, p); +} + +netq_t *netq_pop_first(netq_t **queue) { + netq_t *p = netq_head(queue); + + if (p) + LL_DELETE(*queue, p); + + return p; +} + +netq_t * +netq_node_new(size_t size) { + netq_t *node; + node = netq_malloc_node(size); + +#ifndef NDEBUG + if (!node) + dtls_warn("netq_node_new: malloc\n"); +#endif + + if (node) + memset(node, 0, sizeof(netq_t)); + + return node; +} + +void +netq_node_free(netq_t *node) { + if (node) + netq_free_node(node); +} + +void +netq_delete_all(netq_t **queue) { + netq_t *p, *tmp; + if (queue) { + LL_FOREACH_SAFE(*queue,p,tmp) { + netq_free_node(p); + } + + *queue = NULL; + } +}
diff --git a/netq.h b/netq.h new file mode 100644 index 0000000..a5b71d3 --- /dev/null +++ b/netq.h
@@ -0,0 +1,112 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * Hauke Mehrtens - memory optimization, ECC integration + * + *******************************************************************************/ + +#ifndef _DTLS_NETQ_H_ +#define _DTLS_NETQ_H_ + +#include "tinydtls.h" +#include "global.h" +#include "dtls.h" +#include "dtls_time.h" + +/** + * \defgroup netq Network Packet Queue + * The netq utility functions implement an ordered queue of data packets + * to send over the network and can also be used to queue received packets + * from the network. + * @{ + */ + +#ifndef NETQ_MAXCNT +#ifdef DTLS_ECC +#define NETQ_MAXCNT 5 /**< maximum number of elements in netq structure */ +#elif defined(DTLS_PSK) +#define NETQ_MAXCNT 3 /**< maximum number of elements in netq structure */ +#endif +#endif + +/** + * Datagrams in the netq_t structure have a fixed maximum size of + * DTLS_MAX_BUF to simplify memory management on constrained nodes. */ +typedef unsigned char netq_packet_t[DTLS_MAX_BUF]; + +typedef struct netq_t { + struct netq_t *next; + + clock_time_t t; /**< when to send PDU for the next time */ + unsigned int timeout; /**< randomized timeout value */ + + dtls_peer_t *peer; /**< remote address */ + uint16_t epoch; + uint8_t type; + unsigned char retransmit_cnt; /**< retransmission counter, will be removed when zero */ + + size_t length; /**< actual length of data */ +#ifndef WITH_CONTIKI + unsigned char data[]; /**< the datagram to send */ +#else + netq_packet_t data; /**< the datagram to send */ +#endif +} netq_t; + +#ifndef WITH_CONTIKI +static inline void netq_init() +{ } +#else +void netq_init(); +#endif + +/** + * Adds a node to the given queue, ordered by their time-stamp t. + * This function returns @c 0 on error, or non-zero if @p node has + * been added successfully. + * + * @param queue A pointer to the queue head where @p node will be added. + * @param node The new item to add. + * @return @c 0 on error, or non-zero if the new item was added. + */ +int netq_insert_node(netq_t **queue, netq_t *node); + +/** Destroys specified node and releases any memory that was allocated + * for the associated datagram. */ +void netq_node_free(netq_t *node); + +/** Removes all items from given queue and frees the allocated storage */ +void netq_delete_all(netq_t **queue); + +/** Creates a new node suitable for adding to a netq_t queue. */ +netq_t *netq_node_new(size_t size); + +/** + * Returns a pointer to the first item in given queue or NULL if + * empty. + */ +netq_t *netq_head(netq_t **queue); + +netq_t *netq_next(netq_t *p); +void netq_remove(netq_t **queue, netq_t *p); + +/** + * Removes the first item in given queue and returns a pointer to the + * removed element. If queue is empty when netq_pop_first() is called, + * this function returns NULL. + */ +netq_t *netq_pop_first(netq_t **queue); + +/**@}*/ + +#endif /* _DTLS_NETQ_H_ */
diff --git a/numeric.h b/numeric.h new file mode 100644 index 0000000..e8d1f56 --- /dev/null +++ b/numeric.h
@@ -0,0 +1,134 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * Hauke Mehrtens - memory optimization, ECC integration + * + *******************************************************************************/ + +#ifndef _DTLS_NUMERIC_H_ +#define _DTLS_NUMERIC_H_ + +#include <stdint.h> + +#ifndef min +#define min(A,B) ((A) <= (B) ? (A) : (B)) +#endif + +#ifndef max +#define max(A,B) ((A) < (B) ? (B) : (A)) +#endif + +/* this one is for consistency... */ +static inline int dtls_int_to_uint8(unsigned char *field, uint8_t value) +{ + field[0] = value & 0xff; + return 1; +} + +static inline int dtls_int_to_uint16(unsigned char *field, uint16_t value) +{ + field[0] = (value >> 8) & 0xff; + field[1] = value & 0xff; + return 2; +} + +static inline int dtls_int_to_uint24(unsigned char *field, uint32_t value) +{ + field[0] = (value >> 16) & 0xff; + field[1] = (value >> 8) & 0xff; + field[2] = value & 0xff; + return 3; +} + +static inline int dtls_int_to_uint32(unsigned char *field, uint32_t value) +{ + field[0] = (value >> 24) & 0xff; + field[1] = (value >> 16) & 0xff; + field[2] = (value >> 8) & 0xff; + field[3] = value & 0xff; + return 4; +} + +static inline int dtls_int_to_uint48(unsigned char *field, uint64_t value) +{ + field[0] = (value >> 40) & 0xff; + field[1] = (value >> 32) & 0xff; + field[2] = (value >> 24) & 0xff; + field[3] = (value >> 16) & 0xff; + field[4] = (value >> 8) & 0xff; + field[5] = value & 0xff; + return 6; +} + +static inline int dtls_int_to_uint64(unsigned char *field, uint64_t value) +{ + field[0] = (value >> 56) & 0xff; + field[1] = (value >> 48) & 0xff; + field[2] = (value >> 40) & 0xff; + field[3] = (value >> 32) & 0xff; + field[4] = (value >> 24) & 0xff; + field[5] = (value >> 16) & 0xff; + field[6] = (value >> 8) & 0xff; + field[7] = value & 0xff; + return 8; +} + +static inline uint8_t dtls_uint8_to_int(const unsigned char *field) +{ + return (uint8_t)field[0]; +} + +static inline uint16_t dtls_uint16_to_int(const unsigned char *field) +{ + return ((uint16_t)field[0] << 8) + | (uint16_t)field[1]; +} + +static inline uint32_t dtls_uint24_to_int(const unsigned char *field) +{ + return ((uint32_t)field[0] << 16) + | ((uint32_t)field[1] << 8) + | (uint32_t)field[2]; +} + +static inline uint32_t dtls_uint32_to_int(const unsigned char *field) +{ + return ((uint32_t)field[0] << 24) + | ((uint32_t)field[1] << 16) + | ((uint32_t)field[2] << 8) + | (uint32_t)field[3]; +} + +static inline uint64_t dtls_uint48_to_int(const unsigned char *field) +{ + return ((uint64_t)field[0] << 40) + | ((uint64_t)field[1] << 32) + | ((uint64_t)field[2] << 24) + | ((uint64_t)field[3] << 16) + | ((uint64_t)field[4] << 8) + | (uint64_t)field[5]; +} + +static inline uint64_t dtls_uint64_to_int(const unsigned char *field) +{ + return ((uint64_t)field[0] << 56) + | ((uint64_t)field[1] << 48) + | ((uint64_t)field[2] << 40) + | ((uint64_t)field[3] << 32) + | ((uint64_t)field[4] << 24) + | ((uint64_t)field[5] << 16) + | ((uint64_t)field[6] << 8) + | (uint64_t)field[7]; +} + +#endif /* _DTLS_NUMERIC_H_ */
diff --git a/peer.c b/peer.c new file mode 100644 index 0000000..08d4277 --- /dev/null +++ b/peer.c
@@ -0,0 +1,82 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * Hauke Mehrtens - memory optimization, ECC integration + * + *******************************************************************************/ + +#include "global.h" +#include "peer.h" +#include "debug.h" + +#ifndef WITH_CONTIKI +void peer_init() +{ +} + +static inline dtls_peer_t * +dtls_malloc_peer() { + return (dtls_peer_t *)malloc(sizeof(dtls_peer_t)); +} + +void +dtls_free_peer(dtls_peer_t *peer) { + dtls_handshake_free(peer->handshake_params); + dtls_security_free(peer->security_params[0]); + dtls_security_free(peer->security_params[1]); + free(peer); +} +#else /* WITH_CONTIKI */ + +#include "memb.h" +MEMB(peer_storage, dtls_peer_t, DTLS_PEER_MAX); + +void +peer_init() { + memb_init(&peer_storage); +} + +static inline dtls_peer_t * +dtls_malloc_peer() { + return memb_alloc(&peer_storage); +} + +void +dtls_free_peer(dtls_peer_t *peer) { + dtls_handshake_free(peer->handshake_params); + dtls_security_free(peer->security_params[0]); + dtls_security_free(peer->security_params[1]); + memb_free(&peer_storage, peer); +} +#endif /* WITH_CONTIKI */ + +dtls_peer_t * +dtls_new_peer(const session_t *session) { + dtls_peer_t *peer; + + peer = dtls_malloc_peer(); + if (peer) { + memset(peer, 0, sizeof(dtls_peer_t)); + memcpy(&peer->session, session, sizeof(session_t)); + peer->security_params[0] = dtls_security_new(); + + if (!peer->security_params[0]) { + dtls_free_peer(peer); + return NULL; + } + + dtls_dsrv_log_addr(DTLS_LOG_DEBUG, "dtls_new_peer", session); + } + + return peer; +}
diff --git a/peer.h b/peer.h new file mode 100644 index 0000000..49dac5a --- /dev/null +++ b/peer.h
@@ -0,0 +1,140 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * Hauke Mehrtens - memory optimization, ECC integration + * + *******************************************************************************/ + +/** + * @file peer.h + * @brief information about peers in a DTLS session + */ + +#ifndef _DTLS_PEER_H_ +#define _DTLS_PEER_H_ + +#include <sys/types.h> + +#include "tinydtls.h" +#include "global.h" +#include "session.h" + +#include "state.h" +#include "crypto.h" + +#ifndef DTLS_PEERS_NOHASH +#include "uthash.h" +#endif /* DTLS_PEERS_NOHASH */ + +typedef enum { DTLS_CLIENT=0, DTLS_SERVER } dtls_peer_type; + +/** + * Holds security parameters, local state and the transport address + * for each peer. */ +typedef struct dtls_peer_t { +#ifdef DTLS_PEERS_NOHASH + struct dtls_peer_t *next; +#else /* DTLS_PEERS_NOHASH */ + UT_hash_handle hh; +#endif /* DTLS_PEERS_NOHASH */ + + session_t session; /**< peer address and local interface */ + + dtls_peer_type role; /**< denotes if this host is DTLS_CLIENT or DTLS_SERVER */ + dtls_state_t state; /**< DTLS engine state */ + + dtls_security_parameters_t *security_params[2]; + dtls_handshake_parameters_t *handshake_params; +} dtls_peer_t; + +static inline dtls_security_parameters_t *dtls_security_params_epoch(dtls_peer_t *peer, uint16_t epoch) +{ + if (peer->security_params[0] && peer->security_params[0]->epoch == epoch) { + return peer->security_params[0]; + } else if (peer->security_params[1] && peer->security_params[1]->epoch == epoch) { + return peer->security_params[1]; + } else { + return NULL; + } +} + +static inline dtls_security_parameters_t *dtls_security_params(dtls_peer_t *peer) +{ + return peer->security_params[0]; +} + +static inline dtls_security_parameters_t *dtls_security_params_next(dtls_peer_t *peer) +{ + if (peer->security_params[1]) + dtls_security_free(peer->security_params[1]); + + peer->security_params[1] = dtls_security_new(); + if (!peer->security_params[1]) { + return NULL; + } + peer->security_params[1]->epoch = peer->security_params[0]->epoch + 1; + return peer->security_params[1]; +} + +static inline void dtls_security_params_free_other(dtls_peer_t *peer) +{ + dtls_security_parameters_t * security0 = peer->security_params[0]; + dtls_security_parameters_t * security1 = peer->security_params[1]; + + if (!security0 || !security1 || security0->epoch < security1->epoch) + return; + + dtls_security_free(security1); + peer->security_params[1] = NULL; +} + +static inline void dtls_security_params_switch(dtls_peer_t *peer) +{ + dtls_security_parameters_t * security = peer->security_params[1]; + + peer->security_params[1] = peer->security_params[0]; + peer->security_params[0] = security; +} + +void peer_init(); + +/** + * Creates a new peer for given @p session. The current configuration + * is initialized with the cipher suite TLS_NULL_WITH_NULL_NULL (i.e. + * no security at all). This function returns a pointer to the new + * peer or NULL on error. The caller is responsible for releasing the + * storage allocated for this peer using dtls_free_peer(). + * + * @param session The remote peer's address and local interface index. + * @return A pointer to a newly created and initialized peer object + * or NULL on error. + */ +dtls_peer_t *dtls_new_peer(const session_t *session); + +/** Releases the storage allocated to @p peer. */ +void dtls_free_peer(dtls_peer_t *peer); + +/** Returns the current state of @p peer. */ +static inline dtls_state_t dtls_peer_state(const dtls_peer_t *peer) { + return peer->state; +} + +/** + * Checks if given @p peer is connected. This function returns + * @c 1 if connected, or @c 0 otherwise. + */ +static inline int dtls_peer_is_connected(const dtls_peer_t *peer) { + return peer->state == DTLS_STATE_CONNECTED; +} + +#endif /* _DTLS_PEER_H_ */
diff --git a/platform-specific/Makefile.in b/platform-specific/Makefile.in new file mode 100644 index 0000000..6b30d21 --- /dev/null +++ b/platform-specific/Makefile.in
@@ -0,0 +1,27 @@ +# the library's version +VERSION:=@PACKAGE_VERSION@ + +# tools +@SET_MAKE@ +SHELL = /bin/sh +MKDIR = mkdir + +top_builddir = @top_builddir@ + +THIS=platform-specific +DISTDIR?=$(top_builddir)/@PACKAGE_TARNAME@-@PACKAGE_VERSION@ +FILES:=Makefile.in $(wildcard *.h) + +clean: + +distclean: clean + @rm -rf $(DISTDIR) + @rm -f *~ + +dist: + test -d $(DISTDIR)/$(THIS) || mkdir $(DISTDIR)/$(THIS) + cp -r $(FILES) $(DISTDIR)/$(THIS) + +# this directory contains no installation candidates +install: + :
diff --git a/platform-specific/config-cc2538dk.h b/platform-specific/config-cc2538dk.h new file mode 100644 index 0000000..38bc85e --- /dev/null +++ b/platform-specific/config-cc2538dk.h
@@ -0,0 +1,2 @@ +#define BYTE_ORDER 1234 +#define HAVE_ASSERT_H 1
diff --git a/platform-specific/config-econotag.h b/platform-specific/config-econotag.h new file mode 100644 index 0000000..38bc85e --- /dev/null +++ b/platform-specific/config-econotag.h
@@ -0,0 +1,2 @@ +#define BYTE_ORDER 1234 +#define HAVE_ASSERT_H 1
diff --git a/platform-specific/config-minimal-net.h b/platform-specific/config-minimal-net.h new file mode 100644 index 0000000..547a1b6 --- /dev/null +++ b/platform-specific/config-minimal-net.h
@@ -0,0 +1 @@ +#define HAVE_ASSERT_H 1
diff --git a/platform-specific/config-sky.h b/platform-specific/config-sky.h new file mode 100644 index 0000000..f49ff3b --- /dev/null +++ b/platform-specific/config-sky.h
@@ -0,0 +1,3 @@ +#define BYTE_ORDER 1234 +#define HAVE_ASSERT_H 1 +typedef int ssize_t;
diff --git a/platform-specific/config-wismote.h b/platform-specific/config-wismote.h new file mode 100644 index 0000000..547a1b6 --- /dev/null +++ b/platform-specific/config-wismote.h
@@ -0,0 +1 @@ +#define HAVE_ASSERT_H 1
diff --git a/platform-specific/platform.h b/platform-specific/platform.h new file mode 100644 index 0000000..7418c0a --- /dev/null +++ b/platform-specific/platform.h
