coap_new_context()
coap_context_set_pki_root_cas() - if the root CAs need to be updated and PKI
coap_context_set_pki() and/or coap_context_set_psk2() - if encryption is required
coap_new_endpoint()

coap_new_context()
coap_context_set_pki_root_cas() - if the root CAs need to be updated and PKI
coap_new_client_session(), coap_new_client_session_pki() or coap_new_client_session_psk2()

typedef struct coap_dtls_cpsk_t {
  uint8_t version; /** Set to COAP_DTLS_CPSK_SETUP_VERSION
                       to support the version of the struct */
  /* Options to enable different TLS functionality in libcoap */
  uint8_t reserved[7];             /* Reserved - must be set to 0 for
                                      future compatibility */
  /** Identity Hint check callback function.
   * If not NULL, is called when the Identity Hint (TLS1.2 or earlier) is
   * provided by the server.
   * The appropriate Identity and Pre-Shared Key to use can then be returned.
   */
  coap_dtls_ih_callback_t validate_ih_call_back;
  void *ih_call_back_arg;  /* Passed in to the Identity Hint callback
                              function */
  char* client_sni;    /*  If not NULL, SNI to use in client TLS setup.
                           Owned by the client app and must remain valid
                           during the call to coap_new_client_session_pki().
                           Note: Not supported by TinyDTLS. */
  coap_dtls_cpsk_info_t psk_info;  /* Client PSK definition */
} coap_dtls_cpsk_t;

#define COAP_DTLS_CPSK_SETUP_VERSION 1 /**< Latest CPSK setup version */

/**
 * Identity Hint Validation callback that can be set up by
 * coap_new_client_session_psk2().
 * Invoked when libcoap has done the validation checks at the TLS level,
 * but the application needs to check that the Identity Hint is allowed, and
 * needs to use the appropriate PSK information for the (D)TLS session.
 * Note: Identity Hint is not supported in (D)TLS1.3.
 *
 * @param hint  The server provided Identity Hint
 * @param coap_session  The CoAP session associated with the Identity Hint
 * @param arg  The same as was passed into coap_new_client_session_psk2()
 *             in setup_data->ih_call_back_arg
 *
 * @return New coap_dtls_cpsk_info_t object or @c NULL on error.
 */
typedef const coap_dtls_cpsk_info_t *(*coap_dtls_ih_callback_t)(
                                coap_str_const_t *hint,
                                coap_session_t *coap_session,
                                void *arg);

typedef struct coap_dtls_cpsk_info_t {
  coap_bin_const_t identity; /* The Identity */
  coap_bin_const_t key;      /* The Pre-Shared Key */
} coap_dtls_cpsk_info_t;

typedef struct coap_dtls_spsk_t {
  uint8_t version; /** Set to COAP_DTLS_SPSK_SETUP_VERSION
                       to support the version of the struct */
  /* Options to enable different TLS functionality in libcoap */
  uint8_t reserved[7];             /* Reserved - must be set to 0 for
                                      future compatibility */
  /** Identity check callback function.
   * If not @p NULL, is called when the Identity is provided by the client.
   *  The appropriate Pre-Shared Key to use can then be returned.
   */
  coap_dtls_id_callback_t validate_id_call_back;
  void *id_call_back_arg;  /* Passed in to the Identity callback function */
  /** SNI check callback function.
   * If not @p NULL, called if the SNI is not previously seen and exexuted
   * prior to sending an Identity Hint back to the client so that the
   * appropriate PSK information can be used based on the requesting SNI.
   */
  coap_dtls_psk_sni_callback_t validate_sni_call_back;
  void *sni_call_back_arg;  /* Passed in to the SNI callback function */
  coap_dtls_spsk_info_t psk_info;  /* Server PSK definition */
} coap_dtls_spsk_t;

