1/*
2 * Copyright 2018-2024 NXP
3 *
4 * SPDX-License-Identifier: Apache-2.0
5 *
6 */
7
8#ifndef _NXP_IOT_AGENT_CONFIG_H_
9#define _NXP_IOT_AGENT_CONFIG_H_
10
11#include <nxp_iot_agent_config_certificates.h>
12#include <nxp_iot_agent_config_credentials.h>
13
14#define NXP_IOT_AGENT_MAX_NUM_KEYSTORES (1U)
15#define NXP_IOT_AGENT_MAX_NUM_DATASTORES (1U)
16
17#define NXP_IOT_AGENT_MAX_NUM_ENDPOINTS \
18 ((size_t)(1U /* agent itself */ \
19 + 1U /* edgelock2go datastore */ \
20 + NXP_IOT_AGENT_MAX_NUM_KEYSTORES \
21 + NXP_IOT_AGENT_MAX_NUM_DATASTORES))
22
23/**
24 * The size of the buffer for handling request messages.
25 * Note: Typically, the request message handling is done
26 * via endpoint specific callbacks. This means normally
27 * data can be streamed from the source (network connection) to
28 * the sink without having to store everything in buffers.
29 * This means this limit is rather artificial. Since the
30 * streaming approach was not always used, if not set, the
31 * EdgeLock 2GO cloud service uses a default of 1024 bytes.
32 * If endpoints do have limits on the data they can handle
33 * in their callbacks, they should negotiate with
34 * the respective endpoint driver.
35 */
36#define NXP_IOT_AGENT_REQUEST_BUFFER_SIZE (INT32_MAX)
37
38
39/**
40 * The size of the buffer for assembling response messages.
41 * Note: This affects the buffer used for assembling
42 * protobuf messages, network layers might on top reserve
43 * space for TLS record assembly.
44 */
45#define NXP_IOT_AGENT_RESPONSE_BUFFER_SIZE (4*1024)
46
47/**
48 * The maximum expected size of a certificate chain. This
49 * memory is reserved on the stack when writing the
50 * certificate chain to a file.
51 */
52#define NXP_IOT_AGENT_CERTIFICATE_BUFFER_SIZE (4*1024)
53
54
55/**
56 * If this define evaluates to true, the server certificate of
57 * the EdgeLock 2GO cloud service is verified against a list
58 * of trusted certificates as configured
59 * with NXP_IOT_AGENT_TRUSTED_ROOT_CA_CERTIFICATES.
60 * For security reasons performing this verification
61 * is recommended.
62 */
63#define NXP_IOT_AGENT_VERIFY_EDGELOCK_2GO_SERVER_CERTIFICATE 1
64
65
66/**
67 * If this define evaluates to true, a certificate revocation
68 * list (CRL) will be requested from the EdgeLock 2GO cloud
69 * service after establishing the TLS connection. The server
70 * certificate chain is then verified using a trusted root
71 * and the information in the received CRL.
72 */
73#define NXP_IOT_AGENT_REQUEST_CRL_FROM_EDGELOCK_2GO (1 && NXP_IOT_AGENT_VERIFY_EDGELOCK_2GO_SERVER_CERTIFICATE)
74
75
76#ifndef EDGELOCK2GO_HOSTNAME
77/**
78 * The hostname to use for the connection to the EdgeLock 2GO cloud service.
79 *
80 * This is specific to your customer account, the needed value can be obtaine in the GUI of the
81 * EdgeLock 2GO cloud service in the company settings of the account.
82 */
83#define EDGELOCK2GO_HOSTNAME "CHANGE THIS! - company specific hostname"
84#endif
85
86#ifndef EDGELOCK2GO_PORT
87/**
88 * The port to use for the communication to the EdgeLock 2GO cloud service.
89 */
90#define EDGELOCK2GO_PORT 443U
91#endif
92
93
94/**
95 * These are the trusted root ca certificates that are used to verify the certificate chain that
96 * the EdgeLock 2GO cloud service presents to the EdgeLock 2GO agent.
97 *
98 * Several certificates for different EdgeLock 2GO cloud service installations are predefined in
99 * nxp_iot_agent_config_certificates.h, a selection must be taken based on the environment EdgeLock
100 * 2GO agent is about to connect to and based on the ciphersuite that is intended to be used.
101 *
102 * EdgeLock 2GO agent will prefer authentication with an ECC client certificate, however, not all
103 * secure elements offer ECC functionality. In those cases the authentication will be done with an
104 * RSA client certificate.
105 *
106 * The EdgeLock 2GO cloud service will select the ciphersuite it is using based on the
107 * ciphersuites/signature algorithms that the client supports (this is a configuration option to the
108 * underlying crypto library (openssl/mbedtls) and communicated to the server as part of the
109 * ClientHello). If ciphersuites for ECDSA authentication is choosen, the EdgeLock 2GO cloud service
110 * uses an ECC certificate, in case a RSA authentication is chosen, it uses an RSA certificate.
