diff --git a/.gitignore b/.gitignore index 134e17c6..443be88c 100644 --- a/.gitignore +++ b/.gitignore @@ -62,6 +62,8 @@ test/broker/c/auth_plugin.so test/broker/c/*.test test/ssl/*.csr +test/ssl/rootCA/ +test/ssl/signingCA/ test/lib/c/*.test test/lib/cpp/*.test diff --git a/CMakeLists.txt b/CMakeLists.txt index c670628d..0cde4539 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -11,7 +11,7 @@ project(mosquitto) cmake_minimum_required(VERSION 2.8) # Only for version 3 and up. cmake_policy(SET CMP0042 NEW) -set (VERSION 1.6.4) +set (VERSION 1.6.7) add_definitions (-DCMAKE -DVERSION=\"${VERSION}\") @@ -50,6 +50,9 @@ endif (WITH_SOCKS) option(WITH_SRV "Include SRV lookup support?" OFF) +option(WITH_STATIC_LIBRARIES "Build static versions of the libmosquitto/pp libraries?" OFF) +option(WITH_PIC "Build the static library with PIC (Position Independent Code) enabled archives?" OFF) + option(WITH_THREADING "Include client library threading support?" ON) if (WITH_THREADING) add_definitions("-DWITH_THREADING") diff --git a/ChangeLog.txt b/ChangeLog.txt index d58fd4f0..b8445d19 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -12,6 +12,78 @@ Clients: - Add timeout return code (27) for `mosquitto_sub -W ` and `mosquitto_rr -W `. Closes #275. + +1.6.7 - 20190925 +================ + +Broker: +- Add workaround for working with libwebsockets 3.2.0. +- Fix potential crash when reloading config. Closes #1424, #1425. + +Client library: +- Don't use `/` in autogenerated client ids, to avoid confusing with topics. +- Fix `mosquitto_max_inflight_messages_set()` and `mosquitto_int_option(..., + MOSQ_OPT_*_MAX, ...)` behaviour. Closes #1417. +- Fix regression on use of `mosquitto_connect_async()` not working. + Closes #1415 and #1422. + +Clients: +- mosquitto_sub: Fix `-E` incorrectly not working unless `-d` was also + specified. Closes #1418. +- Updated documentation around automatic client ids. + + +1.6.6 - 20190917 +================ + +Security: +- Restrict topic hierarchy to 200 levels to prevent possible stack overflow. + Closes #1412. + +Broker: +- Restrict topic hierarchy to 200 levels to prevent possible stack overflow. + Closes #1412. +- mosquitto_passwd now returns 1 when attempting to update a user that does + not exist. Closes #1414. + + +1.6.5 - 20190912 +================ + +Broker: +- Fix v5 DISCONNECT packets with remaining length == 2 being treated as a + protocol error. Closes #1367. +- Fix support for libwebsockets 3.x. +- Fix slow websockets performance when sending large messages. Closes #1390. +- Fix bridges potentially not connecting on Windows. Closes #478. +- Fix clients authorised using `use_identity_as_username` or + `use_subject_as_username` being disconnected on SIGHUP. Closes #1402. +- Improve error messages in some situations when clients disconnect. Reduces + the number of "Socket error on client X, disconnecting" messages. +- Fix Will for v5 clients not being sent if will delay interval was greater + than the session expiry interval. Closes #1401. +- Fix CRL file not being reloaded on HUP. Closes #35. +- Fix repeated "Error in poll" messages on Windows when only websockets + listeners are defined. Closes #1391. + +Client library: +- Fix reconnect backoff for the situation where connections are dropped rather + than refused. Closes #737. +- Fix missing locks on `mosq->state`. Closes #1374. + +Documentation: +- Improve details on global/per listener options in the mosquitto.conf man page. + Closes #274. +- Clarify behaviour when clients exceed the `message_size_limit`. Closes #448. +- Improve documentation for `max_inflight_bytes`, `max_inflight_messages`, + and `max_queued_messages`. + +Build: +- Fix missing function warnings on NetBSD. +- Fix WITH_STATIC_LIBRARIES using CMake on Windows. Closes #1369. +- Guard ssize_t definition on Windows. Closes #522. + + 1.6.4 - 20190801 ================ diff --git a/client/CMakeLists.txt b/client/CMakeLists.txt index d928650c..6aa24b2b 100644 --- a/client/CMakeLists.txt +++ b/client/CMakeLists.txt @@ -13,10 +13,15 @@ add_executable(mosquitto_pub pub_client.c pub_shared.c ${shared_src}) add_executable(mosquitto_sub sub_client.c sub_client_output.c ${shared_src}) add_executable(mosquitto_rr rr_client.c pub_shared.c sub_client_output.c ${shared_src}) - -target_link_libraries(mosquitto_pub libmosquitto) -target_link_libraries(mosquitto_sub libmosquitto) -target_link_libraries(mosquitto_rr libmosquitto) +if (WITH_STATIC_LIBRARIES) + target_link_libraries(mosquitto_pub libmosquitto_static) + target_link_libraries(mosquitto_sub libmosquitto_static) + target_link_libraries(mosquitto_rr libmosquitto_static) +else() + target_link_libraries(mosquitto_pub libmosquitto) + target_link_libraries(mosquitto_sub libmosquitto) + target_link_libraries(mosquitto_rr libmosquitto) +endif() if (QNX) target_link_libraries(mosquitto_pub socket) diff --git a/client/sub_client.c b/client/sub_client.c index f5f3ce6d..86a4476e 100644 --- a/client/sub_client.c +++ b/client/sub_client.c @@ -147,11 +147,13 @@ void my_subscribe_callback(struct mosquitto *mosq, void *obj, int mid, int qos_c UNUSED(obj); - if(!cfg.quiet) printf("Subscribed (mid: %d): %d", mid, granted_qos[0]); - for(i=1; iid[1] = 'o'; mosq->id[2] = 's'; mosq->id[3] = 'q'; - mosq->id[4] = '/'; + mosq->id[4] = '-'; rc = util__random_bytes(&mosq->id[5], 18); if(rc) return rc; @@ -120,9 +120,7 @@ int mosquitto_connect_bind_v5(struct mosquitto *mosq, const char *host, int port rc = mosquitto__connect_init(mosq, host, port, keepalive, bind_address); if(rc) return rc; - pthread_mutex_lock(&mosq->state_mutex); - mosq->state = mosq_cs_new; - pthread_mutex_unlock(&mosq->state_mutex); + mosquitto__set_state(mosq, mosq_cs_new); return mosquitto__reconnect(mosq, true, properties); } @@ -139,10 +137,6 @@ int mosquitto_connect_bind_async(struct mosquitto *mosq, const char *host, int p int rc = mosquitto__connect_init(mosq, host, port, keepalive, bind_address); if(rc) return rc; - pthread_mutex_lock(&mosq->state_mutex); - mosq->state = mosq_cs_connect_async; - pthread_mutex_unlock(&mosq->state_mutex); - return mosquitto__reconnect(mosq, false, NULL); } @@ -164,6 +158,7 @@ static int mosquitto__reconnect(struct mosquitto *mosq, bool blocking, const mos const mosquitto_property *outgoing_properties = NULL; mosquitto_property local_property; int rc; + if(!mosq) return MOSQ_ERR_INVAL; if(!mosq->host || mosq->port <= 0) return MOSQ_ERR_INVAL; if(mosq->protocol != mosq_p_mqtt5 && properties) return MOSQ_ERR_NOT_SUPPORTED; @@ -181,17 +176,6 @@ static int mosquitto__reconnect(struct mosquitto *mosq, bool blocking, const mos if(rc) return rc; } - pthread_mutex_lock(&mosq->state_mutex); -#ifdef WITH_SOCKS - if(mosq->socks5_host){ - mosq->state = mosq_cs_socks5_new; - }else -#endif - { - mosq->state = mosq_cs_new; - } - pthread_mutex_unlock(&mosq->state_mutex); - pthread_mutex_lock(&mosq->msgtime_mutex); mosq->last_msg_in = mosquitto_time(); mosq->next_msg_out = mosq->last_msg_in + mosq->keepalive; @@ -215,28 +199,26 @@ static int mosquitto__reconnect(struct mosquitto *mosq, bool blocking, const mos }else #endif { - pthread_mutex_lock(&mosq->state_mutex); - mosq->state = mosq_cs_connecting; - pthread_mutex_unlock(&mosq->state_mutex); rc = net__socket_connect(mosq, mosq->host, mosq->port, mosq->bind_address, blocking); } if(rc>0){ + mosquitto__set_state(mosq, mosq_cs_connect_pending); return rc; } #ifdef WITH_SOCKS if(mosq->socks5_host){ + mosquitto__set_state(mosq, mosq_cs_socks5_new); return socks5__send(mosq); }else #endif { + mosquitto__set_state(mosq, mosq_cs_connected); rc = send__connect(mosq, mosq->keepalive, mosq->clean_start, outgoing_properties); if(rc){ packet__cleanup_all(mosq); net__socket_close(mosq); - pthread_mutex_lock(&mosq->state_mutex); - mosq->state = mosq_cs_new; - pthread_mutex_unlock(&mosq->state_mutex); + mosquitto__set_state(mosq, mosq_cs_new); } return rc; } @@ -269,21 +251,18 @@ int mosquitto_disconnect_v5(struct mosquitto *mosq, int reason_code, const mosqu if(rc) return rc; } - pthread_mutex_lock(&mosq->state_mutex); - mosq->state = mosq_cs_disconnecting; - pthread_mutex_unlock(&mosq->state_mutex); - - if(mosq->sock == INVALID_SOCKET) return MOSQ_ERR_NO_CONN; - return send__disconnect(mosq, reason_code, outgoing_properties); + mosquitto__set_state(mosq, mosq_cs_disconnected); + if(mosq->sock == INVALID_SOCKET){ + return MOSQ_ERR_NO_CONN; + }else{ + return send__disconnect(mosq, reason_code, outgoing_properties); + } } void do_client_disconnect(struct mosquitto *mosq, int reason_code, const mosquitto_property *properties) { - pthread_mutex_lock(&mosq->state_mutex); - mosq->state = mosq_cs_disconnecting; - pthread_mutex_unlock(&mosq->state_mutex); - + mosquitto__set_state(mosq, mosq_cs_disconnected); net__socket_close(mosq); /* Free data and reset values */ diff --git a/lib/cpp/CMakeLists.txt b/lib/cpp/CMakeLists.txt index 89eb560f..b39ac3f5 100644 --- a/lib/cpp/CMakeLists.txt +++ b/lib/cpp/CMakeLists.txt @@ -29,7 +29,7 @@ if (WITH_STATIC_LIBRARIES) target_link_libraries(mosquittopp_static ${LIBRARIES}) set_target_properties(mosquittopp_static PROPERTIES - OUTPUT_NAME mosquittopp + OUTPUT_NAME mosquittopp_static VERSION ${VERSION} ) diff --git a/lib/cpp/mosquittopp.h b/lib/cpp/mosquittopp.h index 8d2e98b0..d3f388c0 100644 --- a/lib/cpp/mosquittopp.h +++ b/lib/cpp/mosquittopp.h @@ -17,7 +17,7 @@ Contributors: #ifndef MOSQUITTOPP_H #define MOSQUITTOPP_H -#ifdef _WIN32 +#if defined(_WIN32) && !defined(LIBMOSQUITTO_STATIC) # ifdef mosquittopp_EXPORTS # define mosqpp_EXPORT __declspec(dllexport) # else diff --git a/lib/handle_connack.c b/lib/handle_connack.c index 60780f6c..379da156 100644 --- a/lib/handle_connack.c +++ b/lib/handle_connack.c @@ -31,6 +31,9 @@ Contributors: static void connack_callback(struct mosquitto *mosq, uint8_t reason_code, uint8_t connect_flags, const mosquitto_property *properties) { log__printf(mosq, MOSQ_LOG_DEBUG, "Client %s received CONNACK (%d)", mosq->id, reason_code); + if(reason_code == MQTT_RC_SUCCESS){ + mosq->reconnects = 0; + } pthread_mutex_lock(&mosq->callback_mutex); if(mosq->on_connect){ mosq->in_callback = true; @@ -108,7 +111,7 @@ int handle__connack(struct mosquitto *mosq) case 0: pthread_mutex_lock(&mosq->state_mutex); if(mosq->state != mosq_cs_disconnecting){ - mosq->state = mosq_cs_connected; + mosq->state = mosq_cs_active; } pthread_mutex_unlock(&mosq->state_mutex); message__retry_check(mosq); diff --git a/lib/handle_ping.c b/lib/handle_ping.c index 56d89a3c..8482336c 100644 --- a/lib/handle_ping.c +++ b/lib/handle_ping.c @@ -37,9 +37,12 @@ Contributors: int handle__pingreq(struct mosquitto *mosq) { + int state; + assert(mosq); - if(mosq->state != mosq_cs_connected){ + state = mosquitto__get_state(mosq); + if(state != mosq_cs_active){ return MOSQ_ERR_PROTOCOL; } @@ -53,9 +56,12 @@ int handle__pingreq(struct mosquitto *mosq) int handle__pingresp(struct mosquitto *mosq) { + int state; + assert(mosq); - if(mosq->state != mosq_cs_connected){ + state = mosquitto__get_state(mosq); + if(state != mosq_cs_active){ return MOSQ_ERR_PROTOCOL; } diff --git a/lib/handle_pubackcomp.c b/lib/handle_pubackcomp.c index 67921494..5bf3d004 100644 --- a/lib/handle_pubackcomp.c +++ b/lib/handle_pubackcomp.c @@ -47,10 +47,12 @@ int handle__pubackcomp(struct mosquitto *mosq, const char *type) int rc; mosquitto_property *properties = NULL; int qos; + int state; assert(mosq); - if(mosq->state != mosq_cs_connected){ + state = mosquitto__get_state(mosq); + if(state != mosq_cs_active){ return MOSQ_ERR_PROTOCOL; } diff --git a/lib/handle_publish.c b/lib/handle_publish.c index 8c93e3ce..909fbaf5 100644 --- a/lib/handle_publish.c +++ b/lib/handle_publish.c @@ -40,10 +40,12 @@ int handle__publish(struct mosquitto *mosq) uint16_t mid; int slen; mosquitto_property *properties = NULL; + int state; assert(mosq); - if(mosq->state != mosq_cs_connected){ + state = mosquitto__get_state(mosq); + if(state != mosq_cs_active){ return MOSQ_ERR_PROTOCOL; } diff --git a/lib/handle_pubrec.c b/lib/handle_pubrec.c index 81f1b496..fda76f04 100644 --- a/lib/handle_pubrec.c +++ b/lib/handle_pubrec.c @@ -41,10 +41,12 @@ int handle__pubrec(struct mosquitto_db *db, struct mosquitto *mosq) uint16_t mid; int rc; mosquitto_property *properties = NULL; + int state; assert(mosq); - if(mosq->state != mosq_cs_connected){ + state = mosquitto__get_state(mosq); + if(state != mosq_cs_active){ return MOSQ_ERR_PROTOCOL; } diff --git a/lib/handle_pubrel.c b/lib/handle_pubrel.c index 209a3e0d..c33d4cbd 100644 --- a/lib/handle_pubrel.c +++ b/lib/handle_pubrel.c @@ -45,10 +45,12 @@ int handle__pubrel(struct mosquitto_db *db, struct mosquitto *mosq) #endif int rc; mosquitto_property *properties = NULL; + int state; assert(mosq); - if(mosq->state != mosq_cs_connected){ + state = mosquitto__get_state(mosq); + if(state != mosq_cs_active){ return MOSQ_ERR_PROTOCOL; } diff --git a/lib/handle_suback.c b/lib/handle_suback.c index dadebcd7..0973e7f2 100644 --- a/lib/handle_suback.c +++ b/lib/handle_suback.c @@ -29,6 +29,7 @@ Contributors: #include "mqtt_protocol.h" #include "packet_mosq.h" #include "property_mosq.h" +#include "util_mosq.h" int handle__suback(struct mosquitto *mosq) @@ -40,10 +41,12 @@ int handle__suback(struct mosquitto *mosq) int i = 0; int rc; mosquitto_property *properties = NULL; + int state; assert(mosq); - if(mosq->state != mosq_cs_connected){ + state = mosquitto__get_state(mosq); + if(state != mosq_cs_active){ return MOSQ_ERR_PROTOCOL; } diff --git a/lib/handle_unsuback.c b/lib/handle_unsuback.c index 3ced0e52..06f9c16d 100644 --- a/lib/handle_unsuback.c +++ b/lib/handle_unsuback.c @@ -42,10 +42,12 @@ int handle__unsuback(struct mosquitto *mosq) uint16_t mid; int rc; mosquitto_property *properties = NULL; + int state; assert(mosq); - if(mosq->state != mosq_cs_connected){ + state = mosquitto__get_state(mosq); + if(state != mosq_cs_active){ return MOSQ_ERR_PROTOCOL; } diff --git a/lib/loop.c b/lib/loop.c index 36763e06..ad9bc0f3 100644 --- a/lib/loop.c +++ b/lib/loop.c @@ -47,6 +47,9 @@ int mosquitto_loop(struct mosquitto *mosq, int timeout, int max_packets) char pairbuf; int maxfd = 0; time_t now; +#ifdef WITH_SRV + int state; +#endif if(!mosq || max_packets < 1) return MOSQ_ERR_INVAL; #ifndef WIN32 @@ -83,17 +86,15 @@ int mosquitto_loop(struct mosquitto *mosq, int timeout, int max_packets) }else{ #ifdef WITH_SRV if(mosq->achan){ - pthread_mutex_lock(&mosq->state_mutex); - if(mosq->state == mosq_cs_connect_srv){ + state = mosquitto__get_state(mosq); + if(state == mosq_cs_connect_srv){ rc = ares_fds(mosq->achan, &readfds, &writefds); if(rc > maxfd){ maxfd = rc; } }else{ - pthread_mutex_unlock(&mosq->state_mutex); return MOSQ_ERR_NO_CONN; } - pthread_mutex_unlock(&mosq->state_mutex); } #else return MOSQ_ERR_NO_CONN; @@ -194,24 +195,19 @@ int mosquitto_loop_forever(struct mosquitto *mosq, int timeout, int max_packets) { int run = 1; int rc; - unsigned int reconnects = 0; unsigned long reconnect_delay; #ifndef WIN32 struct timespec req, rem; #endif + int state; if(!mosq) return MOSQ_ERR_INVAL; - if(mosq->state == mosq_cs_connect_async){ - mosquitto_reconnect(mosq); - } + mosq->reconnects = 0; while(run){ do{ rc = mosquitto_loop(mosq, timeout, max_packets); - if (reconnects !=0 && rc == MOSQ_ERR_SUCCESS){ - reconnects = 0; - } }while(run && rc == MOSQ_ERR_SUCCESS); /* Quit after fatal errors. */ switch(rc){ @@ -236,18 +232,15 @@ int mosquitto_loop_forever(struct mosquitto *mosq, int timeout, int max_packets) } do{ rc = MOSQ_ERR_SUCCESS; - pthread_mutex_lock(&mosq->state_mutex); - if(mosq->state == mosq_cs_disconnecting){ + state = mosquitto__get_state(mosq); + if(state == mosq_cs_disconnecting || state == mosq_cs_disconnected){ run = 0; - pthread_mutex_unlock(&mosq->state_mutex); }else{ - pthread_mutex_unlock(&mosq->state_mutex); - if(mosq->reconnect_delay_max > mosq->reconnect_delay){ if(mosq->reconnect_exponential_backoff){ - reconnect_delay = mosq->reconnect_delay*(reconnects+1)*(reconnects+1); + reconnect_delay = mosq->reconnect_delay*(mosq->reconnects+1)*(mosq->reconnects+1); }else{ - reconnect_delay = mosq->reconnect_delay*(reconnects+1); + reconnect_delay = mosq->reconnect_delay*(mosq->reconnects+1); } }else{ reconnect_delay = mosq->reconnect_delay; @@ -256,7 +249,7 @@ int mosquitto_loop_forever(struct mosquitto *mosq, int timeout, int max_packets) if(reconnect_delay > mosq->reconnect_delay_max){ reconnect_delay = mosq->reconnect_delay_max; }else{ - reconnects++; + mosq->reconnects++; } #ifdef WIN32 @@ -269,12 +262,10 @@ int mosquitto_loop_forever(struct mosquitto *mosq, int timeout, int max_packets) } #endif - pthread_mutex_lock(&mosq->state_mutex); - if(mosq->state == mosq_cs_disconnecting){ + state = mosquitto__get_state(mosq); + if(state == mosq_cs_disconnecting || state == mosq_cs_disconnected){ run = 0; - pthread_mutex_unlock(&mosq->state_mutex); }else{ - pthread_mutex_unlock(&mosq->state_mutex); rc = mosquitto_reconnect(mosq); } } @@ -295,13 +286,14 @@ int mosquitto_loop_misc(struct mosquitto *mosq) static int mosquitto__loop_rc_handle(struct mosquitto *mosq, int rc) { + int state; + if(rc){ net__socket_close(mosq); - pthread_mutex_lock(&mosq->state_mutex); - if(mosq->state == mosq_cs_disconnecting){ + state = mosquitto__get_state(mosq); + if(state == mosq_cs_disconnecting || state == mosq_cs_disconnected){ rc = MOSQ_ERR_SUCCESS; } - pthread_mutex_unlock(&mosq->state_mutex); pthread_mutex_lock(&mosq->callback_mutex); if(mosq->on_disconnect){ mosq->in_callback = true; diff --git a/lib/messages_mosq.c b/lib/messages_mosq.c index 75e4f860..90262441 100644 --- a/lib/messages_mosq.c +++ b/lib/messages_mosq.c @@ -340,10 +340,6 @@ int message__out_update(struct mosquitto *mosq, uint16_t mid, enum mosquitto_msg int mosquitto_max_inflight_messages_set(struct mosquitto *mosq, unsigned int max_inflight_messages) { - if(!mosq) return MOSQ_ERR_INVAL; - - mosq->send_maximum = max_inflight_messages; - - return MOSQ_ERR_SUCCESS; + return mosquitto_int_option(mosq, MOSQ_OPT_SEND_MAXIMUM, max_inflight_messages); } diff --git a/lib/mosquitto.c b/lib/mosquitto.c index 4b5768f3..795013eb 100644 --- a/lib/mosquitto.c +++ b/lib/mosquitto.c @@ -21,6 +21,7 @@ Contributors: #include #ifndef WIN32 #include +#include #endif #include "mosquitto.h" diff --git a/lib/mosquitto.h b/lib/mosquitto.h index 274d54ec..48907459 100644 --- a/lib/mosquitto.h +++ b/lib/mosquitto.h @@ -48,7 +48,7 @@ extern "C" { #define LIBMOSQUITTO_MAJOR 1 #define LIBMOSQUITTO_MINOR 6 -#define LIBMOSQUITTO_REVISION 4 +#define LIBMOSQUITTO_REVISION 7 /* LIBMOSQUITTO_VERSION_NUMBER looks like 1002001 for e.g. version 1.2.1. */ #define LIBMOSQUITTO_VERSION_NUMBER (LIBMOSQUITTO_MAJOR*1000000+LIBMOSQUITTO_MINOR*1000+LIBMOSQUITTO_REVISION) diff --git a/lib/mosquitto_internal.h b/lib/mosquitto_internal.h index ff656a43..de640144 100644 --- a/lib/mosquitto_internal.h +++ b/lib/mosquitto_internal.h @@ -94,7 +94,7 @@ enum mosquitto_client_state { mosq_cs_new = 0, mosq_cs_connected = 1, mosq_cs_disconnecting = 2, - mosq_cs_connect_async = 3, + mosq_cs_active = 3, mosq_cs_connect_pending = 4, mosq_cs_connect_srv = 5, mosq_cs_disconnect_ws = 6, @@ -107,7 +107,6 @@ enum mosquitto_client_state { mosq_cs_socks5_userpass_reply = 13, mosq_cs_socks5_send_userpass = 14, mosq_cs_expiring = 15, - mosq_cs_connecting = 16, mosq_cs_duplicate = 17, /* client that has been taken over by another with the same id */ mosq_cs_disconnect_with_will = 18, mosq_cs_disused = 19, /* client that has been added to the disused list to be freed */ @@ -326,6 +325,7 @@ struct mosquitto { char *host; int port; char *bind_address; + unsigned int reconnects; unsigned int reconnect_delay; unsigned int reconnect_delay_max; bool reconnect_exponential_backoff; @@ -334,8 +334,6 @@ struct mosquitto { # ifdef WITH_SRV ares_channel achan; # endif - uint16_t send_maximum; - uint16_t receive_maximum; #endif uint8_t maximum_qos; diff --git a/lib/net_mosq.c b/lib/net_mosq.c index 9fd75856..c2907452 100644 --- a/lib/net_mosq.c +++ b/lib/net_mosq.c @@ -210,7 +210,7 @@ int net__socket_close(struct mosquitto *mosq) if(mosq->wsi) { if(mosq->state != mosq_cs_disconnecting){ - context__set_state(mosq, mosq_cs_disconnect_ws); + mosquitto__set_state(mosq, mosq_cs_disconnect_ws); } libwebsocket_callback_on_writable(mosq->ws_context, mosq->wsi); }else diff --git a/lib/net_mosq.h b/lib/net_mosq.h index b843ebe3..0ed4c219 100644 --- a/lib/net_mosq.h +++ b/lib/net_mosq.h @@ -17,10 +17,13 @@ Contributors: #define NET_MOSQ_H #ifndef WIN32 -#include +# include #else -#include +# include +# ifndef _SSIZE_T_DEFINED typedef SSIZE_T ssize_t; +# define _SSIZE_T_DEFINED +# endif #endif #include "mosquitto_internal.h" diff --git a/lib/options.c b/lib/options.c index 483edbb2..4ab8897e 100644 --- a/lib/options.c +++ b/lib/options.c @@ -409,14 +409,22 @@ int mosquitto_int_option(struct mosquitto *mosq, enum mosq_opt_t option, int val if(value < 0 || value > 65535){ return MOSQ_ERR_INVAL; } - mosq->receive_maximum = value; + if(value == 0){ + mosq->msgs_in.inflight_maximum = 65535; + }else{ + mosq->msgs_in.inflight_maximum = value; + } break; case MOSQ_OPT_SEND_MAXIMUM: if(value < 0 || value > 65535){ return MOSQ_ERR_INVAL; } - mosq->send_maximum = value; + if(value == 0){ + mosq->msgs_out.inflight_maximum = 65535; + }else{ + mosq->msgs_out.inflight_maximum = value; + } break; case MOSQ_OPT_SSL_CTX_WITH_DEFAULTS: diff --git a/lib/packet_mosq.c b/lib/packet_mosq.c index 22df79e5..f9c46b6b 100644 --- a/lib/packet_mosq.c +++ b/lib/packet_mosq.c @@ -34,6 +34,7 @@ Contributors: #include "net_mosq.h" #include "packet_mosq.h" #include "read_handle.h" +#include "util_mosq.h" #ifdef WITH_BROKER # include "sys_tree.h" # include "send_mosq.h" @@ -202,6 +203,7 @@ int packet__write(struct mosquitto *mosq) { ssize_t write_length; struct mosquitto__packet *packet; + int state; if(!mosq) return MOSQ_ERR_INVAL; if(mosq->sock == INVALID_SOCKET) return MOSQ_ERR_NO_CONN; @@ -217,10 +219,11 @@ int packet__write(struct mosquitto *mosq) } pthread_mutex_unlock(&mosq->out_packet_mutex); + state = mosquitto__get_state(mosq); #if defined(WITH_TLS) && !defined(WITH_BROKER) - if((mosq->state == mosq_cs_connect_pending) || mosq->want_connect){ + if((state == mosq_cs_connect_pending) || mosq->want_connect){ #else - if(mosq->state == mosq_cs_connect_pending){ + if(state == mosq_cs_connect_pending){ #endif pthread_mutex_unlock(&mosq->current_out_packet_mutex); return MOSQ_ERR_SUCCESS; @@ -239,7 +242,11 @@ int packet__write(struct mosquitto *mosq) #ifdef WIN32 errno = WSAGetLastError(); #endif - if(errno == EAGAIN || errno == COMPAT_EWOULDBLOCK){ + if(errno == EAGAIN || errno == COMPAT_EWOULDBLOCK +#ifdef WIN32 + || errno == WSAENOTCONN +#endif + ){ pthread_mutex_unlock(&mosq->current_out_packet_mutex); return MOSQ_ERR_SUCCESS; }else{ @@ -312,6 +319,7 @@ int packet__read(struct mosquitto *mosq) uint8_t byte; ssize_t read_length; int rc = 0; + int state; if(!mosq){ return MOSQ_ERR_INVAL; @@ -319,7 +327,9 @@ int packet__read(struct mosquitto *mosq) if(mosq->sock == INVALID_SOCKET){ return MOSQ_ERR_NO_CONN; } - if(mosq->state == mosq_cs_connect_pending){ + + state = mosquitto__get_state(mosq); + if(state == mosq_cs_connect_pending){ return MOSQ_ERR_SUCCESS; } @@ -344,7 +354,7 @@ int packet__read(struct mosquitto *mosq) #ifdef WITH_BROKER G_BYTES_RECEIVED_INC(1); /* Clients must send CONNECT as their first command. */ - if(!