coap_new_context()
coap_context_set_pki_root_cas() - if the root CAs need to be updated and PKI
coap_context_set_pki() and/or coap_context_set_psk2() - if encryption is required
coap_new_endpoint()

coap_new_context()
coap_context_set_pki_root_cas() - if the root CAs need to be updated and PKI
coap_new_client_session(), coap_new_client_session_pki() or coap_new_client_session_psk2()

typedef struct coap_dtls_cpsk_t {


  uint8_t version; /** Set to COAP_DTLS_CPSK_SETUP_VERSION


                       to support the version of the struct */


  /* Options to enable different TLS functionality in libcoap */


  uint8_t ec_jpake;        /* Set to 1 if DC-JPAKE is to be used.


                              Currently Mbed TLS only */


  uint8_t use_cid;         /* Set to 1 if DTLS Connection ID is to be used.


                              Currently Mbed TLS only */


  /* Options to enable different TLS functionality in libcoap */


  uint8_t reserved[5];             /* Reserved - must be set to 0 for


                                      future compatibility */


  /** Identity Hint check callback function.


   * If not NULL, is called when the Identity Hint (TLS1.2 or earlier) is


   * provided by the server.


   * The appropriate Identity and Pre-Shared Key to use can then be returned.


   */


  coap_dtls_ih_callback_t validate_ih_call_back;


  void *ih_call_back_arg;  /* Passed in to the Identity Hint callback


                              function */


  char* client_sni;    /*  If not NULL, SNI to use in client TLS setup.


                           Owned by the client app and must remain valid


                           during the call to coap_new_client_session_pki().


                           Note: Ignored if literal IPv4 or IPv6 address.


                           Note: Not supported by TinyDTLS. */


  coap_dtls_cpsk_info_t psk_info;  /* Client PSK definition */
} coap_dtls_cpsk_t;

#define COAP_DTLS_CPSK_SETUP_VERSION 1 /**< Latest CPSK setup version */

/**


 * Identity Hint Validation callback that can be set up by


 * coap_new_client_session_psk2().


 * Invoked when libcoap has done the validation checks at the TLS level,


 * but the application needs to check that the Identity Hint is allowed, and


 * needs to use the appropriate PSK information for the (D)TLS session.


 * Note: Identity Hint is not supported in (D)TLS1.3.


 *


 * @param hint  The server provided Identity Hint


 * @param coap_session  The CoAP session associated with the Identity Hint


 * @param arg  The same as was passed into coap_new_client_session_psk2()


 *             in setup_data->ih_call_back_arg


 *


 * @return New coap_dtls_cpsk_info_t object or @c NULL on error.


 */
typedef const coap_dtls_cpsk_info_t *(*coap_dtls_ih_callback_t)(


                                coap_str_const_t *hint,


                                coap_session_t *coap_session,


                                void *arg);

typedef struct coap_dtls_cpsk_info_t {


  coap_bin_const_t identity; /* The Identity */


  coap_bin_const_t key;      /* The Pre-Shared Key */
} coap_dtls_cpsk_info_t;

typedef struct coap_dtls_spsk_t {


  uint8_t version; /* Set to COAP_DTLS_SPSK_SETUP_VERSION


                       to support the version of the struct */


  /* Options to enable different TLS functionality in libcoap */


  uint8_t ec_jpake;        /* Set to 1 if DC-JPAKE can be used.


                              Currently Mbed TLS only */


  /* Options to enable different TLS functionality in libcoap */


  uint8_t reserved[6];             /* Reserved - must be set to 0 for


                                      future compatibility */


  /** Identity check callback function.


   * If not @p NULL, is called when the Identity is provided by the client.


   *  The appropriate Pre-Shared Key to use can then be returned.


   */


  coap_dtls_id_callback_t validate_id_call_back;


  void *id_call_back_arg;  /* Passed in to the Identity callback function */


  /** SNI check callback function.


   * If not @p NULL, called if the SNI is not previously seen and exexuted


   * prior to sending an Identity Hint back to the client so that the


   * appropriate PSK information can be used based on the requesting SNI.


