lwm2m: an open-source LwM2M server in Go

LwM2M is the standard way to manage cellular IoT devices, and Zephyr and the nRF91 modems ship clients for it. The server side is thin. Most teams run Leshan, which is Java, or pay for a hosted platform and hope it handles their devices' quirks.

I wanted a server I could read end to end, run as one binary, and trust to behave the way the spec says when a device on a bad connection does something odd.

Every normative requirement in LwM2M 1.0.2, 1.1.1 and 1.2.2, Core and Transport, is a numbered row in the repository. A test has to claim each row, and the build fails if one goes unclaimed. I mutation-checked the proving tests to make sure they fail when the behaviour breaks.

265 of 273 requirements are proven. 4 are informative with no behaviour to test. The last 4 wait on raw public keys and one DTLS alert in pion/dtls, and I have drafted the patches for upstream.

The Zephyr LwM2M interop suite passes 66 of 66, unchanged, through a Leshan-compatible REST API. Anjay 3.15, Anjay Lite and Wakaama run against it in CI.

Next is a real-device run on the nRF9160 and nRF9151 over a carrier network. It checks DTLS Connection ID, surviving a NAT rebind without a new handshake, queue-mode wake-up and firmware download over CoAP block-wise transfer. Those are the things that break in the field.

CoAP over UDP, DTLS 1.2 and 1.3 with PSK, X.509 and Connection ID, TCP/TLS and WebSockets. LwM2M over MQTT, HTTP, SMS, NIDD and LoRaWAN. OSCORE, EST and COSE.

Every data format, including TLV, SenML JSON and CBOR, and LwM2M CBOR. Queue mode, Send, observations, access control, gateway objects, firmware update orchestration and a bootstrap server.