(mosq->bridge) && mosq->state == mosq_cs_new && (byte&0xF0) != CMD_CONNECT){ + if(!(mosq->bridge) && mosq->state == mosq_cs_connected && (byte&0xF0) != CMD_CONNECT){ return MOSQ_ERR_PROTOCOL; } #endif diff --git a/lib/property_mosq.c b/lib/property_mosq.c index d3854cff..f489136c 100644 --- a/lib/property_mosq.c +++ b/lib/property_mosq.c @@ -20,6 +20,10 @@ Contributors: #include #include +#ifndef WIN32 +# include +#endif + #include "logging_mosq.h" #include "memory_mosq.h" #include "mqtt_protocol.h" diff --git a/lib/socks_mosq.c b/lib/socks_mosq.c index 0df58a4b..a9f0bbcd 100644 --- a/lib/socks_mosq.c +++ b/lib/socks_mosq.c @@ -37,6 +37,7 @@ Contributors: #include "net_mosq.h" #include "packet_mosq.h" #include "send_mosq.h" +#include "util_mosq.h" #define SOCKS_AUTH_NONE 0x00 #define SOCKS_AUTH_GSS 0x01 @@ -112,8 +113,11 @@ int socks5__send(struct mosquitto *mosq) struct in6_addr addr_ipv6; int ipv4_pton_result; int ipv6_pton_result; + int state; - if(mosq->state == mosq_cs_socks5_new){ + state = mosquitto__get_state(mosq); + + if(state == mosq_cs_socks5_new){ packet = mosquitto__calloc(1, sizeof(struct mosquitto__packet)); if(!packet) return MOSQ_ERR_NOMEM; @@ -134,9 +138,7 @@ int socks5__send(struct mosquitto *mosq) packet->payload[2] = SOCKS_AUTH_NONE; } - pthread_mutex_lock(&mosq->state_mutex); - mosq->state = mosq_cs_socks5_start; - pthread_mutex_unlock(&mosq->state_mutex); + mosquitto__set_state(mosq, mosq_cs_socks5_start); mosq->in_packet.pos = 0; mosq->in_packet.packet_length = 2; @@ -149,7 +151,7 @@ int socks5__send(struct mosquitto *mosq) } return packet__queue(mosq, packet); - }else if(mosq->state == mosq_cs_socks5_auth_ok){ + }else if(state == mosq_cs_socks5_auth_ok){ packet = mosquitto__calloc(1, sizeof(struct mosquitto__packet)); if(!packet) return MOSQ_ERR_NOMEM; @@ -201,9 +203,7 @@ int socks5__send(struct mosquitto *mosq) packet->payload[1] = 0x01; packet->payload[2] = 0x00; - pthread_mutex_lock(&mosq->state_mutex); - mosq->state = mosq_cs_socks5_request; - pthread_mutex_unlock(&mosq->state_mutex); + mosquitto__set_state(mosq, mosq_cs_socks5_request); mosq->in_packet.pos = 0; mosq->in_packet.packet_length = 5; @@ -216,7 +216,7 @@ int socks5__send(struct mosquitto *mosq) } return packet__queue(mosq, packet); - }else if(mosq->state == mosq_cs_socks5_send_userpass){ + }else if(state == mosq_cs_socks5_send_userpass){ packet = mosquitto__calloc(1, sizeof(struct mosquitto__packet)); if(!packet) return MOSQ_ERR_NOMEM; @@ -232,9 +232,7 @@ int socks5__send(struct mosquitto *mosq) packet->payload[2+ulen] = plen; memcpy(&(packet->payload[3+ulen]), mosq->socks5_password, plen); - pthread_mutex_lock(&mosq->state_mutex); - mosq->state = mosq_cs_socks5_userpass_reply; - pthread_mutex_unlock(&mosq->state_mutex); + mosquitto__set_state(mosq, mosq_cs_socks5_userpass_reply); mosq->in_packet.pos = 0; mosq->in_packet.packet_length = 2; @@ -256,8 +254,10 @@ int socks5__read(struct mosquitto *mosq) ssize_t len; uint8_t *payload; uint8_t i; + int state; - if(mosq->state == mosq_cs_socks5_start){ + state = mosquitto__get_state(mosq); + if(state == mosq_cs_socks5_start){ while(mosq->in_packet.to_process > 0){ len = net__read(mosq, &(mosq->in_packet.payload[mosq->in_packet.pos]), mosq->in_packet.to_process); if(len > 0){ @@ -289,17 +289,17 @@ int socks5__read(struct mosquitto *mosq) switch(mosq->in_packet.payload[1]){ case SOCKS_AUTH_NONE: packet__cleanup(&mosq->in_packet); - mosq->state = mosq_cs_socks5_auth_ok; + mosquitto__set_state(mosq, mosq_cs_socks5_auth_ok); return socks5__send(mosq); case SOCKS_AUTH_USERPASS: packet__cleanup(&mosq->in_packet); - mosq->state = mosq_cs_socks5_send_userpass; + mosquitto__set_state(mosq, mosq_cs_socks5_send_userpass); return socks5__send(mosq); default: packet__cleanup(&mosq->in_packet); return MOSQ_ERR_AUTH; } - }else if(mosq->state == mosq_cs_socks5_userpass_reply){ + }else if(state == mosq_cs_socks5_userpass_reply){ while(mosq->in_packet.to_process > 0){ len = net__read(mosq, &(mosq->in_packet.payload[mosq->in_packet.pos]), mosq->in_packet.to_process); if(len > 0){ @@ -330,7 +330,7 @@ int socks5__read(struct mosquitto *mosq) } if(mosq->in_packet.payload[1] == 0){ packet__cleanup(&mosq->in_packet); - mosq->state = mosq_cs_socks5_auth_ok; + mosquitto__set_state(mosq, mosq_cs_socks5_auth_ok); return socks5__send(mosq); }else{ i = mosq->in_packet.payload[1]; @@ -355,7 +355,7 @@ int socks5__read(struct mosquitto *mosq) } return MOSQ_ERR_PROXY; } - }else if(mosq->state == mosq_cs_socks5_request){ + }else if(state == mosq_cs_socks5_request){ while(mosq->in_packet.to_process > 0){ len = net__read(mosq, &(mosq->in_packet.payload[mosq->in_packet.pos]), mosq->in_packet.to_process); if(len > 0){ @@ -423,7 +423,7 @@ int socks5__read(struct mosquitto *mosq) if(mosq->in_packet.payload[1] == 0){ /* Auth passed */ packet__cleanup(&mosq->in_packet); - mosq->state = mosq_cs_new; + mosquitto__set_state(mosq, mosq_cs_new); if(mosq->socks5_host){ int rc = net__socket_connect_step3(mosq, mosq->host); if(rc) return rc; @@ -432,7 +432,7 @@ int socks5__read(struct mosquitto *mosq) }else{ i = mosq->in_packet.payload[1]; packet__cleanup(&mosq->in_packet); - mosq->state = mosq_cs_socks5_new; + mosquitto__set_state(mosq, mosq_cs_socks5_new); switch(i){ case SOCKS_REPLY_CONNECTION_NOT_ALLOWED: return MOSQ_ERR_AUTH; diff --git a/lib/srv_mosq.c b/lib/srv_mosq.c index d08c2bd0..b05d257d 100644 --- a/lib/srv_mosq.c +++ b/lib/srv_mosq.c @@ -28,6 +28,7 @@ Contributors: #include "memory_mosq.h" #include "mosquitto_internal.h" #include "mosquitto.h" +#include "util_mosq.h" #ifdef WITH_SRV static void srv_callback(void *arg, int status, int timeouts, unsigned char *abuf, int alen) @@ -91,9 +92,7 @@ int mosquitto_connect_srv(struct mosquitto *mosq, const char *host, int keepaliv mosquitto__free(h); } - pthread_mutex_lock(&mosq->state_mutex); - mosq->state = mosq_cs_connect_srv; - pthread_mutex_unlock(&mosq->state_mutex); + mosquitto__set_state(mosq, mosq_cs_connect_srv); mosq->keepalive = keepalive; diff --git a/lib/thread_mosq.c b/lib/thread_mosq.c index 7bde453d..d92526b3 100644 --- a/lib/thread_mosq.c +++ b/lib/thread_mosq.c @@ -22,6 +22,7 @@ Contributors: #include "mosquitto_internal.h" #include "net_mosq.h" +#include "util_mosq.h" void *mosquitto__thread_main(void *obj); @@ -89,9 +90,7 @@ void *mosquitto__thread_main(void *obj) if(!mosq) return NULL; do{ - pthread_mutex_lock(&mosq->state_mutex); - state = mosq->state; - pthread_mutex_unlock(&mosq->state_mutex); + state = mosquitto__get_state(mosq); if(state == mosq_cs_new){ #ifdef WIN32 Sleep(10); @@ -103,10 +102,6 @@ void *mosquitto__thread_main(void *obj) } }while(1); - if(state == mosq_cs_connect_async){ - mosquitto_reconnect(mosq); - } - if(!mosq->keepalive){ /* Sleep for a day if keepalive disabled. */ mosquitto_loop_forever(mosq, 1000*86400, 1); diff --git a/lib/util_mosq.c b/lib/util_mosq.c index 65fc2215..23cc910a 100644 --- a/lib/util_mosq.c +++ b/lib/util_mosq.c @@ -68,6 +68,7 @@ int mosquitto__check_keepalive(struct mosquitto *mosq) #ifndef WITH_BROKER int rc; #endif + int state; assert(mosq); #if defined(WITH_BROKER) && defined(WITH_BRIDGE) @@ -88,7 +89,8 @@ int mosquitto__check_keepalive(struct mosquitto *mosq) if(mosq->keepalive && mosq->sock != INVALID_SOCKET && (now >= next_msg_out || now - last_msg_in >= mosq->keepalive)){ - if(mosq->state == mosq_cs_connected && mosq->ping_t == 0){ + state = mosquitto__get_state(mosq); + if(state == mosq_cs_active && mosq->ping_t == 0){ send__pingreq(mosq); /* Reset last msg times to give the server time to send a pingresp */ pthread_mutex_lock(&mosq->msgtime_mutex); @@ -100,13 +102,12 @@ int mosquitto__check_keepalive(struct mosquitto *mosq) net__socket_close(db, mosq); #else net__socket_close(mosq); - pthread_mutex_lock(&mosq->state_mutex); - if(mosq->state == mosq_cs_disconnecting){ + state = mosquitto__get_state(mosq); + if(state == mosq_cs_disconnecting){ rc = MOSQ_ERR_SUCCESS; }else{ rc = MOSQ_ERR_KEEPALIVE; } - pthread_mutex_unlock(&mosq->state_mutex); pthread_mutex_lock(&mosq->callback_mutex); if(mosq->on_disconnect){ mosq->in_callback = true; @@ -352,3 +353,30 @@ int util__random_bytes(void *bytes, int count) #endif return rc; } + + +int mosquitto__set_state(struct mosquitto *mosq, enum mosquitto_client_state state) +{ + pthread_mutex_lock(&mosq->state_mutex); +#ifdef WITH_BROKER + if(mosq->state != mosq_cs_disused) +#endif + { + mosq->state = state; + } + pthread_mutex_unlock(&mosq->state_mutex); + + return MOSQ_ERR_SUCCESS; +} + +enum mosquitto_client_state mosquitto__get_state(struct mosquitto *mosq) +{ + enum mosquitto_client_state state; + + pthread_mutex_lock(&mosq->state_mutex); + state = mosq->state; + pthread_mutex_unlock(&mosq->state_mutex); + + return state; +} + diff --git a/lib/util_mosq.h b/lib/util_mosq.h index 9ee570f3..a527fd62 100644 --- a/lib/util_mosq.h +++ b/lib/util_mosq.h @@ -33,6 +33,9 @@ int mosquitto__check_keepalive(struct mosquitto *mosq); uint16_t mosquitto__mid_generate(struct mosquitto *mosq); FILE *mosquitto__fopen(const char *path, const char *mode, bool restrict_read); +int mosquitto__set_state(struct mosquitto *mosq, enum mosquitto_client_state state); +enum mosquitto_client_state mosquitto__get_state(struct mosquitto *mosq); + #ifdef WITH_TLS int mosquitto__hex2bin_sha1(const char *hex, unsigned char **bin); int mosquitto__hex2bin(const char *hex, unsigned char *bin, int bin_max_len); diff --git a/lib/util_topic.c b/lib/util_topic.c index 67b78782..673cc6ca 100644 --- a/lib/util_topic.c +++ b/lib/util_topic.c @@ -49,14 +49,25 @@ Contributors: int mosquitto_pub_topic_check(const char *str) { int len = 0; +#ifdef WITH_BROKER + int hier_count = 0; +#endif while(str && str[0]){ if(str[0] == '+' || str[0] == '#'){ return MOSQ_ERR_INVAL; } +#ifdef WITH_BROKER + else if(str[0] == '/'){ + hier_count++; + } +#endif len++; str = &str[1]; } if(len > 65535) return MOSQ_ERR_INVAL; +#ifdef WITH_BROKER + if(hier_count > TOPIC_HIERARCHY_LIMIT) return MOSQ_ERR_INVAL; +#endif return MOSQ_ERR_SUCCESS; } @@ -64,6 +75,9 @@ int mosquitto_pub_topic_check(const char *str) int mosquitto_pub_topic_check2(const char *str, size_t len) { size_t i; +#ifdef WITH_BROKER + int hier_count = 0; +#endif if(len > 65535) return MOSQ_ERR_INVAL; @@ -71,7 +85,15 @@ int mosquitto_pub_topic_check2(const char *str, size_t len) if(str[i] == '+' || str[i] == '#'){ return MOSQ_ERR_INVAL; } +#ifdef WITH_BROKER + else if(str[i] == '/'){ + hier_count++; + } +#endif } +#ifdef WITH_BROKER + if(hier_count > TOPIC_HIERARCHY_LIMIT) return MOSQ_ERR_INVAL; +#endif return MOSQ_ERR_SUCCESS; } @@ -87,6 +109,10 @@ int mosquitto_sub_topic_check(const char *str) { char c = '\0'; int len = 0; +#ifdef WITH_BROKER + int hier_count = 0; +#endif + while(str && str[0]){ if(str[0] == '+'){ if((c != '\0' && c != '/') || (str[1] != '\0' && str[1] != '/')){ @@ -97,11 +123,19 @@ int mosquitto_sub_topic_check(const char *str) return MOSQ_ERR_INVAL; } } +#ifdef WITH_BROKER + else if(str[0] == '/'){ + hier_count++; + } +#endif len++; c = str[0]; str = &str[1]; } if(len > 65535) return MOSQ_ERR_INVAL; +#ifdef WITH_BROKER + if(hier_count > TOPIC_HIERARCHY_LIMIT) return MOSQ_ERR_INVAL; +#endif return MOSQ_ERR_SUCCESS; } @@ -110,6 +144,9 @@ int mosquitto_sub_topic_check2(const char *str, size_t len) { char c = '\0'; size_t i; +#ifdef WITH_BROKER + int hier_count = 0; +#endif if(len > 65535) return MOSQ_ERR_INVAL; @@ -123,8 +160,16 @@ int mosquitto_sub_topic_check2(const char *str, size_t len) return MOSQ_ERR_INVAL; } } +#ifdef WITH_BROKER + else if(str[i] == '/'){ + hier_count++; + } +#endif c = str[i]; } +#ifdef WITH_BROKER + if(hier_count > TOPIC_HIERARCHY_LIMIT) return MOSQ_ERR_INVAL; +#endif return MOSQ_ERR_SUCCESS; } diff --git a/man/mosquitto.conf.5.xml b/man/mosquitto.conf.5.xml index 3cf729be..baed328e 100644 --- a/man/mosquitto.conf.5.xml +++ b/man/mosquitto.conf.5.xml @@ -132,7 +132,7 @@ for the topic keyword, but using pattern as the keyword. pattern [read|write|readwrite] <topic> - + The patterns available for substition are: %c to match the client id of the client @@ -151,6 +151,13 @@ If the first character of a line of the ACL file is a # it is treated as a comment. + If is + true, this option applies to + the current listener being configured only. If + is + false, this option applies + to all listeners. + Reloaded on reload signal. The currently loaded ACLs will be freed and reloaded. Existing subscriptions will be affected after the reload. @@ -171,6 +178,14 @@ username/password or TLS-PSK checks, then defaults to false. + + If is + true, this option applies to + the current listener being configured only. If + is + false, this option applies + to all listeners. + Reloaded on reload signal. @@ -196,17 +211,28 @@ correctly deal with duplicate messages even when then have QoS=2. Defaults to true. + + This option applies globally. + Reloaded on reload signal. [ true | false ] - MQTT 3.1.1 allows clients to connect with a zero + MQTT 3.1.1 and MQTT 5 allow clients to connect with a zero length client id and have the broker generate a client id for them. Use this option to allow/disallow this behaviour. Defaults to true. See also the option. + + If is + true, this option applies to + the current listener being configured only. If + is + false, this option applies + to all listeners. + Reloaded on reload signal. @@ -214,7 +240,9 @@ value Options to be passed to the auth plugin. See the - specific plugin instructions. + specific plugin instructions. + + Applies to the current authentication plugin being configured. @@ -256,6 +284,8 @@ checks delivered to your plugin by setting this option to false. Defaults to true. + + Applies to the current authentication plugin being configured. Not currently reloaded on reload signal. @@ -267,6 +297,14 @@ to set a string that will be prefixed to the automatically generated client ids to aid visibility in logs. Defaults to . + + If is + true, this option applies to + the current listener being configured only. If + is + false, this option applies + to all listeners. + Reloaded on reload signal. @@ -280,6 +318,9 @@ SIGUSR1 signal. Note that this setting only has an effect if persistence is enabled. Defaults to 1800 seconds (30 minutes). + + This option applies globally. + Reloaded on reload signal. @@ -295,6 +336,9 @@ the in-memory database to disk by treating as a time in seconds. + + This option applies globally. + Reloaded on reload signal. @@ -325,6 +369,9 @@ "secure-" here would mean a client "secure-client" could connect but another with clientid "mqtt" couldn't. By default, all client ids are valid. + + This option applies globally. + Reloaded on reload signal. Note that currently connected clients will be unaffected by any changes. @@ -337,6 +384,9 @@ will include entries when clients connect and disconnect. If set to false, these entries will not appear. + + This option applies globally. + Reloaded on reload signal. @@ -501,23 +551,31 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S count - QoS 1 and 2 messages will be allowed in flight until this byte - limit is reached. Defaults to 0. (No limit) - See also the option. - + Outgoing QoS 1 and 2 messages will be allowed in flight until this byte + limit is reached. This allows control of outgoing message rate based on + message size rather than message count. If the limit is set to 100, + messages of over 100 bytes are still allowed, but only a single message + can be in flight at once. Defaults to 0. (No limit). + See also the option. + + This option applies globally. + Reloaded on reload signal. count - The maximum number of QoS 1 or 2 messages that can be + The maximum number of outgoing QoS 1 or 2 messages that can be in the process of being transmitted simultaneously. This includes messages currently going through handshakes and messages that are being retried. Defaults to 20. Set to 0 for no maximum. If set to 1, this will guarantee in-order delivery of messages. + + This option applies globally. + Reloaded on reload signal. @@ -537,6 +595,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S max_keepalive. This only applies to MQTT v5 clients. The maximum value allowable, and default value, is 65535. Do not set below 10 seconds. + + This option applies globally. + Reloaded on reload signal. @@ -556,22 +617,36 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S using, but v3.1.1 and earlier clients will of course not have received the maximum packet size information. Defaults to no limit. + + This option applies to all clients, not just those + using MQTT v5, but it is not possible to notify clients + using MQTT v3.1.1 or MQTT v3.1 of the limit. + Setting below 20 bytes is forbidden because it is likely to interfere with normal client operation even with small payloads. + + This option applies globally. + Reloaded on reload signal. count - QoS 1 and 2 messages above those currently in-flight will be - queued (per client) until this limit is exceeded. - Defaults to 0. (No maximum) See also the + The number of outgoing QoS 1 and 2 messages above those currently in-flight will be + queued (per client) by the broker. Once this limit has been reached, subsequent + messages will be silently dropped. This is an important option if you are sending + messages at a high rate and/or have clients who are slow to respond or may be offline + for extended periods of time. Defaults to 0. (No maximum). + See also the option. If both max_queued_messages and max_queued_bytes are specified, packets will be queued until the first limit is reached. + + This option applies globally. + Reloaded on reload signal. @@ -583,8 +658,10 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S in flight. Defaults to 100. Set to 0 for no maximum (not recommended). See also the and - options. - + options. + + This option applies globally. + Reloaded on reload signal. @@ -611,10 +688,19 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S This option sets the maximum publish payload size that the broker will allow. Received messages that - exceed this size will not be accepted by the broker. - The default value is 0, which means that all valid MQTT + exceed this size will not be accepted by the broker. This means that the + message will not be forwarded on to subscribing clients, but the QoS flow + will be completed for QoS 1 or QoS 2 messages. MQTT v5 clients using QoS 1 + or QoS 2 will receive a PUBACK or PUBREC with the "implementation specific + error" reason code. + + The default value is 0, which means that all valid MQTT messages are accepted. MQTT imposes a maximum payload size of 268435455 bytes. + + This option applies globally. + + Reloaded on reload signal. @@ -638,6 +724,14 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S valid and could be used with acl_file to have e.g. read only guest/anonymous accounts and defined users that can publish. + + If is + true, this option applies to + the current listener being configured only. If + is + false, this option applies + to all listeners. + Reloaded on reload signal. The currently loaded username and password data will be freed and reloaded. Clients that are already connected will not be @@ -693,6 +787,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S copy of the persistence file before installing a new version so that they can roll back to an earlier version if necessary. + + This option applies globally. + Reloaded on reload signal. @@ -701,6 +798,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S The filename to use for the persistent database. Defaults to mosquitto.db. + + This option applies globally. + Reloaded on reload signal. @@ -710,6 +810,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S The path where the persistence database should be stored. Must end in a trailing slash. If not given, then the current directory is used. + + This option applies globally. + Reloaded on reload signal. @@ -735,6 +838,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S As this is a non-standard option, the default if not set is to never expire persistent clients. + + This option applies globally. + Reloaded on reload signal. @@ -765,6 +871,14 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S listener that has PSK support enabled must provide a matching identity and PSK to allow the encrypted connection to proceed. + + If is + true, this option applies to + the