Skip to content

Commit 9209832

Browse files
miri64miri64
committed
Provide DTLS credentials via config
1 parent 138a0d1 commit 9209832

6 files changed

Lines changed: 53 additions & 15 deletions

File tree

‎services/listen_dnsport.c‎

Lines changed: 24 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1288,21 +1288,23 @@ static coap_context_t*
12881288
doc_setup_server_context(const uint8_t* key, unsigned key_len, const char* hint) {
12891289
coap_address_t listen_addr;
12901290
coap_context_t* coap_context = coap_new_context(NULL);
1291-
coap_dtls_spsk_t dtls_psk;
12921291

12931292
coap_context_set_block_mode(coap_context,
12941293
COAP_BLOCK_USE_LIBCOAP | COAP_BLOCK_SINGLE_BODY);
12951294

1296-
/* setup dtls */
1297-
memset (&dtls_psk, 0, sizeof (dtls_psk));
1295+
if (key && hint) {
1296+
/* setup dtls */
1297+
coap_dtls_spsk_t dtls_psk;
1298+
memset (&dtls_psk, 0, sizeof (dtls_psk));
12981299

1299-
dtls_psk.version = COAP_DTLS_SPSK_SETUP_VERSION;
1300-
dtls_psk.psk_info.hint.s = (const uint8_t*)hint;
1301-
dtls_psk.psk_info.hint.length = hint ? strlen(hint) : 0;
1302-
dtls_psk.psk_info.key.s = key;
1303-
dtls_psk.psk_info.key.length = key_len;
1300+
dtls_psk.version = COAP_DTLS_SPSK_SETUP_VERSION;
1301+
dtls_psk.psk_info.hint.s = (const uint8_t*)hint;
1302+
dtls_psk.psk_info.hint.length = hint ? strlen(hint) : 0;
1303+
dtls_psk.psk_info.key.s = key;
1304+
dtls_psk.psk_info.key.length = key_len;
13041305

1305-
coap_context_set_psk2(coap_context, &dtls_psk);
1306+
coap_context_set_psk2(coap_context, &dtls_psk);
1307+
}
13061308

13071309
/* setup oscore */
13081310
uint64_t start_seq_num = 0;
@@ -1611,6 +1613,7 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
16111613
int* reuseport, int transparent, int tcp_mss, int freebind,
16121614
int http2_nodelay, int use_systemd, int dnscrypt_port, int dscp,
16131615
int quic_port, int coap_port, int coaps_port,
1616+
const char* coaps_psk, const char* coaps_psk_id,
16141617
int http_notls_downstream, int sock_queue_timeout)
16151618
{
16161619
int s, noip6=0;
@@ -1631,14 +1634,16 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
16311634
const char* add = NULL;
16321635

16331636
#ifdef HAVE_COAP
1634-
static const uint8_t psk_key[] = "psk";
1635-
ssize_t psk_length = sizeof(psk_key) - 1;
1636-
static const char* hint = "client";
1637-
coap_context_t* coap_context = doc_setup_server_context(psk_key, psk_length, hint);
1637+
printf("coaps_psk: %s, coaps_psk_len: %lu, coaps_psk_id: %s\n", coaps_psk, strlen(coaps_psk), coaps_psk_id);
1638+
coap_context_t* coap_context = doc_setup_server_context(
1639+
(const uint8_t *)coaps_psk, strlen(coaps_psk), coaps_psk_id);
16381640

16391641
if (!coap_context) {
16401642
fatal_exit("Unable to get server context");
16411643
}
1644+
#else
1645+
(void)coaps_psk;
1646+
(void)coaps_psk_id;
16421647
#endif /* HAVE_COAP */
16431648