   */


  coap_dtls_psk_sni_callback_t validate_sni_call_back;


  void *sni_call_back_arg;  /* Passed in to the SNI callback function */


  coap_dtls_spsk_info_t psk_info;  /* Server PSK definition */
} coap_dtls_spsk_t;

#define COAP_DTLS_SPSK_SETUP_VERSION 1 /**< Latest SPSK setup version */

/**


 * Identity Validation callback that can be set up by


 * coap_context_set_psk2().


 * Invoked when libcoap has done the validation checks at the TLS level,


 * but the application needs to check that the Identity is allowed, and


 * needs to use the appropriate Pre-Shared Key for the (D)TLS session.


 *


 * @param identity  The client provided Identity (should be NULL terminated)


 * @param coap_session  The CoAP session associated with the Identity Hint


 * @param arg  The same as was passed into coap_context_set_psk2()


 *             in setup_data->id_call_back_arg


 *


 * @return New coap_bin_const_t Pre-Shared Key object or @c NULL on error.


 */
typedef const coap_bin_const_t *(*coap_dtls_id_callback_t)(


                                 coap_bin_const_t *identity,


                                 coap_session_t *coap_session,


                                 void *arg);

/**


 * PSK SNI callback that can be set up by coap_context_set_psk2().


 * Invoked when libcoap has done the validation checks at the TLS level,


 * but the application needs to check that the SNI is allowed, and needs


 * to use the appropriate PSK information for the (D)TLS session.


 *


 * @param sni  The client provided SNI


 * @param coap_session  The CoAP session associated with the SNI


 * @param arg  The same as was passed into coap_new_client_session_psk2()


 *             in setup_data->sni_call_back_arg


 *


 * @return New coap_dtls_spsk_info_t object or @c NULL on error.


 */
typedef const coap_dtls_spsk_info_t *(*coap_dtls_psk_sni_callback_t)(


                                 const char *sni,


                                 coap_session_t *coap_session,


                                 void *arg);

typedef struct coap_dtls_spsk_info_t {


  coap_bin_const_t hint; /* The identity hint to use */


  coap_bin_const_t key;  /* The Pre-Shared Key to use */
} coap_dtls_spsk_info_t;

typedef struct coap_dtls_pki_t {


  uint8_t version;            /* COAP_DTLS_PKI_SETUP_VERSION */


  /* Options to enable different TLS functionality in libcoap */


  uint8_t verify_peer_cert;         /* 1 if peer cert is to be verified */


  uint8_t check_common_ca;          /* 1 if peer cert is to be signed by


                                     * the same CA as the local cert */


  uint8_t allow_self_signed;        /* 1 if self-signed certs are allowed */


  uint8_t allow_self_signed;        /* 1 if self-signed certs are allowed.


                                     * Ignored if check_common_ca set */


  uint8_t allow_expired_certs;      /* 1 if expired certs are allowed */


  uint8_t cert_chain_validation;    /* 1 if to check cert_chain_verify_depth */


  uint8_t cert_chain_verify_depth;  /* recommended depth is 3 */


  uint8_t check_cert_revocation;    /* 1 if revocation checks wanted */


  uint8_t allow_no_crl;             /* 1 ignore if CRL not there */


  uint8_t allow_expired_crl;        /* 1 if expired crl is allowed */


  uint8_t allow_bad_md_hash;        /* 1 if unsupported MD hashes are allowed */


  uint8_t allow_short_rsa_length;   /* 1 if small RSA keysizes are allowed */


  uint8_t is_rpk_not_cert;          /* 1 is RPK instead of Public Certificate.


                                     *   If set, PKI key format type cannot be


                                     *   COAP_PKI_KEY_PEM */


  uint8_t use_cid;                  /* 1 if DTLS Connection ID is to be


                                     *   used (Client only, server always enabled)


                                     *   if supported */


  uint8_t reserved[2];              /* Reserved - must be set to 0 for


                                       future compatibility */


  /** CN check callback function


   * If not NULL, is called when the TLS connection has passed the configured


   * TLS options above for the application to verify if the CN is valid.