current listener being configured only. If + is + false, this option applies + to all listeners. + Reloaded on reload signal. The currently loaded identity and key data will be freed and reloaded. Clients that are already connected will not be @@ -781,6 +895,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S Note that the MQTT v3.1.1 spec states that only QoS 1 and 2 messages should be saved in this situation so this is a non-standard option. + + This option applies globally. + Reloaded on reload signal. @@ -791,6 +908,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S supported. Clients that send a message with the retain bit will be disconnected if this option is set to false. Defaults to true. + + This option applies globally. + Reloaded on reload signal. @@ -810,6 +930,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S has the effect of reducing latency of some messages at potentially increasing the number of TCP packets being sent. Defaults to false. + + This option applies globally. + Reloaded on reload signal. @@ -822,6 +945,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S seconds. Set to 0 to disable publishing the $SYS hierarchy completely. + + This option applies globally. + Reloaded on reload signal. @@ -838,6 +964,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S subscription. This is a non-standard option not provided for by the spec. Defaults to false. + + This option applies globally. + Reloaded on reload signal. @@ -879,8 +1008,14 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S to restrict access to certain network interfaces. To restrict access to mosquitto to the local host only, use "bind_address localhost". This only - applies to the default listener. Use the listener - variable to control other listeners. + applies to the default listener. Use the + option to control other + listeners. + + It is recommended to use an explicit + rather than rely on the + implicit default listener options like this. + Not reloaded on reload signal. @@ -958,7 +1093,7 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S count - Limit the QoS value allowed when using this + Limit the QoS value allowed for clients connecting to this listener. Defaults to 2, which means any QoS can be used. Set to 0 or 1 to limit to those QoS values. This makes use of an MQTT v5 feature to notify @@ -973,9 +1108,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S number This option sets the maximum number topic aliases - that an MQTT v5 client is allowed to create. It + that an MQTT v5 client is allowed to create. This option applies per listener. Defaults to 10. Set to 0 to - disallow topic aliases. + disallow topic aliases. The maximum value possible is 65535. Not reloaded on reload signal. @@ -1001,12 +1136,16 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S Set the network port for the default listener to listen on. Defaults to 1883. Not reloaded on reload signal. + + It is recommended to use an explicit + rather than rely on the + implicit default listener options like this. value - Set the protocol to accept for this listener. Can + Set the protocol to accept for the current listener. Can be , the default, or if available. Websockets support is currently disabled by @@ -1098,7 +1237,7 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S file path At least one of or - must be provided to allow + must be provided to enable SSL support. is used to define the path to a file containing the PEM encoded CA @@ -1109,7 +1248,7 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S directory path At least one of or - must be provided to allow + must be provided to enable SSL support. is used to define a directory that contains PEM encoded CA certificates @@ -1173,11 +1312,11 @@ openssl dhparam -out dhparam.pem 2048 trusted certificate. The overall aim is encryption of the network traffic. By setting to - true, the client must - provide a valid certificate in order for the - network connection to proceed. This allows access - to the broker to be controlled outside of the - mechanisms provided by MQTT. + true, a client connecting + to this listener must provide a valid certificate in + order for the network connection to proceed. This + allows access to the broker to be controlled outside + of the mechanisms provided by MQTT. @@ -1465,7 +1604,7 @@ openssl dhparam -out dhparam.pem 2048 [ true | false ] If set to true, only publish - notification messages to the local broker giving + notification messages to the local broker giving information about the state of the bridge connection. Defaults to false. diff --git a/man/mosquitto_pub.1.xml b/man/mosquitto_pub.1.xml index 2c1a425c..88cd3041 100644 --- a/man/mosquitto_pub.1.xml +++ b/man/mosquitto_pub.1.xml @@ -116,7 +116,7 @@ The options below may be given on the command line, but may also be placed in a config file located at or - with one pair of + with one pair of per line. The values in the config file will be used as defaults and can be overridden by using the command line. The exceptions to @@ -254,9 +254,15 @@ - The id to use for this client. If not given, defaults - to mosquitto_pub_ appended with the process id of the - client. Cannot be used at the same time as the + The id to use for this client. If not given, a client id will + be generated depending on the MQTT version being used. For v3.1.1/v3.1, + the client generates a client id in the format + , where the + are replaced with random alphanumeric + characters. For v5.0, the client sends a zero length client id, and the + server will generate a client id for the client. + + This option cannot be used at the same time as the argument. diff --git a/man/mosquitto_rr.1.xml b/man/mosquitto_rr.1.xml index ae06c126..e204b5ad 100644 --- a/man/mosquitto_rr.1.xml +++ b/man/mosquitto_rr.1.xml @@ -272,9 +272,15 @@ - The id to use for this client. If not given, defaults - to mosquitto_rr_ appended with the process id of the - client. Cannot be used at the same time as the + The id to use for this client. If not given, a client id will + be generated depending on the MQTT version being used. For v3.1.1/v3.1, + the client generates a client id in the format + , where the + are replaced with random alphanumeric + characters. For v5.0, the client sends a zero length client id, and the + server will generate a client id for the client. + + This option cannot be used at the same time as the argument. diff --git a/man/mosquitto_sub.1.xml b/man/mosquitto_sub.1.xml index c7b293dc..01b55398 100644 --- a/man/mosquitto_sub.1.xml +++ b/man/mosquitto_sub.1.xml @@ -295,9 +295,15 @@ - The id to use for this client. If not given, defaults - to mosquitto_sub_ appended with the process id of the - client. Cannot be used at the same time as the + The id to use for this client. If not given, a client id will + be generated depending on the MQTT version being used. For v3.1.1/v3.1, + the client generates a client id in the format + , where the + are replaced with random alphanumeric + characters. For v5.0, the client sends a zero length client id, and the + server will generate a client id for the client. + + This option cannot be used at the same time as the argument. diff --git a/set-version.sh b/set-version.sh index 5fe6c80c..45db2b74 100755 --- a/set-version.sh +++ b/set-version.sh @@ -2,7 +2,7 @@ MAJOR=1 MINOR=6 -REVISION=4 +REVISION=7 sed -i "s/^VERSION=.*/VERSION=${MAJOR}.${MINOR}.${REVISION}/" config.mk diff --git a/snap/snapcraft.yaml b/snap/snapcraft.yaml index 95a4eb1f..8ff6a528 100644 --- a/snap/snapcraft.yaml +++ b/snap/snapcraft.yaml @@ -1,5 +1,5 @@ name: mosquitto -version: 1.6.4 +version: 1.6.7 summary: Eclipse Mosquitto MQTT broker description: This is a message broker that supports version 3.1 and 3.1.1 of the MQTT protocol. diff --git a/src/bridge.c b/src/bridge.c index 1c06de10..1907baae 100644 --- a/src/bridge.c +++ b/src/bridge.c @@ -100,6 +100,8 @@ int bridge__new(struct mosquitto_db *db, struct mosquitto__bridge *bridge) new_context->tls_version = new_context->bridge->tls_version; new_context->tls_insecure = new_context->bridge->tls_insecure; new_context->tls_alpn = new_context->bridge->tls_alpn; + new_context->tls_engine = db->config->default_listener.tls_engine; + new_context->tls_keyform = db->config->default_listener.tls_keyform; #ifdef FINAL_WITH_TLS_PSK new_context->tls_psk_identity = new_context->bridge->tls_psk_identity; new_context->tls_psk = new_context->bridge->tls_psk; @@ -137,7 +139,7 @@ int bridge__connect_step1(struct mosquitto_db *db, struct mosquitto *context) if(!context || !context->bridge) return MOSQ_ERR_INVAL; - context__set_state(context, mosq_cs_new); + mosquitto__set_state(context, mosq_cs_new); context->sock = INVALID_SOCKET; context->last_msg_in = mosquitto_time(); context->next_msg_out = mosquitto_time() + context->bridge->keepalive; @@ -257,7 +259,7 @@ int bridge__connect_step2(struct mosquitto_db *db, struct mosquitto *context) HASH_ADD(hh_sock, db->contexts_by_sock, sock, sizeof(context->sock), context); if(rc == MOSQ_ERR_CONN_PENDING){ - context__set_state(context, mosq_cs_connect_pending); + mosquitto__set_state(context, mosq_cs_connect_pending); } return rc; } @@ -316,7 +318,7 @@ int bridge__connect(struct mosquitto_db *db, struct mosquitto *context) if(!context || !context->bridge) return MOSQ_ERR_INVAL; - context__set_state(context, mosq_cs_new); + mosquitto__set_state(context, mosq_cs_new); context->sock = INVALID_SOCKET; context->last_msg_in = mosquitto_time(); context->next_msg_out = mosquitto_time() + context->bridge->keepalive; @@ -410,7 +412,7 @@ int bridge__connect(struct mosquitto_db *db, struct mosquitto *context) return rc; }else if(rc == MOSQ_ERR_CONN_PENDING){ - context__set_state(context, mosq_cs_connect_pending); + mosquitto__set_state(context, mosq_cs_connect_pending); } HASH_ADD(hh_sock, db->contexts_by_sock, sock, sizeof(context->sock), context); diff --git a/src/context.c b/src/context.c index baa5b097..e8ad57d3 100644 --- a/src/context.c +++ b/src/context.c @@ -25,6 +25,7 @@ Contributors: #include "packet_mosq.h" #include "property_mosq.h" #include "time_mosq.h" +#include "util_mosq.h" #include "will_mosq.h" #include "uthash.h" @@ -38,7 +39,7 @@ struct mosquitto *context__init(struct mosquitto_db *db, mosq_sock_t sock) if(!context) return NULL; context->pollfd_index = -1; - context__set_state(context, mosq_cs_new); + mosquitto__set_state(context, mosq_cs_new); context->sock = sock; context->last_msg_in = mosquitto_time(); context->next_msg_out = mosquitto_time() + 60; @@ -209,14 +210,14 @@ void context__disconnect(struct mosquitto_db *db, struct mosquitto *context) }else{ session_expiry__add(db, context); } - context__set_state(context, mosq_cs_disconnected); + mosquitto__set_state(context, mosq_cs_disconnected); } void context__add_to_disused(struct mosquitto_db *db, struct mosquitto *context) { if(context->state == mosq_cs_disused) return; - context__set_state(context, mosq_cs_disused); + mosquitto__set_state(context, mosq_cs_disused); if(context->id){ context__remove_from_by_id(db, context); @@ -274,10 +275,3 @@ void context__remove_from_by_id(struct mosquitto_db *db, struct mosquitto *conte } } - -void context__set_state(struct mosquitto *context, enum mosquitto_client_state state) -{ - if(context->state != mosq_cs_disused){ - context->state = state; - } -} diff --git a/src/database.c b/src/database.c index 715c1690..dbfc0b0f 100644 --- a/src/database.c +++ b/src/database.c @@ -964,11 +964,11 @@ int db__message_write(struct mosquitto_db *db, struct mosquitto *context) uint32_t expiry_interval; if(!context || context->sock == INVALID_SOCKET - || (context->state == mosq_cs_connected && !context->id)){ + || (context->state == mosq_cs_active && !context->id)){ return MOSQ_ERR_INVAL; } - if(context->state != mosq_cs_connected){ + if(context->state != mosq_cs_active){ return MOSQ_ERR_SUCCESS; } diff --git a/src/handle_auth.c b/src/handle_auth.c index 03bf4771..64baacc9 100644 --- a/src/handle_auth.c +++ b/src/handle_auth.c @@ -25,6 +25,7 @@ Contributors: #include "packet_mosq.h" #include "property_mosq.h" #include "send_mosq.h" +#include "util_mosq.h" #include "will_mosq.h" @@ -54,7 +55,7 @@ int handle__auth(struct mosquitto_db *db, struct mosquitto *context) return MOSQ_ERR_PROTOCOL; } - if((reason_code == MQTT_RC_REAUTHENTICATE && context->state != mosq_cs_connected) + if((reason_code == MQTT_RC_REAUTHENTICATE && context->state != mosq_cs_active) || (reason_code == MQTT_RC_CONTINUE_AUTHENTICATION && context->state != mosq_cs_authenticating && context->state != mosq_cs_reauthenticating)){ @@ -94,11 +95,11 @@ int handle__auth(struct mosquitto_db *db, struct mosquitto *context) if(reason_code == MQTT_RC_REAUTHENTICATE){ /* This is a re-authentication attempt */ - context__set_state(context, mosq_cs_reauthenticating); + mosquitto__set_state(context, mosq_cs_reauthenticating); rc = mosquitto_security_auth_start(db, context, true, auth_data, auth_data_len, &auth_data_out, &auth_data_out_len); }else{ if(context->state != mosq_cs_reauthenticating){ - context__set_state(context, mosq_cs_authenticating); + mosquitto__set_state(context, mosq_cs_authenticating); } rc = mosquitto_security_auth_continue(db, context, auth_data, auth_data_len, &auth_data_out, &auth_data_out_len); } @@ -107,7 +108,7 @@ int handle__auth(struct mosquitto_db *db, struct mosquitto *context) if(context->state == mosq_cs_authenticating){ return connect__on_authorised(db, context, auth_data_out, auth_data_out_len); }else{ - context__set_state(context, mosq_cs_connected); + mosquitto__set_state(context, mosq_cs_active); rc = send__auth(db, context, MQTT_RC_SUCCESS, auth_data_out, auth_data_out_len); free(auth_data_out); return rc; diff --git a/src/handle_connack.c b/src/handle_connack.c index ac08d880..77d98934 100644 --- a/src/handle_connack.c +++ b/src/handle_connack.c @@ -108,7 +108,7 @@ int handle__connack(struct mosquitto_db *db, struct mosquitto *context) } } } - context__set_state(context, mosq_cs_connected); + mosquitto__set_state(context, mosq_cs_active); return MOSQ_ERR_SUCCESS; case CONNACK_REFUSED_PROTOCOL_VERSION: if(context->bridge){ diff --git a/src/handle_connect.c b/src/handle_connect.c index 9de98dd9..17434b2b 100644 --- a/src/handle_connect.c +++ b/src/handle_connect.c @@ -166,7 +166,7 @@ int connect__on_authorised(struct mosquitto_db *db, struct mosquitto *context, v found_context->clean_start = true; found_context->session_expiry_interval = 0; - context__set_state(found_context, mosq_cs_duplicate); + mosquitto__set_state(found_context, mosq_cs_duplicate); do_disconnect(db, found_context, MOSQ_ERR_SUCCESS); } @@ -266,7 +266,7 @@ int connect__on_authorised(struct mosquitto_db *db, struct mosquitto *context, v } free(auth_data_out); - context__set_state(context, mosq_cs_connected); + mosquitto__set_state(context, mosq_cs_active); rc = send__connack(db, context, connect_ack, CONNACK_ACCEPTED, connack_props); mosquitto_property_free_all(&connack_props); return rc; @@ -835,7 +835,7 @@ int handle__connect(struct mosquitto_db *db, struct mosquitto *context) if(rc == MOSQ_ERR_SUCCESS){ return connect__on_authorised(db, context, auth_data_out, auth_data_out_len); }else if(rc == MOSQ_ERR_AUTH_CONTINUE){ - context__set_state(context, mosq_cs_authenticating); + mosquitto__set_state(context, mosq_cs_authenticating); rc = send__auth(db, context, MQTT_RC_CONTINUE_AUTHENTICATION, auth_data_out, auth_data_out_len); free(auth_data_out); return rc; diff --git a/src/handle_disconnect.c b/src/handle_disconnect.c index 72db7dd3..eab7b689 100644 --- a/src/handle_disconnect.c +++ b/src/handle_disconnect.c @@ -21,6 +21,7 @@ Contributors: #include "packet_mosq.h" #include "property_mosq.h" #include "send_mosq.h" +#include "util_mosq.h" #include "will_mosq.h" @@ -34,12 +35,12 @@ int handle__disconnect(struct mosquitto_db *db, struct mosquitto *context) return MOSQ_ERR_INVAL; } - if(context->protocol == mosq_p_mqtt5 && context->in_packet.remaining_length > 1){ + if(context->protocol == mosq_p_mqtt5 && context->in_packet.remaining_length > 0){ /* FIXME - must handle reason code */ rc = packet__read_byte(&context->in_packet, &reason_code); if(rc) return rc; - if(context->in_packet.remaining_length > 2){ + if(context->in_packet.remaining_length > 1){ rc = property__read_all(CMD_DISCONNECT, &context->in_packet, &properties); if(rc) return rc; } @@ -54,7 +55,7 @@ int handle__disconnect(struct mosquitto_db *db, struct mosquitto *context) } mosquitto_property_free_all(&properties); /* FIXME - TEMPORARY UNTIL PROPERTIES PROCESSED */ - if(context->in_packet.remaining_length != 0){ + if(context->in_packet.pos != context->in_packet.remaining_length){ return MOSQ_ERR_PROTOCOL; } log__printf(NULL, MOSQ_LOG_DEBUG, "Received DISCONNECT from %s", context->id); @@ -65,10 +66,10 @@ int handle__disconnect(struct mosquitto_db *db, struct mosquitto *context) } } if(reason_code == MQTT_RC_DISCONNECT_WITH_WILL_MSG){ - context__set_state(context, mosq_cs_disconnect_with_will); + mosquitto__set_state(context, mosq_cs_disconnect_with_will); }else{ will__clear(context); - context__set_state(context, mosq_cs_disconnecting); + mosquitto__set_state(context, mosq_cs_disconnecting); } do_disconnect(db, context, MOSQ_ERR_SUCCESS); return MOSQ_ERR_SUCCESS; diff --git a/src/handle_publish.c b/src/handle_publish.c index 0a250d8c..bc414037 100644 --- a/src/handle_publish.c +++ b/src/handle_publish.c @@ -54,7 +54,7 @@ int handle__publish(struct mosquitto_db *db, struct mosquitto *context) int topic_alias = -1; uint8_t reason_code = 0; - if(context->state != mosq_cs_connected){ + if(context->state != mosq_cs_active){ return MOSQ_ERR_PROTOCOL; } diff --git a/src/handle_subscribe.c b/src/handle_subscribe.c index 2f37ca98..2f3eb305 100644 --- a/src/handle_subscribe.c +++ b/src/handle_subscribe.c @@ -46,7 +46,7 @@ int handle__subscribe(struct mosquitto_db *db, struct mosquitto *context) if(!context) return MOSQ_ERR_INVAL; - if(context->state != mosq_cs_connected){ + if(context->state != mosq_cs_active){ return MOSQ_ERR_PROTOCOL; } diff --git a/src/handle_unsubscribe.c b/src/handle_unsubscribe.c index bbf6dc80..e9f89f8c 100644 --- a/src/handle_unsubscribe.c +++ b/src/handle_unsubscribe.c @@ -39,7 +39,7 @@ int handle__unsubscribe(struct mosquitto_db *db, struct mosquitto *context) if(!context) return MOSQ_ERR_INVAL; - if(context->state != mosq_cs_connected){ + if(context->state != mosq_cs_active){ return MOSQ_ERR_PROTOCOL; } log__printf(NULL, MOSQ_LOG_DEBUG, "Received UNSUBSCRIBE from %s", context->id); diff --git a/src/loop.c b/src/loop.c index 8ce2b70c..19557a2c 100644 --- a/src/loop.c +++ b/src/loop.c @@ -101,6 +101,14 @@ static void temp__expire_websockets_clients(struct mosquitto_db *db) } #endif +#if defined(WITH_WEBSOCKETS) && LWS_LIBRARY_VERSION_NUMBER == 3002000 +void lws__sul_callback(struct lws_sorted_usec_list *l) +{ +} + +static struct lws_sorted_usec_list sul; +#endif + int mosquitto_main_loop(struct mosquitto_db *db, mosq_sock_t *listensock, int listensock_count) { #ifdef WITH_SYS_TREE @@ -129,6 +137,11 @@ int mosquitto_main_loop(struct mosquitto_db *db, mosq_sock_t *listensock, int li time_t expiration_check_time = 0; char *id; + +#if defined(WITH_WEBSOCKETS) && LWS_LIBRARY_VERSION_NUMBER == 3002000 + memset(&sul, 0, sizeof(struct lws_sorted_usec_list)); +#endif + #ifndef WIN32 sigemptyset(&sigblock); sigaddset(&sigblock, SIGINT); @@ -291,7 +304,7 @@ int mosquitto_main_loop(struct mosquitto_db *db, mosq_sock_t *listensock, int li log__printf(NULL, MOSQ_LOG_NOTICE, "Expiring persistent client %s due to timeout.", id); G_CLIENTS_EXPIRED_INC(); context->session_expiry_interval = 0; - context__set_state(context, mosq_cs_expiring); + mosquitto__set_state(context, mosq_cs_expiring); do_disconnect(db, context, MOSQ_ERR_SUCCESS); } } @@ -347,7 +360,18 @@ int mosquitto_main_loop(struct mosquitto_db *db, mosq_sock_t *listensock, int li } #else if(fdcount == -1){ - log__printf(NULL, MOSQ_LOG_ERR, "Error in poll: %s.", strerror(errno)); +# ifdef WIN32 + if(pollfd_index == 0 && WSAGetLastError() == WSAEINVAL){ + /* WSAPoll() immediately returns an error if it is not given + * any sockets to wait on. This can happen if we only have + * websockets listeners. Sleep a little to prevent a busy loop. + */ + Sleep(10); + }else +# endif + { + log__printf(NULL, MOSQ_LOG_ERR, "Error in poll: %s.", strerror(errno)); + } }else{ loop_handle_reads_writes(db, pollfds); @@ -405,7 +429,15 @@ int mosquitto_main_loop(struct mosquitto_db *db, mosq_sock_t *listensock, int li * will soon, so for now websockets clients are second class * citizens. */ if(db->config->listeners[i].ws_context){ +#if LWS_LIBRARY_VERSION_NUMBER > 3002000 + libwebsocket_service(db->config->listeners[i].ws_context, -1); +#elif LWS_LIBRARY_VERSION_NUMBER == 3002000 + lws_sul_schedule(db->config->listeners[i].ws_context, 0, &sul, lws__sul_callback, 10); libwebsocket_service(db->config->listeners[i].ws_context, 0); +#else + libwebsocket_service(db->config->listeners[i].ws_context, 0); +#endif + } } if(db->config->have_websockets_listener){ @@ -443,7 +475,7 @@ void do_disconnect(struct mosquitto_db *db, struct mosquitto *context, int reaso } if(context->state != mosq_cs_disconnecting && context->state != mosq_cs_disconnect_with_will){ - context__set_state(context, mosq_cs_disconnect_ws); + mosquitto__set_state(context, mosq_cs_disconnect_ws); } if(context->wsi){ libwebsocket_callback_on_writable(context->ws_context, context->wsi); @@ -524,6 +556,7 @@ static void loop_handle_reads_writes(struct mosquitto_db *db, struct pollfd *pol #endif int err; socklen_t len; + int rc; #ifdef WITH_EPOLL int i; @@ -582,7 +615,7 @@ static void loop_handle_reads_writes(struct mosquitto_db *db, struct pollfd *pol len = sizeof(int); if(!getsockopt(context->sock, SOL_SOCKET, SO_ERROR, (char *)&err, &len)){ if(err == 0){ - context__set_state(context, mosq_cs_new); + mosquitto__set_state(context, mosq_cs_new); #if defined(WITH_ADNS) && defined(WITH_BRIDGE) if(context->bridge){ bridge__connect_step3(db, context); @@ -595,8 +628,9 @@ static void loop_handle_reads_writes(struct mosquitto_db *db, struct pollfd *pol continue; } } - if(packet__write(context)){ - do_disconnect(db, context, MOSQ_ERR_CONN_LOST); + rc = packet__write(context); + if(rc){ + do_disconnect(db, context, rc); continue; } } @@ -637,8 +671,9 @@ static void loop_handle_reads_writes(struct mosquitto_db *db, struct pollfd *pol #endif #endif do{ - if(packet__read(db, context)){ - do_disconnect(db, context, MOSQ_ERR_CONN_LOST); + rc = packet__read(db, context); + if(rc){ + do_disconnect(db, context, rc); continue; } }while(SSL_DATA_PENDING(context)); diff --git a/src/mosquitto_broker_internal.h b/src/mosquitto_broker_internal.h index 17480782..651cef15 100644 --- a/src/mosquitto_broker_internal.h +++ b/src/mosquitto_broker_internal.h @@ -74,6 +74,9 @@ Contributors: #define WEBSOCKET_CLIENT -2 + +#define TOPIC_HIERARCHY_LIMIT 200 + /* ======================================== * UHPA data types * ======================================== */ @@ -586,6 +589,8 @@ void net__broker_cleanup(void); int net__socket_accept(struct mosquitto_db *db, mosq_sock_t listensock); int net__socket_listen(struct mosquitto__listener *listener); int net__socket_get_address(mosq_sock_t sock, char *buf, int len); +int net__tls_load_verify(struct mosquitto__listener *listener); +int net__tls_server_ctx(struct mosquitto__listener *listener); /* ============================================================ * Read handling functions @@ -652,7 +657,6 @@ void context__add_to_disused(struct mosquitto_db *db, struct mosquitto *context) void context__free_disused(struct mosquitto_db *db); void context__send_will(struct mosquitto_db *db, struct mosquitto *context); void context__remove_from_by_id(struct mosquitto_db *db, struct mosquitto *context); -void context__set_state(struct mosquitto *context, enum mosquitto_client_state state); int connect__on_authorised(struct mosquitto_db *db, struct mosquitto *context, void *auth_data_out, uint16_t auth_data_out_len); diff --git a/src/mosquitto_passwd.c b/src/mosquitto_passwd.c index 00e048fb..41d32adb 100644 --- a/src/mosquitto_passwd.c +++ b/src/mosquitto_passwd.c @@ -223,6 +223,7 @@ int delete_pwuser(FILE *fptr, FILE *ftmp, const char *username) } if(!found){ fprintf(stderr, "Warning: User %s not found in password file.