dtls

package module
v2.7.7 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 20, 2023 License: MPL-2.0 Imports: 33 Imported by: 2

README

dtls

Build Status Coverage GoDoc License ReportCard

https://github.com/qwerty-iot/dtls

Renamed from https://github.com/bocajim/dtls

This package implements a RFC-4347 compliant DTLS client and server.

Key Features

  • Pure go, no CGo
  • Supports both client and server via UDP
  • Supports TLS_PSK_WITH_AES_128_CCM_8 cipher RFC-6655
  • Supports TLS_PSK_WITH_AES_128_CBC_SHA256 cipher RFC-5487
  • Supports TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8 cipher RFC-7251
  • Supports pre-shared key authentication
  • Supports certificate based authentication
  • Supports DTLS session resumption
  • Supports persisting session data for resumption later
  • Designed for OMA LWM2M comliance LWM2M
  • Support for Connection ID RFC-9146 (Nov/19 draft)

TODO

  • Implement session renegotiation
  • Implement packet retransmission for handshake
  • Implement out of order handshake processing
  • Implement replay detection
  • Implement client hello stateless cookie handling
  • Improve parallel processing of incoming packets
  • Implement Connection ID for latest RFC-9146 draft

Samples

Keystore

    mks := keystore.NewMemoryKeyStore()
keystore.SetKeyStores([]keystore.KeyStore{mks})
psk, _ := hex.DecodeString("00112233445566")
mks.AddKey("myIdentity", psk)

Sample Client

    listener, _ = NewUdpListener(":6000", time.Second*5)
peer, err := listener.AddPeer("127.0.0.1:5684", "myIdentity")

err = peer.Write("hello world")
data, rsp := listener.Read()

Generating Certificates

The following commands can be used to generate certificates for testing:

# generate private key
openssl ecparam -out key.pem -name prime256v1 -genkey

# generate certificate
openssl req -new -key key.pem -x509 -nodes -days 3650 -out cert.pem

Documentation

http://godoc.org/github.com/qwerty-iot/dtls

License

Mozilla Public License Version 2.0

NOTE: License was changed from MIT on 11/20/2020.

Documentation

Overview

Package ccm implements a CCM, Counter with CBC-MAC as per RFC 3610.

See https://tools.ietf.org/html/rfc3610

Index

Constants

View Source
const (
	AlertType_Warning                uint8 = 1
	AlertType_Fatal                  uint8 = 2
	AlertDesc_CloseNotify            uint8 = 0
	AlertDesc_UnexpectedMessage      uint8 = 10
	AlertDesc_BadRecordMac           uint8 = 20
	AlertDesc_DecryptionFailed       uint8 = 21
	AlertDesc_RecordOverflow         uint8 = 22
	AlertDesc_DecompressionFailure   uint8 = 30
	AlertDesc_HandshakeFailure       uint8 = 40
	AlertDesc_NoCertificate          uint8 = 41
	AlertDesc_BadCertificate         uint8 = 42
	AlertDesc_UnsupportedCertificate uint8 = 43
	AlertDesc_CertificateRevoked     uint8 = 44
	AlertDesc_CertificateExpired     uint8 = 45
	AlertDesc_CertificateUnknown     uint8 = 46
	AlertDesc_IllegalParameter       uint8 = 47
	AlertDesc_UnknownCa              uint8 = 48
	AlertDesc_AccessDenied           uint8 = 49
	AlertDesc_DecodeError            uint8 = 50
	AlertDesc_DecryptError           uint8 = 51
	AlertDesc_ExportRestriction      uint8 = 60
	AlertDesc_ProtocolVersion        uint8 = 70
	AlertDesc_InsufficientSecurity   uint8 = 71
	AlertDesc_InternalError          uint8 = 80
	AlertDesc_UserCanceled           uint8 = 90
	AlertDesc_NoRenegotiation        uint8 = 100
	AlertDesc_UnsupportedExtension   uint8 = 110
	AlertDesc_Noop                   uint8 = 254
)
View Source
const (
	DtlsVersion10 uint16 = 0xFEFF
	DtlsVersion12 uint16 = 0xFEFD
)
View Source
const (
	LogLevelError string = "error"
	LogLevelWarn  string = "warn"
	LogLevelInfo  string = "info"
	LogLevelDebug string = "debug"
)
View Source
const (
	ContentType_ChangeCipherSpec ContentType = 20
	ContentType_Alert                        = 21
	ContentType_Handshake                    = 22
	ContentType_Appdata                      = 23
	ContentType_Appdata_Cid                  = 25
)
View Source
const (
	SessionType_Server string = "server"
	SessionType_Client string = "client"
)
View Source
const (
	SniffWrite = "write"
	SniffRead  = "read"
)
View Source
const (
	AadAuthLen int = 13
)
View Source
const DtlsExtConnectionId = uint16(54)
View Source
const DtlsExtConnectionIdLegacy = uint16(254)
View Source
const (
	EccCurve_P256 eccCurve = 0x0017
)

