BLE Secure#
This module includes functions that control BLE Secure (TLS over BLE) communication.
This module includes functions that implement TCAT communication.
The functions in this module are available when BLE Secure API feature (OPENTHREAD_CONFIG_BLE_TCAT_ENABLE) is enabled.
The functions in this module are available when TCAT feature (OPENTHREAD_CONFIG_BLE_TCAT_ENABLE) is enabled.
Modules#
Enumerations#
Represents TCAT status code.
Represents TCAT application protocol.
Represents a TCAT command class.
Typedefs#
Pointer to call when ble secure connection state changes.
Pointer to call when data was received over a BLE Secure TLS connection.
Represents TCAT status code.
Represents TCAT application protocol.
Represents a TCAT command class.
This structure represents a TCAT vendor information.
Pointer to call when application data was received over a TCAT TLS connection.
Pointer to call to notify the completion of a join operation.
Functions#
Starts the BLE Secure service.
Enables the TCAT protocol over BLE Secure.
Stops the BLE Secure server.
Sets the Pre-Shared Key (PSK) and cipher suite TLS_PSK_WITH_AES_128_CCM_8.
Returns the peer x509 certificate base64 encoded.
Returns an attribute value identified by its OID from the subject of the peer x509 certificate.
Returns an attribute value for the OID 1.3.6.1.4.1.44970.x from the v3 extensions of the peer x509 certificate, where the last digit x is set to aThreadOidDescriptor.
Returns an attribute value for the OID 1.3.6.1.4.1.44970.x from the v3 extensions of the own x509 certificate, where the last digit x is set to aThreadOidDescriptor.
Sets the authentication mode for the BLE secure connection.
Sets the local device's X509 certificate with corresponding private key for TLS session with TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8.
Sets the trusted top level CAs.
Initializes TLS session with a peer using an already open BLE connection.
Stops the BLE and TLS connection.
Indicates whether or not the TLS session is active (connected or conneting).
Indicates whether or not the TLS session is connected.
Indicates whether or not the TCAT agent is enabled.
Indicates whether or not a TCAT command class is authorized.
Sends a secure BLE message.
Sends a secure BLE data packet.
Sends a secure BLE data packet containing a TCAT Send Application Data TLV.
Flushes the send buffer.
Macros#
Maximum string length of a UDP or TCP service name (does not include null char).
Enumeration Documentation#
otTcatStatusCode#
otTcatStatusCode
Represents TCAT status code.
| Enumerator | |
|---|---|
| OT_TCAT_STATUS_SUCCESS | Command or request was successfully processed. |
| OT_TCAT_STATUS_UNSUPPORTED | Requested command or received TLV is not supported. |
| OT_TCAT_STATUS_PARSE_ERROR | Request / command could not be parsed correctly. |
| OT_TCAT_STATUS_VALUE_ERROR | The value of the transmitted TLV has an error. |
| OT_TCAT_STATUS_GENERAL_ERROR | An error not matching any other category occurred. |
| OT_TCAT_STATUS_BUSY | Command cannot be executed because the resource is busy. |
| OT_TCAT_STATUS_UNDEFINED | The requested value, data or service is not defined (currently) or not present. |
| OT_TCAT_STATUS_HASH_ERROR | The hash value presented by the commissioner was incorrect. |
| OT_TCAT_STATUS_UNAUTHORIZED | Sender does not have sufficient authorization for the given command. |
74 of file include/openthread/tcat.hotTcatApplicationProtocol#
otTcatApplicationProtocol
Represents TCAT application protocol.
| Enumerator | |
|---|---|
| OT_TCAT_APPLICATION_PROTOCOL_NONE | Message which has been sent without activating the TCAT agent. |
| OT_TCAT_APPLICATION_PROTOCOL_STATUS | Message directed to a UDP service. |
| OT_TCAT_APPLICATION_PROTOCOL_TCP | Message directed to a TCP service. |
92 of file include/openthread/tcat.hotTcatCommandClass#
otTcatCommandClass
Represents a TCAT command class.
| Enumerator | |
|---|---|
| OT_TCAT_COMMAND_CLASS_GENERAL | TCAT commands related to general operations. |
| OT_TCAT_COMMAND_CLASS_COMMISSIONING | TCAT commands related to commissioning. |
| OT_TCAT_COMMAND_CLASS_EXTRACTION | TCAT commands related to key extraction. |
| OT_TCAT_COMMAND_CLASS_DECOMMISSIONING | TCAT commands related to de-commissioning. |
| OT_TCAT_COMMAND_CLASS_APPLICATION | TCAT commands related to application layer. |
104 of file include/openthread/tcat.hTypedef Documentation#
otHandleBleSecureConnect#
typedef void(* otHandleBleSecureConnect) (otInstance *aInstance, bool aConnected, bool aBleConnectionOpen, void *aContext) )(otInstance *aInstance, bool aConnected, bool aBleConnectionOpen, void *aContext)
Pointer to call when ble secure connection state changes.
