RFC8613: Add in OSCORE support

Based on work done in https://gitlab.informatik.uni-bremen.de/obergman/libcoap

New directories with files
 include/oscore
 src/oscore

New files
 include/coap3/coap_oscore.h
 include/coap3/coap_crypto_internal.h
 include/coap3/coap_oscore_internal.h
 man/coap-oscore-conf.txt.in
 man/coap_oscore.txt.in
 src/coap_oscore.c
 tests/test_oscore.c
 tests/test_oscore.h

Supported by new option (enabled by default)
 ./configure --enable-oscore
 cmake .. -DENABLE_OSCORE=ON

Requires a TLS library configured to do the OSCORE encryption and hashing.

CMakeLists.txt

@@ -24,6 +24,7 @@ option(
   OFF)
 
 add_library(${COAP_LIBRARY_NAME})
+set_property(TARGET ${COAP_LIBRARY_NAME} PROPERTY C_STANDARD 99)
 
 #
 # options to tweak the library
@@ -65,6 +66,10 @@ option(
   ENABLE_SERVER_MODE
   "compile with support for server mode code"
   ON)
+option(
+  ENABLE_OSCORE
+  "compile with support for OSCORE"
+  ON)
 option(
   WITH_EPOLL
   "compile with epoll support"
@@ -190,6 +195,13 @@ else()
   message(STATUS "compiling without server support")
 endif()
 
+if(${ENABLE_OSCORE})
+  set(HAVE_OSCORE "1")
+  message(STATUS "compiling with OSCORE support")
+else()
+  message(STATUS "compiling without OSCORE support")
+endif()
+
 if(${WITH_EPOLL}
    AND ${HAVE_EPOLL_H}
    AND ${HAVE_TIMERFD_H})
@@ -412,6 +424,7 @@ message(STATUS "ENABLE_DTLS:.....................${ENABLE_DTLS}")
 message(STATUS "ENABLE_TCP:......................${ENABLE_TCP}")
 message(STATUS "ENABLE_CLIENT_MODE:..............${ENABLE_CLIENT_MODE}")
 message(STATUS "ENABLE_SERVER_MODE:..............${ENABLE_SERVER_MODE}")
+message(STATUS "ENABLE_OSCORE:...................${ENABLE_OSCORE}")
 message(STATUS "ENABLE_DOCS:.....................${ENABLE_DOCS}")
 message(STATUS "ENABLE_EXAMPLES:.................${ENABLE_EXAMPLES}")
 message(STATUS "DTLS_BACKEND:....................${DTLS_BACKEND}")
@@ -464,6 +477,7 @@ target_sources(
           ${CMAKE_CURRENT_LIST_DIR}/src/coap_io.c
           ${CMAKE_CURRENT_LIST_DIR}/src/coap_notls.c
           ${CMAKE_CURRENT_LIST_DIR}/src/coap_option.c
+          ${CMAKE_CURRENT_LIST_DIR}/src/coap_oscore.c
           ${CMAKE_CURRENT_LIST_DIR}/src/coap_prng.c
           ${CMAKE_CURRENT_LIST_DIR}/src/coap_session.c
           ${CMAKE_CURRENT_LIST_DIR}/src/coap_subscribe.c
@@ -482,6 +496,12 @@ target_sources(
           $<$<BOOL:${HAVE_LIBTINYDTLS}>:${CMAKE_CURRENT_LIST_DIR}/src/coap_tinydtls.c>
           $<$<BOOL:${HAVE_LIBGNUTLS}>:${CMAKE_CURRENT_LIST_DIR}/src/coap_gnutls.c>
           $<$<BOOL:${HAVE_MBEDTLS}>:${CMAKE_CURRENT_LIST_DIR}/src/coap_mbedtls.c>
+          # needed for OSCORE is enabled
+          $<$<BOOL:${HAVE_OSCORE}>:${CMAKE_CURRENT_LIST_DIR}/src/oscore/oscore.c>
+          $<$<BOOL:${HAVE_OSCORE}>:${CMAKE_CURRENT_LIST_DIR}/src/oscore/oscore_cbor.c>
+          $<$<BOOL:${HAVE_OSCORE}>:${CMAKE_CURRENT_LIST_DIR}/src/oscore/oscore_context.c>
+          $<$<BOOL:${HAVE_OSCORE}>:${CMAKE_CURRENT_LIST_DIR}/src/oscore/oscore_cose.c>
+          $<$<BOOL:${HAVE_OSCORE}>:${CMAKE_CURRENT_LIST_DIR}/src/oscore/oscore_crypto.c>
           # headers
           ${CMAKE_CURRENT_LIST_DIR}/include/coap${LIBCOAP_API_VERSION}/coap.h
           ${CMAKE_CURRENT_LIST_DIR}/include/coap${LIBCOAP_API_VERSION}/libcoap.h
@@ -584,6 +604,8 @@ if(ENABLE_TESTS)
     ${CMAKE_CURRENT_LIST_DIR}/tests/test_error_response.h
     ${CMAKE_CURRENT_LIST_DIR}/tests/test_options.c
     ${CMAKE_CURRENT_LIST_DIR}/tests/test_options.h
+    ${CMAKE_CURRENT_LIST_DIR}/tests/test_oscore.c
+    ${CMAKE_CURRENT_LIST_DIR}/tests/test_oscore.h
     ${CMAKE_CURRENT_LIST_DIR}/tests/test_pdu.c
     ${CMAKE_CURRENT_LIST_DIR}/tests/test_pdu.h
     ${CMAKE_CURRENT_LIST_DIR}/tests/test_sendqueue.c
@@ -713,7 +735,8 @@ install(
   PATTERN "*.h"
   PATTERN "coap.h" EXCLUDE
   PATTERN "coap_riot.h" EXCLUDE
-  PATTERN "*_internal.h" EXCLUDE)
+  PATTERN "*_internal.h" EXCLUDE
+  PATTERN "oscore*" EXCLUDE)
 install(
   DIRECTORY ${CMAKE_CURRENT_BINARY_DIR}/include/
   DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}