   */


  coap_dtls_cn_callback_t validate_cn_call_back;


  void *cn_call_back_arg;  /* Passed in to the CN callback function */


  /** SNI check callback function


   * If not NULL, called if the SNI is not previously seen and prior to sending


   * a certificate set back to the client so that the appropriate certificate


   * set can be used based on the requesting SNI.


   */


  coap_dtls_sni_callback_t validate_sni_call_back;


  void *sni_call_back_arg;  /* Passed in to the SNI callback function */


  /** Additional Security callback handler that is invoked when libcoap has


   * done the standard, defined validation checks at the TLS level,


   * If not NULL, called from within the TLS Client Hello connection


   * setup.


   */


  coap_dtls_security_setup_t additional_tls_setup_call_back;


  char* client_sni;       /* If not NULL, SNI to use in client TLS setup.


                             Owned by the client app and must remain valid


                             during the call to coap_new_client_session_pki().


                             Note: Ignored if literal IPv4 or IPv6 address. */


  coap_dtls_key_t pki_key; /* PKI key definition */
} coap_dtls_pki_t;

#define COAP_DTLS_PKI_SETUP_VERSION 1

#define COAP_DTLS_RPK_CERT_CN "RPK"
/**


 * CN Validation callback that can be set up by coap_context_set_pki().


 * Invoked when libcoap has done the validation checks at the TLS level,


 * but the application needs to check that the CN is allowed.


 * CN is the SubjectAltName in the cert, if not present, then the leftmost


 * Common Name (CN) component of the subject name.


 * NOTE: If using RPK, then the Public Key does not contain a CN, but the


 * content of COAP_DTLS_RPK_CERT_CN is presented for the @p cn parameter.


 *


 * @param cn  The determined CN from the certificate


 * @param asn1_public_cert  The ASN.1 encoded (DER) X.509 certificate


 * @param asn1_length  The ASN.1 length


 * @param session  The coap session associated with the certificate update


 * @param depth  Depth in cert chain.  If 0, then client cert, else a CA


 * @param validated  TLS can find no issues if 1


 * @param arg  The same as was passed into coap_context_set_pki()


 *             in setup_data->cn_call_back_arg


 *


 * @return 1 if accepted, else 0 if to be rejected


 */
typedef int (*coap_dtls_cn_callback_t)(const char *cn,


             const uint8_t *asn1_public_cert,


             size_t asn1_length,


             coap_session_t *session,


             unsigned int depth,


             int validated,


             void *arg);

typedef struct coap_dtls_key_t {


  coap_pki_key_t key_type;          /* key format type */


  union {


    coap_pki_key_pem_t pem;         /* for PEM file keys */


    coap_pki_key_pem_buf_t pem_buf; /* for PEM memory keys */


    coap_pki_key_asn1_t asn1;       /* for ASN.1 (DER) memory keys */


    coap_pki_key_pkcs11_t pkcs11;   /* for PKCS11 keys */


    coap_pki_key_define_t define;   /* definable type keys */


  } key;
} coap_dtls_key_t;
/**


 * SNI Validation callback that can be set up by coap_context_set_pki().


 * Invoked if the SNI is not previously seen and prior to sending a certificate


 * set back to the client so that the appropriate certificate set can be used


 * based on the requesting SNI.


 *


 * @param sni  The requested SNI


 * @param arg  The same as was passed into coap_context_set_pki()


 *             in setup_data->sni_call_back_arg


 *


 * @return new set of certificates to use, or NULL if SNI is to be rejected.


 */
typedef coap_dtls_key_t *(*coap_dtls_sni_callback_t)(const char *sni,


             void* arg);

/**


 * Additional Security setup handler that can be set up by


 * coap_context_set_pki().


 * Invoked when libcoap has done the validation checks at the TLS level,


 * but the application needs to do some additional checks/changes/updates.


