I'm having trouble using DTLS

[himoony]

When we try to connect to a Leshan server using DTLS, a timeout occurs and the handshake failed. It's a failure in the DTLS library, but it's hard to think of as a bug in the DTLS side. Is there any setup or test method I didn't think of? Below is how I tried.

$ export M2MROOT="$HOME/lwm2m" $ cd $M2MROOT $ git clone --recursive https://github.com/ARMmbed/mbedtls mbedtls $ cd $M2MROOT/mbedtls $ git checkout mbedtls-2.9.0 -b vmbedtls-2.9.0 $ git checkout mbedtls-2.16.3 -b vmbedtls-2.16.3 $ cd $M2MROOT/mbedtls/crypto $ git checkout mbedcrypto-1.1.1 -b vmbedcrypto-1.1.1 $ cd $M2MROOT $ git clone https://github.com/AVSystem/Anjay.git anjay $ git submodule update --init $ cd $M2MROOT/anjay $ cd .. $ mkdir -p $M2MROOT/build/mbedtls $M2MROOT/build/anjay $ cd $M2MROOT/build/mbedtls $ cmake -DUSE_SHARED_MBEDTLS_LIBRARY=ON -DCMAKE_INSTALL_PREFIX=$M2MROOT/build/ $M2MROOT/mbedtls/ $ make install $ cd $M2MROOT/build/anjay $ cmake $M2MROOT/anjay/ -DDTLS_BACKEND=mbedtls -DMBEDTLS_INCLUDE_DIR=$M2MROOT/build/include -DMBEDTLS_LIBRARY=$M2MROOT/build/lib/libmbedtls.so -DMBEDTLS_CRYPTO_LIBRARY=$M2MROOT/build/lib/libmbedcrypto.so -DMBEDTLS_X509_LIBRARY=$M2MROOT/build/lib/libmbedx509.so -DWITH_MBEDTLS_LOGS=ON $ make $ M2MROOT/build/anjay/output/bin/demo -e jungssl --server-uri coaps://leshan.eclipseprojects.io:5684 --security-mode psk --identity 666f6f --key 626172

[Log Message] 2020-01-15 11:04:47.901025 TRACE [mbedtls] [/home001/moon.jung/anjay_master/mbedtls/library/ssl_tls.c:2536]: => fetch input 2020-01-15 11:04:47.901035 TRACE [mbedtls] [/home001/moon.jung/anjay_master/mbedtls/library/ssl_tls.c:2597]: in_left: 0, nb_want: 13 2020-01-15 11:04:47.901045 TRACE [mbedtls] [/home001/moon.jung/anjay_master/mbedtls/library/ssl_tls.c:2638]: f_recv_timeout: 60000 ms 2020-01-15 11:05:47.956252 TRACE [mbedtls] [/home001/moon.jung/anjay_master/mbedtls/library/ssl_tls.c:2646]: ssl->f_recv(_timeout)() returned -26624 (-0x6800) 2020-01-15 11:05:47.956287 TRACE [mbedtls] [/home001/moon.jung/anjay_master/mbedtls/library/ssl_tls.c:2654]: timeout 2020-01-15 11:05:47.956299 TRACE [mbedtls] [/home001/moon.jung/anjay_master/mbedtls/library/ssl_tls.c:81]: set_timer to 0 ms 2020-01-15 11:05:47.956308 TRACE [mbedtls] [/home001/moon.jung/anjay_master/mbedtls/library/ssl_tls.c:2661]: handshake timeout 2020-01-15 11:05:47.956318 TRACE [mbedtls] [/home001/moon.jung/anjay_master/mbedtls/library/ssl_tls.c:4973]: mbedtls_ssl_fetch_input() returned -26624 (-0x6800) 2020-01-15 11:05:47.956331 TRACE [mbedtls] [/home001/moon.jung/anjay_master/mbedtls/library/ssl_tls.c:4344]: ssl_get_next_record() returned -26624 (-0x6800) 2020-01-15 11:05:47.956343 TRACE [mbedtls] [/home001/moon.jung/anjay_master/mbedtls/library/ssl_tls.c:5906]: mbedtls_ssl_read_record() returned -26624 (-0x6800) 2020-01-15 11:05:47.956355 TRACE [mbedtls] [/home001/moon.jung/anjay_master/mbedtls/library/ssl_tls.c:8094]: <= handshake 2020-01-15 11:05:47.956379 ERROR [avs_net] [/home001/moon.jung/anjay_master/anjay/deps/avs_commons/net/src/mbedtls/mbedtls.c:743]: handshake failed: -26624 2020-01-15 11:05:47.956395 TRACE [mbedtls] [/home001/moon.jung/anjay_master/mbedtls/library/ssl_tls.c:8934]: => free 2020-01-15 11:05:47.956438 TRACE [mbedtls] [/home001/moon.jung/anjay_master/mbedtls/library/ssl_tls.c:8999]: <= free 2020-01-15 11:05:47.956461 ERROR [anjay] [/home001/moon.jung/anjay_master/anjay/src/servers/connection_ip.c:86]: could not connect to leshan.eclipseprojects.io:5684 2020-01-15 11:05:47.956476 DEBUG [coap_stream] [/home001/moon.jung/anjay_master/anjay/deps/avs_coap/src/streaming/streaming_client.c:81]: coap_stream state: UNINITIALIZED -> UNINITIALIZED 2020-01-15 11:05:47.956489 TRACE [anjay] [/home001/moon.jung/anjay_master/anjay/src/servers/activate.c:120]: could not initialize sockets for SSID 1 2020-01-15 11:05:47.958036 DEBUG [anjay] [/home001/moon.jung/anjay_master/anjay/src/servers/activate.c:60]: Non-Bootstrap Server 1: not reachable.

[krwc]

Hi, what you did from Anjay perspective is, I think, fine. The reason the server is not responding is likely due to lack of matching DTLS configuration. Since the server did not recognize the credentials, it simply ignored handshake requests.

So, I'd recommend double checking server configuration.

[himoony]

Testing with the wakama client with tinydtls was a success. Therefore, I do not think that the server configuration is wrong. There seems to be a problem with anjay using mbedtls.

[krwc]

I still think this is a misconfiguration either on server side or client side. I've just added this test security configuration on leshan:

and then started the demo:

./output/bin/demo -s psk -u coaps://leshan.eclipseprojects.io:5684 -i 666f6f -k 626172 -e test-anjay

which resulted in successful registration.

[himoony]

Thank you for your active help. I didn't know if I needed to convert the server's identity value to an ASCII value. I confirmed that it worked. Thank you again.