How to use dtls with Arduino-wolfSSL (no dtls client example that works)

[Friedmonkey]

i want to make a dtls client running on the esp32 using the ardunio ide and Arduino-wolfSSL library
there are no dtls examples and user_settings.h has no mention of dtls

ive tried a few tings but it keeps comming down to wolfDTLSv1_2_client_method not being compiled in despite defining WOLFSSL_DTLS and a few others

is it possible to make a basic dtls client example that compiles
(i want to end up making a coaps dtls client for the ikea tradfri gateway with it)

[embhorn]

HI @Friedmonkey

Thanks for contacting wolfSSL Support. Sounds like a neat project! I have requested a review of this issue by our engineers.

Kind regards,
@embhorn

[gojimmypi]

Hi @Friedmonkey -

It sounds like you already have wolfSSL installed in the Arduino library. The latest version is 5.8.2

For reference we have an "Arduino Getting Started" here if perhaps you need to upgrade:

https://www.wolfssl.com/getting-started-with-wolfssl-on-arduino/

You are correct that there's currently no reference to DTLS, although that is a good idea for a future release Arduino example.

In the meantime there are ESP-IDF DTLS ESP32 examples here:

https://github.com/wolfSSL/wolfssl-examples/tree/master/ESP32

I checked today, and although those examples have not been updated recently, they do work, albeit with just a little attention.

The output, after setting WiFi SSID and password, along with the server address in main/include/client-dtls13.h

#define TLS_SMP_SERVER_ADDRESS           "192.168.1.107"

... should look like this:

Changes Needed

Delete these three lines in the client-dtls13.c duplicate definitions:

WOLFSSL_CTX*  ctx = NULL;
WOLFSSL*      ssl = NULL;
int           listenfd = INVALID_SOCKET;   /* Initialize our socket */

And add the keyword static to these three lines in server-dtls13.c:

static WOLFSSL_CTX*  ctx = NULL;
static WOLFSSL*      ssl = NULL;
static int           listenfd = INVALID_SOCKET;   /* Initialize our socket */

I'll put together a PR to update those examples. In particular for the EDP-IDF environment, wolfSSL now has Managed Components.

Although these examples are specific to the ESP-IDF environment and not Arduino, the point of interest is the user_settings.h files:

• ESP32/DTLS13-wifi-station-client/components/wolfssl/include/user_settings.h

• ESP32/DTLS13-wifi-station-server/components/wolfssl/include/user_settings.h

It's difficult to say what the problem is with your current Arduino sketch, so if you'd like to post it here, I can take a look.

If your project if private, you are also welcome to send a message to support [@] wolfssl.com

In the meantime, I'll take a look at the default Arduino config and determine what is needed to enable DTLS.

[Friedmonkey]

thanks for your reply!
and my excuses for the late respond
i had alot of trouble with the esp-idf environment and i'd like to use the arduino toolchain as my other projects and libraries are using those i was happy to find out that wolfssl supports dtls and that they had an arduino library build, fantastic!

so if possible i would prefer being able to run wolfssl with dtls support with the arduino ide
i had indeed used those user_settings.h to mix and match the stuff i needed but the main issue is with wolfDTLSv1_3_client_method

undefined reference to wolfDTLSv1_3_client_method'`

this is the code i ended up with after mixing and matching defines like from the user_settings.h

#undef WOLFSSL_ESPIDF
#undef WOLFSSL_ESP32
#undef WOLFSSL_ESPWROOM32SE
#undef WOLFSSL_ESP32
#undef WOLFSSL_ESP8266

#define WOLFSSL_ESP32

#define WOLFSSL_TLS13
#define HAVE_TLS_EXTENSIONS
#define WC_RSA_PSS
#define HAVE_HKDF
#define HAVE_AEAD
#define HAVE_SUPPORTED_CURVES

#define WOLFSSL_BENCHMARK_FIXED_UNITS_KB

#define NO_FILESYSTEM

#define HAVE_AESGCM

#define NO_OLD_TLS

#define WOLFSSL_SHA512
#define HAVE_ECC


#define ESP32_USE_RSA_PRIMITIVE
#define EPS_RSA_EXPT_XBTIS           32
#define ESP_RSA_MULM_BITS            9

#define ESP_RSA_TIMEOUT_CNT    0x249F00

#define HASH_SIZE_LIMIT
#define USE_FAST_MATH

#define WOLFSSL_SMALL_STACK

#define HAVE_VERSION_EXTENDED_INFO
#define HAVE_WC_INTROSPECTION

#define ALLOW_BINARY_MISMATCH_INTROSPECTION

#define WOLFSSL_HW_METRICS
#define NO_RECOVER_SOFTWARE_CALC


#define WOLFSSL_DTLS 1
#define WOLFSSL_DTLS13
#define WOLFSSL_SEND_HRR_COOKIE
#define WOLFSSL_ENCRYPTED_KEYS

