Azure IoT Hub Library with OpenThread

RE: Azure IoT Hub Library with OpenThread

NYCdream — Wed, 26 Feb 2025 16:05:09 GMT

Hello fhfs,

We are scoping a project where IIOT devices on a thread network reports their data to Azure IOT hub using MQTT. Were you able to successfully deploy your solution using Thread and Azure? Any suggestions or ideas? Is this practical?

RE: Azure IoT Hub Library with OpenThread

SebastianCorin — Mon, 16 Jan 2023 13:05:08 GMT

Hi fhfs

would you mind to share a working example I can build on?

Best

Sebastian

RE: Azure IoT Hub Library with OpenThread

fhfs — Tue, 26 Jul 2022 08:08:42 GMT

I copied this from a MBedTLS config for Azure IoT Hub and modified some defines.

/*! Size optimized TLS config to connect to Azure IoT Hub using RSA X.509 Certificates */

/* Platform has time function to provide time for certificates verifications */
// #ifndef TOOLCHAIN_ARM // Please set to 1 if you are using secure time
#ifndef MBEDTLS_HAVE_TIME
#define MBEDTLS_HAVE_TIME
#endif // MBEDTLS_HAVE_TIME

#ifndef MBEDTLS_HAVE_TIME_DATE
#define MBEDTLS_HAVE_TIME_DATE
#endif // MBEDTLS_HAVE_TIME_DATE

#ifndef MBEDTLS_PLATFORM_TIME_ALT
#define MBEDTLS_PLATFORM_TIME_ALT
#endif // MBEDTLS_PLATFORM_TIME_ALT

/* System support */
#ifndef MBEDTLS_HAVE_ASM
#define MBEDTLS_HAVE_ASM
#endif // MBEDTLS_HAVE_ASM
// #endif
/* mbed TLS feature support */
#ifndef MBEDTLS_ECP_DP_SECP256R1_ENABLED
#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
#endif // MBEDTLS_ECP_DP_SECP256R1_ENABLED

#ifndef MBEDTLS_ECP_NIST_OPTIM
#define MBEDTLS_ECP_NIST_OPTIM
#endif // MBEDTLS_ECP_NIST_OPTIM

#ifndef MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
#define MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
#endif // MBEDTLS_SSL_MAX_FRAGMENT_LENGTH

#ifndef MBEDTLS_SSL_PROTO_TLS1_2
#define MBEDTLS_SSL_PROTO_TLS1_2
#endif // MBEDTLS_SSL_PROTO_TLS1_2

#ifndef MBEDTLS_SSL_EXPORT_KEYS
#define MBEDTLS_SSL_EXPORT_KEYS
#endif // MBEDTLS_SSL_EXPORT_KEYS

/* mbed TLS modules */
#ifndef MBEDTLS_AES_C
#define MBEDTLS_AES_C
#endif // MBEDTLS_AES_C

/* Disable some of the speed optimizations on AES code to save
 * ~6200 bytes of ROM. According to comments on the mbedtls PR 394,
 * the speed on Cortex M4 is not even reduced by this. */
#ifndef MBEDTLS_AES_FEWER_TABLES
#define MBEDTLS_AES_FEWER_TABLES
#endif // MBEDTLS_AES_FEWER_TABLES

#ifndef MBEDTLS_BIGNUM_C
#define MBEDTLS_BIGNUM_C
#endif // MBEDTLS_BIGNUM_C

#ifndef MBEDTLS_CIPHER_C
#define MBEDTLS_CIPHER_C
#endif // MBEDTLS_CIPHER_C

#ifndef MBEDTLS_CTR_DRBG_C
#define MBEDTLS_CTR_DRBG_C
#endif // MBEDTLS_CTR_DRBG_C

