Add DTLS support to client and broker

.github/workflows/broker-check.yml

@@ -19,21 +19,35 @@ jobs:
           - name: "Broker default (dynamic alloc)"
             cflags: ""
             wolfmqtt_opts: "--enable-broker"
+            wolfssl_opts: "--enable-enckeys"
           - name: "Broker static memory"
             cflags: "-DWOLFMQTT_STATIC_MEMORY"
             wolfmqtt_opts: "--enable-broker"
+            wolfssl_opts: "--enable-enckeys"
           - name: "Broker with TLS"
             cflags: ""
             wolfmqtt_opts: "--enable-broker --enable-tls"
+            wolfssl_opts: "--enable-enckeys"
           - name: "Broker with TLS (static memory)"
             cflags: "-DWOLFMQTT_STATIC_MEMORY"
             wolfmqtt_opts: "--enable-broker --enable-tls"
+            wolfssl_opts: "--enable-enckeys"
+          - name: "Broker with DTLS"
+            cflags: ""
+            wolfmqtt_opts: "--enable-broker --enable-tls --enable-dtls"
+            wolfssl_opts: "--enable-enckeys --enable-dtls --enable-dtls13"
+          - name: "Broker with DTLS (static memory)"
+            cflags: "-DWOLFMQTT_STATIC_MEMORY"
+            wolfmqtt_opts: "--enable-broker --enable-tls --enable-dtls"
+            wolfssl_opts: "--enable-enckeys --enable-dtls --enable-dtls13"
           - name: "Broker no logging"
             cflags: ""
             wolfmqtt_opts: "--enable-broker --disable-broker-log"
+            wolfssl_opts: "--enable-enckeys"
           - name: "Broker minimal (no log, no retained, no will, no wildcards, no auth)"
             cflags: ""
             wolfmqtt_opts: "--enable-broker --disable-broker-log --disable-broker-retained --disable-broker-will --disable-broker-wildcards --disable-broker-auth"
+            wolfssl_opts: "--enable-enckeys"
 
     steps:
     - name: Install dependencies
@@ -51,7 +65,7 @@ jobs:
       run: ./autogen.sh
     - name: wolfssl configure
       working-directory: ./wolfssl
-      run: ./configure --enable-enckeys
+      run: ./configure ${{ matrix.wolfssl_opts }}
     - name: wolfssl make
       working-directory: ./wolfssl
       run: make

CMakeLists.txt

@@ -91,6 +91,18 @@ if (WOLFMQTT_TLS)
     list(APPEND WOLFMQTT_DEFINITIONS "-DENABLE_MQTT_TLS")
 endif()
 
+add_option("WOLFMQTT_DTLS"
+           "Enable DTLS support (requires wolfSSL DTLS)"
+           "no" "yes;no")
+if (WOLFMQTT_DTLS)
+    if (NOT WOLFMQTT_TLS)
+        message(WARNING "DTLS requires TLS support -- disabling DTLS")
+        set(WOLFMQTT_DTLS "no" CACHE STRING "" FORCE)
+    else()
+        list(APPEND WOLFMQTT_DEFINITIONS "-DENABLE_MQTT_DTLS")
+    endif()
+endif()
+
 add_option("WOLFMQTT_SN"
            "Enable MQTT-SN support"
            "no" "yes;no")

configure.ac

@@ -158,7 +158,6 @@ then
     test "$enable_v5" = "" && enable_v5=yes
     test "$enable_discb" = "" && enable_discb=yes
     test "$enable_mt" = "" && enable_mt=yes
-    test "$enable_" = "" && enable_=yes
 fi
 
 # TLS Support with wolfSSL
@@ -176,6 +175,24 @@ AC_CHECK_LIB([wolfssl],[wolfCrypt_Init],,[AC_MSG_ERROR([libwolfssl is required a
 
 fi
 
+# DTLS Support (requires wolfSSL with DTLS)
+AC_ARG_ENABLE([dtls],
+    [AS_HELP_STRING([--enable-dtls],[Enable DTLS support (requires wolfSSL DTLS) (default: disabled)])],
+    [ ENABLED_DTLS=$enableval ],
+    [ ENABLED_DTLS=no ]
+    )
+
+if test "x$ENABLED_DTLS" = "xyes"
+then
+    if test "x$ENABLED_TLS" != "xyes"
+    then
+        AC_MSG_WARN([DTLS requires TLS support -- disabling DTLS])
+        ENABLED_DTLS=no
+    else
+        AM_CFLAGS="$AM_CFLAGS -DENABLE_MQTT_DTLS"
+    fi
+fi
+
 