// #ifndef WOLFSSL_USER_SETTINGS
// #include <wolfssl/options.h>
// #endif
#include <unistd.h>
#include <wolfssl.h>
#include <netdb.h>
#include <signal.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <netinet/in.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#include "dtls-common.h"

#include <WiFi.h>

const char* ssid = "MY-SSID";
const char* password = "MY_PASSWORD";

const char* host = "192.168.2.9";
const int port = 5684;

// PSK credentials
const char* psk_identity = "tradfri_identity";
const char* psk_key = "MY_PSK_KEY";

// CoAP GET packet for /15001
const uint8_t coap_packet[] = {
  0x40, 0x01, 0x00, 0x01,    // ver=1, type=CON, code=GET, message ID
  0xB5, '1', '5', '0', '0', '1'  // Uri-Path: "15001"
};

// PSK callback
unsigned int my_psk_client_cb(WOLFSSL* ssl, const char* hint,
                              char* identity, unsigned int id_max_len,
                              unsigned char* key, unsigned int key_max_len)
{
  strncpy(identity, psk_identity, id_max_len);
  strncpy((char*)key, psk_key, key_max_len);
  return strlen(psk_key);
}

void setup() {
  Serial.begin(115200);
  delay(1000);
  Serial.println("Connecting to WiFi...");
  WiFi.begin(ssid, password);
  while (WiFi.status() != WL_CONNECTED) {
    delay(500);
    Serial.print(".");
  }
  Serial.println("Connected :D");

  // Init wolfSSL
  wolfSSL_Init();

  // Create DTLS context
  WOLFSSL_CTX* ctx = wolfSSL_CTX_new(wolfDTLSv1_3_client_method());
  if (!ctx) {
    Serial.println("Failed to create WOLFSSL_CTX :(");
    return;
  }

  wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_NONE, NULL);
  wolfSSL_CTX_set_psk_client_callback(ctx, my_psk_client_cb);

  // Create socket
  int sock = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
  if (sock < 0) {
    Serial.println("Socket creation failed :(");
    return;
  }

  struct sockaddr_in serverAddr;
  memset(&serverAddr, 0, sizeof(serverAddr));
  serverAddr.sin_family = AF_INET;
  serverAddr.sin_port = htons(port);
  inet_pton(AF_INET, host, &serverAddr.sin_addr.s_addr);

  connect(sock, (struct sockaddr*)&serverAddr, sizeof(serverAddr));

  // Create WOLFSSL object
  WOLFSSL* ssl = wolfSSL_new(ctx);
  wolfSSL_dtls_set_peer(ssl, &serverAddr, sizeof(serverAddr));
  wolfSSL_set_fd(ssl, sock);

  Serial.println("Performing DTLS handshake...");
  if (wolfSSL_connect(ssl) != SSL_SUCCESS) {
    Serial.println("DTLS handshake failed :(");
    Serial.println(wolfSSL_ERR_reason_error_string(wolfSSL_get_error(ssl, 0)));
    return;
  }
  Serial.println("DTLS handshake successful! :D");

  // Send CoAP GET
  int sent = wolfSSL_write(ssl, coap_packet, sizeof(coap_packet));
  if (sent < 0) {
    Serial.println("Failed to send CoAP request :(");
    return;
  }
  Serial.print("Sent CoAP request, bytes: ");
  Serial.println(sent);

  // Receive response
  uint8_t buffer[256];
  int received = wolfSSL_read(ssl, buffer, sizeof(buffer));
  if (received > 0) {
    Serial.print("Received response: ");
    for (int i = 0; i < received; i++) {
      Serial.printf("%02X ", buffer[i]);
    }
    Serial.println();
  } else {
    Serial.println("No response or read failed :(");
  }

  // Cleanup
  wolfSSL_free(ssl);
  wolfSSL_CTX_free(ctx);
  wolfSSL_Cleanup();
  close(sock);
}

void loop() {
  // Nothing here :)
}

but something as simple as

//we want dtls
#define WOLFSSL_DTLS 1


#define WOLFSSL_DTLS13
//WOLFSSL_DTLS13 requires WOLFSSL_TLS13
#define WOLFSSL_TLS13

#include <wolfssl.h>


void setup() {
  Serial.begin(115200);
  delay(1000);

  // Init wolfSSL
  wolfSSL_Init();

  // Create DTLS context
  WOLFSSL_CTX* ctx = wolfSSL_CTX_new(wolfDTLSv1_3_client_method());
}

void loop() {
  // Nothing here :)
}

already does not compile on the Arduino ide because of wolfDTLSv1_3_client_method

it would be greatly appreciated if you would be able to made a simple working dtls example for the Arduino-wolfSSL library that can send a simple udp dtls message (using a pre-shared-key) as authentication
and im sure it would help out alot of other people in the future too if possible ofcource

[gojimmypi]

## Problem with Arduino-wolfSSL 5.8.2

It appears there's a problem with the Arduino library that was not present in version 5.8.0

I suggest using version 5.8.0 for now. See #19

Correction: the problem was cached files / config. Disregard.