LICENSE

@@ -55,6 +55,36 @@ files.  These files are named coap_uthash_internal.h and
 coap_utlist_internal.h respectively to make sure the correct versions
 are included.
 
+========================================================================
+oscore cose
+
+Copyright (c) 2018, SICS, RISE AB
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+3. Neither the name of the Institute nor the names of its contributors
+   may be used to endorse or promote products derived from this software
+   without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
 ========================================================================
 OpenSSL
 

Makefile.am

@@ -17,6 +17,14 @@ ACLOCAL_AMFLAGS = ${ACLOCAL_FLAGS} -I m4
 
 LIBCOAP_PACKAGE_BUILD = @DOLLAR_SIGN@(shell git describe --tags --dirty --always 2>/dev/null || echo @PACKAGE_VERSION@)
 
+## Source files specifically for OSCORE
+libcoap_OSCORE_sources = \
+  src/oscore/oscore.c \
+  src/oscore/oscore_cbor.c \
+  src/oscore/oscore_context.c \
+  src/oscore/oscore_cose.c \
+  src/oscore/oscore_crypto.c
+
 ## Additional files for the distribution archive
 EXTRA_DIST = \
   BUILDING \
@@ -62,11 +70,13 @@ EXTRA_DIST = \
   include/coap$(LIBCOAP_API_VERSION)/coap_async_internal.h \
   include/coap$(LIBCOAP_API_VERSION)/coap_block_internal.h \
   include/coap$(LIBCOAP_API_VERSION)/coap_cache_internal.h \
+  include/coap$(LIBCOAP_API_VERSION)/coap_crypto_internal.h \
   include/coap$(LIBCOAP_API_VERSION)/coap_dtls_internal.h \
   include/coap$(LIBCOAP_API_VERSION)/coap_hashkey_internal.h \
   include/coap$(LIBCOAP_API_VERSION)/coap_io_internal.h \
   include/coap$(LIBCOAP_API_VERSION)/coap_mutex_internal.h \
   include/coap$(LIBCOAP_API_VERSION)/coap_net_internal.h \
+  include/coap$(LIBCOAP_API_VERSION)/coap_oscore_internal.h \
   include/coap$(LIBCOAP_API_VERSION)/coap_pdu_internal.h \
   include/coap$(LIBCOAP_API_VERSION)/coap_resource_internal.h \
   include/coap$(LIBCOAP_API_VERSION)/coap_session_internal.h \
@@ -77,11 +87,17 @@ EXTRA_DIST = \
   include/coap$(LIBCOAP_API_VERSION)/coap.h.in \
   include/coap$(LIBCOAP_API_VERSION)/coap.h.windows \
   include/coap$(LIBCOAP_API_VERSION)/coap.h.windows.in \
+  include/oscore/oscore_cbor.h \
+  include/oscore/oscore_context.h \