Variables

View Source
var DebugEncryption bool = false
View Source
var DebugHandshake bool = false
View Source
var DebugHandshakeHash bool = false
View Source
var HandshakeCompleteCallback func(*Peer, []byte, time.Duration, error)

This callback is invoked each time a handshake completes, if the handshake failed, the reason is stored in error

View Source
var MaxPacketSize = 16384
View Source
var SessionCacheSweepInterval = time.Minute * -5

set to the interval to look for expired sessions

View Source
var SessionCacheTtl = time.Hour * 24

set to whatever you want the cache time to live to be

View Source
var SessionExportCallback func(*Peer)
View Source
var SessionImportCallback func(*Peer) string
View Source
var SessionInactivityTimeout = time.Hour * 24
View Source
var ValidateCertificateCallback func(*Peer, *x509.Certificate) error

Functions

func CertificateFromDisk added in v2.2.0

func CertificateFromDisk(keyPath string, certificatePath string) (*tls.Certificate, error)

func DebugAll

func DebugAll()

func GetPskFromKeystore

func GetPskFromKeystore(identity []byte, remoteAddr string) []byte

func SessionCacheSize

func SessionCacheSize() int

func SetExportSecret added in v2.1.0

func SetExportSecret(key string)

func SetKeyStores

func SetKeyStores(ks []Keystore)

func SetLogFunc

func SetLogFunc(lf LogFunc)

func SetLogLevel

func SetLogLevel(level string)

func SetSniffPacketsCallback added in v2.7.3

func SetSniffPacketsCallback(callback SniffPacketsCallback)

Types

type CCM

type CCM interface {
	cipher.AEAD
	// MaxLength returns the maxium length of plaintext in calls to Seal.
	// The maximum length of ciphertext in calls to Open is MaxLength()+Overhead().
	// The maximum length is related to CCM's `L` parameter (15-noncesize) and
	// is 1<<(8*L) - 1 (but also limited by the maxium size of an int).
	MaxLength() int
}

CCM is a block cipher in Counter with CBC-MAC mode. Providing authenticated encryption with associated data via the cipher.AEAD interface.

func NewCCM

func NewCCM(b cipher.Block, tagsize, noncesize int) (CCM, error)

NewCCM returns the given 128-bit block cipher wrapped in CCM. The tagsize must be an even integer between 4 and 16 inclusive and is used as CCM's `M` parameter. The noncesize must be an integer between 7 and 13 inclusive, 15-noncesize is used as CCM's `L` parameter.

type Cipher

type Cipher interface {
	GetPrfSize() int
	GenerateKeyBlock(masterSecret []byte, rawKeyBlock []byte) *KeyBlock
	Encrypt(s *session, rec *record, key []byte, iv []byte, mac []byte) ([]byte, error)
	Decrypt(s *session, rec *record, key []byte, iv []byte, mac []byte) ([]byte, error)
}

type CipherCBC

type CipherCBC struct {
	// contains filtered or unexported fields
}

func (CipherCBC) Decrypt

func (c CipherCBC) Decrypt(s *session, rec *record, key []byte, iv []byte, mac []byte) ([]byte, error)

func (CipherCBC) Encrypt

func (c CipherCBC) Encrypt(s *session, rec *record, key []byte, iv []byte, mac []byte) ([]byte, error)