#ifndef MBEDTLS_ECP_C
#define MBEDTLS_ECP_C
#endif // MBEDTLS_ECP_C

#ifndef MBEDTLS_ENTROPY_C
#define MBEDTLS_ENTROPY_C
#endif // MBEDTLS_ENTROPY_C

#ifndef MBEDTLS_MD_C
#define MBEDTLS_MD_C
#endif // MBEDTLS_MD_C

#ifndef MBEDTLS_OID_C
#define MBEDTLS_OID_C
#endif // MBEDTLS_OID_C

#ifndef MBEDTLS_PK_C
#define MBEDTLS_PK_C
#endif // MBEDTLS_PK_C

#ifndef MBEDTLS_PK_PARSE_C
#define MBEDTLS_PK_PARSE_C
#endif // MBEDTLS_PK_PARSE_C

#ifndef MBEDTLS_SHA256_C
#define MBEDTLS_SHA256_C
#endif // MBEDTLS_SHA256_C

// Disable the speed optimizations of SHA256, makes binary size smaller
// on Cortex-M by 1800B with ARMCC5 and 1384B with GCC 6.3.
#ifndef MBEDTLS_SHA256_SMALLER
#define MBEDTLS_SHA256_SMALLER
#endif // MBEDTLS_SHA256_SMALLER

#ifndef MBEDTLS_SSL_COOKIE_C
#define MBEDTLS_SSL_COOKIE_C
#endif // MBEDTLS_SSL_COOKIE_C

#ifndef MBEDTLS_SSL_CLI_C
#define MBEDTLS_SSL_CLI_C
#endif // MBEDTLS_SSL_CLI_C

#ifndef MBEDTLS_SSL_TLS_C
#define MBEDTLS_SSL_TLS_C
#endif // MBEDTLS_SSL_TLS_C
// XXX mbedclient needs these: mbedtls_x509_crt_free, mbedtls_x509_crt_init, mbedtls_x509_crt_parse
#ifndef MBEDTLS_X509_USE_C
#define MBEDTLS_X509_USE_C
#endif // MBEDTLS_X509_USE_C

#ifndef MBEDTLS_X509_CRT_PARSE_C
#define MBEDTLS_X509_CRT_PARSE_C
#endif // MBEDTLS_X509_CRT_PARSE_C
// a bit wrong way to get mbedtls_ssl_conf_psk:
#ifndef MBEDTLS_CMAC_C
#define MBEDTLS_CMAC_C
#endif // MBEDTLS_CMAC_C

#ifndef MBEDTLS_ECDH_C
#define MBEDTLS_ECDH_C
#endif // MBEDTLS_ECDH_C

#ifndef MBEDTLS_ECDSA_C
#define MBEDTLS_ECDSA_C
#endif // MBEDTLS_ECDSA_C

#ifndef MBEDTLS_GCM_C
#define MBEDTLS_GCM_C
#endif // MBEDTLS_GCM_C

#ifndef MBEDTLS_CIPHER_MODE_CBC
#define MBEDTLS_CIPHER_MODE_CBC
#endif // MBEDTLS_CIPHER_MODE_CBC

#ifndef MBEDTLS_X509_CRT_PARSE_C
#define MBEDTLS_X509_CRT_PARSE_C
#endif // MBEDTLS_X509_CRT_PARSE_C

#ifndef MBEDTLS_X509_CSR_PARSE_C
#define MBEDTLS_X509_CSR_PARSE_C
#endif // MBEDTLS_X509_CSR_PARSE_C

#ifndef MBEDTLS_SHA1_C
#define MBEDTLS_SHA1_C
#endif

// /*! All of the following definitions are optimizations (reduce mbedTLS memory usage and size),
// *   changing them is on the user responsibility since they can enlarge
// *   the binary footprint and the memory usage
// */

// define to save 8KB RAM at the expense of ROM
#ifndef MBEDTLS_AES_ROM_TABLES
#define MBEDTLS_AES_ROM_TABLES
#endif // MBEDTLS_AES_ROM_TABLES

// Reduce IO buffer to save RAM, default is 16KB
#ifndef MBEDTLS_SSL_MAX_CONTENT_LEN
#define MBEDTLS_SSL_MAX_CONTENT_LEN (10 * 1024)
#endif // MBEDTLS_SSL_MAX_CONTENT_LEN

// Multiple Precision Integers when using RSA can be smaller
#define MBEDTLS_MPI_MAX_SIZE 512
#define MBEDTLS_MPI_WINDOW_SIZE 1

