Dear Erich,
I hope this message finds you well.
Currently, I'm working on a project that involves establishing communication between LPCXpresso55S16 (DTLS server) and Raspberry Pi (DTLS client) via DTLS using mbedtls.
During the DTLS handshake, I encountered an error in the ssl_write_server_key_exchange function, specifically when the mbedtls_ssl_read_record function returns a negative value. I suspect that the issue might be related to my configuration as the client code works fine with a server code on the Raspberry Pi.
Here is the init_server function that I am using:
void dtls_init_server(void)
{
int ret;
mbedtls_ssl_init( &ssl );
mbedtls_ssl_config_init( &conf );
mbedtls_ssl_cookie_init( &cookie_ctx );
#if defined(MBEDTLS_SSL_CACHE_C)
mbedtls_ssl_cache_init( &cache );
#endif
mbedtls_x509_crt_init( &srvcert );
mbedtls_x509_crt_init( &cacert );
mbedtls_pk_init( &pkey );
mbedtls_entropy_init( &entropy );
mbedtls_ctr_drbg_init( &ctr_drbg );
#if defined(MBEDTLS_DEBUG_C)
mbedtls_debug_set_threshold( DEBUG_LEVEL );
#endif
if( ( ret = mbedtls_ctr_drbg_seed( &ctr_drbg, mbedtls_entropy_func, &entropy,
(const unsigned char *) pers,
strlen( pers ) ) ) != 0 )
{
printf( " failed\n ! mbedtls_ctr_drbg_seed returned %d\n", ret );
}
int res;
char* buffer = NULL;
size_t bufferSize = 0;
// First, set our EE certifiacte
res = McuLFS_ReadFile(pdtls->server_ee_cert_chain_filename_ptr, &buffer, &bufferSize);
if(res == 0){
ret = mbedtls_x509_crt_parse( &srvcert,(const unsigned char *)buffer, bufferSize +1);
if( ret != 0 )
{
printf( " failed\n ! mbedtls_x509_crt_parse returned %d\n\n", ret );
buffer = NULL;
bufferSize = 0;
}
PRINTF("We successfully parsing %s \r\n", pdtls->server_ee_cert_chain_filename_ptr);
buffer = NULL;
bufferSize = 0;
}
// Check if we also have an intermediate certificate... -> is the case for non IDevID certificates
if(strcmp(pdtls->server_ee_intermediate_filename_ptr,"") != 0)
{
res = McuLFS_ReadFile(pdtls->server_ee_intermediate_filename_ptr, &buffer, &bufferSize);
if((res == 0)){
ret = mbedtls_x509_crt_parse( &srvcert, (const unsigned char *)buffer,bufferSize +1 );
if( ret != 0 )
{
printf( " failed\n ! mbedtls_x509_crt_parse returned %d\n\n", ret );
buffer = NULL;
bufferSize = 0;
}
PRINTF("We successfully parsing %s \r\n", pdtls->server_ee_intermediate_filename_ptr);
buffer = NULL;
bufferSize = 0;
}
}
if(strcmp(pdtls->server_root_ca_cert_filename_ptr,"") != 0)
{
res = McuLFS_ReadFile(pdtls->server_root_ca_cert_filename_ptr, &buffer, &bufferSize);
if((res == 0)){
ret = mbedtls_x509_crt_parse( &cacert, (const unsigned char *)buffer, bufferSize +1);
if( ret != 0 )
{
printf( " failed\n ! mbedtls_x509_crt_parse returned %d\n\n", ret );
buffer = NULL;
bufferSize = 0;
}
PRINTF("We successfully parsing %s \r\n", pdtls->server_root_ca_cert_filename_ptr);
buffer = NULL;
bufferSize = 0;
}
}
res = McuLFS_ReadFile(pdtls->private_key_filename_ptr, &buffer, &bufferSize);
if((res == 0)){
ret = mbedtls_pk_parse_key( &pkey, (const unsigned char *)buffer,bufferSize +1 , NULL, 0 );
if( ret == 0 )
{
PRINTF("We successfully parsing %s \r\n", pdtls->private_key_filename_ptr);
}
buffer = NULL;
bufferSize = 0;
}
if( ( ret = mbedtls_ssl_config_defaults( &conf,
MBEDTLS_SSL_IS_SERVER,
MBEDTLS_SSL_TRANSPORT_DATAGRAM,
MBEDTLS_SSL_PRESET_DEFAULT ) ) != 0 )
{
mbedtls_printf( " failed\n ! mbedtls_ssl_config_defaults returned %d\n\n", ret );
}
mbedtls_ssl_conf_rng( &conf, mbedtls_ctr_drbg_random, &ctr_drbg );
mbedtls_ssl_conf_dbg( &conf, my_debug, stdout );
mbedtls_ssl_conf_read_timeout( &conf, READ_TIMEOUT_MS );
#if defined(MBEDTLS_SSL_CACHE_C)
mbedtls_ssl_conf_session_cache( &conf, &cache,
mbedtls_ssl_cache_get,
mbedtls_ssl_cache_set );
#endif
mbedtls_ssl_conf_ca_chain( &conf, &cacert, NULL );
if( ( ret = mbedtls_ssl_conf_own_cert( &conf, &srvcert, &pkey ) ) != 0 )
{
printf( " failed\n ! mbedtls_ssl_conf_own_cert returned %d\n\n", ret );
}
if( ( ret = mbedtls_ssl_cookie_setup( &cookie_ctx,
mbedtls_ctr_drbg_random, &ctr_drbg ) ) != 0 )
{
printf( " failed\n ! mbedtls_ssl_cookie_setup returned %d\n\n", ret );
}
/* Reevaluate this, since cookie checking is disabled by Null Pointing*/
mbedtls_ssl_conf_dtls_cookies( &conf, mbedtls_ssl_cookie_write, NULL,
&cookie_ctx );
if( ( ret = mbedtls_ssl_setup( &ssl, &conf ) ) != 0 )
{
printf( " failed\n ! mbedtls_ssl_setup returned %d\n\n", ret );
}
mbedtls_ssl_set_timer_cb( &ssl, &timer, mbedtls_timing_set_delay, mbedtls_timing_get_delay );
mbedtls_ssl_session_reset( &ssl );
mbedtls_ssl_set_bio( &ssl, NULL,
mbedtls_custom_send, mbedtls_custom_receive, NULL );
}
From my debugging efforts, I am confident that the server certificate and private key parsing have occurred successfully, and the ssl struct contains the appropriate cipher suite, srvcert, and private key.
If possible, I was wondering if you have an example that utilizes LPCXpresso55Sxx as a DTLS server. Having access to a working example might help me identify any misconfigurations on my part.
Thank you for your continued support.
Best regards,
Ahmed Bouzid.