 # Non-Blocking support
 AC_ARG_ENABLE([nonblock],
@@ -480,6 +497,7 @@ AM_CONDITIONAL([BUILD_NONBLOCK], [test "x$ENABLED_NONBLOCK" = "xyes"])
 AM_CONDITIONAL([BUILD_MULTITHREAD], [test "x$ENABLED_MULTITHREAD" = "xyes"])
 AM_CONDITIONAL([BUILD_WEBSOCKET], [test "x$ENABLED_WEBSOCKET" = "xyes"])
 AM_CONDITIONAL([BUILD_BROKER], [test "x$ENABLED_BROKER" = "xyes"])
+AM_CONDITIONAL([BUILD_DTLS], [test "x$ENABLED_DTLS" = "xyes"])
 
 
 

examples/mqttclient/mqttclient.c

@@ -268,6 +268,12 @@ int mqttclient_test(MQTTCtx *mqttCtx)
        MqttSocket_Connect for use by mqtt_tls_verify_cb */
     mqttCtx->client.ctx = mqttCtx;
 
+#ifdef ENABLE_MQTT_DTLS
+    if (mqttCtx->use_dtls) {
+        MqttClient_Flags(&mqttCtx->client, 0, MQTT_CLIENT_FLAG_IS_DTLS);
+    }
+#endif
+
 #ifdef WOLFMQTT_DISCONNECT_CB
     /* setup disconnect callback */
     rc = MqttClient_SetDisconnectCallback(&mqttCtx->client,

examples/mqttexample.c

@@ -236,6 +236,9 @@ void mqtt_show_usage(MQTTCtx* mqttCtx)
     #endif /* !ENABLE_MQTT_CURL */
         PRINTF("-p <num>    Port to connect on, default: %d",
              MQTT_DEFAULT_PORT);
+#endif
+#ifdef ENABLE_MQTT_DTLS
+    PRINTF("-D          Enable DTLS (UDP)");
 #endif
     PRINTF("-q <num>    Qos Level 0-2, default: %d",
             mqttCtx->qos);
@@ -312,9 +315,14 @@ int mqtt_parse_args(MQTTCtx* mqttCtx, int argc, char** argv)
     #else
         #define MQTT_V5_ARGS ""
     #endif
+    #ifdef ENABLE_MQTT_DTLS
+        #define MQTT_DTLS_ARGS "D"
+    #else
+        #define MQTT_DTLS_ARGS ""
+    #endif
 
     while ((rc = mygetopt(argc, argv, "?h:p:q:sk:i:lu:w:m:n:C:Tf:rtd" \
-            MQTT_TLS_ARGS MQTT_V5_ARGS)) != -1) {
+            MQTT_TLS_ARGS MQTT_V5_ARGS MQTT_DTLS_ARGS)) != -1) {
         switch ((char)rc) {
         case '?' :
             mqtt_show_usage(mqttCtx);
@@ -394,6 +402,13 @@ int mqtt_parse_args(MQTTCtx* mqttCtx, int argc, char** argv)
             mqttCtx->debug_on = 1;
             break;
 
+    #ifdef ENABLE_MQTT_DTLS
+        case 'D':
+            mqttCtx->use_tls = 1;
+            mqttCtx->use_dtls = 1;
+            break;
+    #endif
+
     #ifdef ENABLE_MQTT_TLS
         case 'A':
             mqttCtx->ca_file = myoptarg;
@@ -640,6 +655,16 @@ int mqtt_tls_cb(MqttClient* client)
     /* Use highest available and allow downgrade. If wolfSSL is built with
      * old TLS support, it is possible for a server to force a downgrade to
      * an insecure version. */
+#ifdef ENABLE_MQTT_DTLS
+    if (MqttClient_Flags(client, 0, 0) & MQTT_CLIENT_FLAG_IS_DTLS) {
+    #ifdef WOLFSSL_DTLS13
+        client->tls.ctx = wolfSSL_CTX_new(wolfDTLSv1_3_client_method());
+    #else
+        client->tls.ctx = wolfSSL_CTX_new(wolfDTLSv1_2_client_method());
+    #endif
+    }
+    else
+#endif
     client->tls.ctx = wolfSSL_CTX_new(wolfSSLv23_client_method());
     if (client->tls.ctx) {
         wolfSSL_CTX_set_verify(client->tls.ctx, WOLFSSL_VERIFY_PEER,
@@ -766,7 +791,11 @@ int mqtt_dtls_cb(MqttClient* client) {
     int rc = WOLFSSL_FAILURE;
     SocketContext * sock = (SocketContext *)client->net->context;
 