 *


 * @param session The security session definition - e.g. SSL * for OpenSSL.


 *                This will be dependent on the underlying TLS library


 *                - see coap_get_tls_library_version()


 * @param setup_data A structure containing setup data originally passed into


 *                   coap_context_set_pki() or coap_new_client_session_pki().


 * @return 1 if successful, else 0


 */
typedef int (*coap_dtls_security_setup_t)(void *context, void* session,


                                          coap_dtls_pki_t *setup_data);

typedef enum coap_pki_key_t {


  COAP_PKI_KEY_PEM,     /* The PKI key type is PEM file */


  COAP_PKI_KEY_ASN1,    /* The PKI key type is ASN.1 (DER) buffer */


  COAP_PKI_KEY_PEM_BUF, /* The PKI key type is PEM buffer */


  COAP_PKI_KEY_PKCS11,  /* The PKI key type is PKCS11 (DER) */


  COAP_PKI_KEY_DEFINE,  /* The individual PKI key types are Definable */
} coap_pki_key_t;

typedef struct coap_pki_key_pem_t {


  const char *ca_file;       /* File location of Common CA (and any


                                intermediates) in PEM format */


  const char *public_cert;   /* File location of Public Cert */


  const char *private_key;   /* File location of Private Key in PEM format */
} coap_pki_key_pem_t;

typedef struct coap_pki_key_pem_buf_t {


  const uint8_t *ca_cert;     /* PEM buffer Common CA Cert */


  const uint8_t *public_cert; /* PEM buffer Public Cert, or Public Key if RPK */


  const uint8_t *private_key; /* PEM buffer Private Key */


                                 If RPK and 'EC PRIVATE KEY' this can be used


                                 for both the public_cert and private_key */


  size_t ca_cert_len;         /* PEM buffer CA Cert length */


  size_t public_cert_len;     /* PEM buffer Public Cert length */


  size_t private_key_len;     /* PEM buffer Private Key length */
} coap_pki_key_pem_buf_t;

typedef struct coap_pki_key_asn1_t {


  const uint8_t *ca_cert;     /* ASN1 Common CA Certificate */


  const uint8_t *public_cert; /* ASN1 (DER) Public Cert, or Public Key if RPK */


  const uint8_t *private_key; /* ASN1 Private Key */


  int ca_cert_len;            /* ASN1 CA Certificate length */


  int public_cert_len;        /* ASN1 Public Certificate length */


  int private_key_len;        /* ASN1 Private Key length */


  coap_asn1_privatekey_type_t private_key_type; /* Private Key Type


                                                   COAP_ASN1_PKEY_* */
} coap_pki_key_asn1_t;
typedef enum coap_asn1_privatekey_type_t {


  COAP_ASN1_PKEY_NONE,


  COAP_ASN1_PKEY_RSA,


  COAP_ASN1_PKEY_RSA2,


  COAP_ASN1_PKEY_DSA,


  COAP_ASN1_PKEY_DSA1,


  COAP_ASN1_PKEY_DSA2,


  COAP_ASN1_PKEY_DSA3,


  COAP_ASN1_PKEY_DSA4,


  COAP_ASN1_PKEY_DH,


  COAP_ASN1_PKEY_DHX,


  COAP_ASN1_PKEY_EC,


  COAP_ASN1_PKEY_HMAC,


  COAP_ASN1_PKEY_CMAC,


  COAP_ASN1_PKEY_TLS1_PRF,


  COAP_ASN1_PKEY_HKDF
} coap_asn1_privatekey_type_t;

typedef struct coap_pki_key_pkcs11_t {


  const char *ca;            /* pkcs11: URI for Common CA Certificate */


  const char *public_cert;   /* pkcs11: URI for Public Cert */


  const char *private_key;   /* pkcs11: URI for Private Key */


  const char *user_pin;      /* User pin to access PKCS11.  If NULL, then


                                pin-value= parameter must be set in


                                pkcs11: URI as a query. */
} coap_pki_key_pkcs11_t;