#define COAP_DTLS_SPSK_SETUP_VERSION 1 /**< Latest SPSK setup version */

/**
 * Identity Validation callback that can be set up by
 * coap_context_set_psk2().
 * Invoked when libcoap has done the validation checks at the TLS level,
 * but the application needs to check that the Identity is allowed, and
 * needs to use the appropriate Pre-Shared Key for the (D)TLS session.
 *
 * @param identity  The client provided Identity (should be NULL terminated)
 * @param coap_session  The CoAP session associated with the Identity Hint
 * @param arg  The same as was passed into coap_context_set_psk2()
 *             in setup_data->id_call_back_arg
 *
 * @return New coap_bin_const_t Pre-Shared Key object or @c NULL on error.
 */
typedef const coap_bin_const_t *(*coap_dtls_id_callback_t)(
                                 coap_bin_const_t *identity,
                                 coap_session_t *coap_session,
                                 void *arg);

/**
 * PSK SNI callback that can be set up by coap_context_set_psk2().
 * Invoked when libcoap has done the validation checks at the TLS level,
 * but the application needs to check that the SNI is allowed, and needs
 * to use the appropriate PSK information for the (D)TLS session.
 *
 * @param sni  The client provided SNI
 * @param coap_session  The CoAP session associated with the SNI
 * @param arg  The same as was passed into coap_new_client_session_psk2()
 *             in setup_data->sni_call_back_arg
 *
 * @return New coap_dtls_spsk_info_t object or @c NULL on error.
 */
typedef const coap_dtls_spsk_info_t *(*coap_dtls_psk_sni_callback_t)(
                                 const char *sni,
                                 coap_session_t *coap_session,
                                 void *arg);

typedef struct coap_dtls_spsk_info_t {
  coap_bin_const_t hint; /* The identity hint to use */
  coap_bin_const_t key;  /* The Pre-Shared Key to use */
} coap_dtls_spsk_info_t;

typedef struct coap_dtls_pki_t {
  uint8_t version;            /* COAP_DTLS_PKI_SETUP_VERSION */
  /* Options to enable different TLS functionality in libcoap */
  uint8_t verify_peer_cert;         /* 1 if peer cert is to be verified */
  uint8_t check_common_ca;          /* 1 if peer cert is to be signed by
                                     * the same CA as the local cert */
  uint8_t allow_self_signed;        /* 1 if self-signed certs are allowed */
  uint8_t allow_self_signed;        /* 1 if self-signed certs are allowed.
                                     * Ignored if check_common_ca set */
  uint8_t allow_expired_certs;      /* 1 if expired certs are allowed */
  uint8_t cert_chain_validation;    /* 1 if to check cert_chain_verify_depth */
  uint8_t cert_chain_verify_depth;  /* recommended depth is 3 */
  uint8_t check_cert_revocation;    /* 1 if revocation checks wanted */
  uint8_t allow_no_crl;             /* 1 ignore if CRL not there */
  uint8_t allow_expired_crl;        /* 1 if expired crl is allowed */
  uint8_t allow_bad_md_hash;        /* 1 if unsupported MD hashes are allowed */
  uint8_t allow_short_rsa_length;   /* 1 if small RSA keysizes are allowed */
  uint8_t is_rpk_not_cert;          /* 1 is RPK instead of Public Certificate.
                                     *   If set, PKI key format type cannot be
                                     *   COAP_PKI_KEY_PEM */
  uint8_t reserved[3];              /* Reserved - must be set to 0 for
                                       future compatibility */
  /** CN check callback function
   * If not NULL, is called when the TLS connection has passed the configured
   * TLS options above for the application to verify if the CN is valid.
   */
  coap_dtls_cn_callback_t validate_cn_call_back;
  void *cn_call_back_arg;  /* Passed in to the CN callback function */
  /** SNI check callback function
   * If not NULL, called if the SNI is not previously seen and prior to sending
   * a certificate set back to the client so that the appropriate certificate
   * set can be used based on the requesting SNI.
   */
  coap_dtls_sni_callback_t validate_sni_call_back;
  void *sni_call_back_arg;  /* Passed in to the SNI callback function */
  /** Additional Security callback handler that is invoked when libcoap has
   * done the standard, defined validation checks at the TLS level,
   * If not NULL, called from within the TLS Client Hello connection
   * setup.
   */
  coap_dtls_security_setup_t additional_tls_setup_call_back;
  char* client_sni;       /* If not NULL, SNI to use in client TLS setup.
                             Owned by the client app and must remain valid
                             during the call to coap_new_client_session_pki() */
  coap_dtls_key_t pki_key; /* PKI key definition */
} coap_dtls_pki_t;