#define MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
#define MBEDTLS_DEBUG
#define MBEDTLS_DEBUG_C
#define MBEDTLS_DEBUG_LEVEL 4
#define CONFIG_MBEDTLS_DEBUG_LEVEL 0

// certificate must fit into one message, fragmenting is not supported
#undef MBEDTLS_SSL_IN_CONTENT_LEN
#undef MBEDTLS_SSL_OUT_CONTENT_LEN
#define MBEDTLS_SSL_IN_CONTENT_LEN 4096
#define MBEDTLS_SSL_OUT_CONTENT_LEN 4096

// Remove error messages, save 10KB of ROM
// #undef MBEDTLS_ERROR_C

// Remove selftesting and save 11KB of ROM
#undef MBEDTLS_SELF_TEST

#undef MBEDTLS_CERTS_C

// Reduces ROM size by 30 kB
#undef MBEDTLS_ERROR_STRERROR_DUMMY

#undef MBEDTLS_VERSION_FEATURES

// You can disable debug as long as you disable MBED_CONF_TLS_SOCKET_DEBUG_LEVEL
// #undef MBEDTLS_DEBUG_C

#undef MBEDTLS_SHA512_C

#undef MBEDTLS_SSL_SRV_C

#undef MBEDTLS_ECP_DP_SECP192R1_ENABLED
#undef MBEDTLS_ECP_DP_SECP224R1_ENABLED
#undef MBEDTLS_ECP_DP_SECP384R1_ENABLED
#undef MBEDTLS_ECP_DP_SECP521R1_ENABLED
#undef MBEDTLS_ECP_DP_SECP192K1_ENABLED
#undef MBEDTLS_ECP_DP_SECP224K1_ENABLED
#undef MBEDTLS_ECP_DP_SECP256K1_ENABLED
#undef MBEDTLS_ECP_DP_BP256R1_ENABLED
#undef MBEDTLS_ECP_DP_BP384R1_ENABLED
#undef MBEDTLS_ECP_DP_BP512R1_ENABLED
#undef MBEDTLS_ECP_DP_CURVE25519_ENABLED

// Reduces size particularly in case PSA crypto is used
#undef MBEDTLS_CHACHA20_C
#undef MBEDTLS_CHACHAPOLY_C
#undef MBEDTLS_POLY1305_C

the define to enable CBC is "#define MBEDTLS_CIPHER_MODE_CBC"

I put these defines in nrf-config-user-empty.h not sure where else to put these defines, or where the proper place for them is.

MBedTLS related prj.conf:

CONFIG_MAIN_STACK_SIZE=4096
CONFIG_NET_BUF_RX_COUNT=100
CONFIG_NET_BUF_TX_COUNT=100

# mbedTLS tweaks
CONFIG_MBEDTLS_DEBUG_C=y
CONFIG_MBEDTLS_DEBUG=y
CONFIG_MBEDTLS_DEBUG_LEVEL=0
# Also see nrf-config-user-empty.h

# TLS configuration
CONFIG_MBEDTLS=y
CONFIG_MBEDTLS_BUILTIN=y
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=60000
# certificate must fit into one message, fragmenting is not supported
CONFIG_MBEDTLS_SSL_MAX_CONTENT_LEN=10240
CONFIG_MBEDTLS_PEM_CERTIFICATE_FORMAT=y
CONFIG_MBEDTLS_ECDSA_C=y
CONFIG_MBEDTLS_SHA256_C=y
CONFIG_MBEDTLS_RSA_C=y
CONFIG_MBEDTLS_AES_C=y
CONFIG_MBEDTLS_PKCS1_V21=y

CONFIG_NET_SOCKETS_SOCKOPT_TLS=y
CONFIG_NET_SOCKETS_TLS_MAX_CONTEXTS=4
CONFIG_NET_SOCKETS_ENABLE_DTLS=n
CONFIG_POSIX_MAX_FDS=8

CONFIG_TLS_CREDENTIALS=y
CONFIG_TLS_MAX_CREDENTIALS_NUMBER=4

# CONFIG_GENERATE_MBEDTLS_CFG_FILE=n # nrf-config.h: No such file or directory

Goodluck!