\n", username); + return 1; } return 0; } diff --git a/src/net.c b/src/net.c index 0b57558c..392972f8 100644 --- a/src/net.c +++ b/src/net.c @@ -310,13 +310,17 @@ static unsigned int psk_server_callback(SSL *ssl, const char *identity, unsigned #endif #ifdef WITH_TLS -static int mosquitto__tls_server_ctx(struct mosquitto__listener *listener) +int net__tls_server_ctx(struct mosquitto__listener *listener) { char buf[256]; int rc; FILE *dhparamfile; DH *dhparam = NULL; + if(listener->ssl_ctx){ + SSL_CTX_free(listener->ssl_ctx); + } + #if OPENSSL_VERSION_NUMBER < 0x10100000L listener->ssl_ctx = SSL_CTX_new(SSLv23_server_method()); #else @@ -406,6 +410,147 @@ static int mosquitto__tls_server_ctx(struct mosquitto__listener *listener) } #endif + +int net__load_crl_file(struct mosquitto__listener *listener) +{ +#ifdef WITH_TLS + X509_STORE *store; + X509_LOOKUP *lookup; + int rc; + + store = SSL_CTX_get_cert_store(listener->ssl_ctx); + if(!store){ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to obtain TLS store."); + net__print_error(MOSQ_LOG_ERR, "Error: %s"); + return 1; + } + lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file()); + rc = X509_load_crl_file(lookup, listener->crlfile, X509_FILETYPE_PEM); + if(rc != 1){ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load certificate revocation file \"%s\". Check crlfile.", listener->crlfile); + net__print_error(MOSQ_LOG_ERR, "Error: %s"); + return 1; + } + X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK); +#endif + + return MOSQ_ERR_SUCCESS; +} + + +int net__tls_load_verify(struct mosquitto__listener *listener) +{ +#ifdef WITH_TLS + ENGINE *engine = NULL; + int rc; + + rc = SSL_CTX_load_verify_locations(listener->ssl_ctx, listener->cafile, listener->capath); + if(rc == 0){ + if(listener->cafile && listener->capath){ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load CA certificates. Check cafile \"%s\" and capath \"%s\".", listener->cafile, listener->capath); + }else if(listener->cafile){ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load CA certificates. Check cafile \"%s\".", listener->cafile); + }else{ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load CA certificates. Check capath \"%s\".", listener->capath); + } + net__print_error(MOSQ_LOG_ERR, "Error: %s"); + return 1; + } + if(listener->tls_engine){ +#if !defined(OPENSSL_NO_ENGINE) + engine = ENGINE_by_id(listener->tls_engine); + if(!engine){ + log__printf(NULL, MOSQ_LOG_ERR, "Error loading %s engine\n", listener->tls_engine); + return 1; + } + if(!ENGINE_init(engine)){ + log__printf(NULL, MOSQ_LOG_ERR, "Failed engine initialisation\n"); + ENGINE_free(engine); + return 1; + } + ENGINE_set_default(engine, ENGINE_METHOD_ALL); + ENGINE_free(engine); /* release the structural reference from ENGINE_by_id() */ +#endif + } + /* FIXME user data? */ + if(listener->require_certificate){ + SSL_CTX_set_verify(listener->ssl_ctx, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, client_certificate_verify); + }else{ + SSL_CTX_set_verify(listener->ssl_ctx, SSL_VERIFY_NONE, client_certificate_verify); + } + rc = SSL_CTX_use_certificate_chain_file(listener->ssl_ctx, listener->certfile); + if(rc != 1){ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load server certificate \"%s\". Check certfile.", listener->certfile); + net__print_error(MOSQ_LOG_ERR, "Error: %s"); +#if !defined(OPENSSL_NO_ENGINE) + ENGINE_FINISH(engine); +#endif + return 1; + } + if(listener->tls_engine && listener->tls_keyform == mosq_k_engine){ +#if !defined(OPENSSL_NO_ENGINE) + UI_METHOD *ui_method = net__get_ui_method(); + if(listener->tls_engine_kpass_sha1){ + if(!ENGINE_ctrl_cmd(engine, ENGINE_SECRET_MODE, ENGINE_SECRET_MODE_SHA, NULL, NULL, 0)){ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to set engine secret mode sha"); + ENGINE_FINISH(engine); + return 1; + } + if(!ENGINE_ctrl_cmd(engine, ENGINE_PIN, 0, listener->tls_engine_kpass_sha1, NULL, 0)){ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to set engine pin"); + ENGINE_FINISH(engine); + return 1; + } + ui_method = NULL; + } + EVP_PKEY *pkey = ENGINE_load_private_key(engine, listener->keyfile, ui_method, NULL); + if(!pkey){ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load engine private key file \"%s\".", listener->keyfile); + ENGINE_FINISH(engine); + return 1; + } + if(SSL_CTX_use_PrivateKey(listener->ssl_ctx, pkey) <= 0){ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to use engine private key file \"%s\".", listener->keyfile); + ENGINE_FINISH(engine); + return 1; + } +#endif + }else{ + rc = SSL_CTX_use_PrivateKey_file(listener->ssl_ctx, listener->keyfile, SSL_FILETYPE_PEM); + if(rc != 1){ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load server key file \"%s\". Check keyfile.", listener->keyfile); + net__print_error(MOSQ_LOG_ERR, "Error: %s"); +#if !defined(OPENSSL_NO_ENGINE) + ENGINE_FINISH(engine); +#endif + return 1; + } + } + rc = SSL_CTX_check_private_key(listener->ssl_ctx); + if(rc != 1){ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Server certificate/key are inconsistent."); + net__print_error(MOSQ_LOG_ERR, "Error: %s"); +#if !defined(OPENSSL_NO_ENGINE) + ENGINE_FINISH(engine); +#endif + return 1; + } + /* Load CRLs if they exist. */ + if(listener->crlfile){ + rc = net__load_crl_file(listener); + if(rc){ +#if !defined(OPENSSL_NO_ENGINE) + ENGINE_FINISH(engine); +#endif + return rc; + } + } +#endif + + return MOSQ_ERR_SUCCESS; +} + + /* Creates a socket and listens on port 'port'. * Returns 1 on failure * Returns 0 on success. @@ -422,11 +567,6 @@ int net__socket_listen(struct mosquitto__listener *listener) #else char ss_opt = 1; #endif -#ifdef WITH_TLS - X509_STORE *store; - X509_LOOKUP *lookup; - ENGINE *engine = NULL; -#endif #ifdef SO_BINDTODEVICE struct ifreq ifr; #endif @@ -519,138 +659,15 @@ int net__socket_listen(struct mosquitto__listener *listener) if(listener->sock_count > 0){ #ifdef WITH_TLS if((listener->cafile || listener->capath) && listener->certfile && listener->keyfile){ - if(mosquitto__tls_server_ctx(listener)){ + if(net__tls_server_ctx(listener)){ COMPAT_CLOSE(sock); return 1; } - rc = SSL_CTX_load_verify_locations(listener->ssl_ctx, listener->cafile, listener->capath); - if(rc == 0){ - if(listener->cafile && listener->capath){ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load CA certificates. Check cafile \"%s\" and capath \"%s\".", listener->cafile, listener->capath); - }else if(listener->cafile){ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load CA certificates. Check cafile \"%s\".", listener->cafile); - }else{ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load CA certificates. Check capath \"%s\".", listener->capath); - } - net__print_error(MOSQ_LOG_ERR, "Error: %s"); + if(net__tls_load_verify(listener)){ COMPAT_CLOSE(sock); return 1; } - if(listener->tls_engine){ -#if !defined(OPENSSL_NO_ENGINE) - engine = ENGINE_by_id(listener->tls_engine); - if(!engine){ - log__printf(NULL, MOSQ_LOG_ERR, "Error loading %s engine\n", listener->tls_engine); - COMPAT_CLOSE(sock); - return 1; - } - if(!ENGINE_init(engine)){ - log__printf(NULL, MOSQ_LOG_ERR, "Failed engine initialisation\n"); - ENGINE_free(engine); - COMPAT_CLOSE(sock); - return 1; - } - ENGINE_set_default(engine, ENGINE_METHOD_ALL); - ENGINE_free(engine); /* release the structural reference from ENGINE_by_id() */ -#endif - } - /* FIXME user data? */ - if(listener->require_certificate){ - SSL_CTX_set_verify(listener->ssl_ctx, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, client_certificate_verify); - }else{ - SSL_CTX_set_verify(listener->ssl_ctx, SSL_VERIFY_NONE, client_certificate_verify); - } - rc = SSL_CTX_use_certificate_chain_file(listener->ssl_ctx, listener->certfile); - if(rc != 1){ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load server certificate \"%s\". Check certfile.", listener->certfile); - net__print_error(MOSQ_LOG_ERR, "Error: %s"); - COMPAT_CLOSE(sock); -#if !defined(OPENSSL_NO_ENGINE) - ENGINE_FINISH(engine); -#endif - return 1; - } - if(listener->tls_keyform == mosq_k_engine){ -#if !defined(OPENSSL_NO_ENGINE) - UI_METHOD *ui_method = net__get_ui_method(); - if(listener->tls_engine_kpass_sha1){ - if(!ENGINE_ctrl_cmd(engine, ENGINE_SECRET_MODE, ENGINE_SECRET_MODE_SHA, NULL, NULL, 0)){ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to set engine secret mode sha"); - COMPAT_CLOSE(sock); - ENGINE_FINISH(engine); - return 1; - } - if(!ENGINE_ctrl_cmd(engine, ENGINE_PIN, 0, listener->tls_engine_kpass_sha1, NULL, 0)){ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to set engine pin"); - COMPAT_CLOSE(sock); - ENGINE_FINISH(engine); - return 1; - } - ui_method = NULL; - } - EVP_PKEY *pkey = ENGINE_load_private_key(engine, listener->keyfile, ui_method, NULL); - if(!pkey){ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load engine private key file \"%s\".", listener->keyfile); - COMPAT_CLOSE(sock); - ENGINE_FINISH(engine); - return 1; - } - if(SSL_CTX_use_PrivateKey(listener->ssl_ctx, pkey) <= 0){ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to use engine private key file \"%s\".", listener->keyfile); - COMPAT_CLOSE(sock); - ENGINE_FINISH(engine); - return 1; - } -#endif - }else{ - rc = SSL_CTX_use_PrivateKey_file(listener->ssl_ctx, listener->keyfile, SSL_FILETYPE_PEM); - if(rc != 1){ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load server key file \"%s\". Check keyfile.", listener->keyfile); - net__print_error(MOSQ_LOG_ERR, "Error: %s"); - COMPAT_CLOSE(sock); -#if !defined(OPENSSL_NO_ENGINE) - ENGINE_FINISH(engine); -#endif - return 1; - } - } - rc = SSL_CTX_check_private_key(listener->ssl_ctx); - if(rc != 1){ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Server certificate/key are inconsistent."); - net__print_error(MOSQ_LOG_ERR, "Error: %s"); - COMPAT_CLOSE(sock); -#if !defined(OPENSSL_NO_ENGINE) - ENGINE_FINISH(engine); -#endif - return 1; - } - /* Load CRLs if they exist. */ - if(listener->crlfile){ - store = SSL_CTX_get_cert_store(listener->ssl_ctx); - if(!store){ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to obtain TLS store."); - net__print_error(MOSQ_LOG_ERR, "Error: %s"); - COMPAT_CLOSE(sock); -#if !defined(OPENSSL_NO_ENGINE) - ENGINE_FINISH(engine); -#endif - return 1; - } - lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file()); - rc = X509_load_crl_file(lookup, listener->crlfile, X509_FILETYPE_PEM); - if(rc != 1){ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load certificate revocation file \"%s\". Check crlfile.", listener->crlfile); - net__print_error(MOSQ_LOG_ERR, "Error: %s"); - COMPAT_CLOSE(sock); -#if !defined(OPENSSL_NO_ENGINE) - ENGINE_FINISH(engine); -#endif - return 1; - } - X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK); - } - # ifdef FINAL_WITH_TLS_PSK }else if(listener->psk_hint){ if(tls_ex_index_context == -1){ @@ -660,11 +677,8 @@ int net__socket_listen(struct mosquitto__listener *listener) tls_ex_index_listener = SSL_get_ex_new_index(0, "listener", NULL, NULL, NULL); } - if(mosquitto__tls_server_ctx(listener)){ + if(net__tls_server_ctx(listener)){ COMPAT_CLOSE(sock); -#if !defined(OPENSSL_NO_ENGINE) - ENGINE_FINISH(engine); -#endif return 1; } SSL_CTX_set_psk_server_callback(listener->ssl_ctx, psk_server_callback); @@ -674,9 +688,6 @@ int net__socket_listen(struct mosquitto__listener *listener) log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to set TLS PSK hint."); net__print_error(MOSQ_LOG_ERR, "Error: %s"); COMPAT_CLOSE(sock); -#if !defined(OPENSSL_NO_ENGINE) - ENGINE_FINISH(engine); -#endif return 1; } } diff --git a/src/security_default.c b/src/security_default.c index cf5d81b6..80638bb4 100644 --- a/src/security_default.c +++ b/src/security_default.c @@ -21,6 +21,8 @@ Contributors: #include "mosquitto_broker_internal.h" #include "memory_mosq.h" +#include "mqtt_protocol.h" +#include "send_mosq.h" #include "util_mosq.h" static int aclfile__parse(struct mosquitto_db *db, struct mosquitto__security_options *security_opts); @@ -939,6 +941,18 @@ static int unpwd__cleanup(struct mosquitto__unpwd **root, bool reload) return MOSQ_ERR_SUCCESS; } + +#ifdef WITH_TLS +static void security__disconnect_auth(struct mosquitto_db *db, struct mosquitto *context) +{ + if(context->protocol == mosq_p_mqtt5){ + send__disconnect(context, MQTT_RC_ADMINISTRATIVE_ACTION, NULL); + } + mosquitto__set_state(context, mosq_cs_disconnecting); + do_disconnect(db, context, MOSQ_ERR_AUTH); +} +#endif + /* Apply security settings after a reload. * Includes: * - Disconnecting anonymous users if appropriate @@ -951,10 +965,32 @@ int mosquitto_security_apply_default(struct mosquitto_db *db) struct mosquitto__acl_user *acl_user_tail; bool allow_anonymous; struct mosquitto__security_options *security_opts = NULL; +#ifdef WITH_TLS + int i; + X509 *client_cert = NULL; + X509_NAME *name; + X509_NAME_ENTRY *name_entry; + ASN1_STRING *name_asn1 = NULL; + struct mosquitto__listener *listener; +#endif if(!db) return MOSQ_ERR_INVAL; - +#ifdef WITH_TLS + for(i=0; iconfig->listener_count; i++){ + listener = &db->config->listeners[i]; + if(listener && listener->ssl_ctx && (listener->cafile || listener->capath) && listener->crlfile && listener->require_certificate){ + if(net__tls_server_ctx(listener)){ + return 1; + } + + if(net__tls_load_verify(listener)){ + return 1; + } + } + } +#endif + HASH_ITER(hh_id, db->contexts_by_id, context, ctxt_tmp){ /* Check for anonymous clients when allow_anonymous is false */ if(db->config->per_listener_settings){ @@ -969,23 +1005,133 @@ int mosquitto_security_apply_default(struct mosquitto_db *db) } if(!allow_anonymous && !context->username){ - context__set_state(context, mosq_cs_disconnecting); + mosquitto__set_state(context, mosq_cs_disconnecting); do_disconnect(db, context, MOSQ_ERR_AUTH); continue; } + /* Check for connected clients that are no longer authorised */ - if(mosquitto_unpwd_check(db, context, context->username, context->password) != MOSQ_ERR_SUCCESS){ - context__set_state(context, mosq_cs_disconnecting); - do_disconnect(db, context, MOSQ_ERR_AUTH); - continue; +#ifdef WITH_TLS + if(context->listener && context->listener->ssl_ctx && (context->listener->use_identity_as_username || context->listener->use_subject_as_username)){ + /* Client must have either a valid certificate, or valid PSK used as a username. */ + if(!context->ssl){ + if(context->protocol == mosq_p_mqtt5){ + send__disconnect(context, MQTT_RC_ADMINISTRATIVE_ACTION, NULL); + } + mosquitto__set_state(context, mosq_cs_disconnecting); + do_disconnect(db, context, MOSQ_ERR_AUTH); + continue; + } +#ifdef FINAL_WITH_TLS_PSK + if(context->listener->psk_hint){ + /* Client should have provided an identity to get this far. */ + if(!context->username){ + security__disconnect_auth(db, context); + continue; + } + }else +#endif /* FINAL_WITH_TLS_PSK */ + { + /* Free existing credentials and then recover them. */ + mosquitto__free(context->username); + context->username = NULL; + mosquitto__free(context->password); + context->password = NULL; + + client_cert = SSL_get_peer_certificate(context->ssl); + if(!client_cert){ + security__disconnect_auth(db, context); + continue; + } + name = X509_get_subject_name(client_cert); + if(!name){ + X509_free(client_cert); + client_cert = NULL; + security__disconnect_auth(db, context); + continue; + } + if (context->listener->use_identity_as_username) { //use_identity_as_username + i = X509_NAME_get_index_by_NID(name, NID_commonName, -1); + if(i == -1){ + X509_free(client_cert); + client_cert = NULL; + security__disconnect_auth(db, context); + continue; + } + name_entry = X509_NAME_get_entry(name, i); + if(name_entry){ + name_asn1 = X509_NAME_ENTRY_get_data(name_entry); + if (name_asn1 == NULL) { + X509_free(client_cert); + client_cert = NULL; + security__disconnect_auth(db, context); + continue; + } +#if OPENSSL_VERSION_NUMBER < 0x10100000L + context->username = mosquitto__strdup((char *) ASN1_STRING_data(name_asn1)); +#else + context->username = mosquitto__strdup((char *) ASN1_STRING_get0_data(name_asn1)); +#endif + if(!context->username){ + X509_free(client_cert); + client_cert = NULL; + security__disconnect_auth(db, context); + continue; + } + /* Make sure there isn't an embedded NUL character in the CN */ + if ((size_t)ASN1_STRING_length(name_asn1) != strlen(context->username)) { + X509_free(client_cert); + client_cert = NULL; + security__disconnect_auth(db, context); + continue; + } + } + } else { // use_subject_as_username + BIO *subject_bio = BIO_new(BIO_s_mem()); + X509_NAME_print_ex(subject_bio, X509_get_subject_name(client_cert), 0, XN_FLAG_RFC2253); + char *data_start = NULL; + long name_length = BIO_get_mem_data(subject_bio, &data_start); + char *subject = mosquitto__malloc(sizeof(char)*name_length+1); + if(!subject){ + BIO_free(subject_bio); + X509_free(client_cert); + client_cert = NULL; + security__disconnect_auth(db, context); + continue; + } + memcpy(subject, data_start, name_length); + subject[name_length] = '\0'; + BIO_free(subject_bio); + context->username = subject; + } + if(!context->username){ + X509_free(client_cert); + client_cert = NULL; + security__disconnect_auth(db, context); + continue; + } + X509_free(client_cert); + client_cert = NULL; + } + }else +#endif + { + /* Username/password check only if the identity/subject check not used */ + if(mosquitto_unpwd_check(db, context, context->username, context->password) != MOSQ_ERR_SUCCESS){ + mosquitto__set_state(context, mosq_cs_disconnecting); + do_disconnect(db, context, MOSQ_ERR_AUTH); + continue; + } } + + /* Check for ACLs and apply to user. */ if(db->config->per_listener_settings){ if(context->listener){ security_opts = &context->listener->security_options; }else{ - if(context->state != mosq_cs_connected){ - context__set_state(context, mosq_cs_disconnecting); + if(context->state != mosq_cs_active){ + mosquitto__set_state(context, mosq_cs_disconnecting); do_disconnect(db, context, MOSQ_ERR_AUTH); continue; } diff --git a/src/session_expiry.c b/src/session_expiry.c index 68540a71..e720b703 100644 --- a/src/session_expiry.c +++ b/src/session_expiry.c @@ -79,6 +79,7 @@ void session_expiry__remove_all(struct mosquitto_db *db) session_expiry__remove(context); context->session_expiry_interval = 0; context->will_delay_interval = 0; + will_delay__remove(context); context__disconnect(db, context); } @@ -100,7 +101,11 @@ void session_expiry__check(struct mosquitto_db *db, time_t now) context = item->context; session_expiry__remove(context); + /* Session has now expired, so clear interval */ context->session_expiry_interval = 0; + /* Session has expired, so will delay should be cleared. */ + context->will_delay_interval = 0; + will_delay__remove(context); context__send_will(db, context); context__add_to_disused(db, context); }else{ diff --git a/src/subs.c b/src/subs.c index aae32666..c059874f 100644 --- a/src/subs.c +++ b/src/subs.c @@ -220,6 +220,7 @@ static int sub__topic_tokenise(const char *subtopic, struct sub__token **topics) int start, stop, tlen; int i; char *topic; + int count = 0; assert(subtopic); assert(topics); @@ -242,6 +243,7 @@ static int sub__topic_tokenise(const char *subtopic, struct sub__token **topics) stop = 0; for(i=start; i TOPIC_HIERARCHY_LIMIT){ + /* Set limit on hierarchy levels, to restrict stack usage. */ + goto cleanup; + } + return MOSQ_ERR_SUCCESS; cleanup: diff --git a/src/websockets.c b/src/websockets.c