#define COAP_DTLS_PKI_SETUP_VERSION 1

#define COAP_DTLS_RPK_CERT_CN "RPK"
/**
 * CN Validation callback that can be set up by coap_context_set_pki().
 * Invoked when libcoap has done the validation checks at the TLS level,
 * but the application needs to check that the CN is allowed.
 * CN is the SubjectAltName in the cert, if not present, then the leftmost
 * Common Name (CN) component of the subject name.
 * NOTE: If using RPK, then the Public Key does not contain a CN, but the
 * content of COAP_DTLS_RPK_CERT_CN is presented for the @p cn parameter.
 *
 * @param cn  The determined CN from the certificate
 * @param asn1_public_cert  The ASN.1 encoded (DER) X.509 certificate
 * @param asn1_length  The ASN.1 length
 * @param session  The coap session associated with the certificate update
 * @param depth  Depth in cert chain.  If 0, then client cert, else a CA
 * @param validated  TLS can find no issues if 1
 * @param arg  The same as was passed into coap_context_set_pki()
 *             in setup_data->cn_call_back_arg
 *
 * @return 1 if accepted, else 0 if to be rejected
 */
typedef int (*coap_dtls_cn_callback_t)(const char *cn,
             const uint8_t *asn1_public_cert,
             size_t asn1_length,
             coap_session_t *session,
             unsigned int depth,
             int validated,
             void *arg);

typedef struct coap_dtls_key_t {
  coap_pki_key_t key_type;          /* key format type */
  union {
    coap_pki_key_pem_t pem;         /* for PEM file keys */
    coap_pki_key_pem_buf_t pem_buf; /* for PEM memory keys */
    coap_pki_key_asn1_t asn1;       /* for ASN.1 (DER) memory keys */
    coap_pki_key_pkcs11_t pkcs11;   /* for PKCS11 keys */
  } key;
} coap_dtls_key_t;
/**
 * SNI Validation callback that can be set up by coap_context_set_pki().
 * Invoked if the SNI is not previously seen and prior to sending a certificate
 * set back to the client so that the appropriate certificate set can be used
 * based on the requesting SNI.
 *
 * @param sni  The requested SNI
 * @param arg  The same as was passed into coap_context_set_pki()
 *             in setup_data->sni_call_back_arg
 *
 * @return new set of certificates to use, or NULL if SNI is to be rejected.
 */
typedef coap_dtls_key_t *(*coap_dtls_sni_callback_t)(const char *sni,
             void* arg);

/**
 * Additional Security setup handler that can be set up by
 * coap_context_set_pki().
 * Invoked when libcoap has done the validation checks at the TLS level,
 * but the application needs to do some additional checks/changes/updates.
 *
 * @param session The security session definition - e.g. SSL * for OpenSSL.
 *                This will be dependent on the underlying TLS library
 *                - see coap_get_tls_library_version()
 * @param setup_data A structure containing setup data originally passed into
 *                   coap_context_set_pki() or coap_new_client_session_pki().
 * @return 1 if successful, else 0
 */
typedef int (*coap_dtls_security_setup_t)(void *context, void* session,
                                          coap_dtls_pki_t *setup_data);

typedef enum coap_pki_key_t {
  COAP_PKI_KEY_PEM,     /* The PKI key type is PEM file */
  COAP_PKI_KEY_ASN1,    /* The PKI key type is ASN.1 (DER) buffer */
  COAP_PKI_KEY_PEM_BUF, /* The PKI key type is PEM buffer */
  COAP_PKI_KEY_PKCS11,  /* The PKI key type is PKCS11 (DER) */
} coap_pki_key_t;