typedef struct coap_pki_key_define_t {


  coap_const_char_ptr_t ca;          /* define: Common CA Certificate */


  coap_const_char_ptr_t public_cert; /* define: Public Cert */


  coap_const_char_ptr_t private_key; /* define: Private Key */


  size_t ca_len;             /* define CA Cert length (if needed)*/


  size_t public_cert_len;    /* define Public Cert length (if needed)*/


  size_t private_key_len;    /* define Private Key length (if needed)*/


  coap_pki_define_t ca_def;  /* define: Common CA type definition*/


  coap_pki_define_t public_cert_def;  /* define: Public Cert type definition*/


  coap_pki_define_t private_key_def;  /* define: Private Key type definition*/


  coap_asn1_privatekey_type_t private_key_type; /* define: ASN1 Private Key


                                                   Type (if needed) */


  const char *user_pin;      /* define: User pin to access type PKCS11.


                                If PKCS11 and NULL, then pin-value= parameter


                                must be set in pkcs11: URI as a query. */
} coap_pki_key_define_t;
typedef union {


  const char *s_byte;    /* signed char ptr */


  const uint8_t *u_byte; /* unsigned char ptr */
} coap_const_char_ptr_t;
typedef enum coap_pki_define_t {


  COAP_PKI_KEY_DEF_PEM = 0, /* The PKI key type is PEM file.


                               Length ignored, NULL terminated. */


  COAP_PKI_KEY_DEF_PEM_BUF, /* The PKI key type is PEM buffer.


                               Length required. */


  COAP_PKI_KEY_DEF_RPK_BUF, /* The PKI key type is RPK in buffer.


                               Length required. */


  COAP_PKI_KEY_DEF_DER,     /* The PKI key type is DER file.


                               Length ignored, NULL terminated. */


  COAP_PKI_KEY_DEF_DER_BUF, /* The PKI key type is DER buffer (ASN.1).


                               Length required.


                               Private Key Type required. */


  COAP_PKI_KEY_DEF_PKCS11,  /* The PKI key type is PKCS11 (pkcs11:...).


                               Length ignored, NULL terminated.


                               User Pin optional. */


  COAP_PKI_KEY_DEF_PKCS11_RPK, /* The PKI key type is PKCS11 w/ RPK (pkcs11:...).


                               Length ignored, NULL terminated.


                               User Pin optional. */


  COAP_PKI_KEY_DEF_ENGINE,  /* The PKI key type is to be passed to ENGINE.


                               Length ignored, NULL terminated.


                               Supported by OpenSSL only */
} coap_pki_define_t;

#include <coap3/coap.h>
typedef struct valid_cns_t {


  int count;


  char **cn_list;
} valid_cns_t;
/**


 * CN Validation callback that can be set up by coap_context_set_pki().


 * Invoked when libcoap has done the validation checks at the TLS level,


 * but the application needs to check that the CN is allowed.


 * CN is the SubjectAltName in the cert, if not present, then the leftmost


 * Common Name (CN) component of the subject name.


 * NOTE: If using RPK, then the Public Key does not contain a CN, but "RPK"


 * is presented for the cn parameter.


 *


 * @param cn  The determined CN from the certificate


 * @param asn1_public_cert  The ASN.1 encoded (DER) X.509 certificate


 * @param asn1_length  The ASN.1 length


 * @param session  The coap session associated with the certificate update


 * @param depth  Depth in cert chain.  If 0, then client cert, else a CA


 * @param validated  TLS can find no issues if 1


 * @param arg  The same as was passed into coap_context_set_pki()


 *             in setup_data->cn_call_back_arg


 *


 * @return 1 if accepted, else 0 if to be rejected


 */
static int
verify_cn_callback(const char *cn,


                   const uint8_t *asn1_public_cert,


                   size_t asn1_length,


                   coap_session_t *c_session,


                   unsigned depth,


                   int validated,


                   void *arg) {


  valid_cns_t *valid_cn_list = (valid_cns_t *)arg;


  int i;