16441649
if(!do_udp && !do_tcp)
@@ -2356,6 +2361,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs,
23562361
cfg->http_nodelay, cfg->use_systemd,
23572362
cfg->dnscrypt_port, cfg->ip_dscp,
23582363
cfg->quic_port, cfg->coap_port, cfg->coaps_port,
2364+
cfg->coaps_psk, cfg->coaps_psk_id,
23592365
cfg->http_notls_downstream,
23602366
cfg->sock_queue_timeout)) {
23612367
listening_ports_free(list);
@@ -2376,6 +2382,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs,
23762382
cfg->http_nodelay, cfg->use_systemd,
23772383
cfg->dnscrypt_port, cfg->ip_dscp,
23782384
cfg->quic_port, cfg->coap_port, cfg->coaps_port,
2385+
cfg->coaps_psk, cfg->coaps_psk_id,
23792386
cfg->http_notls_downstream,
23802387
cfg->sock_queue_timeout)) {
23812388
listening_ports_free(list);
@@ -2398,6 +2405,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs,
23982405
cfg->http_nodelay, cfg->use_systemd,
23992406
cfg->dnscrypt_port, cfg->ip_dscp,
24002407
cfg->quic_port, cfg->coap_port, cfg->coaps_port,
2408+
cfg->coaps_psk, cfg->coaps_psk_id,
24012409
cfg->http_notls_downstream,
24022410
cfg->sock_queue_timeout)) {
24032411
listening_ports_free(list);
@@ -2417,6 +2425,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs,
24172425
cfg->http_nodelay, cfg->use_systemd,
24182426
cfg->dnscrypt_port, cfg->ip_dscp,
24192427
cfg->quic_port, cfg->coap_port, cfg->coaps_port,
2428+
cfg->coaps_psk, cfg->coaps_psk_id,
24202429
cfg->http_notls_downstream,
24212430
cfg->sock_queue_timeout)) {
24222431
listening_ports_free(list);
@@ -2438,6 +2447,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs,
24382447
cfg->http_nodelay, cfg->use_systemd,
24392448
cfg->dnscrypt_port, cfg->ip_dscp,
24402449
cfg->quic_port, cfg->coap_port, cfg->coaps_port,
2450+
cfg->coaps_psk, cfg->coaps_psk_id,
24412451
cfg->http_notls_downstream,
24422452
cfg->sock_queue_timeout)) {
24432453
listening_ports_free(list);
@@ -2457,6 +2467,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs,
24572467
cfg->http_nodelay, cfg->use_systemd,
24582468
cfg->dnscrypt_port, cfg->ip_dscp,
24592469
cfg->quic_port, cfg->coap_port, cfg->coaps_port,
2470+
cfg->coaps_psk, cfg->coaps_psk_id,
24602471
cfg->http_notls_downstream,
24612472
cfg->sock_queue_timeout)) {
24622473
listening_ports_free(list);

‎testdata/doc_downstream.tdir/doc_downstream.conf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ server:
66
outgoing-interface: 127.0.0.1
77
coap-port: @COAP_PORT@
88
coaps-port: @COAPS_PORT@
9+
coaps-psk: "psk"
10+
coaps-psk-id: "client"
911
use-syslog: no
1012
directory: .
1113
pidfile: "unbound.pid"

‎util/config_file.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -139,6 +139,8 @@ config_create(void)
139139
cfg->quic_size = 8*1024*1024;
140140
cfg->coap_port = UNBOUND_DNS_OVER_COAP_PORT;
141141
cfg->coaps_port = UNBOUND_DNS_OVER_COAPS_PORT;
142+
cfg->coaps_psk = NULL;
143+
cfg->coaps_psk_id = NULL;
142144
cfg->use_syslog = 1;
143145
cfg->log_identity = NULL; /* changed later with argv[0] */
144146
cfg->log_time_ascii = 0;

‎util/config_file.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -173,6 +173,10 @@ struct config_file {
173173
int coap_port;
174174
/** port on which to provide DNS over CoAP over DTLS over UDP service */
175175
int coaps_port;
176+
/** CoAPS pre-shared key */
177+
char *coaps_psk;
178+
/** Identity sent for CoAPS pre-shared key */
179+
char *coaps_psk_id;
176180

177181
/** outgoing port range number of ports (per thread) */
178182
int outgoing_num_ports;