| [in] | aInstance | A pointer to an OpenThread instance. |
| [in] | aConnected | TRUE, if a secure connection was established, FALSE otherwise. |
| [in] | aBleConnectionOpen | TRUE if a BLE connection was established to carry a TLS data stream, FALSE otherwise. |
| [in] | aContext | A pointer to arbitrary context information. |
78 of file include/openthread/ble_secure.hotHandleBleSecureReceive#
typedef otHandleTcatApplicationDataReceive otHandleBleSecureReceive
Pointer to call when data was received over a BLE Secure TLS connection.
87 of file include/openthread/ble_secure.hotTcatStatusCode#
typedef enum otTcatStatusCode otTcatStatusCode
Represents TCAT status code.
86 of file include/openthread/tcat.hotTcatApplicationProtocol#
typedef enum otTcatApplicationProtocol otTcatApplicationProtocol
Represents TCAT application protocol.
98 of file include/openthread/tcat.hotTcatCommandClass#
typedef enum otTcatCommandClass otTcatCommandClass
Represents a TCAT command class.
112 of file include/openthread/tcat.hotTcatVendorInfo#
typedef struct otTcatVendorInfo otTcatVendorInfo
This structure represents a TCAT vendor information.
The content of this structure MUST persist and remain unchanged while a TCAT session is running.
131 of file include/openthread/tcat.hotHandleTcatApplicationDataReceive#
typedef void(* otHandleTcatApplicationDataReceive) (otInstance *aInstance, const otMessage *aMessage, int32_t aOffset, otTcatApplicationProtocol aTcatApplicationProtocol, const char *aServiceName, void *aContext) )(otInstance *aInstance, const otMessage *aMessage, int32_t aOffset, otTcatApplicationProtocol aTcatApplicationProtocol, const char *aServiceName, void *aContext)
Pointer to call when application data was received over a TCAT TLS connection.
| [in] | aInstance | A pointer to an OpenThread instance. |
| [in] | aMessage | A pointer to the message. |
| [in] | aOffset | The offset where the application data begins. |
| [in] | aTcatApplicationProtocol | The protocol type of the message received. |
| [in] | aServiceName | The name of the service the message is direced to. |
| [in] | aContext | A pointer to arbitrary context information. |
144 of file include/openthread/tcat.hotHandleTcatJoin#
typedef void(* otHandleTcatJoin) (otError aError, void *aContext) )(otError aError, void *aContext)
Pointer to call to notify the completion of a join operation.
| [in] | aError | OT_ERROR_NONE if the join process succeeded. OT_ERROR_SECURITY if the join process failed due to security credentials. |
| [in] | aContext | A pointer to arbitrary context information. |
159 of file include/openthread/tcat.hFunction Documentation#
otBleSecureStart#
otError otBleSecureStart (otInstance * aInstance, otHandleBleSecureConnect aConnectHandler, otHandleBleSecureReceive aReceiveHandler, bool aTlvMode, void * aContext)
Starts the BLE Secure service.
| [in] | aInstance | A pointer to an OpenThread instance. |
| [in] | aConnectHandler | A pointer to a function that will be called when the connection state changes. |
| [in] | aReceiveHandler | A pointer to a function that will be called once data has been received over the TLS connection. |
| [in] | aTlvMode | A boolean value indicating if line mode shall be activated. |
| [in] | aContext | A pointer to arbitrary context information. May be NULL if not used. |
When TLV mode is active, the function aReceiveHandler will be called once a complete TLV was received and the message offset points to the TLV value.
106 of file include/openthread/ble_secure.hotBleSecureTcatStart#
otError otBleSecureTcatStart (otInstance * aInstance, const otTcatVendorInfo * aVendorInfo, otHandleTcatJoin aHandler)
Enables the TCAT protocol over BLE Secure.
| [in] | aInstance | A pointer to an OpenThread instance. |
| [in] | aVendorInfo | A pointer to the Vendor Information (must remain valid after the method call, may be NULL). |
| [in] | aHandler | A pointer to a function that is called when the join operation completes. |
125 of file include/openthread/ble_secure.hotBleSecureStop#
void otBleSecureStop (otInstance * aInstance)
Stops the BLE Secure server.
| [in] | aInstance | A pointer to an OpenThread instance. |
133 of file include/openthread/ble_secure.hotBleSecureSetPsk#
void otBleSecureSetPsk (otInstance * aInstance, const uint8_t * aPsk, uint16_t aPskLength, const uint8_t * aPskIdentity, uint16_t aPskIdLength)
Sets the Pre-Shared Key (PSK) and cipher suite TLS_PSK_WITH_AES_128_CCM_8.
| [in] | aInstance | A pointer to an OpenThread instance. |
| [in] | aPsk | A pointer to the PSK. |
| [in] | aPskLength | The PSK length. |
| [in] | aPskIdentity | The Identity Name for the PSK. |
| [in] | aPskIdLength | The PSK Identity Length. |
Note
Requires the build-time feature
MBEDTLS_KEY_EXCHANGE_PSK_ENABLEDto be enabled.