RE: Azure IoT Hub Library with OpenThread

brown27 — Mon, 25 Jul 2022 14:11:56 GMT

Hi fhfs,

When you say "enable the CBC ciphers in MBedTLS so we can use the cipher "MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" " in your answer, would you mind sharing the prj settings you used to do so? Also, I am guessing that you are using the new Connect SDK v2.0.0? I see TCP messages to/from my Azure IoT Hub and Thread node using the Wireshark sniffer dongle, but get a -22 error during mqtt_connect(). I think that this might be the issue.

In case it helps anyone, I have been able to retain the getaddrinfo() function as my DNS resolver in azure_iot_hub.c's broker_init() by setting the following in my prj.conf. It provides the same ipv4 address that I get if I run "nslookup my.hostname.here.net 8.8.8.8" on my PC. (8.8.8.8 is Google's public DNS) As you mention, this requires conversion from the returned ipv4 address to ipv6 in broker_init() so that broker4 has the right ipv6 address since we're using OpenThread.

# DNS Settings
CONFIG_DNS_RESOLVER=y
CONFIG_DNS_SERVER_IP_ADDRESSES=y
CONFIG_DNS_SERVER1="64:ff9b::0808:0808"

RE: Azure IoT Hub Library with OpenThread

fhfs — Wed, 20 Jul 2022 14:22:38 GMT

The answer, from a reply I made down below:
I was using the default interface to do my DNS requests and connections to the network outside the Thread network. This was fixed when I configured my IPv6 address as "CONFIG_NET_CONFIG_MY_IPV6_ADDR="fd3f:76ab:550:1:2a9d:e83a:3e:84a7""
I was using my mesh local address instead of my localaddress. Mesh Local can only talk to mesh local prefix addresses. With the correct interface I was able to do DNS requests and connections to NAT64 mapped ipv6 addresses

We can configure the NAT64 address as DNS Server.

The Azure IoT Hub library can be used, the azure_iot_hub.c function broker_init needs to be rewritten to resolve to ipv6 addresses.

I also added SNTP to the project, I did remember from a ESP32 project, MBedTLS would need it. Since we don't have an IPv6 network at home/work. I also had to find NTP servers with only IPv4 addresses so the NAT64 would translate them. Setting the server "eu.pool.ntp.org" in "nrf\lib\date_time\date_time_ntp.c" worked perfectly.

And using the correct MBedTLS config we can create tls connections to the Azure IoT Hub. Here we need to enable the CBC ciphers in MBedTLS so we can use the cipher "MBEDTLS_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256".

The same is true for using the Azure IoT Hub DPS. After fiddling with my certificates, I got that working.

Thanks everyone for your help!

RE: Azure IoT Hub Library with OpenThread

fhfs — Mon, 04 Jul 2022 12:37:16 GMT

I was using the default interface to do my DNS requests and connections to the network outside the Thread network.

This was fixed when I configured my IPv6 address as "CONFIG_NET_CONFIG_MY_IPV6_ADDR="fd3f:76ab:550:1:2a9d:e83a:3e:84a7""

I was using my mesh local address instead of my localaddress. Mesh Local can only talk to mesh local prefix addresses

With the correct interface I was able to do DNS requests and connections to NAT64 mapped ipv6 addresses

RE: Azure IoT Hub Library with OpenThread

fhfs — Thu, 23 Jun 2022 12:32:47 GMT

Don't call any zephyr socket functions in any event handlers. Totally forgot I'm now working in a RTOS, shouldnt be doing that anyway.

Zephyr sockets with MBedTLS should be working. Look at echo_client / echo_server as examples.
You can track everything with TCPDump on your Pi.
You can test TLS connection with socat on the Pi.
The guys at OpenThread Github (Discussion board) are very helpful!

Still have not gotten zephyr dns to work, using the OpenThread DNS works.

I am now trying to connect to my Azure IoT Hub using a static ipv6 address (a mapped ipv4 address)
I'll keep you updated.