index 8a6d3aa4..8c03a08a 100644 --- a/src/websockets.c +++ b/src/websockets.c @@ -38,6 +38,7 @@ POSSIBILITY OF SUCH DAMAGE. #include "memory_mosq.h" #include "packet_mosq.h" #include "sys_tree.h" +#include "util_mosq.h" #include #include @@ -47,6 +48,12 @@ POSSIBILITY OF SUCH DAMAGE. # include #endif +/* Be careful if changing these, if TX is not bigger than SERV then there can + * be very large write performance penalties. + */ +#define WS_SERV_BUF_SIZE 4096 +#define WS_TX_BUF_SIZE (WS_SERV_BUF_SIZE*2) + extern struct mosquitto_db int_db; #if defined(LWS_LIBRARY_VERSION_NUMBER) @@ -97,7 +104,7 @@ static struct libwebsocket_protocols protocols[] = { #ifdef LWS_LIBRARY_VERSION_NUMBER NULL, /* user v1.4 on */ # if LWS_LIBRARY_VERSION_NUMBER >= 2003000 - 0 /* tx_packet_size v2.3.0 */ + WS_TX_BUF_SIZE /* tx_packet_size v2.3.0 */ # endif #endif }, @@ -115,7 +122,7 @@ static struct libwebsocket_protocols protocols[] = { #ifdef LWS_LIBRARY_VERSION_NUMBER NULL, /* user v1.4 on */ # if LWS_LIBRARY_VERSION_NUMBER >= 2003000 - 0 /* tx_packet_size v2.3.0 */ + WS_TX_BUF_SIZE /* tx_packet_size v2.3.0 */ # endif #endif }, @@ -133,7 +140,7 @@ static struct libwebsocket_protocols protocols[] = { #ifdef LWS_LIBRARY_VERSION_NUMBER NULL, /* user v1.4 on */ # if LWS_LIBRARY_VERSION_NUMBER >= 2003000 - 0 /* tx_packet_size v2.3.0 */ + WS_TX_BUF_SIZE /* tx_packet_size v2.3.0 */ # endif #endif }, @@ -180,7 +187,8 @@ static int callback_mqtt(struct libwebsocket_context *context, struct mosquitto_db *db; struct mosquitto *mosq = NULL; struct mosquitto__packet *packet; - int count, i, j; + size_t txlen; + int count; const struct libwebsocket_protocols *p; struct libws_mqtt_data *u = (struct libws_mqtt_data *)user; size_t pos; @@ -195,16 +203,7 @@ static int callback_mqtt(struct libwebsocket_context *context, mosq = context__init(db, WEBSOCKET_CLIENT); if(mosq){ p = libwebsockets_get_protocol(wsi); - for (i=0; iconfig->listener_count; i++){ - if (db->config->listeners[i].protocol == mp_websockets) { - for (j=0; db->config->listeners[i].ws_protocol[j].name; j++){ - if (p == &db->config->listeners[i].ws_protocol[j]){ - mosq->listener = &db->config->listeners[i]; - mosq->listener->client_count++; - } - } - } - } + mosq->listener = p->user; if(!mosq->listener){ mosquitto__free(mosq); return -1; @@ -296,7 +295,12 @@ static int callback_mqtt(struct libwebsocket_context *context, memmove(&packet->payload[LWS_SEND_BUFFER_PRE_PADDING], packet->payload, packet->packet_length); packet->pos += LWS_SEND_BUFFER_PRE_PADDING; } - count = libwebsocket_write(wsi, &packet->payload[packet->pos], packet->to_process, LWS_WRITE_BINARY); + if(packet->to_process > WS_TX_BUF_SIZE){ + txlen = WS_TX_BUF_SIZE; + }else{ + txlen = packet->to_process; + } + count = libwebsocket_write(wsi, &packet->payload[packet->pos], txlen, LWS_WRITE_BINARY); if(count < 0){ if (mosq->state == mosq_cs_disconnect_ws || mosq->state == mosq_cs_disconnecting){ return -1; @@ -421,7 +425,7 @@ static int callback_mqtt(struct libwebsocket_context *context, if(rc && (mosq->out_packet || mosq->current_out_packet)) { if(mosq->state != mosq_cs_disconnecting){ - context__set_state(mosq, mosq_cs_disconnect_ws); + mosquitto__set_state(mosq, mosq_cs_disconnect_ws); } libwebsocket_callback_on_writable(mosq->ws_context, mosq->wsi); } else if (rc) { @@ -715,6 +719,7 @@ struct libwebsocket_context *mosq_websockets_init(struct mosquitto__listener *li p[i].callback = protocols[i].callback; p[i].per_session_data_size = protocols[i].per_session_data_size; p[i].rx_buffer_size = protocols[i].rx_buffer_size; + p[i].user = listener; } memset(&info, 0, sizeof(info)); @@ -765,6 +770,9 @@ struct libwebsocket_context *mosq_websockets_init(struct mosquitto__listener *li } info.user = user; +#if defined(LWS_LIBRARY_VERSION_NUMBER) && LWS_LIBRARY_VERSION_NUMBER>=2004000 + info.pt_serv_buf_size = WS_SERV_BUF_SIZE; +#endif listener->ws_protocol = p; lws_set_log_level(conf->websockets_log_level, log_wrap); diff --git a/src/will_delay.c b/src/will_delay.c index 4bed7a87..8d2be08a 100644 --- a/src/will_delay.c +++ b/src/will_delay.c @@ -96,6 +96,7 @@ void will_delay__remove(struct mosquitto *mosq) { if(mosq->will_delay_entry != NULL){ DL_DELETE(delay_list, mosq->will_delay_entry); + mosquitto__free(mosq->will_delay_entry); mosq->will_delay_entry = NULL; } } diff --git a/test/broker/01-connect-disconnect-v5.py b/test/broker/01-connect-disconnect-v5.py index 45fa601f..5486fdf6 100755 --- a/test/broker/01-connect-disconnect-v5.py +++ b/test/broker/01-connect-disconnect-v5.py @@ -7,16 +7,32 @@ from mosq_test_helper import * def disco_test(test, disconnect_packet): global rc - sock = mosq_test.do_client_connect(connect_packet, connack_packet, port=port) - sock.send(disconnect_packet) - sock.close() + sock1 = mosq_test.do_client_connect(connect1_packet, connack1_packet, port=port) + mosq_test.do_send_receive(sock1, subscribe1_packet, suback1_packet, "suback1") + + + sock2 = mosq_test.do_client_connect(connect2_packet, connack2_packet, port=port) + sock2.send(disconnect_packet) + sock2.close() + + # If this fails then we probably received the will + mosq_test.do_ping(sock1) + rc -= 1 rc = 4 keepalive = 10 -connect_packet = mosq_test.gen_connect("connect-disconnect-test", proto_ver=5, keepalive=keepalive) -connack_packet = mosq_test.gen_connack(rc=0, proto_ver=5) + +connect1_packet = mosq_test.gen_connect("sub", proto_ver=5, keepalive=keepalive) +connack1_packet = mosq_test.gen_connack(rc=0, proto_ver=5) + +mid = 1 +subscribe1_packet = mosq_test.gen_subscribe(mid, "#", 0, proto_ver=5) +suback1_packet = mosq_test.gen_suback(mid, 0, proto_ver=5) + +connect2_packet = mosq_test.gen_connect("connect-disconnect-test", proto_ver=5, keepalive=keepalive, will_topic="failure", will_payload=b"failure") +connack2_packet = mosq_test.gen_connack(rc=0, proto_ver=5) port = mosq_test.get_port() broker = mosq_test.start_broker(filename=os.path.basename(__file__), port=port) diff --git a/test/broker/02-subscribe-long-topic.py b/test/broker/02-subscribe-long-topic.py new file mode 100755 index 00000000..c2e7a107 --- /dev/null +++ b/test/broker/02-subscribe-long-topic.py @@ -0,0 +1,36 @@ +#!/usr/bin/env python3 + +# Test whether a SUBSCRIBE to a topic with 65535 hierarchy characters fails +# This needs checking with MOSQ_USE_VALGRIND=1 to detect memory failures +# https://github.com/eclipse/mosquitto/issues/1412 + +from mosq_test_helper import * + +rc = 1 +mid = 1 +keepalive = 60 +connect_packet = mosq_test.gen_connect("subscribe-long-test", keepalive=keepalive) +connack_packet = mosq_test.gen_connack(rc=0) + +subscribe_packet = mosq_test.gen_subscribe(mid, "/"*65535, 0) +suback_packet = mosq_test.gen_suback(mid, 0) + +port = mosq_test.get_port() +broker = mosq_test.start_broker(filename=os.path.basename(__file__), port=port) + +try: + sock = mosq_test.do_client_connect(connect_packet, connack_packet, port=port) + mosq_test.do_send_receive(sock, subscribe_packet, b"", "suback") + + rc = 0 + + sock.close() +finally: + broker.terminate() + broker.wait() + (stdo, stde) = broker.communicate() + if rc: + print(stde.decode('utf-8')) + +exit(rc) + diff --git a/test/broker/03-publish-long-topic.py b/test/broker/03-publish-long-topic.py new file mode 100755 index 00000000..f57c33bb --- /dev/null +++ b/test/broker/03-publish-long-topic.py @@ -0,0 +1,37 @@ +#!/usr/bin/env python3 + +# Test whether a PUBLISH to a topic with 65535 hierarchy characters fails +# This needs checking with MOSQ_USE_VALGRIND=1 to detect memory failures +# https://github.com/eclipse/mosquitto/issues/1412 + + +from mosq_test_helper import * + +rc = 1 +mid = 19 +keepalive = 60 +connect_packet = mosq_test.gen_connect("pub-qos1-test", keepalive=keepalive) +connack_packet = mosq_test.gen_connack(rc=0) + +publish_packet = mosq_test.gen_publish("/"*65535, qos=1, mid=mid, payload="message") +puback_packet = mosq_test.gen_puback(mid) + +port = mosq_test.get_port() +broker = mosq_test.start_broker(filename=os.path.basename(__file__), port=port) + +try: + sock = mosq_test.do_client_connect(connect_packet, connack_packet, port=port) + mosq_test.do_send_receive(sock, publish_packet, b"", "puback") + + rc = 0 + + sock.close() +finally: + broker.terminate() + broker.wait() + (stdo, stde) = broker.communicate() + if rc: + print(stde.decode('utf-8')) + +exit(rc) + diff --git a/test/broker/04-retain-check-source-persist-diff-port.py b/test/broker/04-retain-check-source-persist-diff-port.py index aa6fc246..fddeba48 100755 --- a/test/broker/04-retain-check-source-persist-diff-port.py +++ b/test/broker/04-retain-check-source-persist-diff-port.py @@ -3,6 +3,7 @@ # Test for CVE-2018-12546, with the broker being stopped to write the persistence file, plus subscriber on different port. from mosq_test_helper import * +import os.path import signal def write_config(filename, port1, port2, per_listener): @@ -79,6 +80,8 @@ def do_test(per_listener, username): write_acl_2(acl_file, username) broker.terminate() broker.wait() + if os.path.isfile(persistence_file) == False: + raise FileNotFoundError("Persistence file not written") broker = mosq_test.start_broker(filename=os.path.basename(__file__), use_conf=True, port=port1) @@ -94,7 +97,10 @@ def do_test(per_listener, username): broker.wait() os.remove(conf_file) os.remove(acl_file) - os.remove(persistence_file) + try: + os.remove(persistence_file) + except FileNotFoundError: + pass (stdo, stde) = broker.communicate() if rc: print(stde.decode('utf-8')) diff --git a/test/broker/07-will-delay-session-expiry.py b/test/broker/07-will-delay-session-expiry.py new file mode 100755 index 00000000..833c84cc --- /dev/null +++ b/test/broker/07-will-delay-session-expiry.py @@ -0,0 +1,52 @@ +#!/usr/bin/env python3 + +# Test whether a client that connects with a will delay that is longer than +# their session expiry interval has their will published. +# MQTT 5 +# https://github.com/eclipse/mosquitto/issues/1401 + +from mosq_test_helper import * + +rc = 1 +keepalive = 60 + +mid = 1 +connect1_packet = mosq_test.gen_connect("will-test", keepalive=keepalive, proto_ver=5) +connack1_packet = mosq_test.gen_connack(rc=0, proto_ver=5) + +will_props = mqtt5_props.gen_uint32_prop(mqtt5_props.PROP_WILL_DELAY_INTERVAL, 4) +connect_props = mqtt5_props.gen_uint32_prop(mqtt5_props.PROP_SESSION_EXPIRY_INTERVAL, 2) + +connect2_packet = mosq_test.gen_connect("will-helper", keepalive=keepalive, proto_ver=5, properties=connect_props, will_topic="will/test", will_payload=b"will delay", will_qos=2, will_properties=will_props) +connack2_packet = mosq_test.gen_connack(rc=0, proto_ver=5) + +subscribe_packet = mosq_test.gen_subscribe(mid, "will/test", 0, proto_ver=5) +suback_packet = mosq_test.gen_suback(mid, 0, proto_ver=5) + +publish_packet = mosq_test.gen_publish("will/test", qos=0, payload="will delay", proto_ver=5) + +port = mosq_test.get_port() +broker = mosq_test.start_broker(filename=os.path.basename(__file__), port=port) + +try: + sock1 = mosq_test.do_client_connect(connect1_packet, connack1_packet, timeout=30, port=port, connack_error="connack1") + mosq_test.do_send_receive(sock1, subscribe_packet, suback_packet, "suback") + + sock2 = mosq_test.do_client_connect(connect2_packet, connack2_packet, timeout=30, port=port, connack_error="connack2") + time.sleep(1) + sock2.close() + + # Wait for session to expire + time.sleep(3) + if mosq_test.expect_packet(sock1, "publish", publish_packet): + rc = 0 + + sock1.close() +finally: + broker.terminate() + broker.wait() + (stdo, stde) = broker.communicate() + if rc: + print(stde.decode('utf-8')) + exit(rc) + diff --git a/test/broker/07-will-delay-session-expiry2.py b/test/broker/07-will-delay-session-expiry2.py new file mode 100755 index 00000000..506dac01 --- /dev/null +++ b/test/broker/07-will-delay-session-expiry2.py @@ -0,0 +1,52 @@ +#!/usr/bin/env python3 + +# Test whether a client that connects with a will delay that is shorter than +# their session expiry interval has their will published. +# MQTT 5 +# https://github.com/eclipse/mosquitto/issues/1401 + +from mosq_test_helper import * + +rc = 1 +keepalive = 60 + +mid = 1 +connect1_packet = mosq_test.gen_connect("will-test", keepalive=keepalive, proto_ver=5) +connack1_packet = mosq_test.gen_connack(rc=0, proto_ver=5) + +will_props = mqtt5_props.gen_uint32_prop(mqtt5_props.PROP_WILL_DELAY_INTERVAL, 2) +connect_props = mqtt5_props.gen_uint32_prop(mqtt5_props.PROP_SESSION_EXPIRY_INTERVAL, 4) + +connect2_packet = mosq_test.gen_connect("will-helper", keepalive=keepalive, proto_ver=5, properties=connect_props, will_topic="will/test", will_payload=b"will delay", will_qos=2, will_properties=will_props) +connack2_packet = mosq_test.gen_connack(rc=0, proto_ver=5) + +subscribe_packet = mosq_test.gen_subscribe(mid, "will/test", 0, proto_ver=5) +suback_packet = mosq_test.gen_suback(mid, 0, proto_ver=5) + +publish_packet = mosq_test.gen_publish("will/test", qos=0, payload="will delay", proto_ver=5) + +port = mosq_test.get_port() +broker = mosq_test.start_broker(filename=os.path.basename(__file__), port=port) + +try: + sock1 = mosq_test.do_client_connect(connect1_packet, connack1_packet, timeout=30, port=port, connack_error="connack1") + mosq_test.do_send_receive(sock1, subscribe_packet, suback_packet, "suback") + + sock2 = mosq_test.do_client_connect(connect2_packet, connack2_packet, timeout=30, port=port, connack_error="connack2") + time.sleep(1) + sock2.close() + + # Wait for session to expire + time.sleep(3) + if mosq_test.expect_packet(sock1, "publish", publish_packet): + rc = 0 + + sock1.close() +finally: + broker.terminate() + broker.wait() + (stdo, stde) = broker.communicate() + if rc: + print(stde.decode('utf-8')) + exit(rc) + diff --git a/test/broker/08-ssl-connect-cert-auth-expired.py b/test/broker/08-ssl-connect-cert-auth-expired.py index a7de9dd0..6f3546c0 100755 --- a/test/broker/08-ssl-connect-cert-auth-expired.py +++ b/test/broker/08-ssl-connect-cert-auth-expired.py @@ -31,7 +31,7 @@ broker = mosq_test.start_broker(filename=os.path.basename(__file__), port=port2, try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) - ssock = ssl.wrap_socket(sock, ca_certs="../ssl/test-root-ca.crt", certfile="../ssl/client-expired.crt", keyfile="../ssl/client.key", cert_reqs=ssl.CERT_REQUIRED) + ssock = ssl.wrap_socket(sock, ca_certs="../ssl/test-root-ca.crt", certfile="../ssl/client-expired.crt", keyfile="../ssl/client-expired.key", cert_reqs=ssl.CERT_REQUIRED) ssock.settimeout(20) try: ssock.connect(("localhost", port1)) diff --git a/test/broker/08-ssl-hup-disconnect.py b/test/broker/08-ssl-hup-disconnect.py new file mode 100755 index 00000000..bd591823 --- /dev/null +++ b/test/broker/08-ssl-hup-disconnect.py @@ -0,0 +1,72 @@ +#!/usr/bin/env python3 + +# Test whether a client connected with a client certificate when +# use_identity_as_username is true is then disconnected when a SIGHUP is +# received. +# https://github.com/eclipse/mosquitto/issues/1402 + +from mosq_test_helper import * +import signal + +if sys.version < '2.7': + print("WARNING: SSL not supported on Python 2.6") + exit(0) + +def write_config(filename, pw_file, port, option): + with open(filename, 'w') as f: + f.write("listener %d\n" % (port)) + f.write("cafile ../ssl/all-ca.crt\n") + f.write("certfile ../ssl/server.crt\n") + f.write("keyfile ../ssl/server.key\n") + f.write("require_certificate true\n") + f.write("%s true\n" % (option)) + f.write("password_file %s\n" % (pw_file)) + +def write_pwfile(filename): + with open(filename, 'w') as f: + # Username "test client", password test + f.write('test client:$6$njERlZMi/7DzNB9E$iiavfuXvUm8iyDZArTy7smTxh07GXXOrOsqxfW6gkOYVXHGk+W+i/8d3xDxrMwEPygEBhoA8A/gjQC0N2M4Lkw==\n') + +def do_test(option): + port = mosq_test.get_port() + conf_file = os.path.basename(__file__).replace('.py', '.conf') + pw_file = os.path.basename(__file__).replace('.py', '.pwfile') + write_config(conf_file, pw_file, port, option) + write_pwfile(pw_file) + + rc = 1 + keepalive = 10 + connect_packet = mosq_test.gen_connect("connect-success-test", keepalive=keepalive) + connack_packet = mosq_test.gen_connack(rc=0) + + broker = mosq_test.start_broker(filename=os.path.basename(__file__), port=port, use_conf=True) + + try: + sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + ssock = ssl.wrap_socket(sock, ca_certs="../ssl/test-root-ca.crt", certfile="../ssl/client.crt", keyfile="../ssl/client.key", cert_reqs=ssl.CERT_REQUIRED) + ssock.settimeout(20) + ssock.connect(("localhost", port)) + mosq_test.do_send_receive(ssock, connect_packet, connack_packet, "connack") + + broker.send_signal(signal.SIGHUP) + time.sleep(1) + + # This will fail if we've been disconnected + mosq_test.do_ping(ssock) + rc = 0 + + ssock.close() + finally: + os.remove(conf_file) + os.remove(pw_file) + broker.terminate() + broker.wait() + (stdo, stde) = broker.communicate() + if rc: + print(stde.decode('utf-8')) + exit(rc) + +do_test("use_identity_as_username") +do_test("use_subject_as_username") +exit(0) + diff --git a/test/broker/09-extended-auth-change-username.py b/test/broker/09-extended-auth-change-username.py index 89b4a823..b692a09c 100755 --- a/test/broker/09-extended-auth-change-username.py +++ b/test/broker/09-extended-auth-change-username.py @@ -1,4 +1,4 @@ -#!/usr/bin/env python +#!/usr/bin/env python3 # Check whether an extended auth plugin can change the username of a client. diff --git a/test/broker/09-extended-auth-multistep-reauth.py b/test/broker/09-extended-auth-multistep-reauth.py index 0f3ae978..e435f09f 100755 --- a/test/broker/09-extended-auth-multistep-reauth.py +++ b/test/broker/09-extended-auth-multistep-reauth.py @@ -1,4 +1,4 @@ -#!/usr/bin/env python +#!/usr/bin/env python3 from mosq_test_helper import * diff --git a/test/broker/09-extended-auth-multistep.py b/test/broker/09-extended-auth-multistep.py index 4414e818..d0916e6d 100755 --- a/test/broker/09-extended-auth-multistep.py +++ b/test/broker/09-extended-auth-multistep.py @@ -1,4 +1,4 @@ -#!/usr/bin/env python +#!/usr/bin/env python3 from mosq_test_helper import * diff --git a/test/broker/09-extended-auth-single.py b/test/broker/09-extended-auth-single.py index 2b7ba340..c7250158 100755 --- a/test/broker/09-extended-auth-single.py +++ b/test/broker/09-extended-auth-single.py @@ -1,4 +1,4 @@ -#!/usr/bin/env python +#!/usr/bin/env python3 # Multi tests for extended auth with a single step. # * Error in plugin diff --git a/test/broker/09-extended-auth-single2.py b/test/broker/09-extended-auth-single2.py index d86f9177..35da0432 100755 --- a/test/broker/09-extended-auth-single2.py +++ b/test/broker/09-extended-auth-single2.py @@ -1,4 +1,4 @@ -#!/usr/bin/env python +#!/usr/bin/env python3 # Multi tests for extended auth with a single step - multiple plugins at once. # * Error in plugin diff --git a/test/broker/09-extended-auth-unsupported.py b/test/broker/09-extended-auth-unsupported.py index 762d492f..4f365b5b 100755 --- a/test/broker/09-extended-auth-unsupported.py +++ b/test/broker/09-extended-auth-unsupported.py @@ -1,4 +1,4 @@ -#!/usr/bin/env python +#!