typedef struct coap_pki_key_pem_t {
  const char *ca_file;       /* File location of Common CA in PEM format */
  const char *public_cert;   /* File location of Public Cert */
  const char *private_key;   /* File location of Private Key in PEM format */
} coap_pki_key_pem_t;

typedef struct coap_pki_key_pem_buf_t {
  const uint8_t *ca_cert;     /* PEM buffer Common CA Cert */
  const uint8_t *public_cert; /* PEM buffer Public Cert, or Public Key if RPK */
  const uint8_t *private_key; /* PEM buffer Private Key */
                                 If RPK and 'EC PRIVATE KEY' this can be used
                                 for both the public_cert and private_key */
  size_t ca_cert_len;         /* PEM buffer CA Cert length */
  size_t public_cert_len;     /* PEM buffer Public Cert length */
  size_t private_key_len;     /* PEM buffer Private Key length */
} coap_pki_key_pem_buf_t;

•Note:* The PEM buffer Certs and Key should be be NULL terminated strings for performance reasons (to save a potential buffer copy) and the length include this NULL terminator. It is not a requirement to have the NULL terminator though and the length must then reflect the actual data size.

typedef struct coap_pki_key_asn1_t {
  const uint8_t *ca_cert;     /* ASN1 Common CA Certificate */
  const uint8_t *public_cert; /* ASN1 (DER) Public Cert, or Public Key if RPK */
  const uint8_t *private_key; /* ASN1 Private Key */
  int ca_cert_len;            /* ASN1 CA Certificate length */
  int public_cert_len;        /* ASN1 Public Certificate length */
  int private_key_len;        /* ASN1 Private Key length */
  coap_asn1_privatekey_type_t private_key_type; /* Private Key Type
                                                   COAP_ASN1_PKEY_* */
} coap_pki_key_asn1_t;
typedef enum coap_asn1_privatekey_type_t {
  COAP_ASN1_PKEY_NONE,
  COAP_ASN1_PKEY_RSA,
  COAP_ASN1_PKEY_RSA2,
  COAP_ASN1_PKEY_DSA,
  COAP_ASN1_PKEY_DSA1,
  COAP_ASN1_PKEY_DSA2,
  COAP_ASN1_PKEY_DSA3,
  COAP_ASN1_PKEY_DSA4,
  COAP_ASN1_PKEY_DH,
  COAP_ASN1_PKEY_DHX,
  COAP_ASN1_PKEY_EC,
  COAP_ASN1_PKEY_HMAC,
  COAP_ASN1_PKEY_CMAC,
  COAP_ASN1_PKEY_TLS1_PRF,
  COAP_ASN1_PKEY_HKDF
} coap_asn1_privatekey_type_t;

typedef struct coap_pki_key_pkcs11_t {
  const char *ca;            /* pkcs11: URI for Common CA Certificate */
  const char *public_cert;   /* pkcs11: URI for Public Cert */
  const char *private_key;   /* pkcs11: URI for Private Key */
  const char *pin;           /* pin to access PKCS11.  If NULL, then
                                pin-value= parameter must be set in
                                pkcs11: URI as a query. */
} coap_pki_key_pkcs11_t;