How are you doing with this problem

RE: Azure IoT Hub Library with OpenThread

fhfs — Wed, 11 May 2022 11:53:12 GMT

According to zephyr\subsys\net\lib\dns\resolve.c:1153 getting mapped ipv4 through getaddrinfo will not work.
I am able to use the OpenThread Libraries to resolve DNS requests through the NAT64 interface.

I will be trying to make small modifications to the nRFConnect Azure library to use Openthread sockets to test if connections will actually work.

RE: Azure IoT Hub Library with OpenThread

Erik Hougaard — Tue, 10 May 2022 06:07:46 GMT

Hi,

Were you able to make this work? I'd be really interested as I am about to implement a similar solution, so any head-start would be appreciated.

Best regards,

Erik

RE: Azure IoT Hub Library with OpenThread

fhfs — Fri, 29 Apr 2022 13:47:24 GMT

Debugging shows the DNS_EAI_CANCELED is the result of a timeout.

I'm also getting a timeout using the OpenThread specific DNS API's


#include <openthread/dns_client.h>

void ot_dns_response(otError aError, const otDnsAddressResponse *aResponse, void *aContext)
{

	char address_string[OT_IP6_ADDRESS_STRING_SIZE];
	otIp6Address address;
	uint32_t ttl;

	// Fails with error 28
	// [00:00:19.219,787] <inf> net_l2_openthread: State changed! Flags: 0x00000200 Current role: 3
	// [00:00:21.184,112] <err> coap_server: ot_dns_response failed 28

	if (aError == OT_ERROR_NONE)
	{
		uint16_t index = 0;

		LOG_INF("ot_dns_response Success");

		while (otDnsAddressResponseGetAddress(aResponse, index, &address, &ttl) == OT_ERROR_NONE)
		{
			otIp6AddressToString(&address, address_string, sizeof(address_string));
			LOG_INF("ip: %s, TTL:%u ", address_string, ttl);
			index++;
		}
	}
	else
	{
		LOG_ERR("ot_dns_response failed %d", aError);
	}
}

otDnsQueryConfig config;
const otDnsQueryConfig *current_config;
void set_ot_dns_config(void)
{
	otError error;
	current_config = otDnsClientGetDefaultConfig(ot_context->instance);

	memcpy(&config, current_config, sizeof(otDnsQueryConfig));

	config.mNat64Mode = OT_DNS_NAT64_ALLOW;
	config.mRecursionFlag = OT_DNS_FLAG_RECURSION_DESIRED;
	config.mMaxTxAttempts = 2;
	config.mResponseTimeout = 1000;
	config.mServerSockAddr.mPort = 53;

	error = otIp6AddressFromString("FDAA:BB:1::2", &config.mServerSockAddr.mAddress);
	if (error != OT_ERROR_NONE)
		LOG_ERR("otIp6AddressFromString failed %d", error);

	otDnsClientSetDefaultConfig(ot_context->instance, &config);

	current_config = otDnsClientGetDefaultConfig(ot_context->instance);
}

void resolve_ot_dns(void)
{
	otError error;
	error = otDnsClientResolveAddress(ot_context->instance, "ing.nl", &ot_dns_response, ot_context->instance, &config);
	if (error != OT_ERROR_NONE)
	{
		LOG_ERR("ot_dns_response resolve_dns %d", error);
	}
}

Thanks for your suggestions. I'm going to try and increase logging and let you know. Any suggestion to which NET component I should set to debug logging?

RE: Azure IoT Hub Library with OpenThread

Jørgen Holmefjord — Fri, 29 Apr 2022 13:38:58 GMT

Can you use the OpenThread specific DNS API used by the ot-cli in the Azure IoT Hub case as well?

If not, you need to debug the application to see where it fails (increase log levels would be a good start), and/or do a on-air sniffer trace of the Thread traffic, to see if the DNS is sent to any destination.

RE: Azure IoT Hub Library with OpenThread

fhfs — Fri, 29 Apr 2022 11:59:51 GMT

Hi,

I've checked by running tcpdump on the RPi OTBR device.