148 of file include/openthread/ble_secure.hotBleSecureGetPeerCertificateBase64#
otError otBleSecureGetPeerCertificateBase64 (otInstance * aInstance, unsigned char * aPeerCert, size_t * aCertLength)
Returns the peer x509 certificate base64 encoded.
| [in] | aInstance | A pointer to an OpenThread instance. |
| [out] | aPeerCert | A pointer to the base64 encoded certificate buffer. |
| [inout] | aCertLength | On input, the size the max size of |
Note
Requires the build-time features
MBEDTLS_BASE64_CandMBEDTLS_SSL_KEEP_PEER_CERTIFICATEto be enabled.
171 of file include/openthread/ble_secure.hotBleSecureGetPeerSubjectAttributeByOid#
otError otBleSecureGetPeerSubjectAttributeByOid (otInstance * aInstance, const char * aOid, size_t aOidLength, uint8_t * aAttributeBuffer, size_t * aAttributeLength, int * aAsn1Type)
Returns an attribute value identified by its OID from the subject of the peer x509 certificate.
| [in] | aInstance | A pointer to an OpenThread instance. |
| [in] | aOid | A pointer to the OID to be found. |
| [in] | aOidLength | The length of the OID. |
| [out] | aAttributeBuffer | A pointer to the attribute buffer. |
| [inout] | aAttributeLength | On input, the size the max size of |
| [out] | aAsn1Type | A pointer to the ASN.1 type of the attribute written to the buffer. |
The peer OID is provided in binary format. The attribute length is set if the attribute was successfully read or zero if unsuccessful. The ASN.1 type as is set as defineded in the ITU-T X.690 standard if the attribute was successfully read.
Note
Requires the build-time feature
MBEDTLS_SSL_KEEP_PEER_CERTIFICATEto be enabled.
197 of file include/openthread/ble_secure.hotBleSecureGetThreadAttributeFromPeerCertificate#
otError otBleSecureGetThreadAttributeFromPeerCertificate (otInstance * aInstance, int aThreadOidDescriptor, uint8_t * aAttributeBuffer, size_t * aAttributeLength)
Returns an attribute value for the OID 1.3.6.1.4.1.44970.x from the v3 extensions of the peer x509 certificate, where the last digit x is set to aThreadOidDescriptor.
| [in] | aInstance | A pointer to an OpenThread instance. |
| [in] | aThreadOidDescriptor | The last digit of the Thread attribute OID. |
| [out] | aAttributeBuffer | A pointer to the attribute buffer. |
| [inout] | aAttributeLength | On input, the size the max size of |
The attribute length is set if the attribute was successfully read or zero if unsuccessful. Requires a connection to be active.
Note
Requires the build-time feature
MBEDTLS_SSL_KEEP_PEER_CERTIFICATEto be enabled.
228 of file include/openthread/ble_secure.hotBleSecureGetThreadAttributeFromOwnCertificate#
otError otBleSecureGetThreadAttributeFromOwnCertificate (otInstance * aInstance, int aThreadOidDescriptor, uint8_t * aAttributeBuffer, size_t * aAttributeLength)
Returns an attribute value for the OID 1.3.6.1.4.1.44970.x from the v3 extensions of the own x509 certificate, where the last digit x is set to aThreadOidDescriptor.
| [in] | aInstance | A pointer to an OpenThread instance. |
| [in] | aThreadOidDescriptor | The last digit of the Thread attribute OID. |
| [out] | aAttributeBuffer | A pointer to the attribute buffer. |
| [inout] | aAttributeLength | On input, the size the max size of |
The attribute length is set if the attribute was successfully read or zero if unsuccessful. Requires a connection to be active.
254 of file include/openthread/ble_secure.hotBleSecureSetSslAuthMode#
void otBleSecureSetSslAuthMode (otInstance * aInstance, bool aVerifyPeerCertificate)
Sets the authentication mode for the BLE secure connection.
| [in] | aInstance | A pointer to an OpenThread instance. |
| [in] | aVerifyPeerCertificate | true, to verify the peer certificate. |
Disable or enable the verification of peer certificate. Must be called before start.