/usr/bin/env python3 # Test whether an unsupported extended auth is rejected. diff --git a/test/broker/11-message-expiry.py b/test/broker/11-message-expiry.py index d7b107c5..253b7ddb 100755 --- a/test/broker/11-message-expiry.py +++ b/test/broker/11-message-expiry.py @@ -39,7 +39,7 @@ helper_connect = mosq_test.gen_connect("helper", proto_ver=5) helper_connack = mosq_test.gen_connack(rc=0, proto_ver=5) mid=1 -props = mqtt5_props.gen_uint32_prop(mqtt5_props.PROP_MESSAGE_EXPIRY_INTERVAL, 1) +props = mqtt5_props.gen_uint32_prop(mqtt5_props.PROP_MESSAGE_EXPIRY_INTERVAL, 5) publish1s_packet = mosq_test.gen_publish("subpub/qos1", mid=mid, qos=1, payload="message1", proto_ver=5, properties=props) puback1s_packet = mosq_test.gen_puback(mid) @@ -75,10 +75,7 @@ try: sock.close() broker = mosq_test.start_broker(filename=os.path.basename(__file__), use_conf=True, port=port) - if os.environ.get('TRAVIS') is not None: - time.sleep(5) - else: - time.sleep(2) + time.sleep(7) sock = mosq_test.do_client_connect(connect_packet, connack2_packet, timeout=20, port=port) packet = sock.recv(len(publish2s_packet)) diff --git a/test/broker/Makefile b/test/broker/Makefile index 8da4d7fa..e4c32c63 100644 --- a/test/broker/Makefile +++ b/test/broker/Makefile @@ -75,6 +75,7 @@ endif ./02-subpub-qos2.py ./02-subscribe-dollar-v5.py ./02-subscribe-invalid-utf8.py + ./02-subscribe-long-topic.py ./02-subscribe-persistence-flipflop.py ./02-subscribe-qos0.py ./02-subscribe-qos1.py @@ -99,6 +100,7 @@ endif ./03-publish-dollar-v5.py ./03-publish-dollar.py ./03-publish-invalid-utf8.py + ./03-publish-long-topic.py ./03-publish-qos1-no-subscribers-v5.py ./03-publish-qos1-retain-disabled.py ./03-publish-qos1.py @@ -138,6 +140,8 @@ endif 07 : ./07-will-delay-reconnect.py ./07-will-delay-recover.py + ./07-will-delay-session-expiry.py + ./07-will-delay-session-expiry2.py ./07-will-delay.py ./07-will-disconnect-with-will.py ./07-will-invalid-utf8.py @@ -160,6 +164,7 @@ ifeq ($(WITH_TLS),yes) ./08-ssl-connect-no-auth-wrong-ca.py ./08-ssl-connect-no-auth.py ./08-ssl-connect-no-identity.py + ./08-ssl-hup-disconnect.py ifeq ($(WITH_TLS_PSK),yes) ./08-tls-psk-pub.py ./08-tls-psk-bridge.py diff --git a/test/broker/test.py b/test/broker/test.py index afaa5388..7a2f9f66 100755 --- a/test/broker/test.py +++ b/test/broker/test.py @@ -54,6 +54,7 @@ tests = [ (1, './02-subpub-qos2.py'), (1, './02-subscribe-dollar-v5.py'), (1, './02-subscribe-invalid-utf8.py'), + (1, './02-subscribe-long-topic.py'), (1, './02-subscribe-persistence-flipflop.py'), (1, './02-subscribe-qos0.py'), (1, './02-subscribe-qos1.py'), @@ -77,6 +78,7 @@ tests = [ (1, './03-publish-dollar-v5.py'), (1, './03-publish-dollar.py'), (1, './03-publish-invalid-utf8.py'), + (1, './03-publish-long-topic.py'), (1, './03-publish-qos1-no-subscribers-v5.py'), (1, './03-publish-qos1-retain-disabled.py'), (1, './03-publish-qos1.py'), @@ -112,6 +114,8 @@ tests = [ (1, './07-will-delay-reconnect.py'), (1, './07-will-delay-recover.py'), + (1, './07-will-delay-session-expiry.py'), + (1, './07-will-delay-session-expiry2.py'), (1, './07-will-delay.py'), (1, './07-will-disconnect-with-will.py'), (1, './07-will-invalid-utf8.py'), @@ -132,6 +136,7 @@ tests = [ (2, './08-ssl-connect-no-auth-wrong-ca.py'), (2, './08-ssl-connect-no-auth.py'), (2, './08-ssl-connect-no-identity.py'), + (1, './08-ssl-hup-disconnect.py'), (2, './08-tls-psk-pub.py'), (3, './08-tls-psk-bridge.py'), diff --git a/test/lib/Makefile b/test/lib/Makefile index 180e660d..e02cc5c0 100644 --- a/test/lib/Makefile +++ b/test/lib/Makefile @@ -32,6 +32,8 @@ c : test-compile ./01-will-unpwd-set.py $@/01-will-unpwd-set.test ./02-subscribe-qos0.py $@/02-subscribe-qos0.test ./02-subscribe-qos1.py $@/02-subscribe-qos1.test + ./02-subscribe-qos1.py $@/02-subscribe-qos1-async1.test + ./02-subscribe-qos1.py $@/02-subscribe-qos1-async2.test ./02-subscribe-qos2.py $@/02-subscribe-qos2.test ./02-unsubscribe-multiple-v5.py $@/02-unsubscribe-multiple-v5.test ./02-unsubscribe-v5.py $@/02-unsubscribe-v5.test diff --git a/test/lib/c/02-subscribe-qos1-async1.c b/test/lib/c/02-subscribe-qos1-async1.c new file mode 100644 index 00000000..381dbd12 --- /dev/null +++ b/test/lib/c/02-subscribe-qos1-async1.c @@ -0,0 +1,78 @@ +#include +#include +#include +#include +#include + +/* mosquitto_connect_async() test, with mosquitto_loop_start() called before mosquitto_connect_async(). */ + +static int run = -1; +static bool should_run = true; + +void on_connect(struct mosquitto *mosq, void *obj, int rc) +{ + if(rc){ + exit(1); + }else{ + mosquitto_subscribe(mosq, NULL, "qos1/test", 1); + } +} + +void on_disconnect(struct mosquitto *mosq, void *obj, int rc) +{ + run = rc; +} + +void on_subscribe(struct mosquitto *mosq, void *obj, int mid, int qos_count, const int *granted_qos) +{ + //mosquitto_disconnect(mosq); + should_run = false; +} + +int main(int argc, char *argv[]) +{ + int rc; + struct mosquitto *mosq; + + int port = atoi(argv[1]); + + mosquitto_lib_init(); + + mosq = mosquitto_new("subscribe-qos1-test", true, NULL); + mosquitto_connect_callback_set(mosq, on_connect); + mosquitto_disconnect_callback_set(mosq, on_disconnect); + mosquitto_subscribe_callback_set(mosq, on_subscribe); + printf("ok, about to call connect_async\n"); + + // this only works if loop_start is first. with loop_start second, + // it fails on both 1.6.4 _and_ 1.6.5 + // in this order, 1.6.4 works and 1.6.5 fails. + rc = mosquitto_loop_start(mosq); + printf("loop_start returned rc: %d\n", rc); + if (rc) { + printf("which is: %s\n", mosquitto_strerror(rc)); + } + + // not sure which rc you want to be returned.... + rc = mosquitto_connect_async(mosq, "localhost", port, 60); + printf("connect async returned rc: %d\n", rc); + if (rc) { + printf("which is: %s\n", mosquitto_strerror(rc)); + } + + printf("ok, so we can start just waiting now, loop_start will run in it's thread\n"); + /* 10 millis to be system polite */ + //struct timespec tv = { 0, 10e6 }; + struct timespec tv = { 1, 0 }; + while(should_run){ + nanosleep(&tv, NULL); + printf("...waiting...\n"); + } + printf("Already exited should_run....\n"); + + mosquitto_disconnect(mosq); + mosquitto_loop_stop(mosq, false); + + mosquitto_lib_cleanup(); + return run; +} diff --git a/test/lib/c/02-subscribe-qos1-async2.c b/test/lib/c/02-subscribe-qos1-async2.c new file mode 100644 index 00000000..ffcfaff9 --- /dev/null +++ b/test/lib/c/02-subscribe-qos1-async2.c @@ -0,0 +1,74 @@ +#include +#include +#include +#include +#include + +/* mosquitto_connect_async() test, with mosquitto_loop_start() called after mosquitto_connect_async(). */ + +static int run = -1; +static bool should_run = true; + +void on_connect(struct mosquitto *mosq, void *obj, int rc) +{ + if(rc){ + exit(1); + }else{ + mosquitto_subscribe(mosq, NULL, "qos1/test", 1); + } +} + +void on_disconnect(struct mosquitto *mosq, void *obj, int rc) +{ + run = rc; +} + +void on_subscribe(struct mosquitto *mosq, void *obj, int mid, int qos_count, const int *granted_qos) +{ + //mosquitto_disconnect(mosq); + should_run = false; +} + +int main(int argc, char *argv[]) +{ + int rc; + struct mosquitto *mosq; + + int port = atoi(argv[1]); + + mosquitto_lib_init(); + + mosq = mosquitto_new("subscribe-qos1-test", true, NULL); + mosquitto_connect_callback_set(mosq, on_connect); + mosquitto_disconnect_callback_set(mosq, on_disconnect); + mosquitto_subscribe_callback_set(mosq, on_subscribe); + printf("ok, about to call connect_async\n"); + + rc = mosquitto_connect_async(mosq, "localhost", port, 60); + printf("connect async returned rc: %d\n", rc); + if (rc) { + printf("which is: %s\n", mosquitto_strerror(rc)); + } + + rc = mosquitto_loop_start(mosq); + printf("loop_start returned rc: %d\n", rc); + if (rc) { + printf("which is: %s\n", mosquitto_strerror(rc)); + } + + printf("ok, so we can start just waiting now, loop_start will run in it's thread\n"); + /* 10 millis to be system polite */ + //struct timespec tv = { 0, 10e6 }; + struct timespec tv = { 1, 0 }; + while(should_run){ + nanosleep(&tv, NULL); + printf("...waiting...\n"); + } + printf("Already exited should_run....\n"); + + mosquitto_disconnect(mosq); + mosquitto_loop_stop(mosq, false); + + mosquitto_lib_cleanup(); + return run; +} diff --git a/test/lib/c/Makefile b/test/lib/c/Makefile index 4eed7da0..b42a768f 100644 --- a/test/lib/c/Makefile +++ b/test/lib/c/Makefile @@ -13,6 +13,8 @@ SRC = \ 01-server-keepalive-pingreq.c \ 02-subscribe-qos0.c \ 02-subscribe-qos1.c \ + 02-subscribe-qos1-async1.c \ + 02-subscribe-qos1-async2.c \ 02-subscribe-qos2.c \ 02-unsubscribe.c \ 02-unsubscribe-v5.c \ diff --git a/test/lib/test.py b/test/lib/test.py index 2bc84643..d61b01c0 100755 --- a/test/lib/test.py +++ b/test/lib/test.py @@ -14,6 +14,8 @@ tests = [ (1, ['./02-subscribe-qos0.py', 'c/02-subscribe-qos0.test']), (1, ['./02-subscribe-qos1.py', 'c/02-subscribe-qos1.test']), + (1, ['./02-subscribe-qos1.py', 'c/02-subscribe-qos1-async1.test']), + (1, ['./02-subscribe-qos1.py', 'c/02-subscribe-qos1-async2.test']), (1, ['./02-subscribe-qos2.py', 'c/02-subscribe-qos2.test']), (1, ['./02-unsubscribe-multiple-v5.py', 'c/02-unsubscribe-multiple-v5.test']), (1, ['./02-unsubscribe-v5.py', 'c/02-unsubscribe-v5.test']), diff --git a/test/mosq_test.py b/test/mosq_test.py index 2093e326..1669f566 100644 --- a/test/mosq_test.py +++ b/test/mosq_test.py @@ -478,19 +478,25 @@ def gen_pubrel(mid, dup=False, proto_ver=4, reason_code=-1, properties=None): def gen_pubcomp(mid, proto_ver=4, reason_code=-1, properties=None): return _gen_command_with_mid(112, mid, proto_ver, reason_code, properties) + def gen_subscribe(mid, topic, qos, proto_ver=4, properties=b""): topic = topic.encode("utf-8") + packet = struct.pack("!B", 130) if proto_ver == 5: if properties == b"": - pack_format = "!BBHBH"+str(len(topic))+"sB" - return struct.pack(pack_format, 130, 2+1+2+len(topic)+1, mid, 0, len(topic), topic, qos) + packet += pack_remaining_length(2+1+2+len(topic)+1) + pack_format = "!HBH"+str(len(topic))+"sB" + return packet + struct.pack(pack_format, mid, 0, len(topic), topic, qos) else: properties = mqtt5_props.prop_finalise(properties) - pack_format = "!BBH"+str(len(properties))+"s"+"H"+str(len(topic))+"sB" - return struct.pack(pack_format, 130, 2+1+2+len(topic)+len(properties), mid, properties, len(topic), topic, qos) + packet += pack_remaining_length(2+1+2+len(topic)+len(properties)) + pack_format = "!H"+str(len(properties))+"s"+"H"+str(len(topic))+"sB" + return packet + struct.pack(pack_format, mid, properties, len(topic), topic, qos) else: - pack_format = "!BBHH"+str(len(topic))+"sB" - return struct.pack(pack_format, 130, 2+2+len(topic)+1, mid, len(topic), topic, qos) + packet += pack_remaining_length(2+2+len(topic)+1) + pack_format = "!HH"+str(len(topic))+"sB" + return packet + struct.pack(pack_format, mid, len(topic), topic, qos) + def gen_suback(mid, qos, proto_ver=4): if proto_ver == 5: diff --git a/test/ssl/all-ca.crt b/test/ssl/all-ca.crt index 8ca6f20f..a27b07b0 100644 --- a/test/ssl/all-ca.crt +++ b/test/ssl/all-ca.crt @@ -2,74 +2,74 @@ Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) - Signature Algorithm: sha256WithRSAEncryption + Signature Algorithm: sha256WithRSAEncryption Issuer: C=GB, ST=Derbyshire, L=Derby, O=Mosquitto Project, OU=Testing, CN=Root CA Validity - Not Before: Sep 18 10:49:47 2018 GMT - Not After : Sep 17 10:49:47 2023 GMT + Not Before: Sep 10 09:33:42 2019 GMT + Not After : Sep 8 09:33:42 2024 GMT Subject: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Signing CA Subject Public Key Info: Public Key Algorithm: rsaEncryption - Public-Key: (1024 bit) + RSA Public-Key: (1024 bit) Modulus: - 00:b7:32:f2:08:04:4c:77:03:70:3e:10:88:84:cd: - cd:f2:87:2f:3c:67:8f:78:01:5e:d5:51:f1:11:68: - 4d:a7:e2:73:b0:69:b5:67:07:59:88:cc:b8:7f:ce: - 97:52:bc:fb:73:7b:60:95:a2:7b:c2:9a:f1:4d:5a: - c4:42:55:c4:6e:02:50:a1:71:41:68:d1:6c:96:e0: - 3d:af:10:3f:7b:64:c1:3a:3a:c3:a9:39:71:08:29: - 45:c8:cc:da:33:65:b4:70:fb:36:bc:15:0d:a7:31: - ef:d5:ec:59:ac:75:2b:77:35:0b:f0:db:3d:14:f5: - 9a:41:e6:a0:b7:b7:62:2b:e7 + 00:e3:39:bc:07:48:ed:c3:d2:3e:4f:a0:61:9a:2b: + e9:46:7a:68:33:52:01:1b:7f:45:88:49:05:85:fd: + 30:8c:2e:60:17:77:b3:38:c3:06:7c:fc:87:a8:61: + 29:03:86:07:20:8f:f8:d2:f0:bb:66:93:33:91:37: + ed:f6:64:b7:46:a5:f6:7d:f7:94:98:52:bc:78:90: + 6d:0b:db:61:c6:00:23:79:c2:a6:3b:2b:ee:c7:3d: + 96:97:9b:4e:eb:78:56:95:52:13:d4:5f:ea:18:85: + 18:0a:d6:d9:cd:4b:b0:15:ef:2f:f0:27:ef:b1:af: + d2:4f:ca:b8:93:c1:2f:2e:4f Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: - EE:60:BB:C7:17:5F:D3:72:AC:33:EE:8E:84:CC:2D:DB:1A:CC:8A:52 + EA:BE:42:EF:98:17:84:D5:FC:28:89:5A:4B:A5:B6:41:4F:7B:BB:28 X509v3 Authority Key Identifier: - keyid:DA:20:AB:E0:98:22:39:28:E0:70:D6:74:65:53:26:E0:6B:4C:96:39 + keyid:CF:F3:9D:BB:BF:2B:14:D5:A2:E5:EC:41:CF:9C:16:D0:4D:AB:84:04 X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha256WithRSAEncryption - 8a:98:17:cd:e1:dc:2b:1b:5b:16:40:99:21:c4:d4:db:3f:5c: - 6a:ed:7b:a2:b6:df:aa:7c:d8:6a:3f:11:39:da:4c:ce:3f:e5: - 99:6a:a4:b8:82:1e:53:7a:5d:f1:52:be:df:f1:3b:59:9a:a8: - bb:7e:f1:30:33:4b:7c:c3:ab:85:1e:c4:0e:ac:d1:7e:2b:cb: - 9d:19:5b:df:94:b4:89:e1:da:5d:31:19:85:34:d5:33:55:f8: - af:92:ea:9a:17:c9:da:68:00:df:10:e9:e4:33:35:cd:15:57: - 80:56:1a:58:94:37:d7:f2:02:de:9b:0b:d3:02:64:c5:8e:6f: - 25:31 + 0f:7d:4c:71:ef:5e:5d:a2:0e:09:da:37:bd:21:77:73:77:b1: + 02:7e:56:7d:82:c0:b9:53:77:c3:bb:9b:08:cf:00:b3:73:18: + 2d:c5:9c:1a:57:8c:2b:46:21:bf:28:2e:f4:6d:12:6a:c3:7f: + 8c:c6:a5:9b:bf:ed:47:cd:88:58:94:35:1f:5c:1e:a7:0d:17: + 96:5f:1b:70:ad:da:05:26:0c:52:d1:87:52:3c:e3:e1:23:ac: + aa:fa:f3:80:48:52:30:da:59:e2:de:0c:61:95:3c:63:ef:1d: + ec:b3:6d:c7:89:e6:e3:65:6c:be:d4:e7:a7:90:8c:f4:ff:1d: + 65:72 -----BEGIN CERTIFICATE----- MIICnTCCAgagAwIBAgIBATANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJHQjET MBEGA1UECAwKRGVyYnlzaGlyZTEOMAwGA1UEBwwFRGVyYnkxGjAYBgNVBAoMEU1v c3F1aXR0byBQcm9qZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRAwDgYDVQQDDAdSb290 -IENBMB4XDTE4MDkxODEwNDk0N1oXDTIzMDkxNzEwNDk0N1owZTELMAkGA1UEBhMC +IENBMB4XDTE5MDkxMDA5MzM0MloXDTI0MDkwODA5MzM0MlowZTELMAkGA1UEBhMC R0IxEzARBgNVBAgMCkRlcmJ5c2hpcmUxGjAYBgNVBAoMEU1vc3F1aXR0byBQcm9q ZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRMwEQYDVQQDDApTaWduaW5nIENBMIGfMA0G -CSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3MvIIBEx3A3A+EIiEzc3yhy88Z494AV7V -UfERaE2n4nOwabVnB1mIzLh/zpdSvPtze2CVonvCmvFNWsRCVcRuAlChcUFo0WyW -4D2vED97ZME6OsOpOXEIKUXIzNozZbRw+za8FQ2nMe/V7FmsdSt3NQvw2z0U9ZpB -5qC3t2Ir5wIDAQABo1AwTjAdBgNVHQ4EFgQU7mC7xxdf03KsM+6OhMwt2xrMilIw -HwYDVR0jBBgwFoAU2iCr4JgiOSjgcNZ0ZVMm4GtMljkwDAYDVR0TBAUwAwEB/zAN -BgkqhkiG9w0BAQsFAAOBgQCKmBfN4dwrG1sWQJkhxNTbP1xq7Xuitt+qfNhqPxE5 -2kzOP+WZaqS4gh5Tel3xUr7f8TtZmqi7fvEwM0t8w6uFHsQOrNF+K8udGVvflLSJ -4dpdMRmFNNUzVfivkuqaF8naaADfEOnkMzXNFVeAVhpYlDfX8gLemwvTAmTFjm8l -MQ== +CSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjObwHSO3D0j5PoGGaK+lGemgzUgEbf0WI +SQWF/TCMLmAXd7M4wwZ8/IeoYSkDhgcgj/jS8LtmkzORN+32ZLdGpfZ995SYUrx4 +kG0L22HGACN5wqY7K+7HPZaXm07reFaVUhPUX+oYhRgK1tnNS7AV7y/wJ++xr9JP +yriTwS8uTwIDAQABo1AwTjAdBgNVHQ4EFgQU6r5C75gXhNX8KIlaS6W2QU97uygw +HwYDVR0jBBgwFoAUz/Odu78rFNWi5exBz5wW0E2rhAQwDAYDVR0TBAUwAwEB/zAN +BgkqhkiG9w0BAQsFAAOBgQAPfUxx715dog4J2je9IXdzd7ECflZ9gsC5U3fDu5sI +zwCzcxgtxZwaV4wrRiG/KC70bRJqw3+MxqWbv+1HzYhYlDUfXB6nDReWXxtwrdoF +JgxS0YdSPOPhI6yq+vOASFIw2lni3gxhlTxj7x3ss23HiebjZWy+1OenkIz0/x1l +cg== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -MIICsjCCAhugAwIBAgIJAOcAUKw/VPlMMA0GCSqGSIb3DQEBCwUAMHIxCzAJBgNV -BAYTAkdCMRMwEQYDVQQIDApEZXJieXNoaXJlMQ4wDAYDVQQHDAVEZXJieTEaMBgG -A1UECgwRTW9zcXVpdHRvIFByb2plY3QxEDAOBgNVBAsMB1Rlc3RpbmcxEDAOBgNV -BAMMB1Jvb3QgQ0EwHhcNMTgwOTE4MTA0OTQ3WhcNMjgwOTE1MTA0OTQ3WjByMQsw -CQYDVQQGEwJHQjETMBEGA1UECAwKRGVyYnlzaGlyZTEOMAwGA1UEBwwFRGVyYnkx -GjAYBgNVBAoMEU1vc3F1aXR0byBQcm9qZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRAw -DgYDVQQDDAdSb290IENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCeTh1y -KRZ1NIeLVvhBxSQC3Cvfe9L3IC8415CVbgipLgZKe7Nl1JBqFYDxXKBn2eVQ6EwL -sCz+U2oa2oCql8r5eYEKpmWFiIcKdrL8aSXNvMKEOu0AJlsIXBe2sDFPxuuw143n -W/odqBiWedciVd5pmJWZZ93neWdkkjnPZZMN4wIDAQABo1AwTjAdBgNVHQ4EFgQU -2iCr4JgiOSjgcNZ0ZVMm4GtMljkwHwYDVR0jBBgwFoAU2iCr4JgiOSjgcNZ0ZVMm -4GtMljkwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQBIs2GY/GQL76rz -+0qSWZvQ7l+HovHdp7C49auI+hiSRAzv3p2y7y3DmZrpmYJlTZJWlaA8eg769sLg -Cyfkt6AIsZPadJiTTUayh8oCF5aMH+OetC+63USFBNYXJN6AOXp9vu/K3TdM8ao6 -WsAf26+DKYAPmvu+oU7ScpCrCSdC+Q== +MIICvTCCAiagAwIBAgIUCq9EuGevQyFmQpXhKjTK8l6q2VYwDQYJKoZIhvcNAQEL +BQAwcjELMAkGA1UEBhMCR0IxEzARBgNVBAgMCkRlcmJ5c2hpcmUxDjAMBgNVBAcM +BURlcmJ5MRowGAYDVQQKDBFNb3NxdWl0dG8gUHJvamVjdDEQMA4GA1UECwwHVGVz +dGluZzEQMA4GA1UEAwwHUm9vdCBDQTAeFw0xOTA5MTAwOTMzNDJaFw0yOTA5MDcw +OTMzNDJaMHIxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApEZXJieXNoaXJlMQ4wDAYD +VQQHDAVEZXJieTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3QxEDAOBgNVBAsM +B1Rlc3RpbmcxEDAOBgNVBAMMB1Jvb3QgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0A +MIGJAoGBAOGwkYR+cUbrn3AGkbdFImPx4tnYIsqT+MwGDNmQ33Q4Ng9ZwEJhsT2C +qGl0Txsj1HLo3goAFU/lZcvedtLT3sZKw1Jamwc7SS3H15Et9Ne9kQczaLekr74d +NpRWvgJMy3+YkBHsB04vFA45ruc4F7UnpljaovJ4sVadx0FyWdxbAgMBAAGjUDBO +MB0GA1UdDgQWBBTP8527vysU1aLl7EHPnBbQTauEBDAfBgNVHSMEGDAWgBTP8527 +vysU1aLl7EHPnBbQTauEBDAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4GB +ABRmECRQbiR9m27Qg8x8Auwus2xdxZTlKz2n8WV1HN8jE2b22g9kqAcamqcQXWYU +JklO18dNdpI2rpJa/rSi/Wcakp2STUnV03kqw7IZWyzCaDNZLRWWDHqsJhH91jzv +jFOhj81GLFVsAwsiTMV2FFk9XzYVpiV2syC7EgFvtjzH -----END CERTIFICATE----- diff --git a/test/ssl/client-encrypted.crt b/test/ssl/client-encrypted.crt index fa0ca023..98a6e890 100644 --- a/test/ssl/client-encrypted.crt +++ b/test/ssl/client-encrypted.crt @@ -1,26 +1,26 @@ Certificate: Data: Version: 3 (0x2) - Serial Number: 5 (0x5) - Signature Algorithm: sha256WithRSAEncryption + Serial Number: 6 (0x6) + Signature Algorithm: sha256WithRSAEncryption Issuer: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Signing CA Validity - Not Before: Sep 18 10:50:08 2018 GMT - Not After : Sep 17 10:50:08 2023 GMT + Not Before: Sep 10 09:33:43 2019 GMT + Not After : Sep 8 09:33:43 2024 GMT Subject: C=GB, ST=Nottinghamshire, L=Nottingham, O=Server, OU=Production, CN=test client encrypted Subject Public Key Info: Public Key Algorithm: rsaEncryption - Public-Key: (1024 bit) + RSA Public-Key: (1024 bit) Modulus: - 00:b6:a9:fe:16:1b:58:bb:96:6c:6e:a4:cf:39:60: - d0:0a:8c:18:9c:0c:75:eb:6f:5b:31:f9:1f:15:a5: - c8:7b:85:c1:cc:fc:1b:72:ba:af:ef:08:b8:e6:31: - bb:e7:20:cb:6a:f1:af:9c:db:df:12:71:3c:d2:98: - fb:14:dd:87:63:ed:6f:49:ab:30:12:aa:45:ab:ad: - 50:21:84:b5:9d:3e:b1:36:8e:92:87:e6:ee:b5:3b: - 9e:da:25:88:74:d9:28:c8:1f:6c:93:29:e7:1d:14: - dc:dc:14:72:1f:b9:84:32:a1:09:d7:cc:e5:21:a8: - 30:8c:d7:73:d7:b1:6f:2d:b7 + 00:b2:3b:8d:2d:d4:22:ee:5f:ea:f5:e5:eb:46:a5: + 10:0c:98:68:9f:d3:e1:bd:63:ca:e0:78:49:7c:54: + 96:49:a3:18:d6:a2:85:1e:7e:c1:65:3c:ba:14:93: + ff:1c:6f:43:f9:43:30:32:04:23:92:2f:1a:9f:a5: + f4:31:a1:d6:fd:b0:65:f6:e9:77:81:64:b6:2e:6e: + 00:71:da:0b:78:22:82:ba:e9:40:bb:a4:43:68:a1: + 28:b3:02:69:97:f9:21:55:c8:80:5c:8a:73:41:db: + 4f:a4:0e:8a:52:45:a4:a4:d7:9a:8c:9b:c0:7c:b6: + ec:dd:78:eb:93:c3:d2:f1:b5 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: @@ -28,34 +28,34 @@ Certificate: Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: - CD:6E:DB:18:BC:30:76:0F:58:6D:6A:5A:1D:3E:AB:0B:D0:DB:BA:8C + 12:37:21:26:74:8E:0E:22:74:95:FF:92:EC:7F:D7:3C:20:C9:B3:55 X509v3 Authority Key Identifier: - keyid:EE:60:BB:C7:17:5F:D3:72:AC:33:EE:8E:84:CC:2D:DB:1A:CC:8A:52 + keyid:EA:BE:42:EF:98:17:84:D5:FC:28:89:5A:4B:A5:B6:41:4F:7B:BB:28 Signature Algorithm: sha256WithRSAEncryption - 34:91:a4:18:93:ce:b6:8d:2a:17:c4:cc:48:34:3f:00:99:4f: - c2:2a:23:47:2f:75:fe:ef:34:da:39:12:16:63:86:9b:eb:30: - b3:d7:26:ff:96:4b:d6:00:c9:71:05:5d:08:c7:e1:52:70:d1: - ab:55:4f:2b:da:a7:ae:47:6d:b7:5d:84:2c:5e:c6:2a:3e:81: - 63:55:99:3f:8b:e1:43:a4:0a:5a:34:4e:50:3e:f8:0a:76:53: - 6b:e0:fc:42:14:b0:7e:ce:25:17:19:b9:d9:8b:dd:99:be:7e: - 6a:a9:7f:ae:d8:a3:7b:c6:48:7a:04:75:3b:8f:6b:85:c1:f0: - 43:18 + 54:e6:ae:58:21:74:be:ac:e8:0a:3e:da:4e:87:56:05:c2:51: + a8:6a:0c:83:dc:89:30:b8:3f:38:83:18:ed:4a:ce:d7:1d:0e: + 62:a7:eb:ec:97:4e:cc:db:c0:1d:12:c6:82:47:a7:a1:e7:1a: + b5:c0:2e:cf:a6:1b:d3:56:a9:f4:69:48:7d:f1:79:de:36:da: + 31:93:06:85:27:be:e8:94:57:64:ee:c9:fd:8e:d3:b1:65:19: + c7:d9:c0:6f:0e:bc:e5:92:09:b4:1f:4a:c6:59:20:15:3f:d3: + 8d:52:08:15:d0:e2:4f:71:c3:cc:b7:1e:20:1a:a3:ac:52:86: + 17:a4 -----BEGIN CERTIFICATE----- -MIIC2TCCAkKgAwIBAgIBBTANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET +MIIC2TCCAkKgAwIBAgIBBjANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET MBEGA1UECAwKRGVyYnlzaGlyZTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3Qx -EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTgwOTE4 -MTA1MDA4WhcNMjMwOTE3MTA1MDA4WjCBgjELMAkGA1UEBhMCR0IxGDAWBgNVBAgM +EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTkwOTEw +MDkzMzQzWhcNMjQwOTA4MDkzMzQzWjCBgjELMAkGA1UEBhMCR0IxGDAWBgNVBAgM D05vdHRpbmdoYW1zaGlyZTETMBEGA1UEBwwKTm90dGluZ2hhbTEPMA0GA1UECgwG U2VydmVyMRMwEQYDVQQLDApQcm9kdWN0aW9uMR4wHAYDVQQDDBV0ZXN0IGNsaWVu -dCBlbmNyeXB0ZWQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALap/hYbWLuW -bG6kzzlg0AqMGJwMdetvWzH5HxWlyHuFwcz8G3K6r+8IuOYxu+cgy2rxr5zb3xJx -PNKY+xTdh2Ptb0mrMBKqRautUCGEtZ0+sTaOkofm7rU7ntoliHTZKMgfbJMp5x0U -3NwUch+5hDKhCdfM5SGoMIzXc9exby23AgMBAAGjezB5MAkGA1UdEwQCMAAwLAYJ +dCBlbmNyeXB0ZWQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALI7jS3UIu5f +6vXl60alEAyYaJ/T4b1jyuB4SXxUlkmjGNaihR5+wWU8uhST/xxvQ/lDMDIEI5Iv +Gp+l9DGh1v2wZfbpd4Fkti5uAHHaC3gigrrpQLukQ2ihKLMCaZf5IVXIgFyKc0Hb +T6QOilJFpKTXmoybwHy27N1465PD0vG1AgMBAAGjezB5MAkGA1UdEwQCMAAwLAYJ YIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1Ud -DgQWBBTNbtsYvDB2D1htalodPqsL0Nu6jDAfBgNVHSMEGDAWgBTuYLvHF1/Tcqwz -7o6EzC3bGsyKUjANBgkqhkiG9w0BAQsFAAOBgQA0kaQYk862jSoXxMxIND8AmU/C -KiNHL3X+7zTaORIWY4ab6zCz1yb/lkvWAMlxBV0Ix+FScNGrVU8r2qeuR223XYQs -XsYqPoFjVZk/i+FDpApaNE5QPvgKdlNr4PxCFLB+ziUXGbnZi92Zvn5qqX+u2KN7 -xkh6BHU7j2uFwfBDGA== +DgQWBBQSNyEmdI4OInSV/5Lsf9c8IMmzVTAfBgNVHSMEGDAWgBTqvkLvmBeE1fwo +iVpLpbZBT3u7KDANBgkqhkiG9w0BAQsFAAOBgQBU5q5YIXS+rOgKPtpOh1YFwlGo +agyD3IkwuD84gxjtSs7XHQ5ip+vsl07M28AdEsaCR6eh5xq1wC7PphvTVqn0aUh9 +8XneNtoxkwaFJ77olFdk7sn9jtOxZRnH2cBvDrzlkgm0H0rGWSAVP9ONUggV0OJP +ccPMtx4gGqOsUoYXpA== -----END CERTIFICATE----- diff --git a/test/ssl/client-encrypted.key b/test/ssl/client-encrypted.key index c6325d84..1d0e8abe 100644 --- a/test/ssl/client-encrypted.key +++ b/test/ssl/client-encrypted.key @@ -1,18 +1,18 @@ -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED -DEK-Info: DES-EDE3-CBC,A17E5BCB1FEA5A08 +DEK-Info: DES-EDE3-CBC,8AEA93E5EEF22B76 -bK5ojhRrYmfh0nhgiLPZoGT6i6NqLoVmHrtxJBumois0wznY0n693KktYs4bIikl -YG5xGU+oOyuPCsi6NH/krIuDpzZzN8r6lTNX3b9BQdiEEL02QO9RJ/qjBz7OqNJF -QrtBZQiXpXw3GgkB9CCnLYV8MzEeEWFJnRifKYZLSN8kEdcekudm7m+ih/yLzoFH -MsnWR52uSVv58vOPqsGSXT5mvIWxZIeHBF5qSgre55rZjzzj5dn3PM/wBOeFIwep -ZWQlm/Y3cg+cpBBe9GRkC+E0WA7iHmBL7WIvuiGq8EHq/LkPsNVPuL4K9YjXL7fH -GSIvJqNq6cZb/dSxHY+8rgckZpnE4y/QH5xRmN43T9uzsno1nkRmojm61M3viObJ -85dlaagMrBgatJABmbtvUzRYQqabFG0R4xcITuZFxWaBZFAWzpn6C65adtN4myoU -nREOHXVWX+oz6E8vZbCaEPH21d8No6geH6+RhRoe+49gnodf57ZY/tlHz+4TL2lP -UQRcEGnZCXHRUZ0lg1eqs50/HB37GMs15pKA+4Bw42eRYQiUbYErsGtzFQPYsLYP -jPyoK5dvq0ZdVOSw8wnIMVX0LgI6v8G9i5R4AOLGHigkUBApwtHA22f+6ubZP/tQ -QHZGBZgpxhwe1aRPGmra6GGpDzzg61zFIulSowt1TXYtzj1CNHCVFMt5DF93bSo6 -g0i9O6fiw6DbX3gB587jvqSgiI2ia+5AA9hrG/Nld9wIH2kvtEa9IUNg97bl+GTr -uen5Y2xlA7Q3HVsxAU9W1CzBIFJYdDBYVkrKHPlKt6HAp5m4NEy+2g== +rNTuFZJw1I+Bvsu4dOcaXFSRvSHHW0f3Sw169Hm5vbAmx6kq6lL8bD1t85aU/1uE +5ACZ/ZlpxID1EEWfKBHdbHnTL5rQ7BJ/dGD4WuNGk6Wo8KvYUFaSHec1Up3KG1PW +EXLsJtcH8iu+OBnVVTEPn+tQYUICCLiAnvBWXFmb5uWHi8mk2S+2jEYcy9H1Ixmr +cLhluK2h6F3uzS+V3uonkjIEty6Rw3oeSe0Nq8Wd74lOzgrPjalVypryJIcfJQ/u +TqZhMhSRQTBbmyKA1AwrOwLFmWhHzQVy+zRwRqvR2qKILyIPTdIWaAOPZjDpynVH +qRL3pXvhrJ4W/r6rx3Irbm9dWgRSmLb7eVkOPYau/qXlxTWm/QA0QXFexXg16iVe +VonEjffgJA2zUF6u7a5mde8bue3c++3SLGPig5GBbbw/ZN5DmnzY6eQXb2U/tKrt +Gl3MSCUFeG4jPF0rTJ4isdgYaQEvx66UaJ/bJ08eIGVryha8az6sEit1fpSb3xQC +/wzthbkkqAB9N+ubVeZ2uogM2waukWc8usB8eIZ1jWzNBaJP8Dl87mHBM3dJCwRH +yTctPZBeylLZP7f46IN3jo/MpNIxOrRrgOJB+RG/p/GnF2+k5/RZgmsrnnc4Dy5B +s1UeEdx2W62+apf85gEy9BBFgPxbDoQC9Bkr7DysxEQzNujLQY+WJXhnotfAOPeE +d0NNYYZERw0GzU5Di7eiHQjnwB2cIQCOhmMesek+ijyVr3gmM6Mh5It+F3zHXktB +N1Br+IyuHDRdAOeJMx7FbU19/iu3vOVVPPd7R+D+prDStwRThzJGsw== -----END RSA PRIVATE KEY----- diff --git a/test/ssl/client-expired.crt b/test/ssl/client-expired.crt index 3992793d..f1c92f02 100644 --- a/test/ssl/client-expired.crt +++ b/test/ssl/client-expired.crt @@ -1,8 +1,8 @@ Certificate: Data: Version: 3 (0x2) - Serial Number: 3 (0x3) - Signature Algorithm: sha256WithRSAEncryption + Serial Number: 4 (0x4) + Signature Algorithm: sha256WithRSAEncryption Issuer: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Signing CA Validity Not Before: Aug 20 00:00:00 2012 GMT @@ -10,17 +10,17 @@ Certificate: Subject: C=GB, ST=Nottinghamshire, L=Nottingham, O=Server, OU=Production, CN=test client expired Subject Public Key Info: Public Key Algorithm: rsaEncryption - Public-Key: (1024 bit) + RSA Public-Key: (1024 bit) Modulus: - 00:cf:a2:94:2e:b7:84:9f:ec:67:86:ce:6a:71:75: - 6a:9d:9a:a3:69:2b:83:8e:a8:23:05:51:bc:ab:98: - 1e:01:bc:06:03:26:bd:34:ec:52:15:a7:4b:45:a5: - 62:f4:3c:c1:95:fe:7b:07:16:f7:03:ae:9a:19:4b: - a2:b9:49:80:5d:63:8b:a8:cb:d4:ed:86:9d:da:71: - 4f:15:6f:c5:0d:c6:81:cb:ad:57:75:7c:d9:2e:65: - a7:86:a4:8f:84:70:0d:c5:3a:53:6c:da:29:a3:1d: - b2:ac:4b:a0:86:7f:f3:16:2e:8d:99:dd:44:30:2b: - 81:89:e3:ae:79:b8:d7:ae:e9 + 00:e3:03:9f:6f:4f:8b:c6:57:bd:04:88:10:bc:04: + e2:c4:a8:cd:a5:3a:ad:46:1e:e7:46:53:d6:f2:3f: + 93:92:cb:2c:31:7f:17:77:44:2f:cf:61:50:9f:ff: + e9:3d:b7:2a:82:84:7e:be:01:3a:17:e5:7b:78:b1: + b5:ab:0f:15:05:3f:85:cf:a7:11:33:c7:8b:9d:a6: + 8b:8b:3f:6e:61:fb:68:9b:0b:00:fe:9b:2d:a2:6f: + 0c:ea:d4:79:c7:11:94:e6:0d:e2:b8:3c:4f:08:3e: + 0a:1d:7d:89:e7:69:2d:06:35:e5:9e:b5:df:16:f8: + 56:c5:77:f2:e2:62:cc:10:87 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: @@ -28,34 +28,34 @@ Certificate: Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: - FB:66:3B:5D:45:33:5B:61:14:52:C0:E4:04:FF:12:73:AD:B3:9B:56 + 04:E8:D6:25:43:18:36:C9:BD:DA:3A:EE:34:CC:1A:49:CB:35:07:5F X509v3 Authority Key Identifier: - keyid:EE:60:BB:C7:17:5F:D3:72:AC:33:EE:8E:84:CC:2D:DB:1A:CC:8A:52 + keyid:EA:BE:42:EF:98:17:84:D5:FC:28:89:5A:4B:A5:B6:41:4F:7B:BB:28 Signature Algorithm: sha256WithRSAEncryption - 80:89:73:0e:35:ea:ce:88:27:9e:71:7a:6c:13:46:2f:e9:cd: - 2a:04:6d:86:98:83:e3:0d:c3:d4:75:9d:6a:96:ec:b4:92:d0: - 7a:3f:f5:e2:84:bb:67:3e:1f:9f:f6:3b:b4:98:2d:17:7f:c6: - 2b:27:8f:4d:e1:4b:5c:7e:ae:e6:e6:e8:b7:82:3f:50:4b:78: - af:ae:2f:13:bf:c6:f1:f1:95:16:c2:46:73:8d:d9:3e:25:cd: - 90:15:e3:63:7d:0a:a2:19:f8:00:70:1e:7a:a1:a6:4e:3c:79: - b9:e1:66:7c:fd:67:40:69:c5:6b:3a:15:55:81:10:b6:4d:d2: - 22:b1 + 45:3c:cf:52:b5:ce:52:a8:98:da:ed:f4:cc:81:42:d3:87:6e: + 29:da:ee:0a:62:02:96:78:04:f9:e7:c6:e0:55:fc:50:b6:4e: + 73:52:c9:44:2e:22:21:ec:70:e0:d6:b9:13:f5:1c:c0:86:b5: + 26:d9:75:69:3c:a9:b0:71:13:aa:2a:f9:f1:86:1d:82:66:1a: + cc:56:4e:3a:7a:d9:20:88:80:e5:42:02:b8:3a:8c:26:8a:57: + f7:5c:5a:a3:15:4e:74:06:a0:3c:ea:1f:67:53:d1:60:a3:5e: + c2:75:17:32:b8:35:08:a7:d8:36:3c:13:1f:9c:97:18:b5:69: + 9f:66 -----BEGIN CERTIFICATE----- -MIIC1zCCAkCgAwIBAgIBAzANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET +MIIC1zCCAkCgAwIBAgIBBDANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET MBEGA1UECAwKRGVyYnlzaGlyZTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3Qx EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTIwODIw MDAwMDAwWhcNMTIwODIxMDAwMDAwWjCBgDELMAkGA1UEBhMCR0IxGDAWBgNVBAgM D05vdHRpbmdoYW1zaGlyZTETMBEGA1UEBwwKTm90dGluZ2hhbTEPMA0GA1UECgwG U2VydmVyMRMwEQYDVQQLDApQcm9kdWN0aW9uMRwwGgYDVQQDDBN0ZXN0IGNsaWVu -dCBleHBpcmVkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPopQut4Sf7GeG -zmpxdWqdmqNpK4OOqCMFUbyrmB4BvAYDJr007FIVp0tFpWL0PMGV/nsHFvcDrpoZ -S6K5SYBdY4uoy9Tthp3acU8Vb8UNxoHLrVd1fNkuZaeGpI+EcA3FOlNs2imjHbKs -S6CGf/MWLo2Z3UQwK4GJ4655uNeu6QIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCG +dCBleHBpcmVkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjA59vT4vGV70E +iBC8BOLEqM2lOq1GHudGU9byP5OSyywxfxd3RC/PYVCf/+k9tyqChH6+AToX5Xt4 +sbWrDxUFP4XPpxEzx4udpouLP25h+2ibCwD+my2ibwzq1HnHEZTmDeK4PE8IPgod +fYnnaS0GNeWetd8W+FbFd/LiYswQhwIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCG SAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4E -FgQU+2Y7XUUzW2EUUsDkBP8Sc62zm1YwHwYDVR0jBBgwFoAU7mC7xxdf03KsM+6O -hMwt2xrMilIwDQYJKoZIhvcNAQELBQADgYEAgIlzDjXqzognnnF6bBNGL+nNKgRt -hpiD4w3D1HWdapbstJLQej/14oS7Zz4fn/Y7tJgtF3/GKyePTeFLXH6u5ubot4I/ -UEt4r64vE7/G8fGVFsJGc43ZPiXNkBXjY30Kohn4AHAeeqGmTjx5ueFmfP1nQGnF -azoVVYEQtk3SIrE= +FgQUBOjWJUMYNsm92jruNMwaScs1B18wHwYDVR0jBBgwFoAU6r5C75gXhNX8KIla +S6W2QU97uygwDQYJKoZIhvcNAQELBQADgYEARTzPUrXOUqiY2u30zIFC04duKdru +CmIClngE+efG4FX8ULZOc1LJRC4iIexw4Na5E/UcwIa1Jtl1aTypsHETqir58YYd +gmYazFZOOnrZIIiA5UICuDqMJopX91xaoxVOdAagPOofZ1PRYKNewnUXMrg1CKfY +NjwTH5yXGLVpn2Y= -----END CERTIFICATE----- diff --git a/test/ssl/client-expired.key b/test/ssl/client-expired.key new file mode 100644 index 00000000..d803b733 --- /dev/null +++ b/test/ssl/client-expired.key @@ -0,0 +1,15 @@ +-----BEGIN RSA PRIVATE KEY----- +MIICXQIBAAKBgQDjA59vT4vGV70EiBC8BOLEqM2lOq1GHudGU9byP5OSyywxfxd3 +RC/PYVCf/+k9tyqChH6+AToX5Xt4sbWrDxUFP4XPpxEzx4udpouLP25h+2ibCwD+ +my2ibwzq1HnHEZTmDeK4PE8IPgodfYnnaS0GNeWetd8W+FbFd/LiYswQhwIDAQAB +AoGAbh8AxS8yH4nKIBuc+ofoNPupniAjk6NED0J2P1cF0CyMiIodKPbDtnZ/dM3g +J9blYSDClorj0lm4lmimNo9/Yv0YEohdFBKAtpfwVufzpR3G9+JbuVpEueTnESpH +iIkhZoCU5EBZoTkNvqvEZkxv6cBCM9riHuBp09Nxf6u9Y3kCQQD++HaG2Vmuo7Tg +oFLL7G16oHVwAYaiguP9OPcwIfyBYLbYEETgAvZ8oSt6A89TjphtnWdK/zDHiXrW +TNdGRYfLAkEA4+5DnSY0iAJei4vOfBp2baHPrHFoOHV/tbpLrZ0oZRMdiPIhgQSX +BTqpSWM1r+WUfWKi2LAiFN6u5nB15RtqtQJBAMjpjKxx9ONSiKNAcj3SjepFKoUa +DrdcIL9W9iFthoWEalATcdJ7QzOt5I5/Fg4nnSEzGUPVluCFCtB3OGNdQsUCQEAY ++w6wdclh0TCxCkpALtm5zWsTIVnvQRDb6PhT3848x+uBHAbqQYYI7x5iNfDXQSDZ +oi4JqivwS4MmUSEyypkCQQCjYN5UYQBqDlD9zf5MTS1mEGpKW5RsDNXjX/eEMYJT +/Dsa3EMYRLCmZxL4FiLZ8GOAxljf9rSkScybxU8XBh0u +-----END RSA PRIVATE KEY----- diff --git a/test/ssl/client-revoked.crt b/test/ssl/client-revoked.crt index f6f10e6c..9f195b5a 100644 --- a/test/ssl/client-revoked.crt +++ b/test/ssl/client-revoked.crt @@ -1,26 +1,26 @@ Certificate: Data: Version: 3 (0x2) - Serial Number: 4 (0x4) - Signature Algorithm: sha256WithRSAEncryption + Serial Number: 5 (0x5) + Signature Algorithm: sha256WithRSAEncryption Issuer: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Signing CA Validity - Not Before: Sep 18 10:49:58 2018 GMT - Not After : Sep 17 10:49:58 2023 GMT + Not Before: Sep 10 09:33:42 2019 GMT + Not After : Sep 8 09:33:42 2024 GMT Subject: C=GB, ST=Nottinghamshire, L=Nottingham, O=Server, OU=Production, CN=test client revoked Subject Public Key Info: Public Key Algorithm: rsaEncryption - Public-Key: (1024 bit) + RSA Public-Key: (1024 bit) Modulus: - 00:cf:30:dc:74:50:c8:4b:4c:0f:c5:15:b1:cc:f4: - 2d:c1:f2:f5:14:16:d3:c9:ff:82:0e:56:f2:98:8b: - 6d:d5:b9:c8:95:fa:33:cc:b3:9e:26:1d:5f:2a:0d: - ce:8d:49:02:f3:6e:a5:c6:90:26:e3:15:4e:d2:bf: - 22:ac:1c:25:5b:b1:06:aa:03:6a:b9:d8:e6:09:e2: - f6:31:e9:e2:76:08:b9:5a:a6:9d:a2:f2:ca:ec:f1: - 97:87:a1:5c:14:4a:06:44:77:1d:13:36:43:b8:36: - bf:6d:6f:0a:c1:91:a6:0b:ea:37:34:08:7b:2d:9f: - e0:ec:ba:5d:52:77:9e:a0:9f + 00:c8:e5:d4:6f:72:06:f8:fa:b1:7a:d0:05:db:ea: + 13:1a:18:b6:c1:95:b3:d5:af:50:de:59:e4:2b:5a: + c3:b8:3f:d9:09:13:6e:42:64:89:8c:f1:42:29:c4: + 75:41:d4:a7:15:6e:76:0d:15:0a:73:7b:b6:54:24: + 8a:44:b1:19:ad:8d:15:5f:c9:d8:a0:ea:94:2d:9e: + 9d:ab:0a:d7:f1:5c:8f:ae:16:55:65:cf:d9:62:bb: + 93:5e:b5:94:1f:b2:d0:7d:3d:d1:45:ed:32:18:5b: + 73:d0:f7:f1:91:9d:18:d2:f9:62:fa:f7:2b:d4:05: + 72:30:83:a3:9a:96:01:1b:41 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: @@ -28,34 +28,34 @@ Certificate: Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: - 56:B4:1E:17:B3:35:C7:16:DB:45:A5:76:40:73:3E:C3:EA:42:5D:F8 + EB:4B:4C:32:62:0A:82:9B:7D:F3:9F:61:1F:2B:E8:2C:93:21:63:BF X509v3 Authority Key Identifier: - keyid:EE:60:BB:C7:17:5F:D3:72:AC:33:EE:8E:84:CC:2D:DB:1A:CC:8A:52 + keyid:EA:BE:42:EF:98:17:84:D5:FC:28:89:5A:4B:A5:B6:41:4F:7B:BB:28 Signature Algorithm: sha256WithRSAEncryption - b5:42:ed:22:06:a9:6d:55:e7:72:c2:09:cf:05:6d:f1:cb:2b: - ae:38:24:63:b4:e2:f3:d6:13:ab:85:08:3f:e1:6e:e4:f4:2c: - 30:7b:cd:ec:be:1d:c1:a6:4b:53:f6:0d:13:55:ef:10:60:b5: - 85:72:b8:85:34:82:28:97:4c:d8:0e:70:7f:4a:b2:ec:ec:13: - 50:14:53:94:ae:04:e3:bf:c8:02:19:ce:9e:d4:85:2a:59:27: - 9b:dc:e7:5f:5a:c7:83:2e:fb:2b:47:e4:51:11:6f:ad:51:bb: - 2e:85:2c:7c:a7:c3:a9:db:72:ab:54:93:f7:70:9e:9b:9c:50: - 20:73 + 9c:01:dd:df:a4:8f:13:51:55:fd:91:63:d3:50:64:03:d6:7d: + de:ea:63:8a:80:72:6f:86:18:4b:60:ba:a5:9d:53:6b:6f:ac: + a7:e2:09:b5:93:3b:47:53:9a:76:37:f8:35:4a:8e:a0:89:93: + ef:ad:a9:2b:46:61:0d:67:14:5e:9b:b5:5c:dc:c3:2a:4c:97: + f0:79:06:33:a5:9c:ec:a3:1d:d1:03:44:ec:f4:06:bc:45:9d: + 47:a0:d4:db:6f:c8:59:d2:2c:5d:38:cc:84:98:0c:61:2d:67: + fe:9e:d5:d4:c7:75:a1:ee:f0:aa:bf:c1:23:09:db:45:ee:76: + 14:22 -----BEGIN CERTIFICATE----- -MIIC1zCCAkCgAwIBAgIBBDANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET +MIIC1zCCAkCgAwIBAgIBBTANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET MBEGA1UECAwKRGVyYnlzaGlyZTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3Qx -EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTgwOTE4 -MTA0OTU4WhcNMjMwOTE3MTA0OTU4WjCBgDELMAkGA1UEBhMCR0IxGDAWBgNVBAgM +EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTkwOTEw +MDkzMzQyWhcNMjQwOTA4MDkzMzQyWjCBgDELMAkGA1UEBhMCR0IxGDAWBgNVBAgM D05vdHRpbmdoYW1zaGlyZTETMBEGA1UEBwwKTm90dGluZ2hhbTEPMA0GA1UECgwG U2VydmVyMRMwEQYDVQQLDApQcm9kdWN0aW9uMRwwGgYDVQQDDBN0ZXN0IGNsaWVu -dCByZXZva2VkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPMNx0UMhLTA/F -FbHM9C3B8vUUFtPJ/4IOVvKYi23VuciV+jPMs54mHV8qDc6NSQLzbqXGkCbjFU7S -vyKsHCVbsQaqA2q52OYJ4vYx6eJ2CLlapp2i8srs8ZeHoVwUSgZEdx0TNkO4Nr9t -bwrBkaYL6jc0CHstn+Dsul1Sd56gnwIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCG +dCByZXZva2VkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI5dRvcgb4+rF6 +0AXb6hMaGLbBlbPVr1DeWeQrWsO4P9kJE25CZImM8UIpxHVB1KcVbnYNFQpze7ZU +JIpEsRmtjRVfydig6pQtnp2rCtfxXI+uFlVlz9liu5NetZQfstB9PdFF7TIYW3PQ +9/GRnRjS+WL69yvUBXIwg6OalgEbQQIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCG SAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4E -FgQUVrQeF7M1xxbbRaV2QHM+w+pCXfgwHwYDVR0jBBgwFoAU7mC7xxdf03KsM+6O -hMwt2xrMilIwDQYJKoZIhvcNAQELBQADgYEAtULtIgapbVXncsIJzwVt8csrrjgk -Y7Ti89YTq4UIP+Fu5PQsMHvN7L4dwaZLU/YNE1XvEGC1hXK4hTSCKJdM2A5wf0qy -7OwTUBRTlK4E47/IAhnOntSFKlknm9znX1rHgy77K0fkURFvrVG7LoUsfKfDqdty -q1ST93Cem5xQIHM= +FgQU60tMMmIKgpt9859hHyvoLJMhY78wHwYDVR0jBBgwFoAU6r5C75gXhNX8KIla +S6W2QU97uygwDQYJKoZIhvcNAQELBQADgYEAnAHd36SPE1FV/ZFj01BkA9Z93upj +ioByb4YYS2C6pZ1Ta2+sp+IJtZM7R1Oadjf4NUqOoImT762pK0ZhDWcUXpu1XNzD +KkyX8HkGM6Wc7KMd0QNE7PQGvEWdR6DU22/IWdIsXTjMhJgMYS1n/p7V1Md1oe7w +qr/BIwnbRe52FCI= -----END CERTIFICATE----- diff --git a/test/ssl/client-revoked.key b/test/ssl/client-revoked.key index da145808..52075275 100644 --- a/test/ssl/client-revoked.key +++ b/test/ssl/client-revoked.key @@ -1,15 +1,15 @@ -----BEGIN RSA PRIVATE KEY----- -MIICXQIBAAKBgQDPMNx0UMhLTA/FFbHM9C3B8vUUFtPJ/4IOVvKYi23VuciV+jPM -s54mHV8qDc6NSQLzbqXGkCbjFU7SvyKsHCVbsQaqA2q52OYJ4vYx6eJ2CLlapp2i -8srs8ZeHoVwUSgZEdx0TNkO4Nr9tbwrBkaYL6jc0CHstn+Dsul1Sd56gnwIDAQAB -AoGBAMqQ0Nh/qnPDl59uiHkDOkFnEilj8AiL4FG4vFJb7zSIAQ5wong+HB7TlJj/ -CrSjb1klErrBcOOPj5MIABQZKINrwgsHlkQIzvC2EGF/I0tfFJDbUjlZ7y1Vh15O -pAOhhx2SuBwvNMHrz6L70Koqg9Y2v1WHQ2IBPuo8i5VBcWSxAkEA9DUZm/Tj4Gqb -pXWiSd2/gV5H2NgVT2t9Jth1Z9nfK9g6GTfVEMbKkp4EGHW3rqL3UbphNK72/v3S -2YTMU0JM7QJBANkyKUbgdUMcqYDypZoBliom2qUqk+kIvWdGSp+W3M5LEQgfuTkN -uW9qz7ncXT3d8cka7Xlg7KO2UKAKnGJbvjsCQQCTYXiTJrhgN/a3ZMcMzUdGTCAQ -PlieFcDyMLCqfFKzo0ts7MUp2s9mrPbLzD+OpcudB16i7PUj7wvROtQVa24BAkAW -5M6tBePWWyMS0IDcJuapMsdBOae1nJI6XJJpGAHWTNtSu+VOOkAdmmii8rNxXf+q -bwgxDyJib0k4VWX+iCUZAkBWqLqyXcclfqAsiTKdzEfQV8uoiu+6hQ6OCh0J1Np3 -7g9p/MLyXkwtAgrtz80zWxkQH+FcFgdTwebrEF1z5kpx +MIICWwIBAAKBgQDI5dRvcgb4+rF60AXb6hMaGLbBlbPVr1DeWeQrWsO4P9kJE25C +ZImM8UIpxHVB1KcVbnYNFQpze7ZUJIpEsRmtjRVfydig6pQtnp2rCtfxXI+uFlVl +z9liu5NetZQfstB9PdFF7TIYW3PQ9/GRnRjS+WL69yvUBXIwg6OalgEbQQIDAQAB +AoGAdlDNBPmN27KhNegvmy3HJDZr46TL7cw7f0hHlbT10ZxgsPStmhJl5AjuY3Td +bfDUmk2c3uWGay7v2axPdlcq/DwU3xWXyQlS8jXldhDMJrrhKe+U0IdY2F1BImts +XS1Xum2opS0B8XebIRIoi5h4q5w2zRqaaLVeVjrxQqprNMECQQD3lWnme2uUSSZK +KMrsgk7WhZV2HpSneSiwyieBk9ikfq68NI5pDnpiVBZAuDwfgXmZ6CIiLoP2h/qJ +DWqHflypAkEAz7oiYHaS8w4+Wvcgo5v9iwjWU+F3rPrSfG7XaS0oGnU5+qF+U0F7 +D9mcecFUy0cNyBLpUx53nDP9BcQbq4oQ2QJAHm0YRKDqSaDrubVlqscg1TA5e/iq +ICK9o2xUipIWz7BZ3PtAfRywYaEf0vhROzX4MbfbagP5Z7SyT2F8tAYNcQJAO4m+ +EKfrtn5+oNP0JvCu2wrNY31cL9g0PDYIx7yJogu3cn6XFoXOH9zfXIZtJ1ZWPOIu +vgQdhEfiXaS3yZLpAQJAacVbsZN0PGe7SEVbbGarTkXu6evyKUc3H436kP+3M2I4 +5YHtJdURVtWdL5rv9QdQz2HknV5Zz383UoOd6HnD5A== -----END RSA PRIVATE KEY----- diff --git a/test/ssl/client.crt b/test/ssl/client.crt index c6b0626f..4bd5414f 100644 --- a/test/ssl/client.crt +++ b/test/ssl/client.crt @@ -1,26 +1,26 @@ Certificate: Data: Version: 3 (0x2) - Serial Number: 2 (0x2) - Signature Algorithm: sha256WithRSAEncryption + Serial Number: 3 (0x3) + Signature Algorithm: sha256WithRSAEncryption Issuer: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Signing CA Validity - Not Before: Sep 18 10:49:56 2018 GMT - Not After : Sep 17 10:49:56 2023 GMT + Not Before: Sep 10 09:33:42 2019 GMT + Not After : Sep 8 09:33:42 2024 GMT Subject: C=GB, ST=Nottinghamshire, L=Nottingham, O=Server, OU=Production, CN=test client Subject Public Key Info: Public Key Algorithm: rsaEncryption - Public-Key: (1024 bit) + RSA Public-Key: (1024 bit) Modulus: - 00:cf:a2:94:2e:b7:84:9f:ec:67:86:ce:6a:71:75: - 6a:9d:9a:a3:69:2b:83:8e:a8:23:05:51:bc:ab:98: - 1e:01:bc:06:03:26:bd:34:ec:52:15:a7:4b:45:a5: - 62:f4:3c:c1:95:fe:7b:07:16:f7:03:ae:9a:19:4b: - a2:b9:49:80:5d:63:8b:a8:cb:d4:ed:86:9d:da:71: - 4f:15:6f:c5:0d:c6:81:cb:ad:57:75:7c:d9:2e:65: - a7:86:a4:8f:84:70:0d:c5:3a:53:6c:da:29:a3:1d: - b2:ac:4b:a0:86:7f:f3:16:2e:8d:99:dd:44:30:2b: - 81:89:e3:ae:79:b8:d7:ae:e9 + 00:ca:37:db:79:24:74:5c:ee:f6:63:a0:50:e9:cc: + 7b:52:f4:24:fb:86:5f:ac:9d:c4:7b:d3:df:5b:94: + ca:7e:fd:40:a8:8d:0a:50:7e:49:63:ce:08:84:2e: + e3:ff:a6:a5:79:80:cc:ae:a8:64:33:c5:16:1f:5d: + c8:3f:8c:e2:8c:ce:92:d4:1e:b8:9f:86:42:f3:c8: + 7c:b3:85:38:25:2c:e7:11:32:ae:f0:be:17:a3:99: + 5e:f2:66:2f:12:18:8d:4c:6b:4b:33:4c:0e:e6:35: + c4:ae:2a:fc:db:b6:b4:3e:80:cd:74:a0:fc:5c:ec: + ec:18:3f:7d:ac:dc:c0:45:7d Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: @@ -28,34 +28,34 @@ Certificate: Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: - FB:66:3B:5D:45:33:5B:61:14:52:C0:E4:04:FF:12:73:AD:B3:9B:56 + 0F:4E:AD:C9:5F:1E:BF:A9:00:B8:0A:0B:D1:48:04:1A:EB:86:25:37 X509v3 Authority Key Identifier: - keyid:EE:60:BB:C7:17:5F:D3:72:AC:33:EE:8E:84:CC:2D:DB:1A:CC:8A:52 + keyid:EA:BE:42:EF:98:17:84:D5:FC:28:89:5A:4B:A5:B6:41:4F:7B:BB:28 Signature Algorithm: sha256WithRSAEncryption - 48:b6:47:12:77:53:07:36:44:93:d7:ea:88:f0:f5:4f:b0:b4: - 52:06:36:ec:7b:df:80:cc:2a:31:fa:b3:b4:c9:0e:4a:6c:b0: - 83:0a:89:2d:58:25:f2:ee:0f:60:93:01:59:db:0a:6d:93:81: - ad:ea:21:cf:ee:d1:a9:b4:c2:b8:77:8c:bf:9d:1f:78:3c:35: - c2:2d:18:11:25:02:f8:7c:9c:42:fd:9b:0f:21:7b:81:88:b3: - c3:84:62:b1:b9:24:3c:8c:94:24:93:c2:74:33:2c:82:ca:b3: - 8f:37:3f:71:6d:b7:79:9b:dd:2e:ee:36:bd:7c:fa:0a:4d:3b: - 88:4b + 25:2d:ca:89:aa:45:42:3c:61:f8:37:56:fa:22:f0:b6:ab:83: + d3:a2:15:d6:cb:64:82:20:79:b1:50:ab:c8:70:02:74:1c:3e: + c1:35:5d:e8:bb:1a:db:d1:c2:7d:06:69:e3:ab:03:a1:63:29: + 11:e6:c1:3e:ef:23:65:32:69:e0:d5:63:07:01:4c:bb:9a:41: + 5d:8e:a9:58:4e:d8:8f:58:10:2f:37:aa:9d:23:68:e5:ab:82: + 3c:be:70:1f:e1:33:11:bb:88:62:cd:59:22:80:87:9d:e6:92: + 38:e8:96:84:89:73:60:c5:d8:20:70:1e:55:97:d4:76:b7:2d: + ac:0c -----BEGIN CERTIFICATE----- -MIICzjCCAjegAwIBAgIBAjANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET +MIICzjCCAjegAwIBAgIBAzANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET MBEGA1UECAwKRGVyYnlzaGlyZTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3Qx -EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTgwOTE4 -MTA0OTU2WhcNMjMwOTE3MTA0OTU2WjB4MQswCQYDVQQGEwJHQjEYMBYGA1UECAwP +EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTkwOTEw +MDkzMzQyWhcNMjQwOTA4MDkzMzQyWjB4MQswCQYDVQQGEwJHQjEYMBYGA1UECAwP Tm90dGluZ2hhbXNoaXJlMRMwEQYDVQQHDApOb3R0aW5naGFtMQ8wDQYDVQQKDAZT ZXJ2ZXIxEzARBgNVBAsMClByb2R1Y3Rpb24xFDASBgNVBAMMC3Rlc3QgY2xpZW50 -MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPopQut4Sf7GeGzmpxdWqdmqNp -K4OOqCMFUbyrmB4BvAYDJr007FIVp0tFpWL0PMGV/nsHFvcDrpoZS6K5SYBdY4uo -y9Tthp3acU8Vb8UNxoHLrVd1fNkuZaeGpI+EcA3FOlNs2imjHbKsS6CGf/MWLo2Z -3UQwK4GJ4655uNeu6QIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQf -Fh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQU+2Y7XUUz -W2EUUsDkBP8Sc62zm1YwHwYDVR0jBBgwFoAU7mC7xxdf03KsM+6OhMwt2xrMilIw -DQYJKoZIhvcNAQELBQADgYEASLZHEndTBzZEk9fqiPD1T7C0UgY27HvfgMwqMfqz -tMkOSmywgwqJLVgl8u4PYJMBWdsKbZOBreohz+7RqbTCuHeMv50feDw1wi0YESUC -+HycQv2bDyF7gYizw4RisbkkPIyUJJPCdDMsgsqzjzc/cW23eZvdLu42vXz6Ck07 -iEs= +MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDKN9t5JHRc7vZjoFDpzHtS9CT7 +hl+sncR7099blMp+/UCojQpQfkljzgiELuP/pqV5gMyuqGQzxRYfXcg/jOKMzpLU +HrifhkLzyHyzhTglLOcRMq7wvhejmV7yZi8SGI1Ma0szTA7mNcSuKvzbtrQ+gM10 +oPxc7OwYP32s3MBFfQIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQf +Fh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUD06tyV8e +v6kAuAoL0UgEGuuGJTcwHwYDVR0jBBgwFoAU6r5C75gXhNX8KIlaS6W2QU97uygw +DQYJKoZIhvcNAQELBQADgYEAJS3KiapFQjxh+DdW+iLwtquD06IV1stkgiB5sVCr +yHACdBw+wTVd6Lsa29HCfQZp46sDoWMpEebBPu8jZTJp4NVjBwFMu5pBXY6pWE7Y +j1gQLzeqnSNo5auCPL5wH+EzEbuIYs1ZIoCHneaSOOiWhIlzYMXYIHAeVZfUdrct +rAw= -----END CERTIFICATE----- diff --git a/test/ssl/client.key b/test/ssl/client.key index 64eb5c55..2ebe2695 100644 --- a/test/ssl/client.key +++ b/test/ssl/client.key @@ -1,15 +1,15 @@ -----BEGIN RSA PRIVATE KEY----- -MIICXwIBAAKBgQDPopQut4Sf7GeGzmpxdWqdmqNpK4OOqCMFUbyrmB4BvAYDJr00 -7FIVp0tFpWL0PMGV/nsHFvcDrpoZS6K5SYBdY4uoy9Tthp3acU8Vb8UNxoHLrVd1 -fNkuZaeGpI+EcA3FOlNs2imjHbKsS6CGf/MWLo2Z3UQwK4GJ4655uNeu6QIDAQAB -AoGBAMwdfSK30i8MzXEedlF3JgotPLtkxX12GIdgJONjNQxrdFWgvZvLPZ5/yWV8 -Al0rZPs5ImSD1OzPtjlru1n+wapHp8zE2xtl3druicErs1A0hF73yx5lJx9rO5V4 -c7FoTFDDs3LJVy9P9gsV/+1iWwgJvvxDs01DWhhi35zFZmoBAkEA5wuDEScxYXbx -KY5irMhsPACwNgzx/c3GBwZ56nx0hGVrqDmghw03sf6leTceKRhLE6xzyk56Z4kD -6/QtpTZMyQJBAOYPxg80W5uZPC7R56jlAzo8fnpwEidTjJlctbS4sDSnITe9yugs -x7SzLhqxzuEuJiLOfzCs/X5TL1UdN1azASECQQCgF6763MBvu34BgILJHJs6vHNd -EH1BkyrrRUaG/zOxZaFCUKP10GfOMxevtUx1xzqGaFFXViekxCDuhyR1vPlZAkEA -h+GBJbHS+ZAED9NCdGrvARKB0WcoEbozLNGpMNh0mmSsJfQfSApK2duKu5GRk0Zi -l+RHE0TZZCdVqXvcF4UagQJBAK3Jdi/F/n6+BYIU6IcFtsHCcm8Nr+Lz3iSt4CT5 -gIZstvNrIy/fJoN/NrrfVUh8JD0UZpEUt1lNclNLxCh/wec= +MIICXAIBAAKBgQDKN9t5JHRc7vZjoFDpzHtS9CT7hl+sncR7099blMp+/UCojQpQ +fkljzgiELuP/pqV5gMyuqGQzxRYfXcg/jOKMzpLUHrifhkLzyHyzhTglLOcRMq7w +vhejmV7yZi8SGI1Ma0szTA7mNcSuKvzbtrQ+gM10oPxc7OwYP32s3MBFfQIDAQAB +AoGBAKGiRCtwmBIwb4Dyg7pdV7XWsDjcD11KPeM8Vyw8oh8fDq+rDLOKPd8osGX3 +lQajjWCxMunoby9yOVyY+ZbSZcH6tIp1gqsn2D/deIeJvwF0Y0+qAThb3rL2dF5r +s/ZtzY7V7M1VsFQz0RagBdJiwudrBy+M7wh/6gWPn0xP9IwBAkEA7srVGiOuP5m2 +wvjyU9T5unPnDOCgnHhqLOHy39ILm9OiMSR2nyrY9s4jZ+0ELD8haaHqsJk2PCTN +icGd8V3XeQJBANjKURH3df6NNUCqM1eDVHsvHjKL/qtwjKxByHo7ZHcTchGDTNlQ +sKWGXSuzLEJCtVcPQoeeAMXMvQ6xca3r6SUCQEL1e2YWBUFuT/JCLmlVeiVPZMWW +o1Lc7SDixuD+HCU45e0TxXOCZ05lpUX6D0Z8+ViOf6m/fJbG1x++vBQ3dTkCQGts +nY2UnTCdEmVPsY9M8aD08TbE7lZPuDVnh4siQR9MUHrjIEKTXGU5VpPf/i97VNam +JiaDoghh8tEEFrvDKc0CQHYPQtEElSAtLfW2G3jWvsUfk+cO4kDnzzXn1HJyLKKt +Qy+zJgnebGJtZSdqH0cpjAJmglx72+ATD2hM5H2Q8c8= -----END RSA PRIVATE KEY----- diff --git a/test/ssl/crl-empty.pem b/test/ssl/crl-empty.pem new file mode 100644 index 00000000..5c83d7f1 --- /dev/null +++ b/test/ssl/crl-empty.pem @@ -0,0 +1,9 @@ +-----BEGIN X509 CRL----- +MIIBPzCBqQIBATANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjETMBEGA1UE +CAwKRGVyYnlzaGlyZTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3QxEDAOBgNV +BAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EXDTE5MDkxMDA5MzM0MloY +DzIxMDExMDMwMDkzMzQyWqAOMAwwCgYDVR0UBAMCAQEwDQYJKoZIhvcNAQELBQAD +gYEAXKXAfdg47KKCs+qvU2BLR7+yGpvBekrkG9BRjKCXHDYO5e8HtLJJCik6DB9m +DZNMX4djcdGfuype4FXmRF4mJChLNfJmXXZ3zuyDjESOlhiC/aX5Xv1961ZwdQOh ++3RtJnFZVu5yOvq5oS+HuoXtMbLl8UwBdWeEH9BrzA22TpU= +-----END X509 CRL----- diff --git a/test/ssl/crl.pem b/test/ssl/crl.pem index 04b09321..6777a1cf 100644 --- a/test/ssl/crl.pem +++ b/test/ssl/crl.pem @@ -1,10 +1,10 @@ -----BEGIN X509 CRL----- MIIBVTCBvwIBATANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjETMBEGA1UE CAwKRGVyYnlzaGlyZTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3QxEDAOBgNV -BAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EXDTE4MDkxODEwNDk1OVoY -DzIxMDAxMTA3MTA0OTU5WjAUMBICAQQXDTE4MDkxODEwNDk1OVqgDjAMMAoGA1Ud -FAQDAgEBMA0GCSqGSIb3DQEBCwUAA4GBABMwUjGo9PMd1kqWqrfqTO3eaesPATX9 -xm6OQyoPEJ0CIwhm9jjWrvKMoJth8W7qnS91AK5vt0avGlUFIC+VG4aNc8MLFzmk -2g425K4d8dQ92OBCc3d6U8cUmpfB2bpK5kPxDliWtH+iBnuWkjTIsaXsfdmnnXhz -3PAFwU9beIef +BAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EXDTE5MDkxMDA5MzM0MloY +DzIxMDExMDMwMDkzMzQyWjAUMBICAQUXDTE5MDkxMDA5MzM0MlqgDjAMMAoGA1Ud +FAQDAgECMA0GCSqGSIb3DQEBCwUAA4GBANir3QTTixD5aAkLwrpMozAbjafitQL8 +XBnbg6Yudy94x6Dlh2sb0RbyLkIP0VhzHZq8fM4mn+FQ7THTlzPlNWv/Sn2iF/y2 +/yCFrYU3dBU3JoQ+Xq5TI/kI3h6naE/083ogRfJD+WkwqVQLQ7dPyPTzJumHjb9I +5RZG6P56JIcs -----END X509 CRL----- diff --git a/test/ssl/demoCA/crlnumber b/test/ssl/demoCA/crlnumber deleted file mode 100644 index eeee65ec..00000000 --- a/test/ssl/demoCA/crlnumber +++ /dev/null @@ -1 +0,0 @@ -05 diff --git a/test/ssl/demoCA/index.txt b/test/ssl/demoCA/index.txt deleted file mode 100644 index ced7051c..00000000 --- a/test/ssl/demoCA/index.txt +++ /dev/null @@ -1 +0,0 @@ -R 391118144000Z 120703155846Z CDAE0E564A2891A7 unknown /C=GB/ST=United Kingdom/L=Derby/O=Mosquitto Test Suite/OU=Broker Test/CN=localhost-client-test diff --git a/test/ssl/demoCA/index.txt.attr b/test/ssl/demoCA/index.txt.attr deleted file mode 100644 index 3a7e39e6..00000000 --- a/test/ssl/demoCA/index.txt.attr +++ /dev/null @@ -1 +0,0 @@ -unique_subject = no diff --git a/test/ssl/demoCA/serial b/test/ssl/demoCA/serial deleted file mode 100644 index 8a0f05e1..00000000 --- a/test/ssl/demoCA/serial +++ /dev/null @@ -1 +0,0 @@ -01 diff --git a/test/ssl/gen.sh b/test/ssl/gen.sh index a52159c1..0267c8e0 100755 --- a/test/ssl/gen.sh +++ b/test/ssl/gen.sh @@ -32,44 +32,57 @@ openssl req -new -x509 -days 3650 -key test-fake-root-ca.key -out test-fake-root openssl genrsa -out test-signing-ca.key 1024 openssl req -out test-signing-ca.csr -key test-signing-ca.key -new -config openssl.cnf -subj "${BASESUBJ}/CN=Signing CA/" openssl ca -batch -config openssl.cnf -name CA_root -extensions v3_ca -out test-signing-ca.crt -infiles test-signing-ca.csr +rm -f test-signing-ca.csr # An alternative intermediate CA, signed by the root CA, not used to sign anything. openssl genrsa -out test-alt-ca.key 1024 openssl req -out test-alt-ca.csr -key test-alt-ca.key -new -config openssl.cnf -subj "${BASESUBJ}/CN=Alternative Signing CA/" openssl ca -batch -config openssl.cnf -name CA_root -extensions v3_ca -out test-alt-ca.crt -infiles test-alt-ca.csr +rm -f test-alt-ca.csr # Valid server key and certificate. openssl genrsa -out server.key 1024 openssl req -new -key server.key -out server.