With OT-CLI I see the DNS requests coming through in the tcpdump:

pi@raspberrypi:~ $ sudo tcpdump -vnni wpan0

tcpdump: listening on wpan0, link-type LINUX_SLL (Linux cooked v1), snapshot length 262144 bytes

14:04:33.770137 IP6 (hlim 64, next-header UDP (17) payload length: 36) fd35:ad25:a99f:8c75:a301:6d0:492:8a96.49153 > fdaa:bb:1::2.53: [udp sum ok] 54430+ AAAA? reddit.com. (28)

14:04:33.831836 IP6 (flowlabel 0x67ac1, hlim 64, next-header UDP (17) payload length: 148) fdaa:bb:1::2.53 > fd35:ad25:a99f:8c75:a301:6d0:492:8a96.49153: [udp sum ok] 54430 4/0/0 reddit.com. AAAA 64:ff9b::9765:818c, reddit.com. AAAA 64:ff9b::9765:c18c, reddit.com. AAAA 64:ff9b::9765:18c, reddit.com. AAAA 64:ff9b::9765:418c (140)

I do not see any activity with my resolve_dns() function

RE: Azure IoT Hub Library with OpenThread

Jørgen Holmefjord — Wed, 27 Apr 2022 14:53:59 GMT

Hi,

Looks like error code -101 means that the request was cancelled (DNS_EAI_CANCELED). Have you checked with a sniffer trace if the request is actually sent over the air, and if it is sent to the correct address and port (compared to the OT CLI command)?

From an earlier test case, it looks like the request will be cancelled if a local DNS server is not present.

Best regards,
Jørgen

RE: Azure IoT Hub Library with OpenThread

fhfs — Fri, 22 Apr 2022 12:36:26 GMT

Hello Jørgen,

I've tried to set the correct Server, but I am getting an error in the callback.

I configure the DNS and try to resolve when the device connects to the Thread network. Also before the error in dns_result_cb, I get a error "<err> net_otPlat_radio: Error while calling otIp6Send"

void set_dns_config(void)
{
	int ret;
	const char *dns_server = "FDAA:BB:1::2";
	struct dns_resolve_context *dnsctx;

	dnsctx = dns_resolve_get_default();
	ret = dns_resolve_reconfigure(dnsctx, &dns_server, NULL);
}

void dns_result_cb(enum dns_resolve_status status,
				   struct dns_addrinfo *info,
				   void *user_data)
{
	// fails with -101
	// <inf> net_l2_openthread: State changed! Flags: 0x00000064 Current role: 3
	// <err> net_otPlat_radio: Error while calling otIp6Send
	// <inf> coap_server: dns_result_cb Failed: -101
	if (status == 0)
	{
		LOG_INF("dns_result_cb Success");
	}
	else
	{
		LOG_INF("dns_result_cb Failed: %d", status);
	}
	return;
}

void resolve_dns(void)
{
	int ret;
	struct dns_resolve_context *dnsctx;

	dnsctx = dns_resolve_get_default();
	ret = dns_resolve_name(dnsctx,
						   "reddit.com",
						   DNS_QUERY_TYPE_AAAA,
						   NULL,
						   dns_result_cb,
						   NULL,
						   1000);
	if (ret != 0)
	{
		LOG_ERR("resolve_dns %d", ret);
	}
}

Maybe I am missing a configuration, the command in OT CLI example does work.

uart:~$ ot dns resolve reddit.com fdaa:bb:1::2 53 1000 2 1
DNS response for reddit.com. - 64:ff9b:0:0:0:0:9765:c18c TTL:67 64:ff9b:0:0:0:0:9765:818c TTL:67 64:ff9b:0:0:0:0:9765:18c TTL:67 64:ff9b:0:0:0:0:9765:418c TTL:67
Done

RE: Azure IoT Hub Library with OpenThread

Jørgen Holmefjord — Thu, 21 Apr 2022 09:24:17 GMT

Hi,

It looks like getaddrinfo() internally calls dns_get_addr_info(), so you may be able to call dns_resolve_init() or dns_resolve_reconfigure() to set the DNS server address.

You may also use the Kconfigs DNS_SERVER_IP_ADDRESSES and CONFIG_DNS_SERVERx to specify the DNS servers used by the DNS resolve library.

Best regards,
Jørgen