111 * Therefore, if ECDSA authentication is in the supported ciphersuites/signature algorithms list of
112 * the client, an ECC root CA certificate has to be trusted, in case RSA authentication is in the
113 * list, an RSA root CA certificate has to be trusted. It is possible to give more than one trusted
114 * certificates by concatenating them when defining NXP_IOT_AGENT_TRUSTED_ROOT_CA_CERTIFICATES.
115 *
116 * Available certificates:
117 * - NXP_IOT_AGENT_TRUSTED_ROOT_CA_CERT_ECC_PROD
118 * - NXP_IOT_AGENT_TRUSTED_ROOT_CA_CERT_RSA_PROD
119 */
120
121#if defined(NXP_IOT_AGENT_ENABLE_SANDBOX_TEST) && (NXP_IOT_AGENT_ENABLE_SANDBOX_TEST == 1)
122 /* Test / Sandbox certificates */
123
124#define NXP_IOT_AGENT_TRUSTED_ROOT_CA_CERTIFICATES { \
125 NXP_IOT_AGENT_TRUSTED_ROOT_CA_CERT_RSA_SANDBOX, \
126 NXP_IOT_AGENT_TRUSTED_ROOT_CA_CERT_ECC_SANDBOX \
127}
128
129#define NXP_IOT_AGENT_TRUSTED_ROOT_CA_CERTIFICATES_SIZE \
130 NXP_IOT_AGENT_TRUSTED_ROOT_CA_CERT_RSA_SANDBOX_SIZE + \
131 NXP_IOT_AGENT_TRUSTED_ROOT_CA_CERT_ECC_SANDBOX_SIZE
132
133#define NXP_IOT_AGENT_CLAIMCODE_KEY_AGREEMENT_PUBLIC_KEY NXP_IOT_AGENT_CLAIMCODE_KEY_AGREEMENT_PUBLIC_KEY_SANDBOX
134#define NXP_IOT_AGENT_CLAIMCODE_KEY_AGREEMENT_PUBLIC_KEY_SIZE NXP_IOT_AGENT_CLAIMCODE_KEY_AGREEMENT_PUBLIC_KEY_SANDBOX_SIZE
135
136#else
137#define NXP_IOT_AGENT_TRUSTED_ROOT_CA_CERTIFICATES { \
138 NXP_IOT_AGENT_TRUSTED_ROOT_CA_CERT_RSA_PROD, \
139 NXP_IOT_AGENT_TRUSTED_ROOT_CA_CERT_ECC_PROD \
140}
141
142#define NXP_IOT_AGENT_CLAIMCODE_KEY_AGREEMENT_PUBLIC_KEY NXP_IOT_AGENT_CLAIMCODE_KEY_AGREEMENT_PUBLIC_KEY_PROD
143#define NXP_IOT_AGENT_CLAIMCODE_KEY_AGREEMENT_PUBLIC_KEY_SIZE NXP_IOT_AGENT_CLAIMCODE_KEY_AGREEMENT_PUBLIC_KEY_PROD_SIZE
144
145
146 /**
147 * Total size of the trusted root ca certificates. This must match the certificates configured in
148 * NXP_IOT_AGENT_TRUSTED_ROOT_CA_CERTIFICATES.
149 */
150#define NXP_IOT_AGENT_TRUSTED_ROOT_CA_CERTIFICATES_SIZE \
151 NXP_IOT_AGENT_TRUSTED_ROOT_CA_CERT_RSA_PROD_SIZE + \
152 NXP_IOT_AGENT_TRUSTED_ROOT_CA_CERT_ECC_PROD_SIZE
153#endif
154
155/**
156 * Flag to enable or disable measurement performance timings of EdgeLock 2GO Agent.
157 */
158#ifndef IOT_AGENT_TIME_MEASUREMENT_ENABLE
159#define IOT_AGENT_TIME_MEASUREMENT_ENABLE 1
160#endif
161
162/**
163 * Set the log-level that is used for output of messages of the openssl engine. The level is a
164 * combination of flags for different message types:
165 * - 0x04 : Error message
166 * - 0x02 : Debug messages
167 * - 0x01 : Flow messages
168 */
169#define NXP_IOT_AGENT_OPENSSL_ENGINE_LOG_LEVEL 0x04
170
171/**
172 * Set the maximum possible size of key data that can be received from EdgeLock 2GO.
173 */
174#define NXP_IOT_AGENT_MAX_KEY_DATA_SIZE (10*1024)
175
176#ifndef ENABLE_IOT_AGENT_TRACE
177#define ENABLE_IOT_AGENT_TRACE 0
178#endif
179
180#ifndef ENABLE_IOT_AGENT_DEBUG
181#define ENABLE_IOT_AGENT_DEBUG 1
182#endif
183
184#ifndef ENABLE_IOT_AGENT_INFO
185#define ENABLE_IOT_AGENT_INFO 1
186#endif
187
188#ifndef ENABLE_IOT_AGENT_WARN
189#define ENABLE_IOT_AGENT_WARN 1
190#endif
191
192#ifndef ENABLE_IOT_AGENT_ERROR
193#define ENABLE_IOT_AGENT_ERROR 1
194#endif
195
196#endif // #ifndef _NXP_IOT_AGENT_CONFIG_H_