  /* Remove (void) definition if variable is used */


  (void)asn1_public_cert;


  (void)asn1_length;


  (void)c_session;


  (void)depth;


  (void)validated;


  /* Check that the CN is valid */


  for (i = 0; i < valid_cn_list->count; i++) {


    if (!strcasecmp(cn, valid_cn_list->cn_list[i])) {


      return 1;


    }


  }


  return 0;
}
typedef struct sni_def_t {


  char *sni;


  coap_dtls_key_t key;
} sni_def_t;
typedef struct valid_snis_t {


  int count;


  sni_def_t *sni_list;
} valid_snis_t;
/**


 * SNI Validation callback that is set up by coap_context_set_pki().


 * Invoked if the SNI is not previously seen and prior to sending a certificate


 * set back to the client so that the appropriate certificate set can be used


 * based on the requesting SNI.


 *


 * @param sni  The requested SNI


 * @param arg  The same as was passed into coap_context_set_pki()


 *             in setup_data->sni_call_back_arg


 *


 * @return new set of certificates to use, or NULL if SNI is to be rejected.


 */
static coap_dtls_key_t *
verify_pki_sni_callback(const char *sni,


                        void *arg) {


  valid_snis_t *valid_sni_list = (valid_snis_t *)arg;


  int i;


  /* Check that the SNI is valid */


  for (i = 0; i < valid_sni_list->count; i++) {


    if (!strcasecmp(sni, valid_sni_list->sni_list[i].sni)) {


      return &valid_sni_list->sni_list[i].key;


    }


  }


  return NULL;
}
/*


 * Set up PKI encryption information


 */
static coap_context_t *
setup_server_context_pki(const char *public_cert_file,


                         const char *private_key_file,


                         const char *ca_file,


                         valid_cns_t *valid_cn_list,


                         valid_snis_t *valid_sni_list) {


  coap_endpoint_t *endpoint;


  coap_address_t listen_addr;


  coap_dtls_pki_t dtls_pki;


  coap_context_t *context;


  /* See coap_tls_library(3) */


  if (!coap_dtls_is_supported())


    return NULL;


  /* See coap_context(3) */


  context = coap_new_context(NULL);


  if (!context)


    return NULL;


  /* See coap_block(3) */


  coap_context_set_block_mode(context,


                              COAP_BLOCK_USE_LIBCOAP | COAP_BLOCK_SINGLE_BODY);


  memset(&dtls_pki, 0, sizeof(dtls_pki));


  dtls_pki.version                 = COAP_DTLS_PKI_SETUP_VERSION;


  dtls_pki.verify_peer_cert        = 1;


  dtls_pki.check_common_ca         = 1;


  dtls_pki.allow_self_signed       = 1;


  dtls_pki.allow_expired_certs     = 1;


  dtls_pki.cert_chain_validation   = 1;


  dtls_pki.cert_chain_verify_depth = 1;


  dtls_pki.check_cert_revocation   = 1;


  dtls_pki.allow_no_crl            = 1;


  dtls_pki.allow_expired_crl       = 1;


  dtls_pki.allow_bad_md_hash       = 0;


  dtls_pki.allow_short_rsa_length  = 0;


  dtls_pki.is_rpk_not_cert         = 0; /* Set to 1 if RPK */


  dtls_pki.validate_cn_call_back   = verify_cn_callback;


  dtls_pki.cn_call_back_arg        = valid_cn_list;


  dtls_pki.validate_sni_call_back  = verify_pki_sni_callback;


  dtls_pki.sni_call_back_arg       = valid_sni_list;


  dtls_pki.additional_tls_setup_call_back = NULL;


  dtls_pki.client_sni              = NULL;


  dtls_pki.pki_key.key_type        = COAP_PKI_KEY_PEM;


  dtls_pki.pki_key.key.pem.ca_file = ca_file;


  dtls_pki.pki_key.key.pem.public_cert = public_cert_file;


  dtls_pki.pki_key.key.pem.private_key = private_key_file;


  /* Alternative definition for dtls_pki.pki_key that does the


   * same thing as above.