+  include/oscore/oscore_cose.h \
+  include/oscore/oscore_crypto.h \
+  include/oscore/oscore.h \
   src/coap_io_lwip.c \
   src/coap_io_riot.c \
   tests/test_error_response.h \
   tests/test_encode.h \
   tests/test_options.h \
+  tests/test_oscore.h \
   tests/test_pdu.h \
   tests/test_sendqueue.h \
   tests/test_session.h \
@@ -101,6 +117,13 @@ EXTRA_DIST = \
   win32/testdriver/testdriver.vcxproj.filters \
   win32/testdriver/testdriver.vcxproj.user
 
+# This is a mirror of files depending on HAVE_OSCORE included in src as per
+# libcoap_@LIBCOAP_NAME_SUFFIX@_la_SOURCES
+if !HAVE_OSCORE
+EXTRA_DIST += $(libcoap_OSCORE_sources)
+
+endif # !HAVE_OSCORE
+
 AM_CFLAGS = -I$(top_builddir)/include -I$(top_srcdir)/include $(WARNING_CFLAGS) \
             $(DTLS_CFLAGS) -std=c99 $(EXTRA_CFLAGS) \
             -DLIBCOAP_PACKAGE_BUILD='"$(LIBCOAP_PACKAGE_BUILD)"'
@@ -138,6 +161,7 @@ libcoap_@LIBCOAP_NAME_SUFFIX@_la_SOURCES = \
   src/coap_notls.c \
   src/coap_openssl.c \
   src/coap_option.c \
+  src/coap_oscore.c \
   src/coap_prng.c \
   src/coap_session.c \
   src/coap_subscribe.c \
@@ -152,6 +176,11 @@ libcoap_@LIBCOAP_NAME_SUFFIX@_la_SOURCES = \
   src/str.c \
   src/uri.c
 
+if HAVE_OSCORE
+libcoap_@LIBCOAP_NAME_SUFFIX@_la_SOURCES += $(libcoap_OSCORE_sources)
+
+endif # HAVE_OSCORE
+
 ## Define the list of public header files and their install location.
 ## The API version is appended to the install folder to being able to
 ## co-install various versions of libcoap.
@@ -179,6 +208,7 @@ libcoap_include_HEADERS = \
   $(top_srcdir)/include/coap$(LIBCOAP_API_VERSION)/mem.h \
   $(top_srcdir)/include/coap$(LIBCOAP_API_VERSION)/net.h \
   $(top_srcdir)/include/coap$(LIBCOAP_API_VERSION)/coap_option.h \
+  $(top_srcdir)/include/coap$(LIBCOAP_API_VERSION)/coap_oscore.h \
   $(top_srcdir)/include/coap$(LIBCOAP_API_VERSION)/pdu.h \
   $(top_srcdir)/include/coap$(LIBCOAP_API_VERSION)/coap_prng.h \
   $(top_srcdir)/include/coap$(LIBCOAP_API_VERSION)/resource.h \
@@ -201,6 +231,8 @@ libcoap_@LIBCOAP_NAME_SUFFIX@_la_LDFLAGS =					\
 ## libcoap-$(LIBCOAP_API_VERSION).{map,sym} for the linker.
 CTAGS_IGNORE=-I " \
 coap_pdu_from_pbuf \
+coap_lwip_dump_memory_pools \
+coap_lwip_set_input_wait_handler \
 "
 