‎util/configlexer.lex‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -273,6 +273,8 @@ quic-port{COLON} { YDVAR(1, VAR_QUIC_PORT) }
273273
quic-size{COLON} { YDVAR(1, VAR_QUIC_SIZE) }
274274
coap-port{COLON} { YDVAR(1, VAR_COAP_PORT) }
275275
coaps-port{COLON} { YDVAR(1, VAR_COAPS_PORT) }
276+
coaps-psk{COLON} { YDVAR(1, VAR_COAPS_PSK) }
277+
coaps-psk-id{COLON} { YDVAR(1, VAR_COAPS_PSK_ID) }
276278
use-systemd{COLON} { YDVAR(1, VAR_USE_SYSTEMD) }
277279
do-daemonize{COLON} { YDVAR(1, VAR_DO_DAEMONIZE) }
278280
interface{COLON} { YDVAR(1, VAR_INTERFACE) }

‎util/configparser.y‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -204,7 +204,7 @@ extern struct config_parser_state* cfg_parser;
204204
%token VAR_INTERFACE_ACTION VAR_INTERFACE_VIEW VAR_INTERFACE_TAG
205205
%token VAR_INTERFACE_TAG_ACTION VAR_INTERFACE_TAG_DATA
206206
%token VAR_QUIC_PORT VAR_QUIC_SIZE
207-
%token VAR_COAP_PORT VAR_COAPS_PORT
207+
%token VAR_COAP_PORT VAR_COAPS_PORT VAR_COAPS_PSK VAR_COAPS_PSK_ID
208208
%token VAR_PROXY_PROTOCOL_PORT VAR_STATISTICS_INHIBIT_ZERO
209209
%token VAR_HARDEN_UNKNOWN_ADDITIONAL VAR_DISABLE_EDNS_DO VAR_CACHEDB_NO_STORE
210210
%token VAR_LOG_DESTADDR VAR_CACHEDB_CHECK_WHEN_SERVE_EXPIRED
@@ -345,7 +345,7 @@ content_server: server_num_threads | server_verbosity | server_port |
345345
server_zonemd_permissive_mode | server_max_reuse_tcp_queries |
346346
server_tcp_reuse_timeout | server_tcp_auth_query_timeout |
347347
server_quic_port | server_quic_size |
348-
server_coap_port | server_coaps_port |
348+
server_coap_port | server_coaps_port | server_coaps_psk | server_coaps_psk_id |
349349
server_interface_automatic_ports | server_ede |
350350
server_proxy_protocol_port | server_statistics_inhibit_zero |
351351
server_harden_unknown_additional | server_disable_edns_do |
@@ -1259,6 +1259,23 @@ server_coaps_port: VAR_COAPS_PORT STRING_ARG
12591259
else cfg_parser->cfg->coaps_port = atoi($2);
12601260
free($2);
12611261
};
1262+
server_coaps_psk: VAR_COAPS_PSK STRING_ARG
1263+
{
1264+
OUTYY(("P(server_coaps_psk:%s)\n", $2));
1265+
#ifndef HAVE_COAP
1266+
log_warn("%s:%d: Unbound is not compiled with "
1267+
"libcoap. This is required to use DNS "
1268+
"over CoAP.", cfg_parser->filename, cfg_parser->line);
1269+
#endif
1270+
free(cfg_parser->cfg->coaps_psk);
1271+
cfg_parser->cfg->coaps_psk = $2;
1272+
};
1273+
server_coaps_psk_id: VAR_COAPS_PSK_ID STRING_ARG
1274+
{
1275+
OUTYY(("P(server_coaps_psk_id:%s)\n", $2));
1276+
free(cfg_parser->cfg->coaps_psk_id);
1277+
cfg_parser->cfg->coaps_psk_id = $2;
1278+
};
12621279
server_use_systemd: VAR_USE_SYSTEMD STRING_ARG
12631280
{
12641281
OUTYY(("P(server_use_systemd:%s)\n", $2));

0 commit comments

Comments
 (0)