@@ -0,0 +1,65 @@ +/************************************************************************/ +/* Contiki-specific parameters */ +/************************************************************************/ + +#ifndef _PLATFORM_H_ +#define _PLATFORM_H_ 1 + +#ifdef CONTIKI +#include "contiki.h" +#include "contiki-lib.h" +#include "contiki-net.h" + +#include "contiki-conf.h" + +/* global constants for constrained devices running Contiki */ +#ifndef DTLS_PEER_MAX +/** The maximum number DTLS peers (i.e. sessions). */ +# define DTLS_PEER_MAX 1 +#endif + +#ifndef DTLS_HANDSHAKE_MAX +/** The maximum number of concurrent DTLS handshakes. */ +# define DTLS_HANDSHAKE_MAX 1 +#endif + +#ifndef DTLS_SECURITY_MAX +/** The maximum number of concurrently used cipher keys */ +# define DTLS_SECURITY_MAX (DTLS_PEER_MAX + DTLS_HANDSHAKE_MAX) +#endif + +#ifndef DTLS_HASH_MAX +/** The maximum number of hash functions that can be used in parallel. */ +# define DTLS_HASH_MAX (3 * DTLS_PEER_MAX) +#endif + +/** do not use uthash hash tables */ +#define DTLS_PEERS_NOHASH 1 + +/************************************************************************/ +/* Specific Contiki platforms */ +/************************************************************************/ + +#if CONTIKI_TARGET_ECONOTAG +# include "platform-specific/config-econotag.h" +#endif /* CONTIKI_TARGET_ECONOTAG */ + +#ifdef CONTIKI_TARGET_CC2538DK +# include "platform-specific/config-cc2538dk.h" +#endif /* CONTIKI_TARGET_CC2538DK */ + +#ifdef CONTIKI_TARGET_WISMOTE +# include "platform-specific/config-wismote.h" +#endif /* CONTIKI_TARGET_WISMOTE */ + +#ifdef CONTIKI_TARGET_SKY +# include "platform-specific/config-sky.h" +#endif /* CONTIKI_TARGET_SKY */ + +#ifdef CONTIKI_TARGET_MINIMAL_NET +# include "platform-specific/config-minimal-net.h" +#endif /* CONTIKI_TARGET_MINIMAL_NET */ + +#endif /* CONTIKI */ + +#endif /* _PLATFORM_H_ */
diff --git a/prng.h b/prng.h new file mode 100644 index 0000000..aa4926e --- /dev/null +++ b/prng.h
@@ -0,0 +1,96 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * Hauke Mehrtens - memory optimization, ECC integration + * + *******************************************************************************/ + +/** + * @file prng.h + * @brief Pseudo Random Numbers + */ + +#ifndef _DTLS_PRNG_H_ +#define _DTLS_PRNG_H_ + +#include "tinydtls.h" + +/** + * @defgroup prng Pseudo Random Numbers + * @{ + */ + +#ifndef WITH_CONTIKI +#include <stdlib.h> + +/** + * Fills \p buf with \p len random bytes. This is the default + * implementation for prng(). You might want to change prng() to use + * a better PRNG on your specific platform. + */ +static inline int +dtls_prng(unsigned char *buf, size_t len) { + while (len--) + *buf++ = rand() & 0xFF; + return 1; +} + +static inline void +dtls_prng_init(unsigned short seed) { + srand(seed); +} +#else /* WITH_CONTIKI */ +#include <string.h> +#include "random.h" + +#ifdef HAVE_PRNG +static inline int +dtls_prng(unsigned char *buf, size_t len) +{ + return contiki_prng_impl(buf, len); +} +#else +/** + * Fills \p buf with \p len random bytes. This is the default + * implementation for prng(). You might want to change prng() to use + * a better PRNG on your specific platform. + */ +static inline int +dtls_prng(unsigned char *buf, size_t len) { + unsigned short v = random_rand(); + while (len > sizeof(v)) { + memcpy(buf, &v, sizeof(v)); + len -= sizeof(v); + buf += sizeof(v); + v = random_rand(); + } + + memcpy(buf, &v, len); + return 1; +} +#endif /* HAVE_PRNG */ + +static inline void +dtls_prng_init(unsigned short seed) { + /* random_init() messes with the radio interface of the CC2538 and + * therefore must not be called after the radio has been + * initialized. */ +#ifndef CONTIKI_TARGET_CC2538DK + random_init(seed); +#endif +} +#endif /* WITH_CONTIKI */ + +/** @} */ + +#endif /* _DTLS_PRNG_H_ */
diff --git a/session.c b/session.c new file mode 100644 index 0000000..e96ebba --- /dev/null +++ b/session.c
@@ -0,0 +1,74 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * + *******************************************************************************/ + +#include "dtls_config.h" +#include "session.h" + +#ifdef HAVE_ASSERT_H +#include <assert.h> +#else +#ifndef assert +#warning "assertions are disabled" +# define assert(x) +#endif +#endif + +#ifdef WITH_CONTIKI +#define _dtls_address_equals_impl(A,B) \ + ((A)->size == (B)->size \ + && (A)->port == (B)->port \ + && uip_ipaddr_cmp(&((A)->addr),&((B)->addr)) \ + && (A)->ifindex == (B)->ifindex) + +#else /* WITH_CONTIKI */ + +static inline int +_dtls_address_equals_impl(const session_t *a, + const session_t *b) { + if (a->ifindex != b->ifindex || + a->size != b->size || a->addr.sa.sa_family != b->addr.sa.sa_family) + return 0; + + /* need to compare only relevant parts of sockaddr_in6 */ + switch (a->addr.sa.sa_family) { + case AF_INET: + return + a->addr.sin.sin_port == b->addr.sin.sin_port && + memcmp(&a->addr.sin.sin_addr, &b->addr.sin.sin_addr, + sizeof(struct in_addr)) == 0; + case AF_INET6: + return a->addr.sin6.sin6_port == b->addr.sin6.sin6_port && + memcmp(&a->addr.sin6.sin6_addr, &b->addr.sin6.sin6_addr, + sizeof(struct in6_addr)) == 0; + default: /* fall through and signal error */ + ; + } + return 0; +} +#endif /* WITH_CONTIKI */ + +void +dtls_session_init(session_t *sess) { + assert(sess); + memset(sess, 0, sizeof(session_t)); + sess->size = sizeof(sess->addr); +} + +int +dtls_session_equals(const session_t *a, const session_t *b) { + assert(a); assert(b); + return _dtls_address_equals_impl(a, b); +}
diff --git a/session.h b/session.h new file mode 100644 index 0000000..8cd8a93 --- /dev/null +++ b/session.h
@@ -0,0 +1,67 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * + *******************************************************************************/ + +#ifndef _DTLS_SESSION_H_ +#define _DTLS_SESSION_H_ + +#include <string.h> + +#include "tinydtls.h" +#include "global.h" + +#ifdef WITH_CONTIKI +#include "ip/uip.h" +typedef struct { + unsigned char size; + uip_ipaddr_t addr; + unsigned short port; + int ifindex; +} session_t; + +#else /* WITH_CONTIKI */ + +#include <sys/socket.h> +#include <netinet/in.h> +#include <arpa/inet.h> + +typedef struct { + socklen_t size; /**< size of addr */ + union { + struct sockaddr sa; + struct sockaddr_storage st; + struct sockaddr_in sin; + struct sockaddr_in6 sin6; + } addr; + uint8_t ifindex; +} session_t; +#endif /* WITH_CONTIKI */ + +/** + * Resets the given session_t object @p sess to its default + * values. In particular, the member rlen must be initialized to the + * available size for storing addresses. + * + * @param sess The session_t object to initialize. + */ +void dtls_session_init(session_t *sess); + +/** + * Compares the given session objects. This function returns @c 0 + * when @p a and @p b differ, @c 1 otherwise. + */ +int dtls_session_equals(const session_t *a, const session_t *b); + +#endif /* _DTLS_SESSION_H_ */
diff --git a/sha2/Makefile.in b/sha2/Makefile.in new file mode 100644 index 0000000..9f19314 --- /dev/null +++ b/sha2/Makefile.in
@@ -0,0 +1,69 @@ +# Makefile for tinydtls +# +# Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. +# All rights reserved. This program and the accompanying materials +# are made available under the terms of the Eclipse Public License v1.0 +# and Eclipse Distribution License v. 1.0 which accompanies this distribution. +# +# The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html +# and the Eclipse Distribution License is available at +# http://www.eclipse.org/org/documents/edl-v10.php. +# +# Contributors: +# Olaf Bergmann - initial API and implementation +# + +# the library's version +VERSION:=@PACKAGE_VERSION@ + +# tools +@SET_MAKE@ +SHELL = /bin/sh +MKDIR = mkdir + +abs_builddir = @abs_builddir@ +top_builddir = @top_builddir@ +top_srcdir:= @top_srcdir@ + +SOURCES:= sha2.c +HEADERS:=sha2.h +OBJECTS:= $(patsubst %.c, %.o, $(SOURCES)) +CPPFLAGS=@CPPFLAGS@ -I$(top_srcdir) +CFLAGS=-Wall -std=c99 -pedantic @CFLAGS@ +LDLIBS=@LIBS@ +FILES:=Makefile.in $(SOURCES) $(HEADERS) README sha2prog.c sha2speed.c sha2test.pl +DISTDIR=$(top_builddir)/@PACKAGE_TARNAME@-@PACKAGE_VERSION@ + +.PHONY: all dirs clean install dist distclean .gitignore doc + +.SUFFIXES: +.SUFFIXES: .c .o + +all: + +check: + echo DISTDIR: $(DISTDIR) + echo top_builddir: $(top_builddir) + +clean: + @rm -f $(PROGRAMS) main.o $(LIB) $(OBJECTS) + for dir in $(SUBDIRS); do \ + $(MAKE) -C $$dir clean ; \ + done + +distclean: clean + @rm -rf $(DISTDIR) + @rm -f *~ $(DISTDIR).tar.gz + +dist: $(FILES) + test -d $(DISTDIR)/sha2 || mkdir $(DISTDIR)/sha2 + cp -p $(FILES) $(DISTDIR)/sha2 + test -d $(DISTDIR)/sha2/testvectors || mkdir $(DISTDIR)/sha2/testvectors + cp -pr testvectors $(DISTDIR)/sha2/testvectors + +install: $(HEADERS) + test -d $(includedir)/sha2 || mkdir -p $(includedir)/sha2 + $(install) $(HEADERS) $(includedir)/sha2 + +.gitignore: + echo "core\n*~\n*.[oa]\n*.gz\n*.cap\n$(PROGRAM)\n$(DISTDIR)\n.gitignore" >$@
diff --git a/state.h b/state.h new file mode 100644 index 0000000..2635988 --- /dev/null +++ b/state.h
@@ -0,0 +1,56 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * Hauke Mehrtens - memory optimization, ECC integration + * + *******************************************************************************/ + +/** + * @file state.h + * @brief state information for DTLS FSM + */ + +#ifndef _DTLS_STATE_H_ +#define _DTLS_STATE_H_ + +#include <sys/types.h> +#include <stdint.h> + +#include "global.h" +#include "hmac.h" + +typedef enum { + DTLS_STATE_INIT = 0, DTLS_STATE_WAIT_CLIENTHELLO, DTLS_STATE_WAIT_CLIENTCERTIFICATE, + DTLS_STATE_WAIT_CLIENTKEYEXCHANGE, DTLS_STATE_WAIT_CERTIFICATEVERIFY, + DTLS_STATE_WAIT_CHANGECIPHERSPEC, + DTLS_STATE_WAIT_FINISHED, DTLS_STATE_FINISHED, + /* client states */ + DTLS_STATE_CLIENTHELLO, DTLS_STATE_WAIT_SERVERCERTIFICATE, DTLS_STATE_WAIT_SERVERKEYEXCHANGE, + DTLS_STATE_WAIT_SERVERHELLODONE, + + DTLS_STATE_CONNECTED, + DTLS_STATE_CLOSING, + DTLS_STATE_CLOSED +} dtls_state_t; + +typedef struct { + uint16_t mseq_s; /**< send handshake message sequence number counter */ + uint16_t mseq_r; /**< received handshake message sequence number counter */ + + /** pending config that is updated during handshake */ + /* FIXME: dtls_security_parameters_t pending_config; */ + + /* temporary storage for the final handshake hash */ + dtls_hash_ctx hs_hash; +} dtls_hs_state_t; +#endif /* _DTLS_STATE_H_ */
diff --git a/tests/Makefile.in b/tests/Makefile.in new file mode 100644 index 0000000..a8a2ed0 --- /dev/null +++ b/tests/Makefile.in
@@ -0,0 +1,75 @@ +# Makefile for tinydtls +# +# Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. +# All rights reserved. This program and the accompanying materials +# are made available under the terms of the Eclipse Public License v1.0 +# and Eclipse Distribution License v. 1.0 which accompanies this distribution. +# +# The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html +# and the Eclipse Distribution License is available at +# http://www.eclipse.org/org/documents/edl-v10.php. +# +# Contributors: +# Olaf Bergmann - initial API and implementation +# + +# the library's version +VERSION:=@PACKAGE_VERSION@ + +# tools +@SET_MAKE@ +SHELL = /bin/sh +MKDIR = mkdir + +abs_builddir = @abs_builddir@ +top_builddir = @top_builddir@ +top_srcdir:= @top_srcdir@ + +# files and flags +SOURCES:= dtls-server.c ccm-test.c prf-test.c \ + dtls-client.c + #cbc_aes128-test.c #dsrv-test.c +OBJECTS:= $(patsubst %.c, %.o, $(SOURCES)) +PROGRAMS:= $(patsubst %.c, %, $(SOURCES)) +HEADERS:= +CFLAGS:=-Wall @CFLAGS@ +CPPFLAGS:=-I$(top_srcdir) @CPPFLAGS@ +LDFLAGS:=-L$(top_builddir) +LDLIBS:=-ltinydtls @LIBS@ +DISTDIR=$(top_builddir)/@PACKAGE_TARNAME@-@PACKAGE_VERSION@ +FILES:=Makefile.in $(SOURCES) ccm-testdata.c #cbc_aes128-testdata.c + +.PHONY: all dirs clean distclean .gitignore doc + +.SUFFIXES: +.SUFFIXES: .c .o + +all: $(PROGRAMS) + +check: + echo DISTDIR: $(DISTDIR) + echo top_builddir: $(top_builddir) + +clean: + @rm -f $(PROGRAMS) main.o $(LIB) $(OBJECTS) + for dir in $(SUBDIRS); do \ + $(MAKE) -C $$dir clean ; \ + done + +doc: + $(MAKE) -C doc + +distclean: clean + @rm -rf $(DISTDIR) + @rm -f *~ $(DISTDIR).tar.gz + +dist: $(FILES) + test -d $(DISTDIR)/tests || mkdir $(DISTDIR)/tests + cp $(FILES) $(DISTDIR)/tests + +# this directory contains no installation candidates +install: + : + +.gitignore: + echo "core\n*~\n*.[oa]\n*.gz\n*.cap\n$(PROGRAM)\n$(DISTDIR)\n.gitignore" >$@
diff --git a/tests/cbc_aes128-test.c b/tests/cbc_aes128-test.c new file mode 100644 index 0000000..1f91920 --- /dev/null +++ b/tests/cbc_aes128-test.c
@@ -0,0 +1,60 @@ +#include <stdio.h> +#include <stdlib.h> +#include <string.h> + +#include "debug.h" +#include "numeric.h" +#include "crypto.h" + +#include "cbc_aes128-testdata.c" + +void +dump(unsigned char *buf, size_t len) { + size_t i = 0; + while (i < len) { + printf("%02x ", buf[i++]); + if (i % 4 == 0) + printf(" "); + if (i % 16 == 0) + printf("\n\t"); + } + printf("\n"); +} + +int main(int argc, char **argv) { + int len, n; + + for (n = 0; n < sizeof(data)/sizeof(struct test_vector); ++n) { + dtls_cipher_context_t *cipher; + + cipher = dtls_new_cipher(&ciphers[AES128], + data[n].key, + sizeof(data[n].key)); + + if (!cipher) { + fprintf(stderr, "cannot set key\n"); + exit(-1); + } + + dtls_init_cipher(cipher, data[n].nonce, sizeof(data[n].nonce)); + + if (data[n].M == 0) + len = dtls_encrypt(cipher, data[n].msg, data[n].lm); + else + len = dtls_decrypt(cipher, data[n].msg, data[n].lm); + + printf("Packet Vector #%d ", n+1); + if (len != data[n].r_lm + || memcmp(data[n].msg, data[n].result, len)) + printf("FAILED, "); + else + printf("OK, "); + + printf("result is (total length = %d):\n\t", (int)len); + dump(data[n].msg, len); + + free(cipher); + } + + return 0; +}
diff --git a/tests/cbc_aes128-testdata.c b/tests/cbc_aes128-testdata.c new file mode 100644 index 0000000..0791679 --- /dev/null +++ b/tests/cbc_aes128-testdata.c
@@ -0,0 +1,72 @@ +/* dtls -- a very basic DTLS implementation + * + * Copyright (C) 2011 Olaf Bergmann <bergmann@tzi.org> + * + * Permission is hereby granted, free of charge, to any person + * obtaining a copy of this software and associated documentation + * files (the "Software"), to deal in the Software without + * restriction, including without limitation the rights to use, copy, + * modify, merge, publish, distribute, sublicense, and/or sell copies + * of the Software, and to permit persons to whom the Software is + * furnished to do so, subject to the following conditions: + * + * The above copyright notice and this permission notice shall be + * included in all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS + * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN + * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN + * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + * SOFTWARE. + */ + +/* test vectors from Appendix F.2.{1,2} of NIST SP 800-38A, ed. 2001 */ + +struct test_vector { + size_t M; /* mode: 0 == encrypt, 1 == decrypt */ + size_t lm; /* overall message length */ + size_t la; /* not used */ + unsigned char key[AES_BLKLEN]; + unsigned char nonce[AES_BLKLEN]; + unsigned char msg[2000]; + size_t r_lm; /* overall result length */ + unsigned char result[2000]; /* result */ +}; + +struct test_vector data[] = { + /* F.2.1 (encrypt) */ + { 0, 4 * AES_BLKLEN, 0, + { 0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6, 0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c }, /* AES key */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f }, /* Nonce */ + { 0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96, 0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a, + 0xae, 0x2d, 0x8a, 0x57, 0x1e, 0x03, 0xac, 0x9c, 0x9e, 0xb7, 0x6f, 0xac, 0x45, 0xaf, 0x8e, 0x51, + 0x30, 0xc8, 0x1c, 0x46, 0xa3, 0x5c, 0xe4, 0x11, 0xe5, 0xfb, 0xc1, 0x19, 0x1a, 0x0a, 0x52, 0xef, + 0xf6, 0x9f, 0x24, 0x45, 0xdf, 0x4f, 0x9b, 0x17, 0xad, 0x2b, 0x41, 0x7b, 0xe6, 0x6c, 0x37, 0x10 }, /* msg */ + 4 * AES_BLKLEN, /* length of result */ + { 0x76, 0x49, 0xab, 0xac, 0x81, 0x19, 0xb2, 0x46, 0xce, 0xe9, 0x8e, 0x9b, 0x12, 0xe9, 0x19, 0x7d, + 0x50, 0x86, 0xcb, 0x9b, 0x50, 0x72, 0x19, 0xee, 0x95, 0xdb, 0x11, 0x3a, 0x91, 0x76, 0x78, 0xb2, + 0x73, 0xbe, 0xd6, 0xb8, 0xe3, 0xc1, 0x74, 0x3b, 0x71, 0x16, 0xe6, 0x9e, 0x22, 0x22, 0x95, 0x16, + 0x3f, 0xf1, 0xca, 0xa1, 0x68, 0x1f, 0xac, 0x09, 0x12, 0x0e, 0xca, 0x30, 0x75, 0x86, 0xe1, 0xa7 + } /* result */ + }, + + /* F.2.2 (decrypt) */ + { 1, 4 * AES_BLKLEN, 0, + { 0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6, 0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c }, /* AES key */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f }, /* Nonce */ + { 0x76, 0x49, 0xab, 0xac, 0x81, 0x19, 0xb2, 0x46, 0xce, 0xe9, 0x8e, 0x9b, 0x12, 0xe9, 0x19, 0x7d, + 0x50, 0x86, 0xcb, 0x9b, 0x50, 0x72, 0x19, 0xee, 0x95, 0xdb, 0x11, 0x3a, 0x91, 0x76, 0x78, 0xb2, + 0x73, 0xbe, 0xd6, 0xb8, 0xe3, 0xc1, 0x74, 0x3b, 0x71, 0x16, 0xe6, 0x9e, 0x22, 0x22, 0x95, 0x16, + 0x3f, 0xf1, 0xca, 0xa1, 0x68, 0x1f, 0xac, 0x09, 0x12, 0x0e, 0xca, 0x30, 0x75, 0x86, 0xe1, 0xa7 + }, /* msg */ + 4 * AES_BLKLEN, /* length of result */ + { 0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96, 0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a, + 0xae, 0x2d, 0x8a, 0x57, 0x1e, 0x03, 0xac, 0x9c, 0x9e, 0xb7, 0x6f, 0xac, 0x45, 0xaf, 0x8e, 0x51, + 0x30, 0xc8, 0x1c, 0x46, 0xa3, 0x5c, 0xe4, 0x11, 0xe5, 0xfb, 0xc1, 0x19, 0x1a, 0x0a, 0x52, 0xef, + 0xf6, 0x9f, 0x24, 0x45, 0xdf, 0x4f, 0x9b, 0x17, 0xad, 0x2b, 0x41, 0x7b, 0xe6, 0x6c, 0x37, 0x10 + } /* result */ + } +};