   *


   * dtls_pki.pki_key.key_type                      = COAP_PKI_KEY_DEFINE;


   * dtls_pki.pki_key.key.define.ca.s_byte          = ca_file;


   * dtls_pki.pki_key.key.define.public_cert.s_byte = public_cert_file;


   * dtls_pki.pki_key.key.define.private_key.s_byte = private_key_file;


   * dtls_pki.pki_key.key.define.ca_def             = COAP_PKI_KEY_DEF_PEM;


   * dtls_pki.pki_key.key.define.public_cert_def    = COAP_PKI_KEY_DEF_PEM;


   * dtls_pki.pki_key.key.define.private_key_def    = COAP_PKI_KEY_DEF_PEM;


   */


  /* See coap_context(3) */


  if (coap_context_set_pki(context, &dtls_pki)) {


    coap_free_context(context);


    return NULL;


  }


  coap_address_init(&listen_addr);


  listen_addr.addr.sa.sa_family = AF_INET;


  listen_addr.addr.sin.sin_port = htons(5684);


  /* See coap_context(3) */


  endpoint = coap_new_endpoint(context, &listen_addr, COAP_PROTO_DTLS);


  if (!endpoint) {


    coap_free_context(context);


    return NULL;


  }


  /* Initialize resources - See coap_resource(3) init_resources() example */


  return context;
}

#include <coap3/coap.h>
typedef struct id_def_t {


  char *hint_match;


  coap_bin_const_t id;


  coap_bin_const_t key;
} id_def_t;
typedef struct valid_ids_t {


  size_t count;


  id_def_t *id_list;
} valid_ids_t;
/*


 * PSK Identity Pre-Shared Key selection Callback function


 */
static const coap_bin_const_t *
verify_id_callback(coap_bin_const_t *identity,


                   coap_session_t *c_session,


                   void *arg) {


  valid_ids_t *valid_id_list = (valid_ids_t *)arg;


  const coap_bin_const_t *s_psk_hint = coap_session_get_psk_hint(c_session);


  size_t i;


  /* Check that the Identity is valid */


  for (i = 0; i < valid_id_list->count; i++) {


    if (s_psk_hint &&


        strcmp((const char *)s_psk_hint->s,


               valid_id_list->id_list[i].hint_match)) {


      continue;


    }


    if (coap_binary_equal(identity, &valid_id_list->id_list[i].id)) {


      return &valid_id_list->id_list[i].key;


    }


  }


  return NULL;
}
typedef struct sni_psk_def_t {


  char *sni;


  coap_dtls_spsk_info_t psk_info;
} sni_psk_def_t;
typedef struct valid_psk_snis_t {


  int count;


  sni_psk_def_t *sni_list;
} valid_psk_snis_t;
/*


 * PSK Subject Name Identifier (SNI) callback verifier


 */
static const coap_dtls_spsk_info_t *
verify_psk_sni_callback(const char *sni,


                        coap_session_t *c_session,


                        void *arg) {


  valid_psk_snis_t *valid_sni_list = (valid_psk_snis_t *)arg;


  int i;


  /* Remove (void) definition if variable is used */


  (void)c_session;


  /* Check that the SNI is valid */


  for (i = 0; i < valid_sni_list->count; i++) {


    if (!strcasecmp(sni, valid_sni_list->sni_list[i].sni)) {


      return &valid_sni_list->sni_list[i].psk_info;


    }


  }


  return NULL;
}
static coap_context_t *
setup_server_context_psk(const char *hint,


                         const uint8_t *key,


                         unsigned int key_len,


                         valid_ids_t *valid_id_list,


                         valid_psk_snis_t *valid_sni_list) {


  coap_endpoint_t *endpoint;


  coap_address_t listen_addr;


  coap_context_t *context;


  coap_dtls_spsk_t dtls_psk;


  /* See coap_tls_library(3) */


  if (!coap_dtls_is_supported())


    return NULL;


  context = coap_new_context(NULL);


  if (!context)


    return NULL;


