go-coap

To generate a server certificate, create an EC private key, generate a Certificate Signing Request (CSR) using the CA's subject information, and then sign that CSR using the CA's certificate and key.

# Note: $CERT_SUBJ must be defined (e.g., from the CA generation step)
openssl ecparam -name secp224r1 -genkey -noout -out server_key.pem
openssl req -new -sha256 -key server_key.pem -subj $CERT_SUBJ -out server.csr
openssl x509 -req -in server.csr  -CA root_ca_cert.pem -CAkey root_ca_key.pem -CAcreateserial -out server_cert.pem -days 500 -sha256

To use this library, you must have the following environment requirement:

• Go 1.25 or higher

To set up a Public Key Infrastructure (PKI) for DTLS examples, you can first generate a self-signed Certificate Authority (CA). This involves generating an Elliptic Curve (EC) key, extracting the public key, and creating a self-signed certificate using openssl.

CERT_SUBJ="/C=BR/ST=Parana/L=Curitiba/O=Dis/CN=example.com"
openssl ecparam -name secp224r1 -genkey -noout -out root_ca_key.pem
openssl ec -in root_ca_key.pem -pubout -out root_ca_pubkey.pem
openssl req -new -key root_ca_key.pem -x509 -nodes -days 365 -out root_ca_cert.pem -subj $CERT_SUBJ

To interact with a CoAP server, use the Dial functions provided by the transport-specific packages (e.g., udp.Dial or tcp.Dial). Once a connection is established, you can perform standard CoAP operations like Get, Post, Put, or Delete using a context.Context for timeout control.

func main() {
    // Dial a UDP server
    co, err := udp.Dial("localhost:5688")
    if err != nil {
        log.Fatalf("Error dialing: %v", err)
    }
    defer co.Close()

    ctx, cancel := context.WithTimeout(context.Background(), time.Second)
    defer cancel()

    // Perform a GET request
    resp, err := co.Get(ctx, "/a")
    if err != nil {
        log.Fatalf("Cannot get response: %v", err)
    }
    log.Printf("Response: %+v", resp)
}

To generate a client certificate, create an EC private key and a CSR with the client's specific subject information (such as an email address), then sign it using the CA's certificate and key.

CERT_SUBJ="/C=BR/ST=Parana/L=Curitiba/O=Dis/CN=example.com/emailAddress=client1@example.com"
openssl ecparam -name secp224r1 -genkey -noout -out client_key.pem
openssl req -new -sha256 -key client_key.pem -subj $CERT_SUBJ -out client.csr
openssl x509 -req -in client.csr  -CA root_ca_cert.pem -CAkey root_ca_key.pem -CAcreateserial -out client_cert.pem -days 500 -sha256

The dtls package uses DTLSClientOptions to configure secure connections. While the specific constructor NewDTLSClientOptions is not defined in this file, Dial accepts it as the preferred configuration type.

Common configuration behaviors managed by the client include:

• Blockwise Transfer: Can be enabled via configuration to handle large payloads.
• Inactivity Monitoring: Uses an InactivityMonitor to manage connection lifecycles.
• Error Handling: A custom Errors function can be provided to intercept and process errors.

The Option interface allows you to customize the server's behavior during initialization. Any type implementing UDPServerApply(cfg *Config) can be passed to New() to modify the Config object used by the server.

type MyOption struct{}

func (o MyOption) UDPServerApply(cfg *server.Config) {
    // Modify cfg here
}

// Usage
srv := server.New(MyOption{})

The udp package uses the Option interface to configure client behavior. An Option is any type that implements the UDPClientApply(cfg *client.Config) UDPClientApply method.

Common configuration areas include:

• Credentials and security settings
• Keepalive and inactivity parameters
• Blockwise transfer settings
• Error handling callbacks

The CID example demonstrates how to use DTLS with Connection ID (CID). This allows the client and server to identify the connection via a unique ID, enabling the connection to be resumed even if the client's network address changes.

# run the server
go run examples/dtls/cid/server/main.go

# run the client
go run examples/dtls/cid/client/main.go

The PSK example demonstrates how to implement DTLS authentication using a Pre-Shared Key. In this mode, the client and server use a shared secret key to authenticate each other instead of certificates.

# run the server
go run examples/dtls/psk/server/main.go

# run the client
go run examples/dtls/psk/client/main.go