diff --git a/tests/ccm-test.c b/tests/ccm-test.c new file mode 100644 index 0000000..e26f43b --- /dev/null +++ b/tests/ccm-test.c
@@ -0,0 +1,97 @@ +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#ifdef HAVE_STRINGS_H +#include <strings.h> +#endif + +#ifdef WITH_CONTIKI +#include "contiki.h" +#include "contiki-lib.h" +#include "contiki-net.h" +#endif /* WITH_CONTIKI */ + +//#include "debug.h" +#include "dtls_config.h" +#include "numeric.h" +#include "ccm.h" + +#include "ccm-testdata.c" + +#ifndef HAVE_FLS +int fls(unsigned int i) { + int n; + for (n = 0; i; n++) + i >>= 1; + return n; +} +#endif + +void +dump(unsigned char *buf, size_t len) { + size_t i = 0; + while (i < len) { + printf("%02x ", buf[i++]); + if (i % 4 == 0) + printf(" "); + if (i % 16 == 0) + printf("\n\t"); + } + printf("\n"); +} + +#ifdef WITH_CONTIKI +PROCESS(ccm_test_process, "CCM test process"); +AUTOSTART_PROCESSES(&ccm_test_process); +PROCESS_THREAD(ccm_test_process, ev, d) +{ +#else /* WITH_CONTIKI */ +int main(int argc, char **argv) { +#endif /* WITH_CONTIKI */ + long int len; + int n; + + rijndael_ctx ctx; + +#ifdef WITH_CONTIKI + PROCESS_BEGIN(); +#endif /* WITH_CONTIKI */ + + for (n = 0; n < sizeof(data)/sizeof(struct test_vector); ++n) { + + if (rijndael_set_key_enc_only(&ctx, data[n].key, 8*sizeof(data[n].key)) < 0) { + fprintf(stderr, "cannot set key\n"); + return -1; + } + + len = dtls_ccm_encrypt_message(&ctx, data[n].M, data[n].L, data[n].nonce, + data[n].msg + data[n].la, + data[n].lm - data[n].la, + data[n].msg, data[n].la); + + len += + data[n].la; + printf("Packet Vector #%d ", n+1); + if (len != data[n].r_lm || memcmp(data[n].msg, data[n].result, len)) + printf("FAILED, "); + else + printf("OK, "); + + printf("result is (total length = %lu):\n\t", len); + dump(data[n].msg, len); + + len = dtls_ccm_decrypt_message(&ctx, data[n].M, data[n].L, data[n].nonce, + data[n].msg + data[n].la, len - data[n].la, + data[n].msg, data[n].la); + + if (len < 0) + printf("Packet Vector #%d: cannot decrypt message\n", n+1); + else + printf("\t*** MAC verified (total length = %lu) ***\n", len + data[n].la); + } + +#ifdef WITH_CONTIKI + PROCESS_END(); +#else /* WITH_CONTIKI */ + return 0; +#endif /* WITH_CONTIKI */ +}
diff --git a/tests/ccm-testdata.c b/tests/ccm-testdata.c new file mode 100644 index 0000000..f0da4ae --- /dev/null +++ b/tests/ccm-testdata.c
@@ -0,0 +1,395 @@ +/* dtls -- a very basic DTLS implementation + * + * Copyright (C) 2011 Olaf Bergmann <bergmann@tzi.org> + * + * Permission is hereby granted, free of charge, to any person + * obtaining a copy of this software and associated documentation + * files (the "Software"), to deal in the Software without + * restriction, including without limitation the rights to use, copy, + * modify, merge, publish, distribute, sublicense, and/or sell copies + * of the Software, and to permit persons to whom the Software is + * furnished to do so, subject to the following conditions: + * + * The above copyright notice and this permission notice shall be + * included in all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS + * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN + * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN + * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + * SOFTWARE. + */ + +/* test vectors from RFC 3610 */ + +struct test_vector { + size_t M, L; + size_t lm; /* overall message length */ + size_t la; /* number of bytes additional data */ + unsigned char key[DTLS_CCM_BLOCKSIZE]; + unsigned char nonce[DTLS_CCM_BLOCKSIZE]; + unsigned char msg[200]; + size_t r_lm; /* overall result length */ + unsigned char result[200]; /* result */ +}; + +struct test_vector data[] = { + /* #1 */ + { 8, 2, 31, 8, + { 0xC0, 0xC1, 0xC2, 0xC3, 0xC4, 0xC5, 0xC6, 0xC7, 0xC8, 0xC9, 0xCA, 0xCB, 0xCC, 0xCD, 0xCE, 0xCF}, /* AES key */ + { 0x00, 0x00, 0x00, 0x03, 0x02, 0x01, 0x00, 0xA0, 0xA1, 0xA2, 0xA3, 0xA4, 0xA5}, /* Nonce */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E}, /* msg */ + 39, /* length of result */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x58, 0x8C, 0x97, 0x9A, 0x61, 0xC6, 0x63, 0xD2, 0xF0, 0x66, 0xD0, 0xC2, 0xC0, 0xF9, 0x89, 0x80, 0x6D, 0x5F, 0x6B, 0x61, 0xDA, 0xC3, 0x84, 0x17, 0xE8, 0xD1, 0x2C, 0xFD, 0xF9, 0x26, 0xE0} /* result */ + }, + + /* #2 */ + { 8, 2, 32, 8, + { 0xC0, 0xC1, 0xC2, 0xC3, 0xC4, 0xC5, 0xC6, 0xC7, 0xC8, 0xC9, 0xCA, 0xCB, 0xCC, 0xCD, 0xCE, 0xCF}, /* AES key */ + { 0x00, 0x00, 0x00, 0x04, 0x03, 0x02, 0x01, 0xA0, 0xA1, 0xA2, 0xA3, 0xA4, 0xA5}, /* Nonce */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F}, /* msg */ + 40, /* length of result */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x72, 0xC9, 0x1A, 0x36, 0xE1, 0x35, 0xF8, 0xCF, 0x29, 0x1C, 0xA8, 0x94, 0x08, 0x5C, 0x87, 0xE3, 0xCC, 0x15, 0xC4, 0x39, 0xC9, 0xE4, 0x3A, 0x3B, 0xA0, 0x91, 0xD5, 0x6E, 0x10, 0x40, 0x09, 0x16} /* result */ + }, + + /* #3 */ + { 8, 2, 33, 8, + { 0xC0, 0xC1, 0xC2, 0xC3, 0xC4, 0xC5, 0xC6, 0xC7, 0xC8, 0xC9, 0xCA, 0xCB, 0xCC, 0xCD, 0xCE, 0xCF}, /* AES key */ + { 0x00, 0x00, 0x00, 0x05, 0x04, 0x03, 0x02, 0xA0, 0xA1, 0xA2, 0xA3, 0xA4, 0xA5}, /* Nonce */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20}, /* msg */ + 41, /* length of result */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x51, 0xB1, 0xE5, 0xF4, 0x4A, 0x19, 0x7D, 0x1D, 0xA4, 0x6B, 0x0F, 0x8E, 0x2D, 0x28, 0x2A, 0xE8, 0x71, 0xE8, 0x38, 0xBB, 0x64, 0xDA, 0x85, 0x96, 0x57, 0x4A, 0xDA, 0xA7, 0x6F, 0xBD, 0x9F, 0xB0, 0xC5} /* result */ + }, + + /* #4 */ + { 8, 2, 31, 12, + { 0xC0, 0xC1, 0xC2, 0xC3, 0xC4, 0xC5, 0xC6, 0xC7, 0xC8, 0xC9, 0xCA, 0xCB, 0xCC, 0xCD, 0xCE, 0xCF}, /* AES key */ + { 0x00, 0x00, 0x00, 0x06, 0x05, 0x04, 0x03, 0xA0, 0xA1, 0xA2, 0xA3, 0xA4, 0xA5}, /* Nonce */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E}, /* msg */ + 39, /* length of result */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0xA2, 0x8C, 0x68, 0x65, 0x93, 0x9A, 0x9A, 0x79, 0xFA, 0xAA, 0x5C, 0x4C, 0x2A, 0x9D, 0x4A, 0x91, 0xCD, 0xAC, 0x8C, 0x96, 0xC8, 0x61, 0xB9, 0xC9, 0xE6, 0x1E, 0xF1} /* result */ + }, + + /* #5 */ + { 8, 2, 32, 12, + { 0xC0, 0xC1, 0xC2, 0xC3, 0xC4, 0xC5, 0xC6, 0xC7, 0xC8, 0xC9, 0xCA, 0xCB, 0xCC, 0xCD, 0xCE, 0xCF}, /* AES key */ + { 0x00, 0x00, 0x00, 0x07, 0x06, 0x05, 0x04, 0xA0, 0xA1, 0xA2, 0xA3, 0xA4, 0xA5}, /* Nonce */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F}, /* msg */ + 40, /* length of result */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0xDC, 0xF1, 0xFB, 0x7B, 0x5D, 0x9E, 0x23, 0xFB, 0x9D, 0x4E, 0x13, 0x12, 0x53, 0x65, 0x8A, 0xD8, 0x6E, 0xBD, 0xCA, 0x3E, 0x51, 0xE8, 0x3F, 0x07, 0x7D, 0x9C, 0x2D, 0x93} /* result */ + }, + + /* #6 */ + { 8, 2, 33, 12, + { 0xC0, 0xC1, 0xC2, 0xC3, 0xC4, 0xC5, 0xC6, 0xC7, 0xC8, 0xC9, 0xCA, 0xCB, 0xCC, 0xCD, 0xCE, 0xCF}, /* AES key */ + { 0x00, 0x00, 0x00, 0x08, 0x07, 0x06, 0x05, 0xA0, 0xA1, 0xA2, 0xA3, 0xA4, 0xA5}, /* Nonce */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20}, /* msg */ + 41, /* length of result */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x6F, 0xC1, 0xB0, 0x11, 0xF0, 0x06, 0x56, 0x8B, 0x51, 0x71, 0xA4, 0x2D, 0x95, 0x3D, 0x46, 0x9B, 0x25, 0x70, 0xA4, 0xBD, 0x87, 0x40, 0x5A, 0x04, 0x43, 0xAC, 0x91, 0xCB, 0x94} /* result */ + }, + + /* #7 */ + { 10, 2, 31, 8, + { 0xC0, 0xC1, 0xC2, 0xC3, 0xC4, 0xC5, 0xC6, 0xC7, 0xC8, 0xC9, 0xCA, 0xCB, 0xCC, 0xCD, 0xCE, 0xCF}, /* AES key */ + { 0x00, 0x00, 0x00, 0x09, 0x08, 0x07, 0x06, 0xA0, 0xA1, 0xA2, 0xA3, 0xA4, 0xA5}, /* Nonce */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E}, /* msg */ + 41, /* length of result */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x01, 0x35, 0xD1, 0xB2, 0xC9, 0x5F, 0x41, 0xD5, 0xD1, 0xD4, 0xFE, 0xC1, 0x85, 0xD1, 0x66, 0xB8, 0x09, 0x4E, 0x99, 0x9D, 0xFE, 0xD9, 0x6C, 0x04, 0x8C, 0x56, 0x60, 0x2C, 0x97, 0xAC, 0xBB, 0x74, 0x90} /* result */ + }, + + /* #8 */ + { 10, 2, 32, 8, + { 0xC0, 0xC1, 0xC2, 0xC3, 0xC4, 0xC5, 0xC6, 0xC7, 0xC8, 0xC9, 0xCA, 0xCB, 0xCC, 0xCD, 0xCE, 0xCF}, /* AES key */ + { 0x00, 0x00, 0x00, 0x0A, 0x09, 0x08, 0x07, 0xA0, 0xA1, 0xA2, 0xA3, 0xA4, 0xA5}, /* Nonce */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F}, /* msg */ + 42, /* length of result */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x7B, 0x75, 0x39, 0x9A, 0xC0, 0x83, 0x1D, 0xD2, 0xF0, 0xBB, 0xD7, 0x58, 0x79, 0xA2, 0xFD, 0x8F, 0x6C, 0xAE, 0x6B, 0x6C, 0xD9, 0xB7, 0xDB, 0x24, 0xC1, 0x7B, 0x44, 0x33, 0xF4, 0x34, 0x96, 0x3F, 0x34, 0xB4} /* result */ + }, + + /* #9 */ + { 10, 2, 33, 8, + { 0xC0, 0xC1, 0xC2, 0xC3, 0xC4, 0xC5, 0xC6, 0xC7, 0xC8, 0xC9, 0xCA, 0xCB, 0xCC, 0xCD, 0xCE, 0xCF}, /* AES key */ + { 0x00, 0x00, 0x00, 0x0B, 0x0A, 0x09, 0x08, 0xA0, 0xA1, 0xA2, 0xA3, 0xA4, 0xA5}, /* Nonce */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20}, /* msg */ + 43, /* length of result */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x82, 0x53, 0x1A, 0x60, 0xCC, 0x24, 0x94, 0x5A, 0x4B, 0x82, 0x79, 0x18, 0x1A, 0xB5, 0xC8, 0x4D, 0xF2, 0x1C, 0xE7, 0xF9, 0xB7, 0x3F, 0x42, 0xE1, 0x97, 0xEA, 0x9C, 0x07, 0xE5, 0x6B, 0x5E, 0xB1, 0x7E, 0x5F, 0x4E} /* result */ + }, + + /* #10 */ + { 10, 2, 31, 12, + { 0xC0, 0xC1, 0xC2, 0xC3, 0xC4, 0xC5, 0xC6, 0xC7, 0xC8, 0xC9, 0xCA, 0xCB, 0xCC, 0xCD, 0xCE, 0xCF}, /* AES key */ + { 0x00, 0x00, 0x00, 0x0C, 0x0B, 0x0A, 0x09, 0xA0, 0xA1, 0xA2, 0xA3, 0xA4, 0xA5}, /* Nonce */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E}, /* msg */ + 41, /* length of result */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x07, 0x34, 0x25, 0x94, 0x15, 0x77, 0x85, 0x15, 0x2B, 0x07, 0x40, 0x98, 0x33, 0x0A, 0xBB, 0x14, 0x1B, 0x94, 0x7B, 0x56, 0x6A, 0xA9, 0x40, 0x6B, 0x4D, 0x99, 0x99, 0x88, 0xDD} /* result */ + }, + + /* #11 */ + { 10, 2, 32, 12, + { 0xC0, 0xC1, 0xC2, 0xC3, 0xC4, 0xC5, 0xC6, 0xC7, 0xC8, 0xC9, 0xCA, 0xCB, 0xCC, 0xCD, 0xCE, 0xCF}, /* AES key */ + { 0x00, 0x00, 0x00, 0x0D, 0x0C, 0x0B, 0x0A, 0xA0, 0xA1, 0xA2, 0xA3, 0xA4, 0xA5}, /* Nonce */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F}, /* msg */ + 42, /* length of result */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x67, 0x6B, 0xB2, 0x03, 0x80, 0xB0, 0xE3, 0x01, 0xE8, 0xAB, 0x79, 0x59, 0x0A, 0x39, 0x6D, 0xA7, 0x8B, 0x83, 0x49, 0x34, 0xF5, 0x3A, 0xA2, 0xE9, 0x10, 0x7A, 0x8B, 0x6C, 0x02, 0x2C} /* result */ + }, + + /* #12 */ + { 10, 2, 33, 12, + { 0xC0, 0xC1, 0xC2, 0xC3, 0xC4, 0xC5, 0xC6, 0xC7, 0xC8, 0xC9, 0xCA, 0xCB, 0xCC, 0xCD, 0xCE, 0xCF}, /* AES key */ + { 0x00, 0x00, 0x00, 0x0E, 0x0D, 0x0C, 0x0B, 0xA0, 0xA1, 0xA2, 0xA3, 0xA4, 0xA5}, /* Nonce */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20}, /* msg */ + 43, /* length of result */ + { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B, 0xC0, 0xFF, 0xA0, 0xD6, 0xF0, 0x5B, 0xDB, 0x67, 0xF2, 0x4D, 0x43, 0xA4, 0x33, 0x8D, 0x2A, 0xA4, 0xBE, 0xD7, 0xB2, 0x0E, 0x43, 0xCD, 0x1A, 0xA3, 0x16, 0x62, 0xE7, 0xAD, 0x65, 0xD6, 0xDB} /* result */ + }, + + /* #13 */ + { 8, 2, 31, 8, + { 0xD7, 0x82, 0x8D, 0x13, 0xB2, 0xB0, 0xBD, 0xC3, 0x25, 0xA7, 0x62, 0x36, 0xDF, 0x93, 0xCC, 0x6B}, /* AES key */ + { 0x00, 0x41, 0x2B, 0x4E, 0xA9, 0xCD, 0xBE, 0x3C, 0x96, 0x96, 0x76, 0x6C, 0xFA}, /* Nonce */ + { 0x0B, 0xE1, 0xA8, 0x8B, 0xAC, 0xE0, 0x18, 0xB1, 0x08, 0xE8, 0xCF, 0x97, 0xD8, 0x20, 0xEA, 0x25, 0x84, 0x60, 0xE9, 0x6A, 0xD9, 0xCF, 0x52, 0x89, 0x05, 0x4D, 0x89, 0x5C, 0xEA, 0xC4, 0x7C}, /* msg */ + 39, /* length of result */ + { 0x0B, 0xE1, 0xA8, 0x8B, 0xAC, 0xE0, 0x18, 0xB1, 0x4C, 0xB9, 0x7F, 0x86, 0xA2, 0xA4, 0x68, 0x9A, 0x87, 0x79, 0x47, 0xAB, 0x80, 0x91, 0xEF, 0x53, 0x86, 0xA6, 0xFF, 0xBD, 0xD0, 0x80, 0xF8, 0xE7, 0x8C, 0xF7, 0xCB, 0x0C, 0xDD, 0xD7, 0xB3} /* result */ + }, + + /* #14 */ + { 8, 2, 32, 8, + { 0xD7, 0x82, 0x8D, 0x13, 0xB2, 0xB0, 0xBD, 0xC3, 0x25, 0xA7, 0x62, 0x36, 0xDF, 0x93, 0xCC, 0x6B}, /* AES key */ + { 0x00, 0x33, 0x56, 0x8E, 0xF7, 0xB2, 0x63, 0x3C, 0x96, 0x96, 0x76, 0x6C, 0xFA}, /* Nonce */ + { 0x63, 0x01, 0x8F, 0x76, 0xDC, 0x8A, 0x1B, 0xCB, 0x90, 0x20, 0xEA, 0x6F, 0x91, 0xBD, 0xD8, 0x5A, 0xFA, 0x00, 0x39, 0xBA, 0x4B, 0xAF, 0xF9, 0xBF, 0xB7, 0x9C, 0x70, 0x28, 0x94, 0x9C, 0xD0, 0xEC}, /* msg */ + 40, /* length of result */ + { 0x63, 0x01, 0x8F, 0x76, 0xDC, 0x8A, 0x1B, 0xCB, 0x4C, 0xCB, 0x1E, 0x7C, 0xA9, 0x81, 0xBE, 0xFA, 0xA0, 0x72, 0x6C, 0x55, 0xD3, 0x78, 0x06, 0x12, 0x98, 0xC8, 0x5C, 0x92, 0x81, 0x4A, 0xBC, 0x33, 0xC5, 0x2E, 0xE8, 0x1D, 0x7D, 0x77, 0xC0, 0x8A} /* result */ + }, + + /* #15 */ + { 8, 2, 33, 8, + { 0xD7, 0x82, 0x8D, 0x13, 0xB2, 0xB0, 0xBD, 0xC3, 0x25, 0xA7, 0x62, 0x36, 0xDF, 0x93, 0xCC, 0x6B}, /* AES key */ + { 0x00, 0x10, 0x3F, 0xE4, 0x13, 0x36, 0x71, 0x3C, 0x96, 0x96, 0x76, 0x6C, 0xFA}, /* Nonce */ + { 0xAA, 0x6C, 0xFA, 0x36, 0xCA, 0xE8, 0x6B, 0x40, 0xB9, 0x16, 0xE0, 0xEA, 0xCC, 0x1C, 0x00, 0xD7, 0xDC, 0xEC, 0x68, 0xEC, 0x0B, 0x3B, 0xBB, 0x1A, 0x02, 0xDE, 0x8A, 0x2D, 0x1A, 0xA3, 0x46, 0x13, 0x2E}, /* msg */ + 41, /* length of result */ + { 0xAA, 0x6C, 0xFA, 0x36, 0xCA, 0xE8, 0x6B, 0x40, 0xB1, 0xD2, 0x3A, 0x22, 0x20, 0xDD, 0xC0, 0xAC, 0x90, 0x0D, 0x9A, 0xA0, 0x3C, 0x61, 0xFC, 0xF4, 0xA5, 0x59, 0xA4, 0x41, 0x77, 0x67, 0x08, 0x97, 0x08, 0xA7, 0x76, 0x79, 0x6E, 0xDB, 0x72, 0x35, 0x06} /* result */ + }, + + /* #16 */ + { 8, 2, 31, 12, + { 0xD7, 0x82, 0x8D, 0x13, 0xB2, 0xB0, 0xBD, 0xC3, 0x25, 0xA7, 0x62, 0x36, 0xDF, 0x93, 0xCC, 0x6B}, /* AES key */ + { 0x00, 0x76, 0x4C, 0x63, 0xB8, 0x05, 0x8E, 0x3C, 0x96, 0x96, 0x76, 0x6C, 0xFA}, /* Nonce */ + { 0xD0, 0xD0, 0x73, 0x5C, 0x53, 0x1E, 0x1B, 0xEC, 0xF0, 0x49, 0xC2, 0x44, 0x12, 0xDA, 0xAC, 0x56, 0x30, 0xEF, 0xA5, 0x39, 0x6F, 0x77, 0x0C, 0xE1, 0xA6, 0x6B, 0x21, 0xF7, 0xB2, 0x10, 0x1C}, /* msg */ + 39, /* length of result */ + { 0xD0, 0xD0, 0x73, 0x5C, 0x53, 0x1E, 0x1B, 0xEC, 0xF0, 0x49, 0xC2, 0x44, 0x14, 0xD2, 0x53, 0xC3, 0x96, 0x7B, 0x70, 0x60, 0x9B, 0x7C, 0xBB, 0x7C, 0x49, 0x91, 0x60, 0x28, 0x32, 0x45, 0x26, 0x9A, 0x6F, 0x49, 0x97, 0x5B, 0xCA, 0xDE, 0xAF} /* result */ + }, + + /* #17 */ + { 8, 2, 32, 12, + { 0xD7, 0x82, 0x8D, 0x13, 0xB2, 0xB0, 0xBD, 0xC3, 0x25, 0xA7, 0x62, 0x36, 0xDF, 0x93, 0xCC, 0x6B}, /* AES key */ + { 0x00, 0xF8, 0xB6, 0x78, 0x09, 0x4E, 0x3B, 0x3C, 0x96, 0x96, 0x76, 0x6C, 0xFA}, /* Nonce */ + { 0x77, 0xB6, 0x0F, 0x01, 0x1C, 0x03, 0xE1, 0x52, 0x58, 0x99, 0xBC, 0xAE, 0xE8, 0x8B, 0x6A, 0x46, 0xC7, 0x8D, 0x63, 0xE5, 0x2E, 0xB8, 0xC5, 0x46, 0xEF, 0xB5, 0xDE, 0x6F, 0x75, 0xE9, 0xCC, 0x0D}, /* msg */ + 40, /* length of result */ + { 0x77, 0xB6, 0x0F, 0x01, 0x1C, 0x03, 0xE1, 0x52, 0x58, 0x99, 0xBC, 0xAE, 0x55, 0x45, 0xFF, 0x1A, 0x08, 0x5E, 0xE2, 0xEF, 0xBF, 0x52, 0xB2, 0xE0, 0x4B, 0xEE, 0x1E, 0x23, 0x36, 0xC7, 0x3E, 0x3F, 0x76, 0x2C, 0x0C, 0x77, 0x44, 0xFE, 0x7E, 0x3C} /* result */ + }, + + /* #18 */ + { 8, 2, 33, 12, + { 0xD7, 0x82, 0x8D, 0x13, 0xB2, 0xB0, 0xBD, 0xC3, 0x25, 0xA7, 0x62, 0x36, 0xDF, 0x93, 0xCC, 0x6B}, /* AES key */ + { 0x00, 0xD5, 0x60, 0x91, 0x2D, 0x3F, 0x70, 0x3C, 0x96, 0x96, 0x76, 0x6C, 0xFA}, /* Nonce */ + { 0xCD, 0x90, 0x44, 0xD2, 0xB7, 0x1F, 0xDB, 0x81, 0x20, 0xEA, 0x60, 0xC0, 0x64, 0x35, 0xAC, 0xBA, 0xFB, 0x11, 0xA8, 0x2E, 0x2F, 0x07, 0x1D, 0x7C, 0xA4, 0xA5, 0xEB, 0xD9, 0x3A, 0x80, 0x3B, 0xA8, 0x7F}, /* msg */ + 41, /* length of result */ + { 0xCD, 0x90, 0x44, 0xD2, 0xB7, 0x1F, 0xDB, 0x81, 0x20, 0xEA, 0x60, 0xC0, 0x00, 0x97, 0x69, 0xEC, 0xAB, 0xDF, 0x48, 0x62, 0x55, 0x94, 0xC5, 0x92, 0x51, 0xE6, 0x03, 0x57, 0x22, 0x67, 0x5E, 0x04, 0xC8, 0x47, 0x09, 0x9E, 0x5A, 0xE0, 0x70, 0x45, 0x51} /* result */ + }, + + /* #19 */ + { 10, 2, 31, 8, + { 0xD7, 0x82, 0x8D, 0x13, 0xB2, 0xB0, 0xBD, 0xC3, 0x25, 0xA7, 0x62, 0x36, 0xDF, 0x93, 0xCC, 0x6B}, /* AES key */ + { 0x00, 0x42, 0xFF, 0xF8, 0xF1, 0x95, 0x1C, 0x3C, 0x96, 0x96, 0x76, 0x6C, 0xFA}, /* Nonce */ + { 0xD8, 0x5B, 0xC7, 0xE6, 0x9F, 0x94, 0x4F, 0xB8, 0x8A, 0x19, 0xB9, 0x50, 0xBC, 0xF7, 0x1A, 0x01, 0x8E, 0x5E, 0x67, 0x01, 0xC9, 0x17, 0x87, 0x65, 0x98, 0x09, 0xD6, 0x7D, 0xBE, 0xDD, 0x18}, /* msg */ + 41, /* length of result */ + { 0xD8, 0x5B, 0xC7, 0xE6, 0x9F, 0x94, 0x4F, 0xB8, 0xBC, 0x21, 0x8D, 0xAA, 0x94, 0x74, 0x27, 0xB6, 0xDB, 0x38, 0x6A, 0x99, 0xAC, 0x1A, 0xEF, 0x23, 0xAD, 0xE0, 0xB5, 0x29, 0x39, 0xCB, 0x6A, 0x63, 0x7C, 0xF9, 0xBE, 0xC2, 0x40, 0x88, 0x97, 0xC6, 0xBA} /* result */ + }, + + /* #20 */ + { 10, 2, 32, 8, + { 0xD7, 0x82, 0x8D, 0x13, 0xB2, 0xB0, 0xBD, 0xC3, 0x25, 0xA7, 0x62, 0x36, 0xDF, 0x93, 0xCC, 0x6B}, /* AES key */ + { 0x00, 0x92, 0x0F, 0x40, 0xE5, 0x6C, 0xDC, 0x3C, 0x96, 0x96, 0x76, 0x6C, 0xFA}, /* Nonce */ + { 0x74, 0xA0, 0xEB, 0xC9, 0x06, 0x9F, 0x5B, 0x37, 0x17, 0x61, 0x43, 0x3C, 0x37, 0xC5, 0xA3, 0x5F, 0xC1, 0xF3, 0x9F, 0x40, 0x63, 0x02, 0xEB, 0x90, 0x7C, 0x61, 0x63, 0xBE, 0x38, 0xC9, 0x84, 0x37}, /* msg */ + 42, /* length of result */ + { 0x74, 0xA0, 0xEB, 0xC9, 0x06, 0x9F, 0x5B, 0x37, 0x58, 0x10, 0xE6, 0xFD, 0x25, 0x87, 0x40, 0x22, 0xE8, 0x03, 0x61, 0xA4, 0x78, 0xE3, 0xE9, 0xCF, 0x48, 0x4A, 0xB0, 0x4F, 0x44, 0x7E, 0xFF, 0xF6, 0xF0, 0xA4, 0x77, 0xCC, 0x2F, 0xC9, 0xBF, 0x54, 0x89, 0x44} /* result */ + }, + + /* #21 */ + { 10, 2, 33, 8, + { 0xD7, 0x82, 0x8D, 0x13, 0xB2, 0xB0, 0xBD, 0xC3, 0x25, 0xA7, 0x62, 0x36, 0xDF, 0x93, 0xCC, 0x6B}, /* AES key */ + { 0x00, 0x27, 0xCA, 0x0C, 0x71, 0x20, 0xBC, 0x3C, 0x96, 0x96, 0x76, 0x6C, 0xFA}, /* Nonce */ + { 0x44, 0xA3, 0xAA, 0x3A, 0xAE, 0x64, 0x75, 0xCA, 0xA4, 0x34, 0xA8, 0xE5, 0x85, 0x00, 0xC6, 0xE4, 0x15, 0x30, 0x53, 0x88, 0x62, 0xD6, 0x86, 0xEA, 0x9E, 0x81, 0x30, 0x1B, 0x5A, 0xE4, 0x22, 0x6B, 0xFA}, /* msg */ + 43, /* length of result */ + { 0x44, 0xA3, 0xAA, 0x3A, 0xAE, 0x64, 0x75, 0xCA, 0xF2, 0xBE, 0xED, 0x7B, 0xC5, 0x09, 0x8E, 0x83, 0xFE, 0xB5, 0xB3, 0x16, 0x08, 0xF8, 0xE2, 0x9C, 0x38, 0x81, 0x9A, 0x89, 0xC8, 0xE7, 0x76, 0xF1, 0x54, 0x4D, 0x41, 0x51, 0xA4, 0xED, 0x3A, 0x8B, 0x87, 0xB9, 0xCE} /* result */ + }, + + /* #22 */ + { 10, 2, 31, 12, + { 0xD7, 0x82, 0x8D, 0x13, 0xB2, 0xB0, 0xBD, 0xC3, 0x25, 0xA7, 0x62, 0x36, 0xDF, 0x93, 0xCC, 0x6B}, /* AES key */ + { 0x00, 0x5B, 0x8C, 0xCB, 0xCD, 0x9A, 0xF8, 0x3C, 0x96, 0x96, 0x76, 0x6C, 0xFA}, /* Nonce */ + { 0xEC, 0x46, 0xBB, 0x63, 0xB0, 0x25, 0x20, 0xC3, 0x3C, 0x49, 0xFD, 0x70, 0xB9, 0x6B, 0x49, 0xE2, 0x1D, 0x62, 0x17, 0x41, 0x63, 0x28, 0x75, 0xDB, 0x7F, 0x6C, 0x92, 0x43, 0xD2, 0xD7, 0xC2}, /* msg */ + 41, /* length of result */ + { 0xEC, 0x46, 0xBB, 0x63, 0xB0, 0x25, 0x20, 0xC3, 0x3C, 0x49, 0xFD, 0x70, 0x31, 0xD7, 0x50, 0xA0, 0x9D, 0xA3, 0xED, 0x7F, 0xDD, 0xD4, 0x9A, 0x20, 0x32, 0xAA, 0xBF, 0x17, 0xEC, 0x8E, 0xBF, 0x7D, 0x22, 0xC8, 0x08, 0x8C, 0x66, 0x6B, 0xE5, 0xC1, 0x97} /* result */ + }, + + /* #23 */ + { 10, 2, 32, 12, + { 0xD7, 0x82, 0x8D, 0x13, 0xB2, 0xB0, 0xBD, 0xC3, 0x25, 0xA7, 0x62, 0x36, 0xDF, 0x93, 0xCC, 0x6B}, /* AES key */ + { 0x00, 0x3E, 0xBE, 0x94, 0x04, 0x4B, 0x9A, 0x3C, 0x96, 0x96, 0x76, 0x6C, 0xFA}, /* Nonce */ + { 0x47, 0xA6, 0x5A, 0xC7, 0x8B, 0x3D, 0x59, 0x42, 0x27, 0xE8, 0x5E, 0x71, 0xE2, 0xFC, 0xFB, 0xB8, 0x80, 0x44, 0x2C, 0x73, 0x1B, 0xF9, 0x51, 0x67, 0xC8, 0xFF, 0xD7, 0x89, 0x5E, 0x33, 0x70, 0x76}, /* msg */ + 42, /* length of result */ + { 0x47, 0xA6, 0x5A, 0xC7, 0x8B, 0x3D, 0x59, 0x42, 0x27, 0xE8, 0x5E, 0x71, 0xE8, 0x82, 0xF1, 0xDB, 0xD3, 0x8C, 0xE3, 0xED, 0xA7, 0xC2, 0x3F, 0x04, 0xDD, 0x65, 0x07, 0x1E, 0xB4, 0x13, 0x42, 0xAC, 0xDF, 0x7E, 0x00, 0xDC, 0xCE, 0xC7, 0xAE, 0x52, 0x98, 0x7D} /* result */ + }, + + /* #24 */ + { 10, 2, 33, 12, + { 0xD7, 0x82, 0x8D, 0x13, 0xB2, 0xB0, 0xBD, 0xC3, 0x25, 0xA7, 0x62, 0x36, 0xDF, 0x93, 0xCC, 0x6B}, /* AES key */ + { 0x00, 0x8D, 0x49, 0x3B, 0x30, 0xAE, 0x8B, 0x3C, 0x96, 0x96, 0x76, 0x6C, 0xFA}, /* Nonce */ + { 0x6E, 0x37, 0xA6, 0xEF, 0x54, 0x6D, 0x95, 0x5D, 0x34, 0xAB, 0x60, 0x59, 0xAB, 0xF2, 0x1C, 0x0B, 0x02, 0xFE, 0xB8, 0x8F, 0x85, 0x6D, 0xF4, 0xA3, 0x73, 0x81, 0xBC, 0xE3, 0xCC, 0x12, 0x85, 0x17, 0xD4}, /* msg */ + 43, /* length of result */ + { 0x6E, 0x37, 0xA6, 0xEF, 0x54, 0x6D, 0x95, 0x5D, 0x34, 0xAB, 0x60, 0x59, 0xF3, 0x29, 0x05, 0xB8, 0x8A, 0x64, 0x1B, 0x04, 0xB9, 0xC9, 0xFF, 0xB5, 0x8C, 0xC3, 0x90, 0x90, 0x0F, 0x3D, 0xA1, 0x2A, 0xB1, 0x6D, 0xCE, 0x9E, 0x82, 0xEF, 0xA1, 0x6D, 0xA6, 0x20, 0x59} /* result */ + }, + + /* #25 */ + /* Cipher: AES-128 M=16 L=2 K_LEN=1 N_LEN=13 K=0x00 N=0x00000000000000000000000000 */ + { 16, 2, 0, 0, + { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, /* AES key */ + { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, /* Nonce */ + { }, /* msg */ + 16, /* length of result */ + { 0x8b, 0x60, 0xab, 0xcd, 0x60, 0x43, 0x81, 0x0b, + 0xa3, 0x78, 0xa0, 0x1d, 0x4a, 0x29, 0x83, 0x0b + } /* result */ + }, + + /* #26 */ + /* Cipher: AES-128 M=16 L=2 K_LEN=1 N_LEN=13 K=0x00 N=0x00000000000000000000000000 */ + { 16, 2, 37, 0, + { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, /* AES key */ + { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00 }, /* Nonce */ + { 0x45, 0x69, 0x6e, 0x20, 0x6b, 0x6c, 0x65, 0x69, + 0x6e, 0x65, 0x72, 0x20, 0x54, 0x65, 0x78, 0x74, + 0x0a, 0x7a, 0x75, 0x6d, 0x20, 0x54, 0x65, 0x73, + 0x74, 0x65, 0x6e, 0x20, 0x76, 0x6f, 0x6e, 0x20, + 0x43, 0x43, 0x4d, 0x2e, 0x0a + }, /* msg */ + 53, /* length of result */ + { 0x90, 0x11, 0x9c, 0x2d, 0x6b, 0xf9, 0xe9, 0x05, + 0x3e, 0x0b, 0x44, 0x56, 0xca, 0xc8, 0xb6, 0x1a, + 0x00, 0x57, 0xa9, 0x8b, 0x6b, 0x69, 0x09, 0x7e, + 0x8e, 0x50, 0x50, 0x63, 0x50, 0x58, 0x0f, 0x78, + 0x75, 0x69, 0x6e, 0x9f, 0x3d, 0x63, 0x93, 0xe7, + 0x7a, 0x84, 0xe9, 0x9f, 0x11, 0x93, 0x95, 0xa0, + 0x9a, 0xef, 0x0d, 0xa0, 0xed + } /* result */ + }, + + /* #27 */ + /* Cipher: AES-128 M=8 L=5 K_LEN=16 N_LEN=10 K=0x001234567890abcdefdcaffeed3921ee N=0x00112233445566778899 */ + { 8, 5, 0, 0, + { 0x00, 0x12, 0x34, 0x56, 0x78, 0x90, 0xab, 0xcd, + 0xef, 0xdc, 0xaf, 0xfe, 0xed, 0x39, 0x21, 0xee }, /* AES key */ + { 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, + 0x88, 0x99 }, /* Nonce */ + { }, /* msg */ + 8, /* length of result */ + { 0xb1, 0x33, 0x51, 0xc8, 0xb3, 0xd5, 0x10, 0xa7 } /* result */ + }, + + /* #28 */ + /* Cipher: AES-128 M=8 L=5 K_LEN=16 N_LEN=10 K=0x001234567890abcdefdcaffeed3921ee N=0x00112233445566778899 */ + { 8, 5, 37, 0, + { 0x00, 0x12, 0x34, 0x56, 0x78, 0x90, 0xab, 0xcd, + 0xef, 0xdc, 0xaf, 0xfe, 0xed, 0x39, 0x21, 0xee }, /* AES key */ + { 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, + 0x88, 0x99 }, /* Nonce */ + { 0x45, 0x69, 0x6e, 0x20, 0x6b, 0x6c, 0x65, 0x69, + 0x6e, 0x65, 0x72, 0x20, 0x54, 0x65, 0x78, 0x74, + 0x0a, 0x7a, 0x75, 0x6d, 0x20, 0x54, 0x65, 0x73, + 0x74, 0x65, 0x6e, 0x20, 0x76, 0x6f, 0x6e, 0x20, + 0x43, 0x43, 0x4d, 0x2e, 0x0a + }, /* msg */ + 45, /* length of result */ + { 0x44, 0x7a, 0x82, 0x70, 0x1d, 0xd0, 0x35, 0x7b, + 0x68, 0xf7, 0x35, 0x4d, 0xbf, 0xd9, 0x16, 0x15, + 0x97, 0x41, 0x3d, 0x1e, 0x89, 0xc1, 0x25, 0xe7, + 0xd6, 0xa7, 0xde, 0x90, 0x1e, 0xf1, 0x69, 0x69, + 0x9f, 0xce, 0x40, 0xdc, 0xf0, 0xd1, 0x74, 0x53, + 0x2c, 0xa3, 0xb0, 0xcf, 0xb9 + } /* result */ + }, + + /* #29 */ + /* Cipher: AES-128 M=14 L=3 K_LEN=16 N_LEN=12 K=0x001234567890abcdefdcaffeed3921ee N=0x001122334455667788990000 */ + { 14, 3, 0, 0, + { 0x00, 0x12, 0x34, 0x56, 0x78, 0x90, 0xab, 0xcd, + 0xef, 0xdc, 0xaf, 0xfe, 0xed, 0x39, 0x21, 0xee }, /* AES key */ + { 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, + 0x88, 0x99, 0x00, 0x00 }, /* Nonce */ + { }, /* msg */ + 14, /* length of result */ + { 0xa4, 0x06, 0xa4, 0x23, 0x93, 0x3d, 0xa0, 0xca, + 0xb5, 0x90, 0xdb, 0x69, 0x69, 0x33 } /* result */ + }, + + /* #30 */ + /* Cipher: AES-128 M=14 L=3 K_LEN=16 N_LEN=12 K=0x001234567890abcdefdcaffeed3921ee N=0x001122334455667788990000 */ + { 14, 3, 37, 0, + { 0x00, 0x12, 0x34, 0x56, 0x78, 0x90, 0xab, 0xcd, + 0xef, 0xdc, 0xaf, 0xfe, 0xed, 0x39, 0x21, 0xee }, /* AES key */ + { 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, + 0x88, 0x99, 0x00, 0x00 }, /* Nonce */ + { 0x45, 0x69, 0x6e, 0x20, 0x6b, 0x6c, 0x65, 0x69, + 0x6e, 0x65, 0x72, 0x20, 0x54, 0x65, 0x78, 0x74, + 0x0a, 0x7a, 0x75, 0x6d, 0x20, 0x54, 0x65, 0x73, + 0x74, 0x65, 0x6e, 0x20, 0x76, 0x6f, 0x6e, 0x20, + 0x43, 0x43, 0x4d, 0x2e, 0x0a + }, /* msg */ + 51, + { 0x60, 0xaf, 0x87, 0x67, 0x4d, 0x9d, 0x54, 0x17, + 0x16, 0xc0, 0x29, 0x10, 0x7e, 0x3e, 0x34, 0x93, + 0x78, 0xe8, 0xd3, 0xc8, 0xc1, 0x03, 0x4f, 0xd6, + 0xf5, 0x3b, 0xaf, 0xd3, 0xf0, 0xd7, 0x0b, 0xdd, + 0x63, 0x93, 0xed, 0xf2, 0xb2, 0x72, 0xdc, 0xae, + 0x7c, 0xa0, 0x01, 0xdb, 0x56, 0x2a, 0x06, 0xb6, + 0xe9, 0xcf, 0x3c } /* result */ + }, + + /* #31 */ + /* Cipher: AES-128 M=8 L=5 K_LEN=6 N_LEN=10 K=0x11223344aabb N=0x00112233445566778899 */ + { 8, 5, 0, 0, + { 0x11, 0x22, 0x33, 0x44, 0xaa, 0xbb }, /* AES key */ + { 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, + 0x88, 0x99 }, /* Nonce */ + { }, /* msg */ + 8, + { 0x28, 0x15, 0xfe, 0x81, 0xdd, 0xc3, 0x79, 0x04 } /* result */ + }, + + /* #32 */ + /* Cipher: AES-128 M=8 L=5 K_LEN=6 N_LEN=10 K=0x11223344aabb N=0x00112233445566778899 */ + + { 8, 5, 37, 0, + { 0x11, 0x22, 0x33, 0x44, 0xaa, 0xbb }, /* AES key */ + { 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, + 0x88, 0x99 }, /* Nonce */ + { 0x45, 0x69, 0x6e, 0x20, 0x6b, 0x6c, 0x65, 0x69, + 0x6e, 0x65, 0x72, 0x20, 0x54, 0x65, 0x78, 0x74, + 0x0a, 0x7a, 0x75, 0x6d, 0x20, 0x54, 0x65, 0x73, + 0x74, 0x65, 0x6e, 0x20, 0x76, 0x6f, 0x6e, 0x20, + 0x43, 0x43, 0x4d, 0x2e, 0x0a + }, /* msg */ + 45, + { 0xdb, 0x31, 0x55, 0x9d, 0xab, 0x70, 0xdc, 0x62, + 0xd7, 0x76, 0x41, 0xb2, 0x14, 0x9e, 0x9c, 0x26, + 0x70, 0x61, 0xea, 0x36, 0xf8, 0x0e, 0xdf, 0x19, + 0xa6, 0xc7, 0x46, 0x3d, 0x5a, 0xc3, 0x0a, 0x73, + 0x14, 0x96, 0xa4, 0x84, 0x7f, 0x37, 0x55, 0x42, + 0xce, 0x7e, 0xf9, 0x3b, 0xe5 } /* result */ + } +};
diff --git a/tests/dsrv-test.c b/tests/dsrv-test.c new file mode 100644 index 0000000..e7b44a9 --- /dev/null +++ b/tests/dsrv-test.c
@@ -0,0 +1,108 @@ +#include <stdio.h> +#include <string.h> +#include <errno.h> +#include <netinet/in.h> +#include <sys/types.h> +#include <sys/socket.h> +#include <sys/time.h> + +#include "dsrv.h" + +void +handle_read(struct dsrv_context_t *ctx) { + int len; + static char buf[200]; + struct sockaddr_storage src; + socklen_t srclen = sizeof(src); + int fd = dsrv_get_fd(ctx, DSRV_READ); + + len = recvfrom(fd, buf, sizeof(buf), 0, + (struct sockaddr *)&src, &srclen); + + if (len < 0) { + perror("recvfrom"); + } else { + printf("read %d bytes: '%*s'\n", len, len, buf); + if (dsrv_sendto(ctx, (struct sockaddr *)&src, srclen, 0, buf, len) + == NULL) { + fprintf(stderr, "cannot add packet to sendqueue\n"); + } + } +} + +int +handle_write(struct dsrv_context_t *ctx) { + struct packet_t *p; + int fd = dsrv_get_fd(ctx, DSRV_WRITE); + int len; + + p = ctx->rq ? nq_peek(ctx->wq) : NULL; + + if (!p) + return -1; + + len = sendto(fd, p->buf, p->len, 0, p->raddr, p->rlen); + + if (len < 0) + perror("sendto"); + else + nq_pop(ctx->wq); + + return len; +} + +int main(int argc, char **argv) { + +#if 1 + struct sockaddr_in6 listen_addr = { AF_INET6, htons(20220), 0, IN6ADDR_ANY_INIT, 0 }; +#else + struct sockaddr_in listen_addr = { AF_INET, htons(20220), { htonl(0x7f000001) } }; +#endif + fd_set rfds, wfds; + struct timeval timeout; + struct dsrv_context_t *ctx; + int result; + + ctx = dsrv_new_context((struct sockaddr *)&listen_addr, sizeof(listen_addr), + 200,200); + + if (!ctx) { + fprintf(stderr, "E: cannot create server context\n"); + return -1; + } + + while (1) { + FD_ZERO(&rfds); + FD_ZERO(&wfds); + + dsrv_prepare(ctx, &rfds, DSRV_READ); + dsrv_prepare(ctx, &wfds, DSRV_WRITE); + +#if 0 + timeout.tv_sec = 0; + timeout.tv_usec = dsrv_get_timeout(ctx); +#else + timeout.tv_sec = 5; + timeout.tv_usec = 0; +#endif + + result = select( FD_SETSIZE, &rfds, &wfds, 0, &timeout); + + if (result < 0) { /* error */ + if (errno != EINTR) + perror("select"); + } else if (result == 0) { /* timeout */ + printf("."); + } else { /* ok */ + if (dsrv_check(ctx, &wfds, DSRV_WRITE)) + handle_write(ctx); + else if (dsrv_check(ctx, &rfds, DSRV_READ)) + handle_read(ctx); + } + } + + dsrv_close(ctx); + dsrv_free_context(ctx); + + return 0; +}
diff --git a/tests/dtls-client.c b/tests/dtls-client.c new file mode 100644 index 0000000..9bee934 --- /dev/null +++ b/tests/dtls-client.c