 # This helper is called by libcoap-$(LIBCOAP_API_VERSION).{map,sym} to see if

Makefile.libcoap

@@ -1,4 +1,4 @@
-libcoap_src = pdu.c net.c coap_cache.c coap_debug.c encode.c uri.c coap_subscribe.c resource.c str.c coap_option.c coap_async.c block.c mem.c coap_io.c coap_session.c coap_notls.c coap_hashkey.c coap_address.c coap_tcp.c
+libcoap_src = pdu.c net.c coap_cache.c coap_debug.c encode.c uri.c coap_subscribe.c resource.c str.c coap_option.c coap_async.c block.c mem.c coap_io.c coap_session.c coap_notls.c coap_hashkey.c coap_address.c coap_tcp.c coap_oscore.c
 
 libcoap_dir := $(filter %libcoap,$(APPDS))
 vpath %c $(libcoap_dir)/src

README.md

@@ -54,6 +54,8 @@ The following RFCs are supported
 
 * RFC8516: "Too Many Requests" Response Code for the Constrained Application Protocol
 
+* RFC8613: Object Security for Constrained RESTful Environments (OSCORE)
+
 * RFC8768: Constrained Application Protocol (CoAP) Hop-Limit Option
 
 * RFC9175: CoAP: Echo, Request-Tag, and Token Processing

cmake_coap_config.h.in

@@ -35,6 +35,9 @@
 /* Define if the system has epoll support */
 #cmakedefine COAP_EPOLL_SUPPORT @COAP_EPOLL_SUPPORT@
 
+/* Define if the library has OSCORE support */
+#cmakedefine HAVE_OSCORE @HAVE_OSCORE@
+
 /* Define to 1 if you have the <arpa/inet.h> header file. */
 #cmakedefine HAVE_ARPA_INET_H @HAVE_ARPA_INET_H@
 

coap_config.h.windows

@@ -71,6 +71,10 @@
 #define COAP_DISABLE_TCP 0
 #endif
 
+#ifndef HAVE_OSCORE
+#define HAVE_OSCORE 1
+#endif
+
 /* Define to the address where bug reports for this package should be sent. */
 #define PACKAGE_BUGREPORT "[email protected]"
 

coap_config.h.windows.in

@@ -71,6 +71,10 @@
 #define COAP_DISABLE_TCP 0
 #endif
 
+#ifndef HAVE_OSCORE
+#define HAVE_OSCORE 1
+#endif
+
 /* Define to the address where bug reports for this package should be sent. */
 #define PACKAGE_BUGREPORT "@PACKAGE_BUGREPORT@"
 

configure.ac

@@ -647,14 +647,36 @@ elif test "x$with_tinydtls" = "xyes"; then
     LIBCOAP_DTLS_LIB_EXTENSION_NAME=-tinydtls
 else
     LIBCOAP_DTLS_LIB_EXTENSION_NAME=-notls
+    AC_DEFINE(HAVE_NOTLS, [1], [Define if libcoap has no tls library support])
 fi
+AM_CONDITIONAL(HAVE_NOTLS, [test "x$LIBCOAP_DTLS_LIB_EXTENSION_NAME" = "x-notls"])
 
 LIBCOAP_NAME_SUFFIX="$LIBCOAP_API_VERSION$LIBCOAP_DTLS_LIB_EXTENSION_NAME"
 