func (CipherCBC) GenerateKeyBlock

func (c CipherCBC) GenerateKeyBlock(masterSecret []byte, rawKeyBlock []byte) *KeyBlock

func (CipherCBC) GetPrfSize

func (c CipherCBC) GetPrfSize() int

type CipherCcm

type CipherCcm struct {
	// contains filtered or unexported fields
}

func (CipherCcm) Decrypt

func (c CipherCcm) Decrypt(s *session, rec *record, key []byte, iv []byte, mac []byte) ([]byte, error)

func (CipherCcm) Encrypt

func (c CipherCcm) Encrypt(s *session, rec *record, key []byte, iv []byte, mac []byte) ([]byte, error)

func (CipherCcm) GenerateKeyBlock

func (c CipherCcm) GenerateKeyBlock(masterSecret []byte, rawKeyBlock []byte) *KeyBlock

func (CipherCcm) GetPrfSize

func (c CipherCcm) GetPrfSize() int

type CipherSuite

type CipherSuite uint16
const (
	CipherSuite_TLS_PSK_WITH_AES_128_CCM_8              CipherSuite = 0xC0A8
	CipherSuite_TLS_PSK_WITH_AES_128_CBC_SHA256         CipherSuite = 0x00AE
	CipherSuite_TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8      CipherSuite = 0xC0AE
	CipherSuite_TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 CipherSuite = 0xC023
)

func (CipherSuite) NeedCert added in v2.4.0

func (cs CipherSuite) NeedCert() bool

func (CipherSuite) NeedPsk added in v2.4.0

func (cs CipherSuite) NeedPsk() bool

func (CipherSuite) String added in v2.7.1

func (cs CipherSuite) String() string

type CompressionMethod

type CompressionMethod uint8
const (
	CompressionMethod_Null CompressionMethod = 0
)

type ContentType

type ContentType uint8

type KeyBlock added in v2.1.0

type KeyBlock struct {
	MasterSecret   []byte `json:"masterSecret"`
	ClientMac      []byte `json:"clientMac"`
	ServerMac      []byte `json:"serverMac"`
	ClientWriteKey []byte `json:"clientWriteKey"`
	ServerWriteKey []byte `json:"serverWriteKey"`
	ClientIV       []byte `json:"clientIV"`
	ServerIV       []byte `json:"serverIV"`
}

func (*KeyBlock) Print added in v2.1.0

func (kb *KeyBlock) Print() string

type Keystore

type Keystore interface {
	GetPsk(identity []byte, remoteAddr string) ([]byte, error)
}

type KeystoreInMemory

type KeystoreInMemory struct {
	// contains filtered or unexported fields
}

func NewKeystoreInMemory

func NewKeystoreInMemory() *KeystoreInMemory

func (*KeystoreInMemory) AddKey

func (ks *KeystoreInMemory) AddKey(identity []byte, psk []byte)

func (*KeystoreInMemory) GetPsk

func (ks *KeystoreInMemory) GetPsk(identity []byte, remoteAddr string) ([]byte, error)

type Listener

type Listener struct {
	// contains filtered or unexported fields
}

func NewUdpListener

func NewUdpListener(listener string, readTimeout time.Duration) (*Listener, error)

func (*Listener) AddCipherSuite

func (l *Listener) AddCipherSuite(cipherSuite CipherSuite)

func (*Listener) AddCompressionMethod

func (l *Listener) AddCompressionMethod(compressionMethod CompressionMethod)

func (*Listener) AddPeer

func (l *Listener) AddPeer(addr string, identity []byte) (*Peer, error)

func (*Listener) AddPeerWithParams

func (l *Listener) AddPeerWithParams(params *PeerParams) (*Peer, error)

func (*Listener) CountPeers

func (l *Listener) CountPeers() int

func (*Listener) EachPeer added in v2.1.0

func (l *Listener) EachPeer(callback func(peer *Peer))

func (*Listener) EnableConnectionId added in v2.6.0

func (l *Listener) EnableConnectionId(cidLen int)

func (*Listener) FindPeer

func (l *Listener) FindPeer(addr string) (*Peer, error)

func (*Listener) LocalAddr added in v2.5.0

func (l *Listener) LocalAddr() string

func (*Listener) Read

func (l *Listener) Read() ([]byte, *Peer)