I've also updated the lines to add to user_settings.h, below.

Espressif

i had alot of trouble with the esp-idf environment

I'm very interested in what specific problems you encountered. Once the ESP-IDF is installed, the examples should work.

I'd appreciate any feedback here, as I'd really like to ensure the first timer has a good experience on getting started.

DTLS

if possible i would prefer being able to run wolfssl with dtls support with the arduino ide

yes, I agree, and I'll be working on including specific DTLS examples for the next release. Good idea on this suggestion, thank you!

this is the code i ended up with after mixing and matching defines

"A picture (or in this case, some sample code) is worth a thousand words" :)

Thanks for including your sample code!

but something as simple as ... already does not compile on the Arduino

Ah yes: the macros to enable DTLS, they need to be seen by the wolfSSL library, specifically in the user_settings.h file, not your Arduino sketch file.

wolfSSL Config Location

For me, on Windows, the wolfSSL library gets installed to:

C:\Users\%USERNAME%\Documents\Arduino\libraries\wolfssl\

So the user_settings.h for me is here:

I'm using the latest version of wolfSSL: version 5.8.2

DTLS Example

To enable DTLS, I used your sample code in a new sketch:

#include <wolfssl.h>


void setup() {
  Serial.begin(115200);
  delay(1000);

  // Init wolfSSL
  wolfSSL_Init();

  // Create DTLS context
  WOLFSSL_CTX* ctx = wolfSSL_CTX_new(wolfDTLSv1_3_client_method());
}

void loop() {
  // Nothing here :)
}

Then I added these lines to the beginning of the user_settings.h:

/* Define a macro to display user settings version in example code: */
#define WOLFSSL_USER_SETTINGS_ID "My Arduino user_settings.h v5.8.2"

/* Enable DTLS */
#define WOLFSSL_DTLS 1
#define WOLFSSL_DTLS13

/* WOLFSSL_DTLS13 requires WOLFSSL_TLS13 */
#define WOLFSSL_TLS13
#define USE_WOLFSSL_IO

#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>

#define SOCKADDR_S        struct sockaddr_storage
#define XSOCKLENT         socklen_t
#define SOCKADDR          struct sockaddr
#define SOCKADDR_IN       struct sockaddr_in
#define XSOCKOPT_TYPE_OPTVAL_TYPE  void*

TLS Example

There's a wolfSSL TLS client and server example that is packaged with the wolfssl library.

See File - Examples - (scroll to the bottom of the list) - wolfssl - "wolfss_client" and "wolfssl_server".

Swap in the include files there, along with the making the changes to user_settings.h described above, and your larger example should compile.

Configuration Best Practices

Beware that when editing the user_settings.h as part of the wolfSSL Arduino directory, that file will likely be overwritten when upgrading the library.

In particular, the Arduino wolfSSL include sequence should look like this at the beginning of a sketch, in this order:

#include <wolfssl.h>
/* Important: make sure settings.h appears before any other wolfSSL headers */
#include <wolfssl/wolfcrypt/settings.h>
/* Reminder: settings.h includes user_settings.h
 * For ALL project wolfSSL settings, see:
 * [your path]/Arduino\libraries\wolfSSL\src\user_settings.h   */
#include <wolfssl/ssl.h>
#include <wolfssl/certs_test.h>
#include <wolfssl/wolfcrypt/error-crypt.h>

The Arduino #include <wolfssl.h> is first.

Followed by #include <wolfssl/wolfcrypt/settings.h>

Do not explicitly include user_settings.h

After the above two, the list any wolfSSL includes.

I'll look into testing this Arduino DTLS client and server later this week.

In the meantime, let me know if you are able to make progress with the information above.

Getting Started

See also my blog on Getting Started with wolfSSL on Arduino:

https://www.wolfssl.com/getting-started-with-wolfssl-on-arduino/

Cheers

[Friedmonkey]

Thank you,
With your example i was able to compile both 1_3 and 1_2 client methods.

the coaps request still failed with some handshake problems but that might be some other problem ill have to look at later but atleast it compiles now, thank you!

[gojimmypi]

Hi @Friedmonkey

With your example i was able to compile both 1_3 and 1_2 client methods.

Yay!

the coaps request still failed with some handshake problems

I didn't look at your larger example in detail. I only confirmed it would compile.

Before you spend too much time on that, you may wish to check out my new wolfssl_client_dtls and wolfssl_server_dtls examples.

This code is based heavily on existing Arduino TLS client & server as well as the DTLS core examples.

Each will need WiFi SSID and password.

Once you have the server running, use the IP address to set client WOLFSSL_DTLS_SERVER_HOST.

These examples still need a little polishing, but otherwise should work.

Let me know if you can take them for a test drive & if you have any suggestions for improvement.

Cheers