 AC_SUBST(LIBCOAP_NAME_SUFFIX)
 AC_SUBST(LIBCOAP_DTLS_LIB_EXTENSION_NAME)
 AC_SUBST([DOLLAR_SIGN],[$])
 
+# configure options
+# __OSCORE__
+# Support for Object Security according to RFC 8613.
+AC_ARG_ENABLE([oscore],
+              [AS_HELP_STRING([--enable-oscore],
+                              [Enable building with OSCORE support [default=yes]])],
+              [build_oscore="$enableval"],
+              [build_oscore="yes"])
+
+if test "x$build_oscore" = "xyes"; then
+    if test "x$LIBCOAP_DTLS_LIB_EXTENSION_NAME" = "x-notls"; then
+        AC_MSG_WARN([==> --enable-oscore requires crypto support from TLS library or OS])
+    fi
+fi
+
+if test "x$build_oscore" = "xyes"; then
+        AC_DEFINE(HAVE_OSCORE, [1], [Define to build with OSCORE support])
+fi
+AM_CONDITIONAL(HAVE_OSCORE, [test "x$build_oscore" = "xyes"])
+
 # configure options
 # __tests__
 AC_ARG_ENABLE([tests],
@@ -976,6 +998,7 @@ man/coap_keepalive.txt
 man/coap_logging.txt
 man/coap_lwip.txt
 man/coap_observe.txt
+man/coap_oscore.txt
 man/coap_pdu_access.txt
 man/coap_pdu_setup.txt
 man/coap_recovery.txt
@@ -985,6 +1008,7 @@ man/coap_string.txt
 man/coap_tls_library.txt
 man/coap_uri.txt
 man/coap-client.txt
+man/coap-oscore-conf.txt
 man/coap-server.txt
 man/coap-rd.txt
 man/Makefile
@@ -1063,6 +1087,11 @@ if test "x$build_async" != "xno"; then
 else
     AC_MSG_RESULT([      enable separate responses: "no"])
 fi
+if test "x$build_oscore" != "xno"; then
+    AC_MSG_RESULT([      enable OSCORE support    : "yes"])
+else
+    AC_MSG_RESULT([      enable OSCORE support    : "no"])
+fi
 if test "x$build_doxygen" = "xyes"; then
     AC_MSG_RESULT([      build doxygen pages      : "yes"])
     AC_MSG_RESULT([          --> Doxygen around   : "yes" ($DOXYGEN $doxygen_version)])

doc/Doxyfile.in

@@ -857,7 +857,9 @@ WARN_LOGFILE           =
 INPUT                  = @top_srcdir@/doc/main.md \
                          @top_srcdir@/doc/module_api_wrap.h \
                          @top_srcdir@/src \
+                         @top_srcdir@/src/oscore \
                          @top_srcdir@/include/coap@LIBCOAP_API_VERSION@ \
+                         @top_srcdir@/include/oscore \
                          @top_builddir@/doc/man_tmp
 
 # This tag can be used to specify the character encoding of the source files

doc/Makefile.am

@@ -64,8 +64,9 @@ man-page-start: man-page-prepare
 	@echo '   <table class="directory">' >> $(top_builddir)/doc/man_tmp/upgrading.dox
 