@@ -0,0 +1,530 @@ +#include "tinydtls.h" + +/* This is needed for apple */ +#define __APPLE_USE_RFC_3542 + +#include <stdio.h> +#include <string.h> +#include <errno.h> +#include <unistd.h> +#include <ctype.h> +#include <netinet/in.h> +#include <sys/types.h> +#include <sys/socket.h> +#include <sys/time.h> +#include <arpa/inet.h> +#include <netdb.h> +#include <signal.h> + +#include "global.h" +#include "debug.h" +#include "dtls.h" + +#define DEFAULT_PORT 20220 + +#define PSK_DEFAULT_IDENTITY "Client_identity" +#define PSK_DEFAULT_KEY "secretPSK" +#define PSK_OPTIONS "i:k:" + +#ifdef __GNUC__ +#define UNUSED_PARAM __attribute__((unused)) +#else +#define UNUSED_PARAM +#endif /* __GNUC__ */ + +static char buf[200]; +static size_t len = 0; + +typedef struct { + size_t length; /* length of string */ + unsigned char *s; /* string data */ +} dtls_str; + +static dtls_str output_file = { 0, NULL }; /* output file name */ + +static dtls_context_t *dtls_context = NULL; +static dtls_context_t *orig_dtls_context = NULL; + + +static const unsigned char ecdsa_priv_key[] = { + 0x41, 0xC1, 0xCB, 0x6B, 0x51, 0x24, 0x7A, 0x14, + 0x43, 0x21, 0x43, 0x5B, 0x7A, 0x80, 0xE7, 0x14, + 0x89, 0x6A, 0x33, 0xBB, 0xAD, 0x72, 0x94, 0xCA, + 0x40, 0x14, 0x55, 0xA1, 0x94, 0xA9, 0x49, 0xFA}; + +static const unsigned char ecdsa_pub_key_x[] = { + 0x36, 0xDF, 0xE2, 0xC6, 0xF9, 0xF2, 0xED, 0x29, + 0xDA, 0x0A, 0x9A, 0x8F, 0x62, 0x68, 0x4E, 0x91, + 0x63, 0x75, 0xBA, 0x10, 0x30, 0x0C, 0x28, 0xC5, + 0xE4, 0x7C, 0xFB, 0xF2, 0x5F, 0xA5, 0x8F, 0x52}; + +static const unsigned char ecdsa_pub_key_y[] = { + 0x71, 0xA0, 0xD4, 0xFC, 0xDE, 0x1A, 0xB8, 0x78, + 0x5A, 0x3C, 0x78, 0x69, 0x35, 0xA7, 0xCF, 0xAB, + 0xE9, 0x3F, 0x98, 0x72, 0x09, 0xDA, 0xED, 0x0B, + 0x4F, 0xAB, 0xC3, 0x6F, 0xC7, 0x72, 0xF8, 0x29}; + +#ifdef DTLS_PSK +ssize_t +read_from_file(char *arg, unsigned char *buf, size_t max_buf_len) { + FILE *f; + ssize_t result = 0; + + f = fopen(arg, "r"); + if (f == NULL) + return -1; + + while (!feof(f)) { + size_t bytes_read; + bytes_read = fread(buf, 1, max_buf_len, f); + if (ferror(f)) { + result = -1; + break; + } + + buf += bytes_read; + result += bytes_read; + max_buf_len -= bytes_read; + } + + fclose(f); + return result; +} + +/* The PSK information for DTLS */ +#define PSK_ID_MAXLEN 256 +#define PSK_MAXLEN 256 +static unsigned char psk_id[PSK_ID_MAXLEN]; +static size_t psk_id_length = 0; +static unsigned char psk_key[PSK_MAXLEN]; +static size_t psk_key_length = 0; + +/* This function is the "key store" for tinyDTLS. It is called to + * retrieve a key for the given identity within this particular + * session. */ +static int +get_psk_info(struct dtls_context_t *ctx UNUSED_PARAM, + const session_t *session UNUSED_PARAM, + dtls_credentials_type_t type, + const unsigned char *id, size_t id_len, + unsigned char *result, size_t result_length) { + + switch (type) { + case DTLS_PSK_IDENTITY: + if (id_len) { + dtls_debug("got psk_identity_hint: '%.*s'\n", id_len, id); + } + + if (result_length < psk_id_length) { + dtls_warn("cannot set psk_identity -- buffer too small\n"); + return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR); + } + + memcpy(result, psk_id, psk_id_length); + return psk_id_length; + case DTLS_PSK_KEY: + if (id_len != psk_id_length || memcmp(psk_id, id, id_len) != 0) { + dtls_warn("PSK for unknown id requested, exiting\n"); + return dtls_alert_fatal_create(DTLS_ALERT_ILLEGAL_PARAMETER); + } else if (result_length < psk_key_length) { + dtls_warn("cannot set psk -- buffer too small\n"); + return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR); + } + + memcpy(result, psk_key, psk_key_length); + return psk_key_length; + default: + dtls_warn("unsupported request type: %d\n", type); + } + + return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR); +} +#endif /* DTLS_PSK */ + +#ifdef DTLS_ECC +static int +get_ecdsa_key(struct dtls_context_t *ctx, + const session_t *session, + const dtls_ecdsa_key_t **result) { + static const dtls_ecdsa_key_t ecdsa_key = { + .curve = DTLS_ECDH_CURVE_SECP256R1, + .priv_key = ecdsa_priv_key, + .pub_key_x = ecdsa_pub_key_x, + .pub_key_y = ecdsa_pub_key_y + }; + + *result = &ecdsa_key; + return 0; +} + +static int +verify_ecdsa_key(struct dtls_context_t *ctx, + const session_t *session, + const unsigned char *other_pub_x, + const unsigned char *other_pub_y, + size_t key_size) { + return 0; +} +#endif /* DTLS_ECC */ + +static void +try_send(struct dtls_context_t *ctx, session_t *dst) { + int res; + res = dtls_write(ctx, dst, (uint8 *)buf, len); + if (res >= 0) { + memmove(buf, buf + res, len - res); + len -= res; + } +} + +static void +handle_stdin() { + if (fgets(buf + len, sizeof(buf) - len, stdin)) + len += strlen(buf + len); +} + +static int +read_from_peer(struct dtls_context_t *ctx, + session_t *session, uint8 *data, size_t len) { + size_t i; + for (i = 0; i < len; i++) + printf("%c", data[i]); + return 0; +} + +static int +send_to_peer(struct dtls_context_t *ctx, + session_t *session, uint8 *data, size_t len) { + + int fd = *(int *)dtls_get_app_data(ctx); + return sendto(fd, data, len, MSG_DONTWAIT, + &session->addr.sa, session->size); +} + +static int +dtls_handle_read(struct dtls_context_t *ctx) { + int fd; + session_t session; +#define MAX_READ_BUF 2000 + static uint8 buf[MAX_READ_BUF]; + int len; + + fd = *(int *)dtls_get_app_data(ctx); + + if (!fd) + return -1; + + memset(&session, 0, sizeof(session_t)); + session.size = sizeof(session.addr); + len = recvfrom(fd, buf, MAX_READ_BUF, 0, + &session.addr.sa, &session.size); + + if (len < 0) { + perror("recvfrom"); + return -1; + } else { + dtls_dsrv_log_addr(DTLS_LOG_DEBUG, "peer", &session); + dtls_debug_dump("bytes from peer", buf, len); + } + + return dtls_handle_message(ctx, &session, buf, len); +} + +static void dtls_handle_signal(int sig) +{ + dtls_free_context(dtls_context); + dtls_free_context(orig_dtls_context); + signal(sig, SIG_DFL); + kill(getpid(), sig); +} + +/* stolen from libcoap: */ +static int +resolve_address(const char *server, struct sockaddr *dst) { + + struct addrinfo *res, *ainfo; + struct addrinfo hints; + static char addrstr[256]; + int error; + + memset(addrstr, 0, sizeof(addrstr)); + if (server && strlen(server) > 0) + memcpy(addrstr, server, strlen(server)); + else + memcpy(addrstr, "localhost", 9); + + memset ((char *)&hints, 0, sizeof(hints)); + hints.ai_socktype = SOCK_DGRAM; + hints.ai_family = AF_UNSPEC; + + error = getaddrinfo(addrstr, "", &hints, &res); + + if (error != 0) { + fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(error)); + return error; + } + + for (ainfo = res; ainfo != NULL; ainfo = ainfo->ai_next) { + + switch (ainfo->ai_family) { + case AF_INET6: + case AF_INET: + + memcpy(dst, ainfo->ai_addr, ainfo->ai_addrlen); + return ainfo->ai_addrlen; + default: + ; + } + } + + freeaddrinfo(res); + return -1; +} + +/*---------------------------------------------------------------------------*/ +static void +usage( const char *program, const char *version) { + const char *p; + + p = strrchr( program, '/' ); + if ( p ) + program = ++p; + + fprintf(stderr, "%s v%s -- DTLS client implementation\n" + "(c) 2011-2014 Olaf Bergmann <bergmann@tzi.org>\n\n" +#ifdef DTLS_PSK + "usage: %s [-i file] [-k file] [-o file] [-p port] [-v num] addr [port]\n" +#else /* DTLS_PSK */ + "usage: %s [-o file] [-p port] [-v num] addr [port]\n" +#endif /* DTLS_PSK */ +#ifdef DTLS_PSK + "\t-i file\t\tread PSK identity from file\n" + "\t-k file\t\tread pre-shared key from file\n" +#endif /* DTLS_PSK */ + "\t-o file\t\toutput received data to this file (use '-' for STDOUT)\n" + "\t-p port\t\tlisten on specified port (default is %d)\n" + "\t-v num\t\tverbosity level (default: 3)\n", + program, version, program, DEFAULT_PORT); +} + +static dtls_handler_t cb = { + .write = send_to_peer, + .read = read_from_peer, + .event = NULL, +#ifdef DTLS_PSK + .get_psk_info = get_psk_info, +#endif /* DTLS_PSK */ +#ifdef DTLS_ECC + .get_ecdsa_key = get_ecdsa_key, + .verify_ecdsa_key = verify_ecdsa_key +#endif /* DTLS_ECC */ +}; + +#define DTLS_CLIENT_CMD_CLOSE "client:close" +#define DTLS_CLIENT_CMD_RENEGOTIATE "client:renegotiate" + +/* As per RFC 6347 section 4.2.8, DTLS Server should support requests + * from clients who have silently abandoned the existing association + * and initiated a new handshake request by sending a ClientHello. + * Below command tests this feature. + */ +#define DTLS_CLIENT_CMD_REHANDSHAKE "client:rehandshake" + +int +main(int argc, char **argv) { + fd_set rfds, wfds; + struct timeval timeout; + unsigned short port = DEFAULT_PORT; + char port_str[NI_MAXSERV] = "0"; + log_t log_level = DTLS_LOG_WARN; + int fd, result; + int on = 1; + int opt, res; + session_t dst; + + dtls_init(); + snprintf(port_str, sizeof(port_str), "%d", port); + +#ifdef DTLS_PSK + psk_id_length = strlen(PSK_DEFAULT_IDENTITY); + psk_key_length = strlen(PSK_DEFAULT_KEY); + memcpy(psk_id, PSK_DEFAULT_IDENTITY, psk_id_length); + memcpy(psk_key, PSK_DEFAULT_KEY, psk_key_length); +#endif /* DTLS_PSK */ + + while ((opt = getopt(argc, argv, "p:o:v:" PSK_OPTIONS)) != -1) { + switch (opt) { +#ifdef DTLS_PSK + case 'i' : { + ssize_t result = read_from_file(optarg, psk_id, PSK_ID_MAXLEN); + if (result < 0) { + dtls_warn("cannot read PSK identity\n"); + } else { + psk_id_length = result; + } + break; + } + case 'k' : { + ssize_t result = read_from_file(optarg, psk_key, PSK_MAXLEN); + if (result < 0) { + dtls_warn("cannot read PSK\n"); + } else { + psk_key_length = result; + } + break; + } +#endif /* DTLS_PSK */ + case 'p' : + strncpy(port_str, optarg, NI_MAXSERV-1); + port_str[NI_MAXSERV - 1] = '\0'; + break; + case 'o' : + output_file.length = strlen(optarg); + output_file.s = (unsigned char *)malloc(output_file.length + 1); + + if (!output_file.s) { + dtls_crit("cannot set output file: insufficient memory\n"); + exit(-1); + } else { + /* copy filename including trailing zero */ + memcpy(output_file.s, optarg, output_file.length + 1); + } + break; + case 'v' : + log_level = strtol(optarg, NULL, 10); + break; + default: + usage(argv[0], dtls_package_version()); + exit(1); + } + } + + dtls_set_log_level(log_level); + + if (argc <= optind) { + usage(argv[0], dtls_package_version()); + exit(1); + } + + memset(&dst, 0, sizeof(session_t)); + /* resolve destination address where server should be sent */ + res = resolve_address(argv[optind++], &dst.addr.sa); + if (res < 0) { + dtls_emerg("failed to resolve address\n"); + exit(-1); + } + dst.size = res; + + /* use port number from command line when specified or the listen + port, otherwise */ + dst.addr.sin.sin_port = htons(atoi(optind < argc ? argv[optind++] : port_str)); + + + /* init socket and set it to non-blocking */ + fd = socket(dst.addr.sa.sa_family, SOCK_DGRAM, 0); + + if (fd < 0) { + dtls_alert("socket: %s\n", strerror(errno)); + return 0; + } + + if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on) ) < 0) { + dtls_alert("setsockopt SO_REUSEADDR: %s\n", strerror(errno)); + } +#if 0 + flags = fcntl(fd, F_GETFL, 0); + if (flags < 0 || fcntl(fd, F_SETFL, flags | O_NONBLOCK) < 0) { + dtls_alert("fcntl: %s\n", strerror(errno)); + goto error; + } +#endif + on = 1; +#ifdef IPV6_RECVPKTINFO + if (setsockopt(fd, IPPROTO_IPV6, IPV6_RECVPKTINFO, &on, sizeof(on) ) < 0) { +#else /* IPV6_RECVPKTINFO */ + if (setsockopt(fd, IPPROTO_IPV6, IPV6_PKTINFO, &on, sizeof(on) ) < 0) { +#endif /* IPV6_RECVPKTINFO */ + dtls_alert("setsockopt IPV6_PKTINFO: %s\n", strerror(errno)); + } + + if (signal(SIGINT, dtls_handle_signal) == SIG_ERR) { + dtls_alert("An error occurred while setting a signal handler.\n"); + return EXIT_FAILURE; + } + + dtls_context = dtls_new_context(&fd); + if (!dtls_context) { + dtls_emerg("cannot create context\n"); + exit(-1); + } + + dtls_set_handler(dtls_context, &cb); + + dtls_connect(dtls_context, &dst); + + while (1) { + FD_ZERO(&rfds); + FD_ZERO(&wfds); + + FD_SET(fileno(stdin), &rfds); + FD_SET(fd, &rfds); + /* FD_SET(fd, &wfds); */ + + timeout.tv_sec = 5; + timeout.tv_usec = 0; + + result = select(fd+1, &rfds, &wfds, 0, &timeout); + + if (result < 0) { /* error */ + if (errno != EINTR) + perror("select"); + } else if (result == 0) { /* timeout */ + } else { /* ok */ + if (FD_ISSET(fd, &wfds)) + /* FIXME */; + else if (FD_ISSET(fd, &rfds)) + dtls_handle_read(dtls_context); + else if (FD_ISSET(fileno(stdin), &rfds)) + handle_stdin(); + } + + if (len) { + if (len >= strlen(DTLS_CLIENT_CMD_CLOSE) && + !memcmp(buf, DTLS_CLIENT_CMD_CLOSE, strlen(DTLS_CLIENT_CMD_CLOSE))) { + printf("client: closing connection\n"); + dtls_close(dtls_context, &dst); + len = 0; + } else if (len >= strlen(DTLS_CLIENT_CMD_RENEGOTIATE) && + !memcmp(buf, DTLS_CLIENT_CMD_RENEGOTIATE, strlen(DTLS_CLIENT_CMD_RENEGOTIATE))) { + printf("client: renegotiate connection\n"); + dtls_renegotiate(dtls_context, &dst); + len = 0; + } else if (len >= strlen(DTLS_CLIENT_CMD_REHANDSHAKE) && + !memcmp(buf, DTLS_CLIENT_CMD_REHANDSHAKE, strlen(DTLS_CLIENT_CMD_REHANDSHAKE))) { + printf("client: rehandshake connection\n"); + if (orig_dtls_context == NULL) { + /* Cache the current context. We cannot free the current context as it will notify + * the Server to close the connection (which we do not want). + */ + orig_dtls_context = dtls_context; + /* Now, Create a new context and attempt to initiate a handshake. */ + dtls_context = dtls_new_context(&fd); + if (!dtls_context) { + dtls_emerg("cannot create context\n"); + exit(-1); + } + dtls_set_handler(dtls_context, &cb); + dtls_connect(dtls_context, &dst); + } + len = 0; + } else { + try_send(dtls_context, &dst); + } + } + } + + dtls_free_context(dtls_context); + dtls_free_context(orig_dtls_context); + exit(0); +} +
diff --git a/tests/dtls-server.c b/tests/dtls-server.c new file mode 100644 index 0000000..3f030b1 --- /dev/null +++ b/tests/dtls-server.c
@@ -0,0 +1,366 @@ + +/* This is needed for apple */ +#define __APPLE_USE_RFC_3542 + +#include <assert.h> +#include <stdio.h> +#include <string.h> +#include <errno.h> +#include <unistd.h> +#include <netinet/in.h> +#include <sys/types.h> +#include <sys/socket.h> +#include <sys/time.h> +#include <netdb.h> +#include <signal.h> + +#include "tinydtls.h" +#include "dtls.h" +#include "debug.h" + +#define DEFAULT_PORT 20220 + +static const unsigned char ecdsa_priv_key[] = { + 0xD9, 0xE2, 0x70, 0x7A, 0x72, 0xDA, 0x6A, 0x05, + 0x04, 0x99, 0x5C, 0x86, 0xED, 0xDB, 0xE3, 0xEF, + 0xC7, 0xF1, 0xCD, 0x74, 0x83, 0x8F, 0x75, 0x70, + 0xC8, 0x07, 0x2D, 0x0A, 0x76, 0x26, 0x1B, 0xD4}; + +static const unsigned char ecdsa_pub_key_x[] = { + 0xD0, 0x55, 0xEE, 0x14, 0x08, 0x4D, 0x6E, 0x06, + 0x15, 0x59, 0x9D, 0xB5, 0x83, 0x91, 0x3E, 0x4A, + 0x3E, 0x45, 0x26, 0xA2, 0x70, 0x4D, 0x61, 0xF2, + 0x7A, 0x4C, 0xCF, 0xBA, 0x97, 0x58, 0xEF, 0x9A}; + +static const unsigned char ecdsa_pub_key_y[] = { + 0xB4, 0x18, 0xB6, 0x4A, 0xFE, 0x80, 0x30, 0xDA, + 0x1D, 0xDC, 0xF4, 0xF4, 0x2E, 0x2F, 0x26, 0x31, + 0xD0, 0x43, 0xB1, 0xFB, 0x03, 0xE2, 0x2F, 0x4D, + 0x17, 0xDE, 0x43, 0xF9, 0xF9, 0xAD, 0xEE, 0x70}; + +#if 0 +/* SIGINT handler: set quit to 1 for graceful termination */ +void +handle_sigint(int signum) { + dsrv_stop(dsrv_get_context()); +} +#endif + +#ifdef DTLS_PSK +/* This function is the "key store" for tinyDTLS. It is called to + * retrieve a key for the given identity within this particular + * session. */ +static int +get_psk_info(struct dtls_context_t *ctx, const session_t *session, + dtls_credentials_type_t type, + const unsigned char *id, size_t id_len, + unsigned char *result, size_t result_length) { + + struct keymap_t { + unsigned char *id; + size_t id_length; + unsigned char *key; + size_t key_length; + } psk[3] = { + { (unsigned char *)"Client_identity", 15, + (unsigned char *)"secretPSK", 9 }, + { (unsigned char *)"default identity", 16, + (unsigned char *)"\x11\x22\x33", 3 }, + { (unsigned char *)"\0", 2, + (unsigned char *)"", 1 } + }; + + if (type != DTLS_PSK_KEY) { + return 0; + } + + if (id) { + int i; + for (i = 0; i < sizeof(psk)/sizeof(struct keymap_t); i++) { + if (id_len == psk[i].id_length && memcmp(id, psk[i].id, id_len) == 0) { + if (result_length < psk[i].key_length) { + dtls_warn("buffer too small for PSK"); + return dtls_alert_fatal_create(DTLS_ALERT_INTERNAL_ERROR); + } + + memcpy(result, psk[i].key, psk[i].key_length); + return psk[i].key_length; + } + } + } + + return dtls_alert_fatal_create(DTLS_ALERT_DECRYPT_ERROR); +} + +#endif /* DTLS_PSK */ + +#ifdef DTLS_ECC +static int +get_ecdsa_key(struct dtls_context_t *ctx, + const session_t *session, + const dtls_ecdsa_key_t **result) { + static const dtls_ecdsa_key_t ecdsa_key = { + .curve = DTLS_ECDH_CURVE_SECP256R1, + .priv_key = ecdsa_priv_key, + .pub_key_x = ecdsa_pub_key_x, + .pub_key_y = ecdsa_pub_key_y + }; + + *result = &ecdsa_key; + return 0; +} + +static int +verify_ecdsa_key(struct dtls_context_t *ctx, + const session_t *session, + const unsigned char *other_pub_x, + const unsigned char *other_pub_y, + size_t key_size) { + return 0; +} +#endif /* DTLS_ECC */ + +#define DTLS_SERVER_CMD_CLOSE "server:close" +#define DTLS_SERVER_CMD_RENEGOTIATE "server:renegotiate" + +static int +read_from_peer(struct dtls_context_t *ctx, + session_t *session, uint8 *data, size_t len) { + size_t i; + for (i = 0; i < len; i++) + printf("%c", data[i]); + if (len >= strlen(DTLS_SERVER_CMD_CLOSE) && + !memcmp(data, DTLS_SERVER_CMD_CLOSE, strlen(DTLS_SERVER_CMD_CLOSE))) { + printf("server: closing connection\n"); + dtls_close(ctx, session); + return len; + } else if (len >= strlen(DTLS_SERVER_CMD_RENEGOTIATE) && + !memcmp(data, DTLS_SERVER_CMD_RENEGOTIATE, strlen(DTLS_SERVER_CMD_RENEGOTIATE))) { + printf("server: renegotiate connection\n"); + dtls_renegotiate(ctx, session); + return len; + } + + return dtls_write(ctx, session, data, len); +} + +static int +send_to_peer(struct dtls_context_t *ctx, + session_t *session, uint8 *data, size_t len) { + + int fd = *(int *)dtls_get_app_data(ctx); + return sendto(fd, data, len, MSG_DONTWAIT, + &session->addr.sa, session->size); +} + +static int +dtls_handle_read(struct dtls_context_t *ctx) { + int *fd; + session_t session; + static uint8 buf[DTLS_MAX_BUF]; + int len; + + fd = dtls_get_app_data(ctx); + + assert(fd); + + memset(&session, 0, sizeof(session_t)); + session.size = sizeof(session.addr); + len = recvfrom(*fd, buf, sizeof(buf), MSG_TRUNC, + &session.addr.sa, &session.size); + + if (len < 0) { + perror("recvfrom"); + return -1; + } else { + dtls_debug("got %d bytes from port %d\n", len, + ntohs(session.addr.sin6.sin6_port)); + if (sizeof(buf) < len) { + dtls_warn("packet was truncated (%d bytes lost)\n", len - sizeof(buf)); + } + } + + return dtls_handle_message(ctx, &session, buf, len); +} + +static int +resolve_address(const char *server, struct sockaddr *dst) { + + struct addrinfo *res, *ainfo; + struct addrinfo hints; + static char addrstr[256]; + int error; + + memset(addrstr, 0, sizeof(addrstr)); + if (server && strlen(server) > 0) + memcpy(addrstr, server, strlen(server)); + else + memcpy(addrstr, "localhost", 9); + + memset ((char *)&hints, 0, sizeof(hints)); + hints.ai_socktype = SOCK_DGRAM; + hints.ai_family = AF_UNSPEC; + + error = getaddrinfo(addrstr, "", &hints, &res); + + if (error != 0) { + fprintf(stderr, "getaddrinfo: %s\n", gai_strerror(error)); + return error; + } + + for (ainfo = res; ainfo != NULL; ainfo = ainfo->ai_next) { + + switch (ainfo->ai_family) { + case AF_INET6: + + memcpy(dst, ainfo->ai_addr, ainfo->ai_addrlen); + return ainfo->ai_addrlen; + default: + ; + } + } + + freeaddrinfo(res); + return -1; +} + +static void +usage(const char *program, const char *version) { + const char *p; + + p = strrchr( program, '/' ); + if ( p ) + program = ++p; + + fprintf(stderr, "%s v%s -- DTLS server implementation\n" + "(c) 2011-2014 Olaf Bergmann <bergmann@tzi.org>\n\n" + "usage: %s [-A address] [-p port] [-v num]\n" + "\t-A address\t\tlisten on specified address (default is ::)\n" + "\t-p port\t\tlisten on specified port (default is %d)\n" + "\t-v num\t\tverbosity level (default: 3)\n", + program, version, program, DEFAULT_PORT); +} + +static dtls_handler_t cb = { + .write = send_to_peer, + .read = read_from_peer, + .event = NULL, +#ifdef DTLS_PSK + .get_psk_info = get_psk_info, +#endif /* DTLS_PSK */ +#ifdef DTLS_ECC + .get_ecdsa_key = get_ecdsa_key, + .verify_ecdsa_key = verify_ecdsa_key +#endif /* DTLS_ECC */ +}; + +int +main(int argc, char **argv) { + dtls_context_t *the_context = NULL; + log_t log_level = DTLS_LOG_WARN; + fd_set rfds, wfds; + struct timeval timeout; + int fd, opt, result; + int on = 1; + struct sockaddr_in6 listen_addr; + + memset(&listen_addr, 0, sizeof(struct sockaddr_in6)); + + /* fill extra field for 4.4BSD-based systems (see RFC 3493, section 3.4) */ +#if defined(SIN6_LEN) || defined(HAVE_SOCKADDR_IN6_SIN6_LEN) + listen_addr.sin6_len = sizeof(struct sockaddr_in6); +#endif + + listen_addr.sin6_family = AF_INET6; + listen_addr.sin6_port = htons(DEFAULT_PORT); + listen_addr.sin6_addr = in6addr_any; + + while ((opt = getopt(argc, argv, "A:p:v:")) != -1) { + switch (opt) { + case 'A' : + if (resolve_address(optarg, (struct sockaddr *)&listen_addr) < 0) { + fprintf(stderr, "cannot resolve address\n"); + exit(-1); + } + break; + case 'p' : + listen_addr.sin6_port = htons(atoi(optarg)); + break; + case 'v' : + log_level = strtol(optarg, NULL, 10); + break; + default: + usage(argv[0], dtls_package_version()); + exit(1); + } + } + + dtls_set_log_level(log_level); + + /* init socket and set it to non-blocking */ + fd = socket(listen_addr.sin6_family, SOCK_DGRAM, 0); + + if (fd < 0) { + dtls_alert("socket: %s\n", strerror(errno)); + return 0; + } + + if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on) ) < 0) { + dtls_alert("setsockopt SO_REUSEADDR: %s\n", strerror(errno)); + } +#if 0 + flags = fcntl(fd, F_GETFL, 0); + if (flags < 0 || fcntl(fd, F_SETFL, flags | O_NONBLOCK) < 0) { + dtls_alert("fcntl: %s\n", strerror(errno)); + goto error; + } +#endif + on = 1; +#ifdef IPV6_RECVPKTINFO + if (setsockopt(fd, IPPROTO_IPV6, IPV6_RECVPKTINFO, &on, sizeof(on) ) < 0) { +#else /* IPV6_RECVPKTINFO */ + if (setsockopt(fd, IPPROTO_IPV6, IPV6_PKTINFO, &on, sizeof(on) ) < 0) { +#endif /* IPV6_RECVPKTINFO */ + dtls_alert("setsockopt IPV6_PKTINFO: %s\n", strerror(errno)); + } + + if (bind(fd, (struct sockaddr *)&listen_addr, sizeof(listen_addr)) < 0) { + dtls_alert("bind: %s\n", strerror(errno)); + goto error; + } + + dtls_init(); + + the_context = dtls_new_context(&fd); + + dtls_set_handler(the_context, &cb); + + while (1) { + FD_ZERO(&rfds); + FD_ZERO(&wfds); + + FD_SET(fd, &rfds); + /* FD_SET(fd, &wfds); */ + + timeout.tv_sec = 5; + timeout.tv_usec = 0; + + result = select( fd+1, &rfds, &wfds, 0, &timeout); + + if (result < 0) { /* error */ + if (errno != EINTR) + perror("select"); + } else if (result == 0) { /* timeout */ + } else { /* ok */ + if (FD_ISSET(fd, &wfds)) + ; + else if (FD_ISSET(fd, &rfds)) { + dtls_handle_read(the_context); + } + } + } + + error: + dtls_free_context(the_context); + exit(0); +}
diff --git a/tests/netq-test.c b/tests/netq-test.c new file mode 100644 index 0000000..901a342 --- /dev/null +++ b/tests/netq-test.c
@@ -0,0 +1,123 @@ +#include <string.h> +#include <stdio.h> + +#include "utlist.h" +#include "netq.h" + +void +dump_queue(struct netq_t *queue) { + struct netq_t *p; + int i = 0; + + if (!queue) { + printf("(null)\n"); + } else { + LL_FOREACH(queue, p) { + printf("node #%d, timeout: %d\n", i++, p->t); + } + } +} + +int main(int argc, char **argv) { + struct netq_t *nq = NULL, *node; + int i; + + clock_time_t timestamps[] = { 300, 100, 200, 400, 500 }; + + for (i = 0; i < sizeof(timestamps)/sizeof(clock_time_t); i++) { + node = netq_node_new(0); + + if (!node) { + fprintf(stderr, "E: cannot create node #%d\n", i); + exit(EXIT_FAILURE); + } + + node->t = timestamps[i]; + + if (!netq_insert_node(&nq, node)) { + fprintf(stderr, "E: cannot add node to nodelist #%d\n", i); + exit(EXIT_FAILURE); + } + } + + printf("------------------------------------------------------------------------\n"); + printf("initial queue:\n"); + dump_queue(nq); + + printf("------------------------------------------------------------------------\n"); + printf("pop first element:\n"); + node = netq_pop_first(&nq); + + assert(node); + printf("first node's timeout is %d\n", node->t); + dump_queue(nq); + + netq_node_free(node); + + printf("------------------------------------------------------------------------\n"); + printf("queue head:\n"); + node = netq_head(&nq); + + printf("head's timeout is %d\n", node->t); + dump_queue(nq); + + printf("------------------------------------------------------------------------\n"); + printf("next timeout:\n"); + + node = netq_next(node); + + printf("next node's timeout is %d\n", node->t); + + printf("------------------------------------------------------------------------\n"); + printf("remove next:\n"); + + netq_remove(&nq, node); + dump_queue(nq); + + netq_node_free(node); + + printf("------------------------------------------------------------------------\n"); + printf("insert new item (timeout 50):\n"); + node = netq_node_new(0); + + assert(node); + node->t = 50; + + netq_insert_node(&nq, node); + dump_queue(nq); + + printf("------------------------------------------------------------------------\n"); + printf("insert new item (timeout 350):\n"); + node = netq_node_new(0); + + assert(node); + node->t = 350; + + netq_insert_node(&nq, node); + dump_queue(nq); + + printf("------------------------------------------------------------------------\n"); + printf("insert new item (timeout 1000):\n"); + node = netq_node_new(0); + + assert(node); + node->t = 1000; + + netq_insert_node(&nq, node); + dump_queue(nq); + + printf("------------------------------------------------------------------------\n"); + printf("remove all:\n"); + + netq_delete_all(&nq); + dump_queue(nq); + + printf("------------------------------------------------------------------------\n"); + printf("pop first element of empty queue:\n"); + node = netq_pop_first(&nq); + + assert(node == NULL); + dump_queue(nq); + + return 0; +}
diff --git a/tests/pcap.c b/tests/pcap.c new file mode 100644 index 0000000..7534c5f --- /dev/null +++ b/tests/pcap.c
@@ -0,0 +1,478 @@ +#include <stdio.h> +#include <string.h> +#include <getopt.h> +#include <pcap/pcap.h> + +#include "tinydtls.h" +#include "debug.h" +#include "dtls.h" + +#define TRANSPORT_HEADER_SIZE (14+20+8) /* Ethernet + IP + UDP */ + +/* the pre_master_secret is generated from the PSK at startup */ +unsigned char pre_master_secret[60]; +size_t pre_master_len = 0; + +unsigned char master_secret[DTLS_MASTER_SECRET_LENGTH]; +size_t master_secret_len = 0; + +dtls_security_parameters_t security_params[2]; +int config = 0; +unsigned int epoch[2] = { 0, 0 }; + +#if DTLS_VERSION == 0xfeff +dtls_hash_t hs_hash[2]; +#elif DTLS_VERSION == 0xfefd +dtls_hash_t hs_hash[1]; +#endif + +static inline void +update_hash(uint8 *record, size_t rlength, + uint8 *data, size_t data_length) { + int i; + + if (!hs_hash[0]) + return; + + for (i = 0; i < sizeof(hs_hash) / sizeof(dtls_hash_t *); ++i) { + dtls_hash_update(hs_hash[i], data, data_length); + } +} + +static inline void +finalize_hash(uint8 *buf) { +#if DTLS_VERSION == 0xfeff + unsigned char statebuf[sizeof(md5_state_t) + sizeof(SHA_CTX)]; +#elif DTLS_VERSION == 0xfefd + unsigned char statebuf[sizeof(SHA256_CTX)]; +#endif + + if (!hs_hash[0]) + return; + + /* temporarily store hash status for roll-back after finalize */ +#if DTLS_VERSION == 0xfeff + memcpy(statebuf, hs_hash[0], sizeof(md5_state_t)); + memcpy(statebuf + sizeof(md5_state_t), + hs_hash[1], + sizeof(SHA_CTX)); +#elif DTLS_VERSION == 0xfefd + memcpy(statebuf, hs_hash[0], sizeof(statebuf)); +#endif + + dtls_hash_finalize(buf, hs_hash[0]); +#if DTLS_VERSION == 0xfeff + dtls_hash_finalize(buf + 16, hs_hash[1]); +#endif + + /* restore hash status */ +#if DTLS_VERSION == 0xfeff + memcpy(hs_hash[0], statebuf, sizeof(md5_state_t)); + memcpy(hs_hash[1], + statebuf + sizeof(md5_state_t), + sizeof(SHA_CTX)); +#elif DTLS_VERSION == 0xfefd + memcpy(hs_hash[0], statebuf, sizeof(statebuf)); +#endif +} + +static inline void +clear_hash() { + int i; + + for (i = 0; i < sizeof(hs_hash) / sizeof(dtls_hash_t *); ++i) + free(hs_hash[i]); + memset(hs_hash, 0, sizeof(hs_hash)); +} + +#undef CURRENT_CONFIG +#undef OTHER_CONFIG +#undef SWITCH_CONFIG +#define CURRENT_CONFIG (&security_params[config]) +#define OTHER_CONFIG (&security_params[!(config & 0x01)]) +#define SWITCH_CONFIG (config = !(config & 0x01)) + +int +pcap_verify(dtls_security_parameters_t *sec, + int is_client, + const unsigned char *record, size_t record_length, + const unsigned char *cleartext, size_t cleartext_length) { + + unsigned char mac[DTLS_HMAC_MAX]; + dtls_hmac_context_t hmac_ctx; + int ok; + + if (cleartext_length < dtls_kb_digest_size(sec)) + return 0; + + dtls_hmac_init(&hmac_ctx, + is_client + ? dtls_kb_client_mac_secret(sec) + : dtls_kb_server_mac_secret(sec), + dtls_kb_mac_secret_size(sec)); + + cleartext_length -= dtls_kb_digest_size(sec); + + /* calculate MAC even if padding is wrong */ + dtls_mac(&hmac_ctx, + record, /* the pre-filled record header */ + cleartext, cleartext_length, + mac); + + ok = memcmp(mac, cleartext + cleartext_length, + dtls_kb_digest_size(sec)) == 0; +#ifndef NDEBUG + printf("MAC (%s): ", ok ? "valid" : "invalid"); + dump(mac, dtls_kb_digest_size(sec)); + printf("\n"); +#endif + return ok; +} + +int +decrypt_verify(int is_client, const uint8 *packet, size_t length, + uint8 **cleartext, size_t *clen) { + int res, ok = 0; + dtls_cipher_context_t *cipher; + + static unsigned char buf[1000]; + + switch (CURRENT_CONFIG->cipher) { + case AES128: /* TLS_PSK_WITH_AES128_CBC_SHA */ + *cleartext = buf; + *clen = length - sizeof(dtls_record_header_t); + + if (is_client) + cipher = CURRENT_CONFIG->read_cipher; + else + cipher = CURRENT_CONFIG->write_cipher; + + res = dtls_decrypt(cipher, + (uint8 *)packet + sizeof(dtls_record_header_t), *clen, + buf, NULL, 0); + + if (res < 0) { + warn("decryption failed!\n"); + } else { + ok = pcap_verify(CURRENT_CONFIG, is_client, (uint8 *)packet, length, + *cleartext, res); + + if (ok) + *clen = res - dtls_kb_digest_size(CURRENT_CONFIG); + } + break; + default: /* no cipher suite selected */ + *cleartext = (uint8 *)packet + sizeof(dtls_record_header_t); + *clen = length - sizeof(dtls_record_header_t); + + ok = 1; + } + + if (ok) + printf("verify OK\n"); + else + printf("verification failed!\n"); + return ok; +} + +#define SKIP_ETH_HEADER(M,L) \ + if ((L) < 14) \ + return; \ + else { \ + (M) += 14; \ + (L) -= 14; \ + } + +#define SKIP_IP_HEADER(M,L) \ + if (((M)[0] & 0xF0) == 0x40) { /* IPv4 */ \ + (M) += (M[0] & 0x0F) * 4; \ + (L) -= (M[0] & 0x0F) * 4; \ + } else \ + if (((M)[0] & 0xF0) == 0x60) { /* IPv6 */ \ + (M) += 40; \ + (L) -= 40; \ + } + +#define SKIP_UDP_HEADER(M,L) { \ + (M) += 8; \ + (L) -= 8; \ + } + +void +handle_packet(const u_char *packet, int length) { + static int n = 0; + static unsigned char initial_hello[] = { + 0x16, 0xfe, 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 + }; + uint8 *data; + size_t data_length, rlen; + int i, res; +#if DTLS_VERSION == 0xfeff +#ifndef SHA1_DIGEST_LENGTH +#define SHA1_DIGEST_LENGTH 20 +#endif + uint8 hash_buf[16 + SHA1_DIGEST_LENGTH]; +#elif DTLS_VERSION == 0xfefd + uint8 hash_buf[SHA256_DIGEST_LENGTH]; +#endif +#define verify_data_length 12 + int is_client; + n++; + + SKIP_ETH_HEADER(packet, length); + SKIP_IP_HEADER(packet, length); + + /* determine from port if this is a client */ + is_client = dtls_uint16_to_int(packet) != 20220; + + SKIP_UDP_HEADER(packet, length); + + while (length) { + rlen = dtls_uint16_to_int(packet + 11) + sizeof(dtls_record_header_t); + + if (!rlen) { + fprintf(stderr, "invalid length!