#include <coap3/coap.h>
typedef struct valid_cns_t {
  int count;
  char **cn_list;
} valid_cns_t;
/**
 * CN Validation callback that can be set up by coap_context_set_pki().
 * Invoked when libcoap has done the validation checks at the TLS level,
 * but the application needs to check that the CN is allowed.
 * CN is the SubjectAltName in the cert, if not present, then the leftmost
 * Common Name (CN) component of the subject name.
 * NOTE: If using RPK, then the Public Key does not contain a CN, but "RPK"
 * is presented for the cn parameter.
 *
 * @param cn  The determined CN from the certificate
 * @param asn1_public_cert  The ASN.1 encoded (DER) X.509 certificate
 * @param asn1_length  The ASN.1 length
 * @param session  The coap session associated with the certificate update
 * @param depth  Depth in cert chain.  If 0, then client cert, else a CA
 * @param validated  TLS can find no issues if 1
 * @param arg  The same as was passed into coap_context_set_pki()
 *             in setup_data->cn_call_back_arg
 *
 * @return 1 if accepted, else 0 if to be rejected
 */
static int
verify_cn_callback(const char *cn,
                   const uint8_t *asn1_public_cert,
                   size_t asn1_length,
                   coap_session_t *c_session,
                   unsigned depth,
                   int validated,
                   void *arg
) {
  valid_cns_t *valid_cn_list = (valid_cns_t*)arg;
  int i;
  /* Remove (void) definition if variable is used */
  (void)asn1_public_cert;
  (void)asn1_length;
  (void)c_session;
  (void)depth;
  (void)validated;
  /* Check that the CN is valid */
  for (i = 0; i < valid_cn_list->count; i++) {
    if (!strcasecmp(cn, valid_cn_list->cn_list[i])) {
      return 1;
    }
  }
  return 0;
}
typedef struct sni_def_t {
  char* sni;
  coap_dtls_key_t key;
} sni_def_t;
typedef struct valid_snis_t {
  int count;
  sni_def_t *sni_list;
} valid_snis_t;
/**
 * SNI Validation callback that is set up by coap_context_set_pki().
 * Invoked if the SNI is not previously seen and prior to sending a certificate
 * set back to the client so that the appropriate certificate set can be used
 * based on the requesting SNI.
 *
 * @param sni  The requested SNI
 * @param arg  The same as was passed into coap_context_set_pki()
 *             in setup_data->sni_call_back_arg
 *
 * @return new set of certificates to use, or NULL if SNI is to be rejected.
 */
static coap_dtls_key_t *
verify_pki_sni_callback(const char *sni,
                        void *arg
) {
  valid_snis_t *valid_sni_list = (valid_snis_t *)arg;
  int i;
  /* Check that the SNI is valid */
  for (i = 0; i < valid_sni_list->count; i++) {
    if (!strcasecmp(sni, valid_sni_list->sni_list[i].sni)) {
      return &valid_sni_list->sni_list[i].key;
    }
  }
  return NULL;
}
/*
 * Set up PKI encryption information
 */
static coap_context_t *
setup_server_context_pki (const char *public_cert_file,
                          const char *private_key_file,
                          const char *ca_file,
                          valid_cns_t *valid_cn_list,
                          valid_snis_t *valid_sni_list
) {
  coap_endpoint_t *endpoint;
  coap_address_t listen_addr;
  coap_dtls_pki_t dtls_pki;
  coap_context_t *context;
  /* See coap_tls_library(3) */
  if (!coap_dtls_is_supported())
    return NULL;
  /* See coap_context(3) */
  context = coap_new_context(NULL);
  if (!context)
    return NULL;
  /* See coap_block(3) */
  coap_context_set_block_mode(context,
                              COAP_BLOCK_USE_LIBCOAP | COAP_BLOCK_SINGLE_BODY);
  memset (&dtls_pki, 0, sizeof (dtls_pki));
  dtls_pki.version                 = COAP_DTLS_PKI_SETUP_VERSION;
  dtls_pki.verify_peer_cert        = 1;
  dtls_pki.check_common_ca         = 1;
  dtls_pki.allow_self_signed       = 1;
  dtls_pki.allow_expired_certs     = 1;
  dtls_pki.cert_chain_validation   = 1;
  dtls_pki.cert_chain_verify_depth = 1;
  dtls_pki.check_cert_revocation   = 1;
  dtls_pki.allow_no_crl            = 1;
  dtls_pki.allow_expired_crl       = 1;
  dtls_pki.allow_bad_md_hash       = 0;
  dtls_pki.allow_short_rsa_length  = 0;
  dtls_pki.is_rpk_not_cert         = 0; /* Set to 1 if RPK */
  dtls_pki.validate_cn_call_back   = verify_cn_callback;
  dtls_pki.cn_call_back_arg        = valid_cn_list;
  dtls_pki.validate_sni_call_back  = verify_pki_sni_callback;
  dtls_pki.sni_call_back_arg       = valid_sni_list;
  dtls_pki.additional_tls_setup_call_back = NULL;
  dtls_pki.client_sni              = NULL;
  dtls_pki.pki_key.key_type        = COAP_PKI_KEY_PEM;
  dtls_pki.pki_key.key.pem.ca_file = ca_file;
  dtls_pki.pki_key.key.pem.public_cert = public_cert_file;
  dtls_pki.pki_key.key.pem.private_key = private_key_file;
  /* See coap_context(3) */
  if (coap_context_set_pki(context, &dtls_pki)) {
    coap_free_context(context);
    return NULL;
  }
  coap_address_init(&listen_addr);
  listen_addr.addr.sa.sa_family = AF_INET;
  listen_addr.addr.sin.sin_port = htons (5684);
  /* See coap_context(3) */
  endpoint = coap_new_endpoint(context, &listen_addr, COAP_PROTO_DTLS);
  if (!endpoint) {
    coap_free_context(context);
    return NULL;
  }
  /* Initialize resources - See coap_resource(3) init_resources() example */
  return context;
}