func (*Listener) RemovePeer

func (l *Listener) RemovePeer(peer *Peer, alertDesc uint8)

func (*Listener) RemovePeerByAddr

func (l *Listener) RemovePeerByAddr(addr string, alertDesc uint8)

func (*Listener) SetCertificate added in v2.2.0

func (l *Listener) SetCertificate(cert tls.Certificate) error

func (*Listener) SetFrameLimits added in v2.2.0

func (l *Listener) SetFrameLimits(maxPacket int, maxHandshake int)

func (*Listener) Shutdown

func (l *Listener) Shutdown() error

func (*Listener) UpdatePeer added in v2.6.4

func (l *Listener) UpdatePeer(p *Peer, trans TransportEndpoint, lock bool)

type LogFunc

type LogFunc func(ts time.Time, level string, peer *Peer, err error, msg string)

type Peer

type Peer struct {
	// contains filtered or unexported fields
}

func (*Peer) CipherSuite added in v2.7.1

func (p *Peer) CipherSuite() string

func (*Peer) Close

func (p *Peer) Close(alertDesc uint8)

func (*Peer) LastActivity

func (p *Peer) LastActivity() time.Time

func (*Peer) Lock

func (p *Peer) Lock()

func (*Peer) Read

func (p *Peer) Read(timeout time.Duration) ([]byte, error)

func (*Peer) RemoteAddr

func (p *Peer) RemoteAddr() string

func (*Peer) SessionCertificate added in v2.2.1

func (p *Peer) SessionCertificate() *x509.Certificate

func (*Peer) SessionCid added in v2.6.0

func (p *Peer) SessionCid() []byte

func (*Peer) SessionExport added in v2.1.0

func (p *Peer) SessionExport() string

func (*Peer) SessionIdentity

func (p *Peer) SessionIdentity() []byte

func (*Peer) SessionIdentityOrPublicKeyString added in v2.5.11

func (p *Peer) SessionIdentityOrPublicKeyString() string

func (*Peer) SessionIdentityString

func (p *Peer) SessionIdentityString() string

func (*Peer) SessionPeerCid added in v2.7.1

func (p *Peer) SessionPeerCid() []byte

func (*Peer) SessionPublicKey added in v2.2.1

func (p *Peer) SessionPublicKey() []byte

func (*Peer) SetName

func (p *Peer) SetName(name string)

func (*Peer) Unlock

func (p *Peer) Unlock()

func (*Peer) UseQueue

func (p *Peer) UseQueue(en bool)

func (*Peer) Write

func (p *Peer) Write(data []byte) error

type PeerParams

type PeerParams struct {
	Addr             string
	Identity         []byte
	HandshakeTimeout time.Duration
	SessionId        []byte
}

type SessionStore added in v2.1.0

type SessionStore struct {
	Id                  []byte      `json:"id"`
	Type                string      `json:"type"`
	RemoteAddr          string      `json:"remoteAddr"`
	PeerIdentity        []byte      `json:"peerIdentity"`
	Cid                 []byte      `json:"cid"`
	PeerCid             []byte      `json:"peerCid"`
	CidVersion          uint16      `json:"cidVersion"`
	Epoch               uint16      `json:"epoch"`
	SequenceNumber0     uint64      `json:"sequenceNumber0"`
	SequenceNumber1     uint64      `json:"sequenceNumber1"`
	KeyBlock            *KeyBlock   `json:"KeyBlock"`
	SelectedCipherSuite CipherSuite `json:"selectedCipherSuite"`
}

type SniffPacketsCallback added in v2.7.3

type SniffPacketsCallback func(transportType string, op string, from string, to string, data []byte)

type Transport

type Transport interface {
	Type() string
	Local() string
	Shutdown() error
	NewEndpoint(address string) TransportEndpoint
	ReadPacket() ([]byte, TransportEndpoint, error)
}

type TransportEndpoint

type TransportEndpoint interface {
	String() string
	WritePacket(data []byte) error
}

func NewUdpPeerFromSocket

func NewUdpPeerFromSocket(socket *net.UDPConn, addr *net.UDPAddr) TransportEndpoint

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL