diff --git a/src/core/meshcop/dtls.cpp b/src/core/meshcop/dtls.cpp index ef09d4c2a..e4041278a 100644 --- a/src/core/meshcop/dtls.cpp +++ b/src/core/meshcop/dtls.cpp @@ -68,7 +68,6 @@ Dtls::Dtls(Instance &aInstance, bool aLayerTwoSecurity) , mReceiveMessage(nullptr) , mConnectedHandler(nullptr) , mReceiveHandler(nullptr) - , mSendHandler(nullptr) , mContext(nullptr) , mSocket(Get()) , mTransportCallback(nullptr) @@ -82,7 +81,7 @@ Dtls::Dtls(Instance &aInstance, bool aLayerTwoSecurity) mPreSharedKeyIdentity = nullptr; mPreSharedKeyIdLength = 0; mPreSharedKeyLength = 0; -#endif // MBEDTLS_KEY_EXCHANGE_PSK_ENABLED +#endif #ifdef MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED mCaChainSrc = nullptr; @@ -94,8 +93,8 @@ Dtls::Dtls(Instance &aInstance, bool aLayerTwoSecurity) memset(&mCaChain, 0, sizeof(mCaChain)); memset(&mOwnCert, 0, sizeof(mOwnCert)); memset(&mPrivateKey, 0, sizeof(mPrivateKey)); -#endif // MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED -#endif // OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE +#endif +#endif memset(mCipherSuites, 0, sizeof(mCipherSuites)); memset(mPsk, 0, sizeof(mPsk)); @@ -117,8 +116,8 @@ void Dtls::FreeMbedtls(void) mbedtls_x509_crt_free(&mCaChain); mbedtls_x509_crt_free(&mOwnCert); mbedtls_pk_free(&mPrivateKey); -#endif // MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED -#endif // OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE +#endif +#endif mbedtls_ssl_config_free(&mConf); mbedtls_ssl_free(&mSsl); } @@ -258,8 +257,8 @@ otError Dtls::Setup(bool aClient) mbedtls_x509_crt_init(&mCaChain); mbedtls_x509_crt_init(&mOwnCert); mbedtls_pk_init(&mPrivateKey); -#endif // MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED -#endif // OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE +#endif +#endif #if defined(MBEDTLS_SSL_SRV_C) && defined(MBEDTLS_SSL_COOKIE_C) mbedtls_ssl_cookie_init(&mCookieCtx); #endif @@ -279,7 +278,7 @@ otError Dtls::Setup(bool aClient) } #else OT_UNUSED_VARIABLE(mVerifyPeerCertificate); -#endif // OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE +#endif mbedtls_ssl_conf_rng(&mConf, mbedtls_ctr_drbg_random, Random::Crypto::MbedTlsContextGet()); mbedtls_ssl_conf_min_version(&mConf, MBEDTLS_SSL_MAJOR_VERSION_3, MBEDTLS_SSL_MINOR_VERSION_3); @@ -316,7 +315,7 @@ otError Dtls::Setup(bool aClient) { rval = SetApplicationCoapSecureKeys(); } -#endif // OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE +#endif VerifyOrExit(rval == 0, OT_NOOP); mReceiveMessage = nullptr; @@ -332,7 +331,7 @@ otError Dtls::Setup(bool aClient) { otLogInfoCoap("Application Coap Secure DTLS started"); } -#endif // OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE +#endif mState = kStateConnecting; @@ -376,7 +375,7 @@ int Dtls::SetApplicationCoapSecureKeys(void) rval = mbedtls_ssl_conf_own_cert(&mConf, &mOwnCert, &mPrivateKey); VerifyOrExit(rval == 0, OT_NOOP); } -#endif // MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED +#endif break; case MBEDTLS_TLS_PSK_WITH_AES_128_CCM_8: @@ -384,7 +383,7 @@ int Dtls::SetApplicationCoapSecureKeys(void) rval = mbedtls_ssl_conf_psk(&mConf, static_cast(mPreSharedKey), mPreSharedKeyLength, static_cast(mPreSharedKeyIdentity), mPreSharedKeyIdLength); VerifyOrExit(rval == 0, OT_NOOP); -#endif // MBEDTLS_KEY_EXCHANGE_PSK_ENABLED +#endif break; default: @@ -398,11 +397,6 @@ exit: return rval; } -void Dtls::SetSslAuthMode(bool aVerifyPeerCertificate) -{ - mVerifyPeerCertificate = aVerifyPeerCertificate; -} - #endif // OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE void Dtls::Close(void) @@ -485,7 +479,6 @@ void Dtls::SetCaCertificateChain(const uint8_t *aX509CaCertificateChain, uint32_ #endif // MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED #ifdef MBEDTLS_KEY_EXCHANGE_PSK_ENABLED - void Dtls::SetPreSharedKey(const uint8_t *aPsk, uint16_t aPskLength, const uint8_t *aPskIdentity, uint16_t aPskIdLength) { OT_ASSERT(aPsk != nullptr); @@ -501,7 +494,7 @@ void Dtls::SetPreSharedKey(const uint8_t *aPsk, uint16_t aPskLength, const uint8 mCipherSuites[0] = MBEDTLS_TLS_PSK_WITH_AES_128_CCM_8; mCipherSuites[1] = 0; } -#endif // MBEDTLS_KEY_EXCHANGE_PSK_ENABLED +#endif #ifdef MBEDTLS_BASE64_C @@ -519,7 +512,7 @@ exit: return error; } -#endif // MBEDTLS_BASE64_C +#endif #endif // OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE #ifdef MBEDTLS_SSL_SRV_C @@ -581,7 +574,7 @@ int Dtls::HandleMbedtlsTransmit(const unsigned char *aBuf, size_t aLength) { otLogDebgCoap("Dtls::ApplicationCoapSecure HandleMbedtlsTransmit"); } -#endif // OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE +#endif error = HandleDtlsSend(aBuf, static_cast(aLength), mMessageSubType); @@ -625,7 +618,7 @@ int Dtls::HandleMbedtlsReceive(unsigned char *aBuf, size_t aLength) { otLogDebgCoap("Dtls:: ApplicationCoapSecure HandleMbedtlsReceive"); } -#endif // OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE +#endif VerifyOrExit(mReceiveMessage != nullptr && (rval = mReceiveMessage->GetLength() - mReceiveMessage->GetOffset()) > 0, rval = MBEDTLS_ERR_SSL_WANT_READ); @@ -660,7 +653,7 @@ int Dtls::HandleMbedtlsGetTimer(void) { otLogDebgCoap("Dtls:: ApplicationCoapSecure HandleMbedtlsGetTimer"); } -#endif // OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE +#endif if (!mTimerSet) { @@ -698,7 +691,7 @@ void Dtls::HandleMbedtlsSetTimer(uint32_t aIntermediate, uint32_t aFinish) { otLogDebgCoap("Dtls::ApplicationCoapSecure SetTimer"); } -#endif // OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE +#endif if (aFinish == 0) { @@ -750,7 +743,7 @@ int Dtls::HandleMbedtlsExportKeys(const unsigned char *aMasterSecret, { otLogDebgCoap("ApplicationCoapSecure Generated KEK"); } -#endif // OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE +#endif return 0; } @@ -813,7 +806,10 @@ void Dtls::Process(void) if (rval > 0) { - mReceiveHandler(mContext, buf, static_cast(rval)); + if (mReceiveHandler != nullptr) + { + mReceiveHandler(mContext, buf, static_cast(rval)); + } } else if (rval == 0 || rval == MBEDTLS_ERR_SSL_WANT_READ || rval == MBEDTLS_ERR_SSL_WANT_WRITE) { @@ -874,30 +870,34 @@ exit: } } -void Dtls::HandleMbedtlsDebug(void *ctx, int level, const char *, int, const char *str) +void Dtls::HandleMbedtlsDebug(void *aContext, int aLevel, const char *aFile, int aLine, const char *aStr) { - OT_UNUSED_VARIABLE(str); + static_cast(aContext)->HandleMbedtlsDebug(aLevel, aFile, aLine, aStr); +} - Dtls *pThis = static_cast(ctx); - OT_UNUSED_VARIABLE(pThis); +void Dtls::HandleMbedtlsDebug(int aLevel, const char *aFile, int aLine, const char *aStr) +{ + OT_UNUSED_VARIABLE(aStr); + OT_UNUSED_VARIABLE(aFile); + OT_UNUSED_VARIABLE(aLine); - switch (level) + switch (aLevel) { case 1: - otLogCritMbedTls("[%hu] %s", pThis->mSocket.GetSockName().mPort, str); + otLogCritMbedTls("[%hu] %s", mSocket.GetSockName().mPort, aStr); break; case 2: - otLogWarnMbedTls("[%hu] %s", pThis->mSocket.GetSockName().mPort, str); + otLogWarnMbedTls("[%hu] %s", mSocket.GetSockName().mPort, aStr); break; case 3: - otLogInfoMbedTls("[%hu] %s", pThis->mSocket.GetSockName().mPort, str); + otLogInfoMbedTls("[%hu] %s", mSocket.GetSockName().mPort, aStr); break; case 