  /* See coap_block(3) */


  coap_context_set_block_mode(context,


                              COAP_BLOCK_USE_LIBCOAP | COAP_BLOCK_SINGLE_BODY);


  memset(&dtls_psk, 0, sizeof(dtls_psk));


  /* see coap_encryption(3) */


  dtls_psk.version                 = COAP_DTLS_SPSK_SETUP_VERSION;


  dtls_psk.validate_id_call_back   = verify_id_callback;


  dtls_psk.id_call_back_arg        = valid_id_list;


  dtls_psk.validate_sni_call_back  = verify_psk_sni_callback;


  dtls_psk.sni_call_back_arg       = valid_sni_list;


  dtls_psk.psk_info.hint.s         = (const uint8_t *)hint;


  dtls_psk.psk_info.hint.length    = hint ? strlen(hint) : 0;


  dtls_psk.psk_info.key.s          = key;


  dtls_psk.psk_info.key.length     = key_len;


  if (coap_context_set_psk2(context, &dtls_psk)) {


    coap_free_context(context);


    return NULL;


  }


  coap_address_init(&listen_addr);


  listen_addr.addr.sa.sa_family = AF_INET;


  listen_addr.addr.sin.sin_port = htons(5684);


  endpoint = coap_new_endpoint(context, &listen_addr, COAP_PROTO_DTLS);


  if (!endpoint) {


    coap_free_context(context);


    return NULL;


  }


  /* Initialize resources - See coap_resource(3) init_resources() example */


  return context;
}

#include <coap3/coap.h>
#include <stdio.h>
#ifndef min
#define min(a,b) ((a) < (b) ? (a) : (b))
#endif
static const coap_dtls_cpsk_info_t *
verify_ih_callback(coap_str_const_t *hint,


                   coap_session_t *c_session,


                   void *arg) {


  coap_dtls_cpsk_info_t *psk_info = (coap_dtls_cpsk_info_t *)arg;


  /* Remove (void) definition if variable is used */


  (void)c_session;


  coap_log_info("Identity Hint '%.*s' provided\n", (int)hint->length, hint->s);


  /* Just use the defined information for now as passed in by arg */


  return psk_info;
}
static coap_dtls_cpsk_t dtls_psk;
static char client_sni[256];
static coap_session_t *
setup_client_session_psk(const char *host,


                         struct in_addr ip_address,


                         const uint8_t *identity,


                         unsigned int identity_len,


                         const uint8_t *key,


                         unsigned int key_len) {


  coap_session_t *session;


  coap_address_t server;


  /* See coap_context(3) */


  coap_context_t *context = coap_new_context(NULL);


  if (!context)


    return NULL;


  /* See coap_block(3) */


  coap_context_set_block_mode(context,


                              COAP_BLOCK_USE_LIBCOAP | COAP_BLOCK_SINGLE_BODY);


  coap_address_init(&server);


  server.addr.sa.sa_family = AF_INET;


  server.addr.sin.sin_addr = ip_address;


  server.addr.sin.sin_port = htons(5684);


  /* See coap_encryption(3) */


  memset(&dtls_psk, 0, sizeof(dtls_psk));


  dtls_psk.version = COAP_DTLS_CPSK_SETUP_VERSION;


  dtls_psk.validate_ih_call_back = verify_ih_callback;


  dtls_psk.ih_call_back_arg = &dtls_psk.psk_info;


  snprintf(client_sni, sizeof(client_sni), "%s", host);


  dtls_psk.client_sni = client_sni;


  dtls_psk.psk_info.identity.s = identity;


  dtls_psk.psk_info.identity.length = identity_len;


  dtls_psk.psk_info.key.s = key;


  dtls_psk.psk_info.key.length = key_len;


  session = coap_new_client_session_psk2(context, NULL, &server,


                                         COAP_PROTO_DTLS, &dtls_psk);


  if (!session) {


    coap_free_context(context);


    return NULL;


  }


  /* The context is in session->context */


  return session;
}