269 of file include/openthread/ble_secure.hotBleSecureSetCertificate#
void otBleSecureSetCertificate (otInstance * aInstance, const uint8_t * aX509Cert, uint32_t aX509Length, const uint8_t * aPrivateKey, uint32_t aPrivateKeyLength)
Sets the local device's X509 certificate with corresponding private key for TLS session with TLS_ECDHE_ECDSA_WITH_AES_128_CCM_8.
| [in] | aInstance | A pointer to an OpenThread instance. |
| [in] | aX509Cert | A pointer to the PEM formatted X509 certificate. |
| [in] | aX509Length | The length of certificate. |
| [in] | aPrivateKey | A pointer to the PEM formatted private key. |
| [in] | aPrivateKeyLength | The length of the private key. |
Note
Requires
MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED=1.
284 of file include/openthread/ble_secure.hotBleSecureSetCaCertificateChain#
void otBleSecureSetCaCertificateChain (otInstance * aInstance, const uint8_t * aX509CaCertificateChain, uint32_t aX509CaCertChainLength)
Sets the trusted top level CAs.
| [in] | aInstance | A pointer to an OpenThread instance. |
| [in] | aX509CaCertificateChain | A pointer to the PEM formatted X509 CA chain. |
| [in] | aX509CaCertChainLength | The length of chain. |
It is needed for validating the certificate of the peer.
TLS mode "ECDHE ECDSA with AES 128 CCM 8" for secure BLE.
Note
Requires
MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED=1.
303 of file include/openthread/ble_secure.hotBleSecureConnect#
otError otBleSecureConnect (otInstance * aInstance)
Initializes TLS session with a peer using an already open BLE connection.
| [in] | aInstance | A pointer to an OpenThread instance. |
315 of file include/openthread/ble_secure.hotBleSecureDisconnect#
void otBleSecureDisconnect (otInstance * aInstance)
Stops the BLE and TLS connection.
| [in] | aInstance | A pointer to an OpenThread instance. |
323 of file include/openthread/ble_secure.hotBleSecureIsConnectionActive#
bool otBleSecureIsConnectionActive (otInstance * aInstance)
Indicates whether or not the TLS session is active (connected or conneting).
| [in] | aInstance | A pointer to an OpenThread instance. |
334 of file include/openthread/ble_secure.hotBleSecureIsConnected#
bool otBleSecureIsConnected (otInstance * aInstance)
Indicates whether or not the TLS session is connected.
| [in] | aInstance | A pointer to an OpenThread instance. |
345 of file include/openthread/ble_secure.hotBleSecureIsTcatEnabled#
bool otBleSecureIsTcatEnabled (otInstance * aInstance)
Indicates whether or not the TCAT agent is enabled.
| N/A | aInstance |
354 of file include/openthread/ble_secure.hotBleSecureIsCommandClassAuthorized
bool otBleSecureIsCommandClassAuthorized (otInstance * aInstance, otTcatCommandClass aCommandClass)
Indicates whether or not a TCAT command class is authorized.
| [in] | aInstance | A pointer to an OpenThread instance. |
| [in] | aCommandClass | A command class to check. |
366 of file include/openthread/ble_secure.hotBleSecureSendMessage#
otError otBleSecureSendMessage (otInstance * aInstance, otMessage * aMessage)
Sends a secure BLE message.
| [in] | aInstance | A pointer to an OpenThread instance. |
| [in] | aMessage | A pointer to the message to send. |
If the return value is OT_ERROR_NONE, OpenThread takes ownership of aMessage, and the caller should no longer reference aMessage. If the return value is not OT_ERROR_NONE, the caller retains ownership of aMessage, including freeing aMessage if the message buffer is no longer needed.
383 of file include/openthread/ble_secure.hotBleSecureSend#
otError otBleSecureSend (otInstance * aInstance, uint8_t * aBuf, uint16_t aLength)
Sends a secure BLE data packet.
| [in] | aInstance | A pointer to an OpenThread instance. |
| [in] | aBuf | A pointer to the data to send as the Value of the TCAT Send Application Data TLV. |
| [in] | aLength | A number indicating the length of the data buffer. |
397 of file include/openthread/ble_secure.hotBleSecureSendApplicationTlv#
otError otBleSecureSendApplicationTlv (otInstance * aInstance, uint8_t * aBuf, uint16_t aLength)
Sends a secure BLE data packet containing a TCAT Send Application Data TLV.
| [in] | aInstance | A pointer to an OpenThread instance. |
| [in] | aBuf | A pointer to the data to send as the Value of the TCAT Send Application Data TLV. |
| [in] | aLength | A number indicating the length of the data buffer. |
411 of file include/openthread/ble_secure.hotBleSecureFlush#
otError otBleSecureFlush (otInstance * aInstance)
Flushes the send buffer.
| [in] | aInstance | A pointer to an OpenThread instance. |
423 of file include/openthread/ble_secure.h