4: default: - otLogDebgMbedTls("[%hu] %s", pThis->mSocket.GetSockName().mPort, str); + otLogDebgMbedTls("[%hu] %s", mSocket.GetSockName().mPort, aStr); break; } } diff --git a/src/core/meshcop/dtls.hpp b/src/core/meshcop/dtls.hpp index e2617c924..748a132de 100644 --- a/src/core/meshcop/dtls.hpp +++ b/src/core/meshcop/dtls.hpp @@ -48,8 +48,8 @@ #include #include #include -#endif // MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED -#endif // OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE +#endif +#endif #include "common/locator.hpp" #include "common/message.hpp" @@ -69,23 +69,7 @@ class Dtls : public InstanceLocator public: enum { - kPskMaxLength = 32, - kGuardTimeNewConnectionMilli = 2000, -#if !OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE - kApplicationDataMaxLength = 512, -#else - kApplicationDataMaxLength = OPENTHREAD_CONFIG_DTLS_APPLICATION_DATA_MAX_LENGTH, -#endif // OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE - }; - - enum State - { - kStateClosed = 0, - kStateOpen, - kStateInitializing, - kStateConnecting, - kStateConnected, - kStateCloseNotify, + kPskMaxLength = 32, ///< Maximum PSK length. }; /** @@ -126,17 +110,6 @@ public: */ typedef otError (*TransportCallback)(void *aContext, ot::Message &aMessage, const Ip6::MessageInfo &aMessageInfo); - /** - * This function pointer is called when data is ready to transmit for the DTLS session. - * - * @param[in] aContext A pointer to application-specific context. - * @param[in] aBuf A pointer to the transmit data buffer. - * @param[in] aLength Number of bytes in the transmit data buffer. - * @param[in] aMessageSubtype A message sub type information for the sender. - * - */ - typedef otError (*SendHandler)(void *aContext, const uint8_t *aBuf, uint16_t aLength, uint8_t aMessageSubType); - /** * This method opens the DTLS socket. * @@ -156,7 +129,7 @@ public: * @param[in] aPort The port to bind. * * @retval OT_ERROR_NONE Successfully bound the DTLS socket. - * @retval OT_ERROR_INVALID_STATE The DTLS service is not in state kStateOpen. + * @retval OT_ERROR_INVALID_STATE The DTLS socket is not open. * @retval OT_ERROR_ALREADY Already bound. * */ @@ -169,7 +142,7 @@ public: * @param[in] aContext A pointer to arbitrary context information. * * @retval OT_ERROR_NONE Successfully bound the DTLS socket. - * @retval OT_ERROR_INVALID_STATE The DTLS service is not in state kStateOpen. + * @retval OT_ERROR_INVALID_STATE The DTLS socket is not open. * @retval OT_ERROR_ALREADY Already bound. * */ @@ -185,7 +158,7 @@ public: * @param[in] aSockAddr A reference to the remote sockaddr. * * @retval OT_ERROR_NONE Successfully started DTLS handshake. - * @retval OT_ERROR_INVALID_STATE The DTLS service is not in state kStateOpen. + * @retval OT_ERROR_INVALID_STATE The DTLS socket is not open. * */ otError Connect(const Ip6::SockAddr &aSockAddr); @@ -193,8 +166,6 @@ public: /** * This method indicates whether or not the DTLS session is active. * - * In other words, the state is kStateConnecting, kStateConnected, or kStateCloseNotify. - * * @retval TRUE If DTLS session is active. * @retval FALSE If DTLS session is not active. * @@ -204,8 +175,6 @@ public: /** * This method indicates whether or not the DTLS session is connected. * - * In other words, the state is kStateConnected. - * * @retval TRUE The DTLS session is connected. * @retval FALSE The DTLS session is not connected. * @@ -224,18 +193,6 @@ public: */ void Close(void); - /** - * This method returns the