 man-page-build: upg-page-build man-page-start
-	@MAN_FILES=`find $(top_srcdir)/man/ -type f -name "coap.txt.in" ; find $(top_srcdir)/man/ -type f -name "coap_*.in" | ALL=C sort ; find $(top_srcdir)/man/ -type f -name "coap-*.in" | LC_ALL=C sort` ;\
-	UPG_FILES=`find $(top_srcdir)/doc/ -type f -name "upgrade_*.txt" | ALL=C sort` ;\
+	@MAN_FILES=`find $(top_srcdir)/man/ -type f -name "coap.txt.in" ; find $(top_srcdir)/man/ -type f -name "coap_*.in" | LC_ALL=C sort ; find $(top_srcdir)/man/ -type f -name "coap-*.in" | LC_ALL=C sort` ;\
+	MAN3_FILES=`find $(top_srcdir)/man/ -type f -name "coap_*.in" | LC_ALL=C sort` ;\
+	UPG_FILES=`find $(top_srcdir)/doc/ -type f -name "upgrade_*.txt" | LC_ALL=C sort` ;\
 	HTML_FILES=`find $(top_builddir)/man/ -type f -name "*.html"` ;\
 	COUNT_MAN_FILES=`echo $${MAN_FILES} | wc -w` ;\
 	COUNT_HTML_FILES=`echo $${HTML_FILES} | wc -w` ;\
@@ -80,6 +81,9 @@ man-page-build: upg-page-build man-page-start
 		BASE=`basename $${FILE} | cut -d. -f 1` ;\
 		MANUAL=`egrep -B 1 "^====" $${FILE} | head -1` ;\
 		SUMMARY=`egrep -B 2 "^SYNOPSIS" $${FILE} | ${SED} 's/coap-//g' | cut -d\- -f2 | cut -c2- | head -1` ;\
+		if [ -z "$${SUMMARY}" ] ; then \
+			SUMMARY=`egrep -B 2 "^DESCRIPTION" $${FILE} | ${SED} 's/coap-//g' | cut -d\- -f2 | cut -c2- | head -1` ;\
+		fi ;\
 		##
 		## Fix and copy .html file across
 		##
@@ -117,7 +121,7 @@ man-page-build: upg-page-build man-page-start
 	## Build the individual man pages
 	##
 	echo '     <tab  type="usergroup" visible="yes" url="@ref man_individual" title="Individual Man Pages">' >> $(top_builddir)/doc/insert_file ;\
-	for FILE in $${MAN_FILES} ; do \
+	for FILE in $${MAN3_FILES} ; do \
 		BASE=`basename $${FILE} | cut -d. -f 1` ;\
 		LIST=`${SED} -ne '/^NAME/,/^SYNOPSIS/p;/^SYNOPSIS/q' $${FILE} | ${SED} -ne '/coap_/{ s/ *, *//g ; p }' | egrep -v "^$${BASE}$$"` ;\
 		for ENTRY in $${LIST} ; do \
@@ -134,7 +138,7 @@ man-page-build: upg-page-build man-page-start
 	##
 	## Process the (sorted) list of individual man pages
 	##
-	for ENTRY in `cat $(top_builddir)/doc/scratch_insert_file | ALL=C sort -u` ; do \
+	for ENTRY in `cat $(top_builddir)/doc/scratch_insert_file | LC_ALL=C sort -u` ; do \
 		## Update the individual man page
 		MANUAL="$${ENTRY}(3)" ;\
 		echo "      <tab type=\"user\" visible=\"yes\" url=\"@ref man_$${ENTRY}\" title=\"$${MANUAL}\" intro=\"\"/>" >> $(top_builddir)/doc/insert_file ;\

doc/main.md

@@ -38,6 +38,8 @@ The following RFCs are supported
 
 * RFC8516: "Too Many Requests" Response Code for the Constrained Application Protocol
 
+* RFC8613: Object Security for Constrained RESTful Environments (OSCORE)
+
 * RFC8768: Constrained Application Protocol (CoAP) Hop-Limit Option
 
 * RFC9175: CoAP: Echo, Request-Tag, and Token Processing

examples/Makefile.am

@@ -47,7 +47,7 @@ endif # BUILD_ADD_DEFAULT_NAMES
 if ! HAVE_CLIENT_SUPPORT
 coap_server_CPPFLAGS=-DSERVER_CAN_PROXY=0
 coap_server@LIBCOAP_DTLS_LIB_EXTENSION_NAME@_CPPFLAGS=-DSERVER_CAN_PROXY=0
-endif # HAVE_CLIENT_SUPPORT
+endif # ! HAVE_CLIENT_SUPPORT
 
 endif # HAVE_SERVER_SUPPORT