\n"); + return; + } + + /* skip packet if it is from a different epoch */ + if (dtls_uint16_to_int(packet + 3) != epoch[is_client]) + goto next; + + res = decrypt_verify(is_client, packet, rlen, + &data, &data_length); + + if (res <= 0) + goto next; + + printf("packet %d (from %s):\n", n, is_client ? "client" : "server"); + hexdump(packet, sizeof(dtls_record_header_t)); + printf("\n"); + hexdump(data, data_length); + printf("\n"); + + if (packet[0] == 22 && data[0] == 1) { /* ClientHello */ + if (memcmp(packet, initial_hello, sizeof(initial_hello)) == 0) + goto next; + + memcpy(dtls_kb_client_iv(OTHER_CONFIG), data + 14, 32); + + clear_hash(); +#if DTLS_VERSION == 0xfeff + hs_hash[0] = dtls_new_hash(HASH_MD5); + hs_hash[1] = dtls_new_hash(HASH_SHA1); + + hs_hash[0]->init(hs_hash[0]->data); + hs_hash[1]->init(hs_hash[1]->data); +#elif DTLS_VERSION == 0xfefd + dtls_hash_init(hs_hash[0]); +#endif + } + + if (packet[0] == 22 && data[0] == 2) { /* ServerHello */ + memcpy(dtls_kb_server_iv(OTHER_CONFIG), data + 14, 32); + /* FIXME: search in ciphers */ + OTHER_CONFIG->cipher = TLS_PSK_WITH_AES_128_CCM_8; + } + + if (packet[0] == 20 && data[0] == 1) { /* ChangeCipherSpec */ + printf("client random: "); + dump(dtls_kb_client_iv(OTHER_CONFIG), 32); + printf("\nserver random: "); + dump(dtls_kb_server_iv(OTHER_CONFIG), 32); + printf("\n"); + master_secret_len = + dtls_prf(pre_master_secret, pre_master_len, + (unsigned char *)"master secret", 13, + dtls_kb_client_iv(OTHER_CONFIG), 32, + dtls_kb_server_iv(OTHER_CONFIG), 32, + master_secret, DTLS_MASTER_SECRET_LENGTH); + + printf("master_secret:\n "); + for(i = 0; i < master_secret_len; i++) + printf("%02x", master_secret[i]); + printf("\n"); + + /* create key_block from master_secret + * key_block = PRF(master_secret, + "key expansion" + server_random + client_random) */ + dtls_prf(master_secret, master_secret_len, + (unsigned char *)"key expansion", 13, + dtls_kb_server_iv(OTHER_CONFIG), 32, + dtls_kb_client_iv(OTHER_CONFIG), 32, + OTHER_CONFIG->key_block, + dtls_kb_size(OTHER_CONFIG)); + + OTHER_CONFIG->read_cipher = + dtls_cipher_new(OTHER_CONFIG->cipher, + dtls_kb_client_write_key(OTHER_CONFIG), + dtls_kb_key_size(OTHER_CONFIG)); + + if (!OTHER_CONFIG->read_cipher) { + warn("cannot create read cipher\n"); + } else { + dtls_cipher_set_iv(OTHER_CONFIG->read_cipher, + dtls_kb_client_iv(OTHER_CONFIG), + dtls_kb_iv_size(OTHER_CONFIG)); + } + + OTHER_CONFIG->write_cipher = + dtls_cipher_new(OTHER_CONFIG->cipher, + dtls_kb_server_write_key(OTHER_CONFIG), + dtls_kb_key_size(OTHER_CONFIG)); + + if (!OTHER_CONFIG->write_cipher) { + warn("cannot create write cipher\n"); + } else { + dtls_cipher_set_iv(OTHER_CONFIG->write_cipher, + dtls_kb_server_iv(OTHER_CONFIG), + dtls_kb_iv_size(OTHER_CONFIG)); + } + + /* if (is_client) */ + SWITCH_CONFIG; + epoch[is_client]++; + + printf("key_block:\n"); + printf(" client_MAC_secret:\t"); + dump(dtls_kb_client_mac_secret(CURRENT_CONFIG), + dtls_kb_mac_secret_size(CURRENT_CONFIG)); + printf("\n"); + + printf(" server_MAC_secret:\t"); + dump(dtls_kb_server_mac_secret(CURRENT_CONFIG), + dtls_kb_mac_secret_size(CURRENT_CONFIG)); + printf("\n"); + + printf(" client_write_key:\t"); + dump(dtls_kb_client_write_key(CURRENT_CONFIG), + dtls_kb_key_size(CURRENT_CONFIG)); + printf("\n"); + + printf(" server_write_key:\t"); + dump(dtls_kb_server_write_key(CURRENT_CONFIG), + dtls_kb_key_size(CURRENT_CONFIG)); + printf("\n"); + + printf(" client_IV:\t\t"); + dump(dtls_kb_client_iv(CURRENT_CONFIG), + dtls_kb_iv_size(CURRENT_CONFIG)); + printf("\n"); + + printf(" server_IV:\t\t"); + dump(dtls_kb_server_iv(CURRENT_CONFIG), + dtls_kb_iv_size(CURRENT_CONFIG)); + printf("\n"); + + } + + if (packet[0] == 22) { + if (data[0] == 20) { /* Finished */ + finalize_hash(hash_buf); + /* clear_hash(); */ + + update_hash((unsigned char *)packet, sizeof(dtls_record_header_t), + data, data_length); + + dtls_prf(master_secret, master_secret_len, + is_client + ? (unsigned char *)"client finished" + : (unsigned char *)"server finished" + , 15, + hash_buf, sizeof(hash_buf), + NULL, 0, + data + sizeof(dtls_handshake_header_t), + verify_data_length); + printf("verify_data:\n"); + dump(data, data_length); + printf("\n"); + } else { + update_hash((unsigned char *)packet, sizeof(dtls_record_header_t), + data, data_length); + } + } + + if (packet[0] == 23) { /* Application Data */ + printf("Application Data:\n"); + dump(data, data_length); + printf("\n"); + } + + next: + length -= rlen; + packet += rlen; + } +} + +void init() { + memset(security_params, 0, sizeof(security_params)); + CURRENT_CONFIG->cipher = -1; + + memset(hs_hash, 0, sizeof(hs_hash)); + + /* set pre_master_secret to default if no PSK was given */ + if (!pre_master_len) { + /* unsigned char psk[] = { 0x01, 0x02, 0x03, 0x04, 0x05, 0x06 }; */ + pre_master_len = + dtls_pre_master_secret((unsigned char *)"secretPSK", 9, + pre_master_secret); + } +} + +int main(int argc, char **argv) { + pcap_t *pcap; + char errbuf[PCAP_ERRBUF_SIZE]; + struct pcap_pkthdr *pkthdr; + const u_char *packet; + int res = 0; + int c, option_index = 0; + + static struct option opts[] = { + { "psk", 1, 0, 'p' }, + { 0, 0, 0, 0 } + }; + + /* handle command line options */ + while (1) { + c = getopt_long(argc, argv, "p:", opts, &option_index); + if (c == -1) + break; + + switch (c) { + case 'p': + pre_master_len = dtls_pre_master_secret((unsigned char *)optarg, + strlen(optarg), pre_master_secret); + break; + } + } + + if (argc <= optind) { + fprintf(stderr, "usage: %s [-p|--psk PSK] pcapfile\n", argv[0]); + return -1; + } + + init(); + + pcap = pcap_open_offline(argv[optind], errbuf); + if (!pcap) { + fprintf(stderr, "pcap_open_offline: %s\n", errbuf); + return -2; + } + + for (;;) { + res = pcap_next_ex(pcap, &pkthdr, &packet); + + switch(res) { + case -2: goto done; + case -1: pcap_perror(pcap, "read packet"); break; + case 1: handle_packet(packet, pkthdr->caplen); break; + default: + ; + } + } + done: + + pcap_close(pcap); + + return 0; +}
diff --git a/tests/prf-test.c b/tests/prf-test.c new file mode 100644 index 0000000..d8d83d9 --- /dev/null +++ b/tests/prf-test.c
@@ -0,0 +1,31 @@ +#include <stdio.h> + +#include "tinydtls.h" +#include "debug.h" +#include "global.h" +#include "crypto.h" + +int +main() { + /* see http://www.ietf.org/mail-archive/web/tls/current/msg03416.html */ + unsigned char key[] = { 0x9b, 0xbe, 0x43, 0x6b, 0xa9, 0x40, 0xf0, 0x17, + 0xb1, 0x76, 0x52, 0x84, 0x9a, 0x71, 0xdb, 0x35 }; + unsigned char label[] = { 0x74, 0x65, 0x73, 0x74, 0x20, 0x6c, 0x61, 0x62, + 0x65, 0x6c}; + unsigned char random1[] = { 0xa0, 0xba, 0x9f, 0x93, 0x6c, 0xda, 0x31, 0x18}; + unsigned char random2[] = {0x27, 0xa6, 0xf7, 0x96, 0xff, 0xd5, 0x19, 0x8c + }; + unsigned char buf[200]; + size_t result; + + result = dtls_prf(key, sizeof(key), + label, sizeof(label), + random1, sizeof(random1), + random2, sizeof(random2), + buf, 100); + + printf("PRF yields %zu bytes of random data:\n", result); + hexdump(buf, result); + printf("\n"); + return 0; +}
diff --git a/tests/secure-server.c b/tests/secure-server.c new file mode 100644 index 0000000..6ba5258 --- /dev/null +++ b/tests/secure-server.c
@@ -0,0 +1,862 @@ +/* secure-server -- A (broken) DTLS server example + * + * Copyright (C) 2011 Olaf Bergmann <bergmann@tzi.org> + * + * Permission is hereby granted, free of charge, to any person + * obtaining a copy of this software and associated documentation + * files (the "Software"), to deal in the Software without + * restriction, including without limitation the rights to use, copy, + * modify, merge, publish, distribute, sublicense, and/or sell copies + * of the Software, and to permit persons to whom the Software is + * furnished to do so, subject to the following conditions: + * + * The above copyright notice and this permission notice shall be + * included in all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, + * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF + * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND + * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS + * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN + * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN + * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + * SOFTWARE. + */ + +#include <string.h> +#include <stdlib.h> +#include <unistd.h> +#include <fcntl.h> +#include <stdio.h> +#include <ctype.h> +#include <sys/select.h> +#include <sys/types.h> +#include <sys/socket.h> +#include <netinet/in.h> +#include <arpa/inet.h> +#include <netdb.h> +#include <sys/stat.h> +#include <errno.h> +#include <signal.h> + +#include <openssl/ssl.h> +#include <openssl/bio.h> +#include <openssl/err.h> +#include <openssl/rand.h> + +#ifdef WITH_DTLS +#define SERVER_CERT_PEM "./server-cert.pem" +#define SERVER_KEY_PEM "./server-key.pem" +#define CA_CERT_PEM "./ca-cert.pem" +#endif + +#ifdef HAVE_ASSERT_H +# include <assert.h> +#else +# define assert(x) +#endif /* HAVE_ASSERT_H */ + +static int quit=0; + +/* SIGINT handler: set quit to 1 for graceful termination */ +void +handle_sigint(int signum) { + quit = 1; +} + +int +check_connect(int sockfd, char *buf, int buflen, + struct sockaddr *src, int *ifindex) { + + /* for some reason, the definition in netinet/in.h is not exported */ +#ifndef IN6_PKTINFO + struct in6_pktinfo + { + struct in6_addr ipi6_addr; /* src/dst IPv6 address */ + unsigned int ipi6_ifindex; /* send/recv interface index */ + }; +#endif + + size_t bytes; + + struct iovec iov[1] = { {buf, buflen} }; + char cmsgbuf[CMSG_SPACE(sizeof(struct in6_pktinfo))]; + struct in6_pktinfo *p = NULL; + + struct msghdr msg = { 0 }; + struct cmsghdr *cmsg; + + msg.msg_name = src; + msg.msg_namelen = sizeof(struct sockaddr_in6); + msg.msg_iov = iov; + msg.msg_iovlen = 1; + msg.msg_control = cmsgbuf; + msg.msg_controllen = sizeof(cmsgbuf); + + bytes = recvmsg(sockfd, &msg, MSG_DONTWAIT | MSG_PEEK); + if (bytes < 0) { + perror("recvmsg"); + return bytes; + } + + /* TODO: handle msg.msg_flags & MSG_TRUNC */ + if (msg.msg_flags & MSG_CTRUNC) { + fprintf(stderr, "control was truncated!\n"); + return -1; + } + + if (ifindex) { + /* Here we try to retrieve the interface index where the packet was received */ + *ifindex = 0; + for (cmsg = CMSG_FIRSTHDR(&msg); cmsg != NULL; + cmsg = CMSG_NXTHDR(&msg, cmsg)) { + + if (cmsg->cmsg_level == IPPROTO_IPV6 && cmsg->cmsg_type == IPV6_PKTINFO) { + p = (struct in6_pktinfo *)(CMSG_DATA(cmsg)); + *ifindex = p->ipi6_ifindex; + break; + } + } + } + + return bytes; +} + +typedef enum { UNKNOWN=0, DTLS=1 } protocol_t; + +protocol_t +demux_protocol(const char *buf, int len) { + return DTLS; +} + +#ifdef WITH_DTLS +typedef enum { + PEER_ST_ESTABLISHED, PEER_ST_PENDING, PEER_ST_CLOSED + } peer_state_t; +typedef struct { + peer_state_t state; + unsigned long h; + SSL *ssl; +} ssl_peer_t; + +#define MAX_SSL_PENDING 2 /* must be less than MAX_SSL_PEERS */ +#define MAX_SSL_PEERS 10 /* MAX_SSL_PENDING of these might be pending */ +ssl_peer_t *ssl_peer_storage[MAX_SSL_PEERS]; +static int pending = 0; + +void +check_peers() { +typedef struct bio_dgram_data_st + { + union { + struct sockaddr sa; + struct sockaddr_in sa_in; + struct sockaddr_in6 sa_in6; + } peer; + unsigned int connected; + unsigned int _errno; + unsigned int mtu; + struct timeval next_timeout; + struct timeval socket_timeout; + } bio_dgram_data; + + struct sockaddr_in6 peer; + int i; + BIO *bio; + for (i = 0; i < MAX_SSL_PEERS; i++) { + if (ssl_peer_storage[i]) { + if (!ssl_peer_storage[i]->ssl) + fprintf(stderr, "invalid SSL object for peer %d!\n",i); + else { + bio = SSL_get_rbio(ssl_peer_storage[i]->ssl); + if (bio) { + (void) BIO_dgram_get_peer(bio, (struct sockaddr *)&peer); + if (peer.sin6_port && ssl_peer_storage[i]->h != ntohs(peer.sin6_port)) { + fprintf(stderr, " bio %p: port differs from hash: %d != %d! (%sconnected)\n", bio, + ssl_peer_storage[i]->h, + ntohs(((struct sockaddr_in6 *)&peer)->sin6_port), + ((bio_dgram_data *)bio->ptr)->connected ? "" : "not "); + } + + } + } + } + } +} + +/** Creates a hash value from the first num bytes of s, taking init as + * initialization value. */ +static inline unsigned long +_hash(unsigned long init, const char *s, int num) { + int c; + + while (num--) + while ( (c = *s++) ) { + init = ((init << 7) + init) + c; + } + + return init; +} + +static inline unsigned long +hash_peer(const struct sockaddr *peer, int ifindex) { + unsigned long h; + + /* initialize hash value to interface index */ + h = _hash(0, (char *)&ifindex, sizeof(int)); + +#define CAST(TYPE,VAR) ((TYPE)VAR) + + assert(peer); + switch (peer->sa_family) { + case AF_INET: + return ntohs(CAST(const struct sockaddr_in *, peer)->sin_port); + h = _hash(h, (char *) &CAST(const struct sockaddr_in *, peer)->sin_addr, + sizeof(struct in_addr)); + h = _hash(h, (char *) &CAST(const struct sockaddr_in *, peer)->sin_port, + sizeof(in_port_t)); + break; + case AF_INET6: + return ntohs(CAST(const struct sockaddr_in6 *, peer)->sin6_port); + h = _hash(h, + (char *) &CAST(const struct sockaddr_in6 *, peer)->sin6_addr, + sizeof(struct in6_addr)); + h = _hash(h, + (char *) &CAST(const struct sockaddr_in6 *, peer)->sin6_port, + sizeof(in_port_t)); + break; + default: + /* last resort */ + h = _hash(h, (char *)peer, sizeof(struct sockaddr)); + } + + return 42; + return h; +} + +/* Returns index of peer object for specified address/ifindex pair. */ +int +get_index_of_peer(const struct sockaddr *peer, int ifindex) { + unsigned long h; + int idx; +#ifndef NDEBUG + char addr[INET6_ADDRSTRLEN]; + char port[6]; +#endif + + if (!peer) + return -1; + + h = hash_peer(peer,ifindex); + + for (idx = 0; idx < MAX_SSL_PEERS; idx++) { + if (ssl_peer_storage[idx] && ssl_peer_storage[idx]->h == h) { +#ifndef NDEBUG + getnameinfo((struct sockaddr *)peer, sizeof(struct sockaddr_in6), + addr, sizeof(addr), port, sizeof(port), + NI_NUMERICHOST | NI_NUMERICSERV); + + fprintf(stderr, "get_index_of_peer: [%s]:%s => %lu\n", + addr, port, h); +#endif + return idx; + } + } + return -1; +} + +SSL * +get_ssl(SSL_CTX *ctx, int sockfd, struct sockaddr *src, int ifindex) { + int idx; + BIO *bio; + SSL *ssl; +#ifndef NDEBUG + struct sockaddr_storage peer; + char addr[INET6_ADDRSTRLEN]; + char port[6]; + int i; +#endif + + idx = get_index_of_peer(src,ifindex); + if (idx >= 0) { + fprintf(stderr,"found peer %d ",idx); + switch (ssl_peer_storage[idx]->state) { + case PEER_ST_ESTABLISHED: fprintf(stderr,"established\n"); break; + case PEER_ST_PENDING: fprintf(stderr,"pending\n"); break; + case PEER_ST_CLOSED: fprintf(stderr,"closed\n"); break; + default: + OPENSSL_assert(0); + } + +#ifndef NDEBUG + memset(&peer, 0, sizeof(peer)); + (void) BIO_dgram_get_peer(SSL_get_rbio(ssl_peer_storage[idx]->ssl), &peer); + + getnameinfo((struct sockaddr *)&peer, sizeof(peer), + addr, sizeof(addr), port, sizeof(port), + NI_NUMERICHOST | NI_NUMERICSERV); + + fprintf(stderr," [%s]:%s \n", addr, port); +#endif + return ssl_peer_storage[idx]->ssl; + } + + /* none found, create new if sufficient space available */ + if (pending < MAX_SSL_PENDING) { + for (idx = 0; idx < MAX_SSL_PEERS; idx++) { + if (ssl_peer_storage[idx] == NULL) { /* found space */ + ssl = SSL_new(ctx); + + if (ssl) { + bio = BIO_new_dgram(sockfd, BIO_NOCLOSE); + if (!bio) { + SSL_free(ssl); + return NULL; + } + + SSL_set_bio(ssl, bio, bio); + SSL_set_options(ssl, SSL_OP_COOKIE_EXCHANGE); + + SSL_set_accept_state(ssl); + ssl_peer_storage[idx] = (ssl_peer_t *) malloc(sizeof(ssl_peer_t)); + if (!ssl_peer_storage[idx]) { + SSL_free(ssl); + return NULL; + } + ssl_peer_storage[idx]->state = PEER_ST_PENDING; + ssl_peer_storage[idx]->h = hash_peer(src,ifindex); + ssl_peer_storage[idx]->ssl = ssl; + + pending++; + + fprintf(stderr, + "created new SSL peer %d for ssl object %p (storage: %p)\n", + idx, ssl, ssl_peer_storage[idx]); +#ifndef NDEBUG + if (getnameinfo((struct sockaddr *)&src, sizeof(src), + addr, sizeof(addr), port, sizeof(port), + NI_NUMERICHOST | NI_NUMERICSERV) != 0) { + perror("getnameinfo"); + fprintf(stderr, "port was %u\n", ntohs(((struct sockaddr_in6 *)src)->sin6_port)); + } else { + fprintf(stderr," [%s]:%s \n", addr, port); + } +#endif + OPENSSL_assert(ssl_peer_storage[idx]->ssl == ssl); + fprintf(stderr,"%d objects pending\n", pending); + check_peers(); + return ssl; + } + } + } + } else { + fprintf(stderr, "too many pending SSL objects\n"); + return NULL; + } + + fprintf(stderr, "too many peers\n"); + return NULL; +} + +/** Deletes peer stored at index idx and frees allocated memory. */ +static inline void +delete_peer(int idx) { + if (idx < 0 || !ssl_peer_storage[idx]) + return; + + if (ssl_peer_storage[idx]->state == PEER_ST_PENDING) + pending--; + + OPENSSL_assert(ssl_peer_storage[idx]->ssl); + SSL_free(ssl_peer_storage[idx]->ssl); + + free(ssl_peer_storage[idx]); + ssl_peer_storage[idx] = NULL; + + printf("deleted peer %d\n",idx); +} + +/** Deletes all closed objects from ssl_peer_storage. */ +void +remove_closed() { + int idx; + + for (idx = 0; idx < MAX_SSL_PEERS; idx++) + if (ssl_peer_storage[idx] + && ssl_peer_storage[idx]->state == PEER_ST_CLOSED) + delete_peer(idx); +} + +#define min(a,b) ((a) < (b) ? (a) : (b)) + +unsigned int +psk_server_callback(SSL *ssl, const char *identity, + unsigned char *psk, unsigned int max_psk_len) { + static char keybuf[] = "secretPSK"; + + printf("psk_server_callback: check identity of client %s\n", identity); + memcpy(psk, keybuf, min(strlen(keybuf), max_psk_len)); + + return min(strlen(keybuf), max_psk_len); +} + +#endif + +#ifdef WITH_DTLS +/** + * This function tracks the status changes from libssl to manage local + * object state. + */ +void +info_callback(const SSL *ssl, int where, int ret) { + int idx, i; + struct sockaddr_storage peer; + struct sockaddr_storage peer2; + char addr[INET6_ADDRSTRLEN]; + char port[6]; + + if (where & SSL_CB_LOOP) /* do not care for intermediary states */ + return; + + memset(&peer, 0, sizeof(peer)); + (void) BIO_dgram_get_peer(SSL_get_rbio(ssl), &peer); + + /* lookup SSL object */ /* FIXME: need to get the ifindex */ + idx = get_index_of_peer((struct sockaddr *)&peer, 0); + + if (idx >= 0) + fprintf(stderr, "info_callback: assert: %d < 0 || %p == %p (storage: %p)\n", + idx, ssl, ssl_peer_storage[idx]->ssl, ssl_peer_storage[idx]); + if (idx >= 0 && ssl != ssl_peer_storage[idx]->ssl) { + getnameinfo((struct sockaddr *)&peer, sizeof(peer), + addr, sizeof(addr), port, sizeof(port), + NI_NUMERICHOST | NI_NUMERICSERV); + + fprintf(stderr," ssl: [%s]:%s ", addr, port); + + (void) BIO_dgram_get_peer(SSL_get_rbio(ssl_peer_storage[idx]->ssl), &peer2); + getnameinfo((struct sockaddr *)&peer2, sizeof(peer2), + addr, sizeof(addr), port, sizeof(port), + NI_NUMERICHOST | NI_NUMERICSERV); + + fprintf(stderr," ssl_peer_storage[idx]->ssl: [%s]:%s\n", addr, port); + + fprintf(stderr, " hash:%lu h: %lu\n", + hash_peer((const struct sockaddr *)&peer, 0), + ssl_peer_storage[idx]->h); + + for (i = 0; i < MAX_SSL_PEERS; i++) { + if (ssl_peer_storage[i]) { + fprintf(stderr, "%02d: %p ssl: %p ", + i, ssl_peer_storage[i] ,ssl_peer_storage[i]->ssl); + + (void) BIO_dgram_get_peer(SSL_get_rbio(ssl_peer_storage[i]->ssl), &peer2); + getnameinfo((struct sockaddr *)&peer2, sizeof(peer2), + addr, sizeof(addr), port, sizeof(port), + NI_NUMERICHOST | NI_NUMERICSERV); + + fprintf(stderr," peer: [%s]:%s h: %lu\n", addr, port, ssl_peer_storage[i]->h); + } + } + fprintf(stderr, "***** ASSERT FAILED ******\n"); + + memset(&peer, 0, sizeof(peer)); + (void) BIO_dgram_get_peer(SSL_get_wbio(ssl), &peer); + + idx = get_index_of_peer((struct sockaddr *)&peer, 0); + fprintf(stderr, " get_index_of_peer for wbio returns %d, type is %04x\n", + idx, where); + } +#if 1 + check_peers(); + OPENSSL_assert((idx < 0) || (ssl == ssl_peer_storage[idx]->ssl)); +#endif + + if (where & SSL_CB_ALERT) { +#ifndef NDEBUG + if (ret != 0) + fprintf(stderr,"%s:%s:%s\n", SSL_alert_type_string(ret), + SSL_alert_desc_string(ret), SSL_alert_desc_string_long(ret)); +#endif + + /* examine alert type */ + switch (*SSL_alert_type_string(ret)) { + case 'F': + /* move SSL object from pending to close */ + if (idx >= 0) { + ssl_peer_storage[idx]->state = PEER_ST_CLOSED; + pending--; + } + break; + case 'W': + if ((ret & 0xff) == SSL_AD_CLOSE_NOTIFY) { + if (where == SSL_CB_WRITE_ALERT) + fprintf(stderr,"sent CLOSE_NOTIFY\n"); + else /* received CN */ + fprintf(stderr,"received CLOSE_NOTIFY\n"); + } + break; + default: /* handle unknown alert types */ +#ifndef NDEBUG + printf("not handled!\n"); +#endif + } + } + + if (where & SSL_CB_HANDSHAKE_DONE) { + /* move SSL object from pending to established */ + printf("HANDSHAKE_DONE "); + if (idx >= 0) { + + if (ssl_peer_storage[idx]->state == PEER_ST_PENDING) { + ssl_peer_storage[idx]->state = PEER_ST_ESTABLISHED; + pending--; + printf("moved SSL object %d to ESTABLISHED\n", idx); + printf("%d objects pending\n", pending); + } else { +#ifndef NDEBUG + printf("huh, object %d was not pending? (%d)\n", idx, + ssl_peer_storage[idx]->state); +#endif + } + return; + } + return; + } + + return; +} +#endif + +#ifdef WITH_DTLS +/* checks if ssl object was closed and can be removed */ +int +check_close(SSL *ssl) { + int res, err, idx; + struct sockaddr_storage peer; + + memset(&peer, 0, sizeof(peer)); + (void)BIO_dgram_get_peer(SSL_get_rbio(ssl), &peer); + + res = 0; + if (SSL_get_shutdown(ssl) & SSL_RECEIVED_SHUTDOWN) { + printf("SSL_RECEIVED_SHUTDOWN\n"); + res = SSL_shutdown(ssl); + if (res == 0) { + printf("must call SSL_shutdown again\n"); + res = SSL_shutdown(ssl); + } + if (res < 0) { + err = SSL_get_error(ssl,res); + fprintf(stderr, "shutdown: SSL error %d: %s\n", err, + ERR_error_string(err, NULL)); + } + + /* we can close the SSL object anyway */ + /* FIXME: need to get ifindex from somewhere */ + idx = get_index_of_peer((struct sockaddr *)&peer, 0); + OPENSSL_assert(idx < 0 || ssl == ssl_peer_storage[idx]->ssl); + if (idx >= 0) { + ssl_peer_storage[idx]->state = PEER_ST_CLOSED; + printf("moved SSL object %d to CLOSED\n",idx); + } + } + + return res; +} + +int +check_timeout() { + int i, result, err; + + for (i = 0; i < MAX_SSL_PEERS; i++) { + if (ssl_peer_storage[i]) { + OPENSSL_assert(ssl_peer_storage[i]->ssl); + result = DTLSv1_handle_timeout(ssl_peer_storage[i]->ssl); + if (result < 0) { + err = SSL_get_error(ssl_peer_storage[i]->ssl,result); + fprintf(stderr, "dtls1_handle_timeout (%d): %s\n", + err, ERR_error_string(err, NULL)); + } + } + } + + /* remove outdated obbjects? */ + + return 0; +} +#endif /* WITH_DTLS */ + +int +_read(SSL_CTX *ctx, int sockfd) { + char buf[2000]; + struct sockaddr_in6 src; + int len, ifindex, i; + char addr[INET6_ADDRSTRLEN]; + char port[6]; + socklen_t sz = sizeof(struct sockaddr_in6); +#ifdef WITH_DTLS + SSL *ssl; + int err; +#endif + + /* Retrieve remote address and interface index as well as the first + few bytes of the message to demultiplex protocols. */ + memset(&src, 0, sizeof(struct sockaddr_in6)); + len = check_connect(sockfd, buf, 4, (struct sockaddr *)&src, &ifindex); + + if (len < 0) /* error */ + return len; + +#ifndef NDEBUG + fprintf(stderr,"received packet"); + + if (getnameinfo((struct sockaddr *)&src, sizeof(src), + addr, sizeof(addr), port, sizeof(port), + NI_NUMERICHOST | NI_NUMERICSERV) == 0) + fprintf(stderr," from [%s]:%s", addr, port); + + fprintf(stderr," on interface %d\n", ifindex); +#endif + + switch (demux_protocol(buf, len)) { +#ifdef WITH_DTLS + case DTLS : + ssl = get_ssl(ctx, sockfd, (struct sockaddr *)&src, ifindex); + if (!ssl) { + fprintf(stderr, "cannot create new SSL object\n"); + /* return recv(sockfd, buf, sizeof(buf), MSG_DONTWAIT);*/ + len = recvfrom(sockfd, buf, sizeof(buf), MSG_DONTWAIT, + (struct sockaddr *)&src, &sz); + getnameinfo((struct sockaddr *)&src, sz, + addr, sizeof(addr), port, sizeof(port), + NI_NUMERICHOST | NI_NUMERICSERV); + printf("discarded %d bytes from [%s]:%s\n", len, addr, port); + return len; + } + len = SSL_read(ssl, buf, sizeof(buf)); + break; +#endif + case UNKNOWN: + default : + len = recv(sockfd, buf, sizeof(buf), MSG_DONTWAIT); + } + + if (len > 0) { + printf("here is the data:\n"); + for (i=0; i<len; i++) + printf("%c",buf[i]); + } if (len == 0) { /* session closed? */ +#ifdef WITH_DTLS + if (check_close(ssl) <= 0) { + fprintf(stderr, "not closed\n"); + } +#endif + } else { +#ifdef WITH_DTLS + err = SSL_get_error(ssl,len); + switch (err) { + case SSL_ERROR_WANT_READ: + fprintf(stderr, "SSL_ERROR_WANT_READ\n"); + return 0; + case SSL_ERROR_WANT_WRITE: + fprintf(stderr, "SSL_ERROR_WANT_WRITE\n"); + return 0; + default: + fprintf(stderr, "read: SSL error %d: %s\n", err, + ERR_error_string(err, NULL)); + return 0; + } +#else + perror("recv"); +#endif + } + + return len; +} + +int +_write(SSL_CTX *ctx, int sockfd) { + int res = 0; +#ifdef WITH_DTLS + SSL *ssl; + int err; + + ssl = get_ssl(ctx, sockfd, NULL, 1); + if (!ssl) { + fprintf(stderr, "no SSL object for writing"); + return 0; + } + res = SSL_write(ssl, NULL, 0); + if (res < 0) { + /* + if (SSL_want_write(ssl)) + return 0; + */ + /* FIXME: check SSL_want_read(ssl) */ + + err = SSL_get_error(ssl,res); + fprintf(stderr,"SSL_write returned %d (%s)\n", err, ERR_error_string(err, NULL)); + } else { + printf("SSL_write successful\n"); + } +#else +#endif + + return res; +} + + +int +generate_cookie(SSL *ssl, unsigned char *cookie, unsigned int *cookie_len) { + /* FIXME: generate secure client-specific cookie */ +#define DUMMYSTR "ABCDEFGHIJKLMNOP" + *cookie_len = strlen(DUMMYSTR); + memcpy(cookie, DUMMYSTR, *cookie_len); + + return 1; +} + +int +verify_cookie(SSL *ssl, unsigned char *cookie, unsigned int cookie_len) { + /* FIXME */ + return 1; +} + +enum { READ, WRITE }; + +int +main(int argc, char **argv) { + int sockfd = 0; + int on = 1; + struct sockaddr_in6 listen_addr = { AF_INET6, htons(20220), 0, IN6ADDR_ANY_INIT, 0 }; + size_t addr_size = sizeof(struct sockaddr_in6); + fd_set fds[2]; + int result, flags; + int idx, res = 0; + struct timeval timeout; + struct sigaction act, oact; + +#ifdef WITH_DTLS + SSL_CTX *ctx; + + memset(ssl_peer_storage, 0, sizeof(ssl_peer_storage)); + + SSL_load_error_strings(); + SSL_library_init(); + ctx = SSL_CTX_new(DTLSv1_server_method()); + + SSL_CTX_set_cipher_list(ctx, "ALL"); + SSL_CTX_set_session_cache_mode(ctx, SSL_SESS_CACHE_OFF); + + res = SSL_CTX_use_certificate_file(ctx, SERVER_CERT_PEM, SSL_FILETYPE_PEM); + if (res != 1) { + fprintf(stderr, "cannot read server certificate from file '%s' (%s)\n", + SERVER_CERT_PEM, ERR_error_string(res,NULL)); + goto end; + } + + res = SSL_CTX_use_PrivateKey_file(ctx, SERVER_KEY_PEM, SSL_FILETYPE_PEM); + if (res != 1) { + fprintf(stderr, "cannot read server key from file '%s' (%s)\n", + SERVER_KEY_PEM, ERR_error_string(res,NULL)); + goto end; + } + + res = SSL_CTX_check_private_key (ctx); + if (res != 1) { + fprintf(stderr, "invalid private key\n"); + goto end; + } + + res = SSL_CTX_load_verify_locations(ctx, CA_CERT_PEM, NULL); + if (res != 1) { + fprintf(stderr, "cannot read ca file '%s'\n", CA_CERT_PEM); + goto end; + } + + /* Client has to authenticate */ + + /* Client has to authenticate */ + SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, NULL); + + SSL_CTX_set_read_ahead(ctx, 1); /* disable read-ahead */ + SSL_CTX_set_cookie_generate_cb(ctx, generate_cookie); + SSL_CTX_set_cookie_verify_cb(ctx, verify_cookie); + + SSL_CTX_use_psk_identity_hint(ctx, "Enter password for CoAP-Gateway"); + SSL_CTX_set_psk_server_callback(ctx, psk_server_callback); + + SSL_CTX_set_info_callback(ctx, info_callback); +#endif + + sockfd = socket(listen_addr.sin6_family, SOCK_DGRAM, 0); + if ( sockfd < 0 ) { + perror("socket"); + return -1; + } + + if (setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on) ) < 0) + perror("setsockopt SO_REUSEADDR"); + + flags = fcntl(sockfd, F_GETFL, 0); + if (flags < 0 || fcntl(sockfd, F_SETFL, flags | O_NONBLOCK) < 0) { + perror("fcntl"); + return -1; + } + + on = 1; + if (setsockopt(sockfd, IPPROTO_IPV6, IPV6_RECVPKTINFO, &on, sizeof(on) ) < 0) { + perror("setsockopt IPV6_PKTINFO"); + } + + if (bind (sockfd, (const struct sockaddr *)&listen_addr, addr_size) < 0) { + perror("bind"); + res = -2; + goto end; + } + + act.sa_handler = handle_sigint; + sigemptyset(&act.sa_mask); + act.sa_flags = 0; + sigaction(SIGINT, &act, &oact); + + while (!quit) { + FD_ZERO(&fds[READ]); + FD_ZERO(&fds[WRITE]); + FD_SET(sockfd, &fds[READ]); + + timeout.tv_sec = 1; + timeout.tv_usec = 0; + result = select( FD_SETSIZE, &fds[READ], &fds[WRITE], 0, &timeout); + + if (result < 0) { /* error */ + if (errno != EINTR) + perror("select"); + } else if (result > 0) { /* read from socket */ + if ( FD_ISSET( sockfd, &fds[READ]) ) { + _read(ctx, sockfd); /* read received data */ + } else if ( FD_ISSET( sockfd, &fds[WRITE]) ) { /* write to socket */ + _write(ctx, sockfd); /* write data */ + } + } else { /* timeout */ + check_timeout(); + } + remove_closed(); + } + + end: +#ifdef WITH_DTLS + for (idx = 0; idx < MAX_SSL_PEERS; idx++) { + if (ssl_peer_storage[idx] && ssl_peer_storage[idx]->ssl) { + if (ssl_peer_storage[idx]->state == PEER_ST_ESTABLISHED) + SSL_shutdown(ssl_peer_storage[idx]->ssl); + SSL_free(ssl_peer_storage[idx]->ssl); + } + } + + SSL_CTX_free(ctx); +#endif + close(sockfd); /* don't care if we close stdin at this point */ + return res; +}
diff --git a/tinydtls.h.in b/tinydtls.h.in new file mode 100644 index 0000000..3aa54a9 --- /dev/null +++ b/tinydtls.h.in
@@ -0,0 +1,35 @@ +/******************************************************************************* + * + * Copyright (c) 2011, 2012, 2013, 2014, 2015 Olaf Bergmann (TZI) and others. + * All rights reserved. This program and the accompanying materials + * are made available under the terms of the Eclipse Public License v1.0 + * and Eclipse Distribution License v. 1.0 which accompanies this distribution. + * + * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html + * and the Eclipse Distribution License is available at + * http://www.eclipse.org/org/documents/edl-v10.php. + * + * Contributors: + * Olaf Bergmann - initial API and implementation + * Hauke Mehrtens - memory optimization, ECC integration + * + *******************************************************************************/ + +/** + * @file tinydtls.h + * @brief public tinydtls API + */ + +#ifndef _DTLS_TINYDTLS_H_ +#define _DTLS_TINYDTLS_H_ + +/** Defined to 1 if tinydtls is built with support for ECC */ +#undef DTLS_ECC + +/** Defined to 1 if tinydtls is built with support for PSK */ +#undef DTLS_PSK + +/** Defined to 1 if tinydtls is built for Contiki OS */ +#undef WITH_CONTIKI + +#endif /* _DTLS_TINYDTLS_H_ */