+#ifdef WOLFSSL_DTLS13
+    client->tls.ctx = wolfSSL_CTX_new(wolfDTLSv1_3_client_method());
+#else
     client->tls.ctx = wolfSSL_CTX_new(wolfDTLSv1_2_client_method());
+#endif
     if (client->tls.ctx) {
         wolfSSL_CTX_set_verify(client->tls.ctx, WOLFSSL_VERIFY_PEER,
                 mqtt_tls_verify_cb);

examples/mqttexample.h

@@ -170,6 +170,9 @@ typedef struct _MQTTCtx {
     byte *tx_buf, *rx_buf;
     int return_code;
     int use_tls;
+#ifdef ENABLE_MQTT_DTLS
+    int use_dtls;
+#endif
     int retain;
     int enable_lwt;
 #ifdef WOLFMQTT_V5

examples/mqttnet.c

@@ -1217,12 +1217,20 @@ static int NetConnect(void *context, const char* host, word16 port,
 {
     SocketContext *sock = (SocketContext*)context;
     int type = SOCK_STREAM;
+    int proto = IPPROTO_TCP;
     int rc = -1;
     SOERROR_T so_error = 0;
     struct addrinfo *result = NULL;
     struct addrinfo hints;
     MQTTCtx* mqttCtx = sock->mqttCtx;
 
+#ifdef ENABLE_MQTT_DTLS
+    if (mqttCtx->use_dtls) {
+        type = SOCK_DGRAM;
+        proto = IPPROTO_UDP;
+    }
+#endif
+
     /* Get address information for host and locate IPv4 */
     switch(sock->stat) {
         case SOCK_BEGIN:
@@ -1234,8 +1242,8 @@ static int NetConnect(void *context, const char* host, word16 port,
 
             XMEMSET(&hints, 0, sizeof(hints));
             hints.ai_family = AF_INET;
-            hints.ai_socktype = SOCK_STREAM;
-            hints.ai_protocol = IPPROTO_TCP;
+            hints.ai_socktype = type;
+            hints.ai_protocol = proto;
 
             XMEMSET(&sock->addr, 0, sizeof(sock->addr));
             sock->addr.sin_family = AF_INET;

scripts/broker.test

@@ -320,6 +320,55 @@ else
     echo "SKIP: TLS tests (broker not built with TLS support)"
 fi
 
+# --- DTLS Tests ---
+has_dtls=no
+echo "$broker_features" | grep -q "dtls" && has_dtls=yes
+
+if [ "$has_dtls" = "yes" ]; then
+    # --- Test 17: DTLS pub/sub ---
+    echo ""
+    echo "--- Test 17: DTLS pub/sub ---"
+    # DTLS uses UDP; nc -z only checks TCP, so use sleep for startup
+    if [ $broker_pid != $no_pid ]; then
+        kill $broker_pid 2>/dev/null
+        wait $broker_pid 2>/dev/null || true
+        broker_pid=$no_pid
+    fi
+    generate_port
+    ./$broker_bin -D \
+        -c scripts/broker_test/server-cert.pem \
+        -K scripts/broker_test/server-key.pem \
+        -p $port &
+    broker_pid=$!
+    sleep 2
+
+    ./$client_bin -T -h 127.0.0.1 -p $port -n "test/dtls" -D \
+        -A scripts/broker_test/ca-cert.pem -C 5000 \
+        >"${TMP_DIR}/t17.log" 2>&1
+    if [ $? -eq 0 ]; then
+        echo "PASS: DTLS pub/sub"
+    else
+        echo "FAIL: DTLS pub/sub"
+        FAIL=1
+    fi
+
+    # --- Test 18: DTLS QoS 2 ---
+    echo ""
+    echo "--- Test 18: DTLS QoS 2 ---"
+    ./$client_bin -T -h 127.0.0.1 -p $port -n "test/dtls_qos2" -q 2 -D \
+        -A scripts/broker_test/ca-cert.pem -C 5000 \
+        >"${TMP_DIR}/t18.log" 2>&1
+    if [ $? -eq 0 ]; then
+        echo "PASS: DTLS QoS 2"
+    else
+        echo "FAIL: DTLS QoS 2"
+        FAIL=1
+    fi
+else
+    echo ""
+    echo "SKIP: DTLS tests (broker not built with DTLS support)"
+fi
+
 # --- Test 11: Multi-client QoS 2 (separate pub/sub) ---
 echo ""
 echo "--- Test 11: Multi-client QoS 2 ---"