#include <coap3/coap.h>
typedef struct id_def_t {
  char *hint_match;
  coap_bin_const_t id;
  coap_bin_const_t key;
} id_def_t;
typedef struct valid_ids_t {
  size_t count;
  id_def_t *id_list;
} valid_ids_t;
/*
 * PSK Identity Pre-Shared Key selection Callback function
 */
static const coap_bin_const_t *
verify_id_callback(coap_bin_const_t *identity,
                   coap_session_t *c_session,
                   void *arg
) {
  valid_ids_t *valid_id_list = (valid_ids_t*)arg;
  const coap_bin_const_t *s_psk_hint = coap_session_get_psk_hint(c_session);
  size_t i;
  /* Check that the Identity is valid */
  for (i = 0; i < valid_id_list->count; i++) {
    if (s_psk_hint &&
        strcmp((const char *)s_psk_hint->s,
               valid_id_list->id_list[i].hint_match)) {
      continue;
    }
    if (coap_binary_equal(identity, &valid_id_list->id_list[i].id)) {
      return &valid_id_list->id_list[i].key;
    }
  }
  return NULL;
}
typedef struct sni_psk_def_t {
  char* sni;
  coap_dtls_spsk_info_t psk_info;
} sni_psk_def_t;
typedef struct valid_psk_snis_t {
  int count;
  sni_psk_def_t *sni_list;
} valid_psk_snis_t;
/*
 * PSK Subject Name Identifier (SNI) callback verifier
 */
static const coap_dtls_spsk_info_t *
verify_psk_sni_callback(const char *sni,
                        coap_session_t *c_session,
                        void *arg
) {
  valid_psk_snis_t *valid_sni_list = (valid_psk_snis_t *)arg;
  int i;
  /* Remove (void) definition if variable is used */
  (void)c_session;
  /* Check that the SNI is valid */
  for (i = 0; i < valid_sni_list->count; i++) {
    if (!strcasecmp(sni, valid_sni_list->sni_list[i].sni)) {
      return &valid_sni_list->sni_list[i].psk_info;
    }
  }
  return NULL;
}
static coap_context_t *
setup_server_context_psk (const char *hint,
                          const uint8_t *key,
                          unsigned int key_len,
                          valid_ids_t *valid_id_list,
                          valid_psk_snis_t *valid_sni_list
) {
  coap_endpoint_t *endpoint;
  coap_address_t listen_addr;
  coap_context_t *context;
  coap_dtls_spsk_t dtls_psk;
  /* See coap_tls_library(3) */
  if (!coap_dtls_is_supported())
    return NULL;
  context = coap_new_context(NULL);
  if (!context)
    return NULL;
  /* See coap_block(3) */
  coap_context_set_block_mode(context,
                              COAP_BLOCK_USE_LIBCOAP | COAP_BLOCK_SINGLE_BODY);
  memset (&dtls_psk, 0, sizeof (dtls_psk));
  /* see coap_encryption(3) */
  dtls_psk.version                 = COAP_DTLS_SPSK_SETUP_VERSION;
  dtls_psk.validate_id_call_back   = verify_id_callback;
  dtls_psk.id_call_back_arg        = valid_id_list;
  dtls_psk.validate_sni_call_back  = verify_psk_sni_callback;
  dtls_psk.sni_call_back_arg       = valid_sni_list;
  dtls_psk.psk_info.hint.s         = (const uint8_t*)hint;
  dtls_psk.psk_info.hint.length    = hint ? strlen(hint) : 0;
  dtls_psk.psk_info.key.s          = key;
  dtls_psk.psk_info.key.length     = key_len;
  if (coap_context_set_psk2(context, &dtls_psk)) {
    coap_free_context(context);
    return NULL;
  }
  coap_address_init(&listen_addr);
  listen_addr.addr.sa.sa_family = AF_INET;
  listen_addr.addr.sin.sin_port = htons (5684);
  endpoint = coap_new_endpoint(context, &listen_addr, COAP_PROTO_DTLS);
  if (!endpoint) {
    coap_free_context(context);
    return NULL;
  }
  /* Initialize resources - See coap_resource(3) init_resources() example */
  return context;
}

#include <coap3/coap.h>
#include <stdio.h>
#ifndef min
#define min(a,b) ((a) < (b) ? (a) : (b))
#endif
static const coap_dtls_cpsk_info_t *
verify_ih_callback(coap_str_const_t *hint,
                   coap_session_t *c_session,
                   void *arg
) {
  coap_dtls_cpsk_info_t *psk_info = (coap_dtls_cpsk_info_t *)arg;
  /* Remove (void) definition if variable is used */
  (void)c_session;
  coap_log(LOG_INFO, "Identity Hint '%.*s' provided\n", (int)hint->length, hint->s);
  /* Just use the defined information for now as passed in by arg */
  return psk_info;
}
static coap_dtls_cpsk_t dtls_psk;
static char client_sni[256];
static coap_session_t *
setup_client_session_psk (const char *uri,
                          struct in_addr ip_address,
                          const uint8_t *identity,
                          unsigned int identity_len,
                          const uint8_t *key,
                          unsigned int key_len
) {
  coap_session_t *session;
  coap_address_t server;
  /* See coap_context(3) */
  coap_context_t *context = coap_new_context(NULL);
  if (!context)
    return NULL;
  /* See coap_block(3) */
  coap_context_set_block_mode(context,
                              COAP_BLOCK_USE_LIBCOAP | COAP_BLOCK_SINGLE_BODY);
  coap_address_init(&server);
  server.addr.sa.sa_family = AF_INET;
  server.addr.sin.sin_addr = ip_address;
  server.addr.sin.sin_port = htons (5684);
  /* See coap_encryption(3) */
  memset (&dtls_psk, 0, sizeof(dtls_psk));
  dtls_psk.version = COAP_DTLS_CPSK_SETUP_VERSION;
  dtls_psk.validate_ih_call_back = verify_ih_callback;
  dtls_psk.ih_call_back_arg = &dtls_psk.psk_info;
  if (uri)
    memcpy(client_sni, uri, min(strlen(uri), sizeof(client_sni)-1));
  else
    memcpy(client_sni, "localhost", 9);
  dtls_psk.client_sni = client_sni;
  dtls_psk.psk_info.identity.s = identity;
  dtls_psk.psk_info.identity.length = identity_len;
  dtls_psk.psk_info.key.s = key;
  dtls_psk.psk_info.key.length = key_len;
  session = coap_new_client_session_psk2(context, NULL, &server,
                                        COAP_PROTO_DTLS, &dtls_psk);
  if (!session) {
    coap_free_context(context);
    return NULL;
  }
  /* The context is in session->context */
  return session;
}