DTLS connection state. - * - * @retval kStateClosed The UDP socket closed. - * @retval kStateOpen The UDP socket is open. - * @retval kStateConnecting The DTLS service is establishing a connection. - * @retval kStateConnected The DTLS service has a connection established. - * @retval kStateCloseNotify The DTLS service is closing a connection. - * - */ - State GetState(void) const { return mState; } - /** * This method sets the PSK. * @@ -265,7 +222,7 @@ public: */ void SetPreSharedKey(const uint8_t *aPsk, uint16_t aPskLength, const uint8_t *aPskIdentity, uint16_t aPskIdLength); -#endif // MBEDTLS_KEY_EXCHANGE_PSK_ENABLED +#endif #ifdef MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED /** @@ -313,7 +270,7 @@ public: * */ otError GetPeerCertificateBase64(unsigned char *aPeerCert, size_t *aCertLength, size_t aCertBufferSize); -#endif // MBEDTLS_BASE64_C +#endif /** * This method set the authentication mode for a dtls connection. @@ -324,7 +281,7 @@ public: * @param[in] aVerifyPeerCertificate true, if the peer certificate should verify. * */ - void SetSslAuthMode(bool aVerifyPeerCertificate); + void SetSslAuthMode(bool aVerifyPeerCertificate) { mVerifyPeerCertificate = aVerifyPeerCertificate; } #endif // OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE #ifdef MBEDTLS_SSL_SRV_C @@ -380,6 +337,26 @@ public: void HandleUdpReceive(Message &aMessage, const Ip6::MessageInfo &aMessageInfo); private: + enum State : uint8_t + { + kStateClosed, // UDP socket is closed. + kStateOpen, // UDP socket is open. + kStateInitializing, // The DTLS service is initializing. + kStateConnecting, // The DTLS service is establishing a connection. + kStateConnected, // The DTLS service has a connection established. + kStateCloseNotify, // The DTLS service is closing a connection. + }; + + enum + { + kGuardTimeNewConnectionMilli = 2000, +#if !OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE + kApplicationDataMaxLength = 512, +#else + kApplicationDataMaxLength = OPENTHREAD_CONFIG_DTLS_APPLICATION_DATA_MAX_LENGTH, +#endif + }; + void FreeMbedtls(void); otError Setup(bool aClient); @@ -391,9 +368,10 @@ private: * */ int SetApplicationCoapSecureKeys(void); -#endif // OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE +#endif - static void HandleMbedtlsDebug(void *ctx, int level, const char *file, int line, const char *str); + static void HandleMbedtlsDebug(void *aContext, int aLevel, const char *aFile, int aLine, const char *aStr); + void HandleMbedtlsDebug(int aLevel, const char *aFile, int aLine, const char *aStr); static int HandleMbedtlsGetTimer(void *aContext); int HandleMbedtlsGetTimer(void); @@ -437,7 +415,6 @@ private: #if OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE #ifdef MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED - const uint8_t * mCaChainSrc; uint32_t mCaChainLength; const uint8_t * mOwnCertSrc; @@ -447,15 +424,14 @@ private: mbedtls_x509_crt mCaChain; mbedtls_x509_crt mOwnCert; mbedtls_pk_context mPrivateKey; -#endif // MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED - +#endif #ifdef MBEDTLS_KEY_EXCHANGE_PSK_ENABLED const uint8_t *mPreSharedKey; const uint8_t *mPreSharedKeyIdentity; uint16_t mPreSharedKeyLength; uint16_t mPreSharedKeyIdLength; -#endif // MBEDTLS_KEY_EXCHANGE_PSK_ENABLED -#endif // OPENTHREAD_CONFIG_COAP_SECURE_API_ENABLE +#endif +#endif bool mVerifyPeerCertificate; @@ -477,7 +453,6 @@ private: ConnectedHandler mConnectedHandler; ReceiveHandler mReceiveHandler; - SendHandler mSendHandler; void * mContext; Ip6::MessageInfo mPeerAddress;