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=localhost/" openssl ca -batch -config openssl.cnf -name CA_signing -out server.crt -infiles server.csr +rm -f server.csr -# Expired server certificate, based on the above server key. -openssl req -new -days 1 -key server.key -out server-expired.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=localhost/" +# Expired server certificate +openssl genrsa -out server-expired.key 1024 +openssl req -new -key server-expired.key -out server-expired.csr -config openssl.cnf -subj "${SBASESUBJ}-expired/CN=localhost/" openssl ca -batch -config openssl.cnf -name CA_signing -days 1 -startdate 120820000000Z -enddate 120821000000Z -out server-expired.crt -infiles server-expired.csr +rm -f server-expired.csr # Valid client key and certificate. openssl genrsa -out client.key 1024 openssl req -new -key client.key -out client.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=test client/" openssl ca -batch -config openssl.cnf -name CA_signing -out client.crt -infiles client.csr +rm -f client.csr -# Expired client certificate, based on the above client key. -openssl req -new -days 1 -key client.key -out client-expired.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=test client expired/" +# Expired client certificate +openssl genrsa -out client-expired.key 1024 +openssl req -new -key client-expired.key -out client-expired.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=test client expired/" openssl ca -batch -config openssl.cnf -name CA_signing -days 1 -startdate 120820000000Z -enddate 120821000000Z -out client-expired.crt -infiles client-expired.csr +rm -f client-expired.csr -# Revoked client certificate, based on a new client key. +# Empty CRL file +openssl ca -batch -config openssl.cnf -name CA_signing -gencrl -out crl-empty.pem + +# Revoked client certificate openssl genrsa -out client-revoked.key 1024 -openssl req -new -days 1 -key client-revoked.key -out client-revoked.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=test client revoked/" +openssl req -new -key client-revoked.key -out client-revoked.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=test client revoked/" openssl ca -batch -config openssl.cnf -name CA_signing -out client-revoked.crt -infiles client-revoked.csr openssl ca -batch -config openssl.cnf -name CA_signing -revoke client-revoked.crt openssl ca -batch -config openssl.cnf -name CA_signing -gencrl -out crl.pem +rm -f client-revoked.csr # Valid client key and certificate, encrypted (use "password" as password) openssl genrsa -des3 -out client-encrypted.key -passout pass:password 1024 openssl req -new -key client-encrypted.key -out client-encrypted.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=test client encrypted/" -passin pass:password openssl ca -batch -config openssl.cnf -name CA_signing -out client-encrypted.crt -infiles client-encrypted.csr +rm -f client-encrypted.csr cat test-signing-ca.crt test-root-ca.crt > all-ca.crt #mkdir certs #cp test-signing-ca.crt certs/test-signing-ca.pem #cp test-root-ca.crt certs/test-root.ca.pem -openssl rehash certs +#openssl rehash certs diff --git a/test/ssl/server-expired.crt b/test/ssl/server-expired.crt index e69de29b..0b820674 100644 --- a/test/ssl/server-expired.crt +++ b/test/ssl/server-expired.crt @@ -0,0 +1,61 @@ +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 2 (0x2) + Signature Algorithm: sha256WithRSAEncryption + Issuer: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Signing CA + Validity + Not Before: Aug 20 00:00:00 2012 GMT + Not After : Aug 21 00:00:00 2012 GMT + Subject: C=GB, ST=Nottinghamshire, L=Nottingham, O=Server, OU=Production-expired, CN=localhost + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public-Key: (1024 bit) + Modulus: + 00:9e:17:15:22:13:1e:22:b2:b5:e2:8c:d3:ac:f5: + 4c:bc:ef:55:92:46:8e:96:6d:b7:c1:af:50:4d:5f: + 88:49:92:74:b1:91:b1:70:50:74:f3:d4:6f:83:e1: + 21:58:44:7d:d4:c0:9f:51:fe:95:55:14:fe:30:e8: + 50:cf:18:a0:99:94:99:1e:ae:87:e2:63:10:7a:1b: + 17:da:f1:72:2b:63:59:bf:e4:9c:79:bb:63:c7:40: + 31:47:7b:8a:b7:82:44:69:d6:a9:24:38:5e:fb:e2: + c0:0b:d0:42:70:dc:4e:a0:7b:44:23:45:8b:92:db: + 3c:7b:7f:ea:60:8d:5a:a9:0b + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: + CA:FALSE + Netscape Comment: + OpenSSL Generated Certificate + X509v3 Subject Key Identifier: + 6C:37:48:ED:A0:0E:E7:67:BF:20:1D:76:48:75:82:1D:16:BA:ED:54 + X509v3 Authority Key Identifier: + keyid:EA:BE:42:EF:98:17:84:D5:FC:28:89:5A:4B:A5:B6:41:4F:7B:BB:28 + + Signature Algorithm: sha256WithRSAEncryption + 02:bb:c3:b6:e5:50:25:ef:32:c7:54:54:0c:3a:fd:2b:21:c8: + e0:1b:df:29:c8:0e:b1:ce:44:6d:9f:51:42:f2:d0:8a:42:a0: + 96:10:45:b9:d5:e8:7e:5d:5c:f0:ef:3c:8d:89:58:11:16:84: + 71:da:1e:98:84:9b:b2:d1:a3:a5:3f:fd:d9:8b:df:90:ab:22: + 7e:12:16:ef:1f:02:fd:86:07:ad:85:83:e6:59:d7:ff:ee:b1: + 44:b1:2c:29:8d:90:c0:73:53:e2:13:20:21:2b:8e:89:e2:4b: + 20:16:13:ea:20:ae:d8:fc:6e:61:31:11:33:2f:dc:40:a0:6b: + a1:a1 +-----BEGIN CERTIFICATE----- +MIIC1DCCAj2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET +MBEGA1UECAwKRGVyYnlzaGlyZTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3Qx +EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTIwODIw +MDAwMDAwWhcNMTIwODIxMDAwMDAwWjB+MQswCQYDVQQGEwJHQjEYMBYGA1UECAwP +Tm90dGluZ2hhbXNoaXJlMRMwEQYDVQQHDApOb3R0aW5naGFtMQ8wDQYDVQQKDAZT +ZXJ2ZXIxGzAZBgNVBAsMElByb2R1Y3Rpb24tZXhwaXJlZDESMBAGA1UEAwwJbG9j +YWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCeFxUiEx4isrXijNOs +9Uy871WSRo6WbbfBr1BNX4hJknSxkbFwUHTz1G+D4SFYRH3UwJ9R/pVVFP4w6FDP +GKCZlJkerofiYxB6Gxfa8XIrY1m/5Jx5u2PHQDFHe4q3gkRp1qkkOF774sAL0EJw +3E6ge0QjRYuS2zx7f+pgjVqpCwIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG ++EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQU +bDdI7aAO52e/IB12SHWCHRa67VQwHwYDVR0jBBgwFoAU6r5C75gXhNX8KIlaS6W2 +QU97uygwDQYJKoZIhvcNAQELBQADgYEAArvDtuVQJe8yx1RUDDr9KyHI4BvfKcgO +sc5EbZ9RQvLQikKglhBFudXofl1c8O88jYlYERaEcdoemISbstGjpT/92YvfkKsi +fhIW7x8C/YYHrYWD5lnX/+6xRLEsKY2QwHNT4hMgISuOieJLIBYT6iCu2PxuYTER +My/cQKBroaE= +-----END CERTIFICATE----- diff --git a/test/ssl/server-expired.key b/test/ssl/server-expired.key new file mode 100644 index 00000000..1f024d02 --- /dev/null +++ b/test/ssl/server-expired.key @@ -0,0 +1,15 @@ +-----BEGIN RSA PRIVATE KEY----- +MIICXAIBAAKBgQCeFxUiEx4isrXijNOs9Uy871WSRo6WbbfBr1BNX4hJknSxkbFw +UHTz1G+D4SFYRH3UwJ9R/pVVFP4w6FDPGKCZlJkerofiYxB6Gxfa8XIrY1m/5Jx5 +u2PHQDFHe4q3gkRp1qkkOF774sAL0EJw3E6ge0QjRYuS2zx7f+pgjVqpCwIDAQAB +AoGAdHSCf9BfcaX98D5XK+CjP8Z6Xb+WB+AY7heL6wNFrRSy2598e0T5cih6YUa1 +PoVtwAyJEGiebseBHFv2MyhsHK4Ae7oZaL+xmQ//klWJa+1jEBpdgX8D1NWklqYx +ZnRKaPQB1xbuAqYIEYb1ioM2x+P8mp78iDy5uzSP/fMreekCQQDK/id7GsuAifPi +vHs6JUpR5a+BvRZWhx4VWvMLk5swvhx8OxNfxadfR7JlikT9TLtRY8uu3gIE+ELi +sEznet5tAkEAx188sgXYk8R43AGpFt9sStxdvCK1CZLdDVNFcUDqeXMZhE6E81x+ +frx8hq+H3T1zGQWJnz24J8ZjPx+fvsoaVwJAe1Jym+iIb5vfzgTh/E5BW4Xl3TUK +CCFoVmL9uy++nZsx5Qti1tFWwJznNacOCLEAMA8n5CG+KlTFFcEzx4Gu9QJAb8SQ +PizQ0WYfaxbzOANgrkcDtWivnQJcMhAwqeD+kb9Y2rc6CUQdFeeM1+Sngfvk/m4A +TOlIx+OL1+NeppKeWQJBAKru6FO8OwA4ttqyMRF9YhSvlF/sNB4rSHQHs0IVtAgI +86p4/oC6F+cTS48QgEFREeh8IRYVnBHYA103dcqdFm4= +-----END RSA PRIVATE KEY----- diff --git a/test/ssl/server.crt b/test/ssl/server.crt index 843e29d4..7d26b682 100644 --- a/test/ssl/server.crt +++ b/test/ssl/server.crt @@ -2,25 +2,25 @@ Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) - Signature Algorithm: sha256WithRSAEncryption + Signature Algorithm: sha256WithRSAEncryption Issuer: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Signing CA Validity - Not Before: Sep 18 10:49:54 2018 GMT - Not After : Sep 17 10:49:54 2023 GMT + Not Before: Sep 10 09:33:42 2019 GMT + Not After : Sep 8 09:33:42 2024 GMT Subject: C=GB, ST=Nottinghamshire, L=Nottingham, O=Server, OU=Production, CN=localhost Subject Public Key Info: Public Key Algorithm: rsaEncryption - Public-Key: (1024 bit) + RSA Public-Key: (1024 bit) Modulus: - 00:cc:a0:1e:6a:7c:20:f0:3f:b2:48:2d:61:8d:b9: - db:a8:a5:65:6b:13:88:37:c7:12:d7:32:dc:b6:fd: - 89:4c:fd:2e:bf:e6:34:f5:ac:9d:db:82:54:b1:9c: - 84:7b:a7:af:3a:7e:89:fd:7e:fe:f1:3d:6f:46:1b: - 28:f2:d9:65:76:0d:11:4a:10:8b:a9:eb:bd:11:2c: - a8:5d:0a:30:65:c7:99:1f:96:88:2e:f1:a5:15:62: - a9:4a:2b:50:9e:70:04:0c:3d:24:55:4b:c3:d2:86: - 57:4f:76:91:6b:2b:35:40:10:b2:f0:c2:17:3f:da: - dd:d1:00:a7:32:64:37:24:b5 + 00:e6:df:91:e3:42:94:b4:4d:ca:4b:74:9f:bb:f3: + b2:7f:04:f1:77:69:f0:9d:0a:10:d3:e4:c5:cf:be: + 70:65:83:37:cb:28:92:fb:45:fb:93:62:47:da:2d: + d6:0d:b3:4e:11:5b:bc:c1:a5:10:f8:be:81:65:51: + 3b:69:7c:99:30:a6:46:89:5f:ad:b9:03:cf:4c:87: + 51:27:ca:46:64:ad:7b:5b:fc:94:85:48:4d:b7:42: + 2e:98:84:af:36:fa:f7:ba:55:da:ea:7b:c8:52:9f: + 68:1a:0c:4d:38:cd:c1:3e:58:6b:9d:11:1b:4b:0e: + 4e:28:a9:58:3c:e6:c2:34:1b Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: @@ -28,33 +28,33 @@ Certificate: Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: - F9:F6:14:B3:4E:D1:D5:35:9F:15:D4:74:10:0E:85:F5:FF:8C:D2:C9 + D9:14:AF:ED:6A:06:A9:D2:17:2D:16:9E:59:2B:09:7E:2E:4F:59:9E X509v3 Authority Key Identifier: - keyid:EE:60:BB:C7:17:5F:D3:72:AC:33:EE:8E:84:CC:2D:DB:1A:CC:8A:52 + keyid:EA:BE:42:EF:98:17:84:D5:FC:28:89:5A:4B:A5:B6:41:4F:7B:BB:28 Signature Algorithm: sha256WithRSAEncryption - 94:f9:64:c6:99:00:68:03:bb:58:e8:cd:71:65:82:02:30:ff: - cf:87:c3:5f:98:51:c8:96:93:c2:92:c0:f5:d4:78:5b:a2:0b: - ee:1a:77:6c:1e:bb:f8:d9:d9:93:b5:d2:9e:84:1b:bd:e3:0d: - 43:91:5b:a3:87:b3:a5:87:6b:ed:a3:93:e2:5a:7c:1e:09:f0: - 2a:27:97:39:3b:c4:a0:23:b4:84:50:c1:a2:1c:4d:0b:dc:66: - 16:d4:ef:1b:3b:bf:ef:69:a2:de:e1:01:b8:ca:e3:d3:be:f0: - e2:87:e1:1f:b5:92:93:25:32:e9:12:19:cb:78:dc:16:56:48: - ea:7c + 29:f6:76:33:b1:13:25:7f:b0:3a:d7:a0:7b:f0:e3:df:88:ef: + f0:57:dc:a6:c2:40:ee:9d:34:b9:a3:35:70:e6:30:72:b8:dd: + cf:b5:81:32:6d:d4:e3:61:45:43:eb:1c:74:32:42:3c:21:fa: + c0:32:de:f8:26:f9:3b:13:37:3c:1a:61:02:4b:b0:29:a6:47: + 4c:91:ec:ed:43:d9:01:a6:eb:85:5b:34:a4:78:cc:cb:cb:87: + e8:4b:74:38:42:c1:30:d3:f7:b8:59:43:93:8d:e8:f6:1f:95: + df:7d:e3:25:78:3c:bf:40:28:9c:a4:e2:e1:12:20:65:9a:50: + f3:54 -----BEGIN CERTIFICATE----- MIICzDCCAjWgAwIBAgIBATANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET MBEGA1UECAwKRGVyYnlzaGlyZTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3Qx -EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTgwOTE4 -MTA0OTU0WhcNMjMwOTE3MTA0OTU0WjB2MQswCQYDVQQGEwJHQjEYMBYGA1UECAwP +EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTkwOTEw +MDkzMzQyWhcNMjQwOTA4MDkzMzQyWjB2MQswCQYDVQQGEwJHQjEYMBYGA1UECAwP Tm90dGluZ2hhbXNoaXJlMRMwEQYDVQQHDApOb3R0aW5naGFtMQ8wDQYDVQQKDAZT ZXJ2ZXIxEzARBgNVBAsMClByb2R1Y3Rpb24xEjAQBgNVBAMMCWxvY2FsaG9zdDCB -nzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAzKAeanwg8D+ySC1hjbnbqKVlaxOI -N8cS1zLctv2JTP0uv+Y09ayd24JUsZyEe6evOn6J/X7+8T1vRhso8tlldg0RShCL -qeu9ESyoXQowZceZH5aILvGlFWKpSitQnnAEDD0kVUvD0oZXT3aRays1QBCy8MIX -P9rd0QCnMmQ3JLUCAwEAAaN7MHkwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0EHxYd -T3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFPn2FLNO0dU1 -nxXUdBAOhfX/jNLJMB8GA1UdIwQYMBaAFO5gu8cXX9NyrDPujoTMLdsazIpSMA0G -CSqGSIb3DQEBCwUAA4GBAJT5ZMaZAGgDu1jozXFlggIw/8+Hw1+YUciWk8KSwPXU -eFuiC+4ad2weu/jZ2ZO10p6EG73jDUORW6OHs6WHa+2jk+JafB4J8Conlzk7xKAj -tIRQwaIcTQvcZhbU7xs7v+9pot7hAbjK49O+8OKH4R+1kpMlMukSGct43BZWSOp8 +nzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA5t+R40KUtE3KS3Sfu/OyfwTxd2nw +nQoQ0+TFz75wZYM3yyiS+0X7k2JH2i3WDbNOEVu8waUQ+L6BZVE7aXyZMKZGiV+t +uQPPTIdRJ8pGZK17W/yUhUhNt0IumISvNvr3ulXa6nvIUp9oGgxNOM3BPlhrnREb +Sw5OKKlYPObCNBsCAwEAAaN7MHkwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0EHxYd +T3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFNkUr+1qBqnS +Fy0WnlkrCX4uT1meMB8GA1UdIwQYMBaAFOq+Qu+YF4TV/CiJWkultkFPe7soMA0G +CSqGSIb3DQEBCwUAA4GBACn2djOxEyV/sDrXoHvw49+I7/BX3KbCQO6dNLmjNXDm +MHK43c+1gTJt1ONhRUPrHHQyQjwh+sAy3vgm+TsTNzwaYQJLsCmmR0yR7O1D2QGm +64VbNKR4zMvLh+hLdDhCwTDT97hZQ5ON6PYfld994yV4PL9AKJyk4uESIGWaUPNU -----END CERTIFICATE----- diff --git a/test/ssl/server.key b/test/ssl/server.key index fe26ae2f..06531bf6 100644 --- a/test/ssl/server.key +++ b/test/ssl/server.key @@ -1,15 +1,15 @@ -----BEGIN RSA PRIVATE KEY----- -MIICXAIBAAKBgQDMoB5qfCDwP7JILWGNuduopWVrE4g3xxLXMty2/YlM/S6/5jT1 -rJ3bglSxnIR7p686fon9fv7xPW9GGyjy2WV2DRFKEIup670RLKhdCjBlx5kflogu -8aUVYqlKK1CecAQMPSRVS8PShldPdpFrKzVAELLwwhc/2t3RAKcyZDcktQIDAQAB -AoGBAKS4MEPf8FP1snpPrbv85Un4+o8bhggAhLYfB3V22tPS65MmqXMqpVhSrgLb -z/oKnhAkVMhvNqLTpYN10ZzMS9MvaUK2G7TeNAFVuZcs4bit0YJchf/s947SOuZp -lSjIqbjiAkHsediyqsSZxMMwP2SxpevlmgPcdJfvwFeL6siBAkEA5vf1XPLF/etj -bcGim24wo5rbfq2pgszbKRbhr3syeRSv7NFsC2adRswQ7ZL3pIP0KezlEXCuoY0Z -fxs6QcFB/QJBAOLNSoihg26Z1omRR9LGS6iXrsLkznB/O6wGZl2dPMUO6fhXjOx0 -jXvubvrsuaZlavPc3U1bz9Q0r8xt++sXbxkCQHgEqzxUbyvmEDGtaBjKZn3tb1dh -WG8+kjfEyxuLsguXA1/U5wb5mIp8aeN59jNH2i2bCuFII4aRMomJFXmrueUCQGdX -r4yOO7sbsdvBLP7nh/XsF5+Kbl5oOyJpUB971ALehtG34uijOwyrWjpPv1AIijFQ -BC6JlStWTnxR6SX36ZECQGtidHZtfChaaeGi5rgORalVSngj+b5qjeR/x6KbDw6y -XmRC0C20CEyTgVwVsQVSAUoDiJSi4ol3/k5Yo5R9Lc0= +MIICXQIBAAKBgQDm35HjQpS0TcpLdJ+787J/BPF3afCdChDT5MXPvnBlgzfLKJL7 +RfuTYkfaLdYNs04RW7zBpRD4voFlUTtpfJkwpkaJX625A89Mh1EnykZkrXtb/JSF +SE23Qi6YhK82+ve6Vdrqe8hSn2gaDE04zcE+WGudERtLDk4oqVg85sI0GwIDAQAB +AoGANWbrQMzqxpXjv/ZW6EujMvw6uitYC4sDf2/ATaA4MVLbufNFpDd4zIuEITRO ++dZKrXsxuvzqYw71sTDL9Edsy0KBft/gOD/eEEGLMCTSxAVzIlnk3iIjGJ+vcHp7 +K0TPy7yfk8CiHKUcxTfTWykr7x+gGu+XRmYlJv9izcA8nSkCQQD1np5HahyGzRgE +N5xeL6B0We+WwvXxsuBe96EAF1WdN35weKx4Y1330qRE0aia5A9lJw2TTXNH+5vF +8Bj6X+PVAkEA8KFpALzuGtot5hZ1nryOJS8BJMwjdbmUOAGu/J6sY9RSLj+qty7C +LHLrUvteikGKsQN/8WnVls7kSivqqBngLwJBALyu2jZQLJPdb+qlccjk22UmRahS +Iq9G05gAsLyqMEmy/L2X5h4hb2lWdnyrdtNuCOmSw5n58GpGvhajZ/zGtvUCQQC6 +y+JSY1fHWpWE5ux5xE/oR5vwr9PbIKwR6iSoEJksifcd1ei1eUPc830Alwgl9Ykv +rtLUWl8nSgZoGb14r1WbAkAQANc9yjhDyk9mQwBzDrvQiQnBJWROrgtNCgq2g9m6 +zawZwPtI6lbvvsR2t5kEDR4piXDiwiadXDdd3pq8m/LS -----END RSA PRIVATE KEY----- diff --git a/test/ssl/signingCA/crlnumber b/test/ssl/signingCA/crlnumber index 9e22bcb8..75016ea3 100644 --- a/test/ssl/signingCA/crlnumber +++ b/test/ssl/signingCA/crlnumber @@ -1 +1 @@ -02 +03 diff --git a/test/ssl/signingCA/serial b/test/ssl/signingCA/serial index cd672a53..2c7456e3 100644 --- a/test/ssl/signingCA/serial +++ b/test/ssl/signingCA/serial @@ -1 +1 @@ -06 +07 diff --git a/test/ssl/test-alt-ca.crt b/test/ssl/test-alt-ca.crt index 161b8066..2e7fa1ef 100644 --- a/test/ssl/test-alt-ca.crt +++ b/test/ssl/test-alt-ca.crt @@ -2,57 +2,57 @@ Certificate: Data: Version: 3 (0x2) Serial Number: 2 (0x2) - Signature Algorithm: sha256WithRSAEncryption + Signature Algorithm: sha256WithRSAEncryption Issuer: C=GB, ST=Derbyshire, L=Derby, O=Mosquitto Project, OU=Testing, CN=Root CA Validity - Not Before: Sep 18 10:49:53 2018 GMT - Not After : Sep 17 10:49:53 2023 GMT + Not Before: Sep 10 09:33:42 2019 GMT + Not After : Sep 8 09:33:42 2024 GMT Subject: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Alternative Signing CA Subject Public Key Info: Public Key Algorithm: rsaEncryption - Public-Key: (1024 bit) + RSA Public-Key: (1024 bit) Modulus: - 00:d9:91:e8:a7:67:b4:bf:8e:c9:6a:23:ee:00:14: - 6b:1f:b9:73:4d:af:ab:d3:96:5f:76:e5:0d:59:d4: - 0b:35:d4:48:5d:9b:9f:fc:e0:c2:29:b2:32:a9:e7: - 5b:81:bf:9c:55:e5:7f:e1:64:c5:c7:bc:10:3f:6e: - 05:16:82:47:e9:ae:86:97:75:2f:93:56:b2:4b:df: - 80:e1:a3:75:22:03:e0:de:93:5d:2d:98:ae:a9:c7: - 53:7d:a2:1a:c9:5d:83:0e:e2:60:52:a5:a8:82:fe: - 04:ae:be:1d:c4:c6:5c:ae:08:41:33:7a:88:4d:82: - e8:da:93:b8:01:ad:c6:1b:75 + 00:b3:5e:a7:16:47:3f:40:b1:a6:2b:30:72:23:83: + a6:bd:06:f8:ad:a9:01:91:cb:90:5e:7d:ca:f9:0a: + fb:bf:76:bc:0e:97:4b:4a:68:26:71:2b:23:78:b4: + 55:2a:91:63:19:a7:a1:9c:67:47:39:dd:b9:c0:76: + 6a:93:59:ae:a0:c5:67:89:82:1c:da:e4:3a:a4:d6: + c1:b8:ae:78:0e:8c:07:a7:a4:94:b8:0b:78:48:a8: + f7:a4:78:af:93:a0:77:d4:0a:19:f3:ef:37:2c:b9: + 14:fb:da:14:41:06:64:f9:70:90:c2:b2:93:6f:ad: + 1e:77:5f:0f:32:00:c7:d8:f5 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: - EC:E8:0A:3E:42:B9:F1:5D:F9:74:6E:07:8D:39:3F:63:53:7A:2C:17 + D6:68:84:29:27:27:1B:55:39:A5:42:93:95:08:B4:4B:55:FB:98:AA X509v3 Authority Key Identifier: - keyid:DA:20:AB:E0:98:22:39:28:E0:70:D6:74:65:53:26:E0:6B:4C:96:39 + keyid:CF:F3:9D:BB:BF:2B:14:D5:A2:E5:EC:41:CF:9C:16:D0:4D:AB:84:04 X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha256WithRSAEncryption - 0a:14:f7:e7:54:44:59:39:14:b0:aa:d3:0e:bd:94:e2:0a:b3: - e9:65:31:c7:8c:0b:af:55:b9:c0:96:bb:2f:12:40:6a:4e:3e: - 13:c8:7e:cc:02:06:83:41:ad:22:2b:15:ea:fe:c4:09:25:2d: - e7:d4:f4:91:59:4e:6b:c9:8c:c5:a3:e0:f7:d2:56:1a:ea:82: - a6:06:15:d8:25:03:2f:71:c4:78:5c:ba:ce:8c:a4:80:67:58: - 33:12:86:df:ae:da:bd:d2:ff:e5:71:d0:8a:1f:ad:b4:0a:70: - 52:d7:04:0f:f8:2c:b9:1c:8e:1b:5b:c2:df:f8:ca:c9:97:4e: - 1a:0c + a1:9a:e1:2a:68:5d:54:f9:a1:fb:a4:7c:c0:ad:05:db:1c:4b: + 01:af:5f:96:f3:bd:33:e3:eb:24:f1:7e:16:0f:58:64:fe:ef: + 33:a4:30:4e:64:31:3b:52:b5:ca:7e:2f:cd:6e:7d:ed:ff:81: + 85:c9:bd:a4:51:e5:ba:d6:ca:3b:93:94:26:3c:61:8b:e1:e2: + fc:3e:23:57:27:22:47:fa:aa:e3:f6:90:c6:2c:e9:33:22:65: + 82:19:c8:9e:35:f4:b2:98:94:19:03:c0:c8:62:5b:42:6a:71: + 7b:d9:9d:8f:79:c1:7c:e7:ae:59:63:39:bf:e8:36:68:3e:be: + 49:c7 -----BEGIN CERTIFICATE----- MIICqTCCAhKgAwIBAgIBAjANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJHQjET MBEGA1UECAwKRGVyYnlzaGlyZTEOMAwGA1UEBwwFRGVyYnkxGjAYBgNVBAoMEU1v c3F1aXR0byBQcm9qZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRAwDgYDVQQDDAdSb290 -IENBMB4XDTE4MDkxODEwNDk1M1oXDTIzMDkxNzEwNDk1M1owcTELMAkGA1UEBhMC +IENBMB4XDTE5MDkxMDA5MzM0MloXDTI0MDkwODA5MzM0MlowcTELMAkGA1UEBhMC R0IxEzARBgNVBAgMCkRlcmJ5c2hpcmUxGjAYBgNVBAoMEU1vc3F1aXR0byBQcm9q ZWN0MRAwDgYDVQQLDAdUZXN0aW5nMR8wHQYDVQQDDBZBbHRlcm5hdGl2ZSBTaWdu -aW5nIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDZkeinZ7S/jslqI+4A -FGsfuXNNr6vTll925Q1Z1As11Ehdm5/84MIpsjKp51uBv5xV5X/hZMXHvBA/bgUW -gkfproaXdS+TVrJL34Dho3UiA+Dek10tmK6px1N9ohrJXYMO4mBSpaiC/gSuvh3E -xlyuCEEzeohNgujak7gBrcYbdQIDAQABo1AwTjAdBgNVHQ4EFgQU7OgKPkK58V35 -dG4HjTk/Y1N6LBcwHwYDVR0jBBgwFoAU2iCr4JgiOSjgcNZ0ZVMm4GtMljkwDAYD -VR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQAKFPfnVERZORSwqtMOvZTiCrPp -ZTHHjAuvVbnAlrsvEkBqTj4TyH7MAgaDQa0iKxXq/sQJJS3n1PSRWU5ryYzFo+D3 -0lYa6oKmBhXYJQMvccR4XLrOjKSAZ1gzEobfrtq90v/lcdCKH620CnBS1wQP+Cy5 -HI4bW8Lf+MrJl04aDA== +aW5nIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCzXqcWRz9AsaYrMHIj +g6a9BvitqQGRy5Befcr5Cvu/drwOl0tKaCZxKyN4tFUqkWMZp6GcZ0c53bnAdmqT +Wa6gxWeJghza5Dqk1sG4rngOjAenpJS4C3hIqPekeK+ToHfUChnz7zcsuRT72hRB +BmT5cJDCspNvrR53Xw8yAMfY9QIDAQABo1AwTjAdBgNVHQ4EFgQU1miEKScnG1U5 +pUKTlQi0S1X7mKowHwYDVR0jBBgwFoAUz/Odu78rFNWi5exBz5wW0E2rhAQwDAYD +VR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQChmuEqaF1U+aH7pHzArQXbHEsB +r1+W870z4+sk8X4WD1hk/u8zpDBOZDE7UrXKfi/Nbn3t/4GFyb2kUeW61so7k5Qm +PGGL4eL8PiNXJyJH+qrj9pDGLOkzImWCGcieNfSymJQZA8DIYltCanF72Z2PecF8 +565ZYzm/6DZoPr5Jxw== -----END CERTIFICATE----- diff --git a/test/ssl/test-alt-ca.key b/test/ssl/test-alt-ca.key index 3e59fb4c..a26e35ae 100644 --- a/test/ssl/test-alt-ca.key +++ b/test/ssl/test-alt-ca.key @@ -1,15 +1,15 @@ -----BEGIN RSA PRIVATE KEY----- -MIICXQIBAAKBgQDZkeinZ7S/jslqI+4AFGsfuXNNr6vTll925Q1Z1As11Ehdm5/8 -4MIpsjKp51uBv5xV5X/hZMXHvBA/bgUWgkfproaXdS+TVrJL34Dho3UiA+Dek10t -mK6px1N9ohrJXYMO4mBSpaiC/gSuvh3ExlyuCEEzeohNgujak7gBrcYbdQIDAQAB -AoGBAKh2ovekhD7i17AYu/tR1BSPaulXQaumvqp39tt8JWX7xkC89KdAfPb+JN6L -5r3TWMDl4BvtBHuAcfA7RzNDk1u/DZUT25ZnkbnL9iuQhBweRLETGSbBcrJ/VvGi -BXBB9bQfAbtUqF4MiPVIjgBSZn/Jtgz0A9PAKYpnhqvpIVStAkEA8kBBNAOA0ZI7 -r3DPEiL9QEMad0tDBIkM8hcFYVwPqi0O5mRt4YXDev0OzyvTVYX5Z1BaF5uJvUSH -y1lvDdpYkwJBAOXrDhnmW0K6xCYIqLVfdXG4LIx/exCQuYr78QGVV1rE4UCuIDZl -zOlRmmLzFsP1T8bArYGSxWqtU1ZYgv8uaNcCQQDlT1VpOvexaU7+Hzaj4GMBdYOT -8LYbkO+kKY56Pn7Fg6lbBS3OEKSdwvVFviJqDkurNDBTsHONqVUxdBLfdhPpAkB8 -9ZLVasig7OcckMo4wWgQZXv45HRbXX0qV6H2LVer4qNWRw0E47FKAer56oqt+E7i -g+gJK18Wiptnq3WPAYdDAkAdaJWEoOWkQROPvlKWlD51hAqCReb9ElxAeJOcte/Y -k1xir4zsMLo8cjqr/GLWVMhYv4zw9ZoKMNR7tfmYLZUC +MIICXQIBAAKBgQCzXqcWRz9AsaYrMHIjg6a9BvitqQGRy5Befcr5Cvu/drwOl0tK +aCZxKyN4tFUqkWMZp6GcZ0c53bnAdmqTWa6gxWeJghza5Dqk1sG4rngOjAenpJS4 +C3hIqPekeK+ToHfUChnz7zcsuRT72hRBBmT5cJDCspNvrR53Xw8yAMfY9QIDAQAB +AoGAE83rnOYY8cerlTEwKQOsMUrHwkTay4IyWnyBIKY5zZYKhYHm6jw9olkk/XrL +vHt4+agsi9xLXPRCQiHQ+pv4T9CiuwmjhYyZmurSSIBEtHrMKuVXvwhNDRyqiGb1 +XyW23x1hoQ/G3CBQh+7n8Z+x+sNgdyipV1ia4tryuxsvgQECQQDd4CbsGARJ/E0z +fSo3Y4ZhTHvOrwYYPmjBFBOFPt/acwl6IH7XhtJKL7MlveapGyLk65ksptjREIMu +ED51Q3IlAkEAzvTt0seXV1ZGf9i/DlES3m6NSSNh2eRZjDMzf55WQ8D59frteMVN +BLyE3jrhYdS37iqpjdTQh1mKsrVuvIfKkQJBAJmkDI/UmbO5+KO8+qzcSEO8OMeI +v4muPc/l3RaZ0V1t55QgSHVqsNgaa82o0L8tQV6QHsOizeUHsC8HpJiDGdkCQAJv +STj4liQ15KBuaVj+xS0OueTJYMZSdGc81vdCYptrcsVdDVwlXhGXMiz3Hl2rRfqs +T9BWV5mwCPyvO71GD7ECQQDRjmnHPm7kehGeHW11LVbRA9TauZClJnsvI4XgYgsN +Gbd96uWaQHzWt9qovtuxQsk618ZlajGlOrmCO2BDC0Vm -----END RSA PRIVATE KEY----- diff --git a/test/ssl/test-bad-root-ca.crt b/test/ssl/test-bad-root-ca.crt index 1e72d2e9..0dcb8386 100644 --- a/test/ssl/test-bad-root-ca.crt +++ b/test/ssl/test-bad-root-ca.crt @@ -1,17 +1,17 @@ -----BEGIN CERTIFICATE----- -MIICujCCAiOgAwIBAgIJAOk0UydITfTbMA0GCSqGSIb3DQEBCwUAMHYxCzAJBgNV -BAYTAkdCMRMwEQYDVQQIDApEZXJieXNoaXJlMQ4wDAYDVQQHDAVEZXJieTEaMBgG -A1UECgwRTW9zcXVpdHRvIFByb2plY3QxEDAOBgNVBAsMB1Rlc3RpbmcxFDASBgNV -BAMMC0JhZCBSb290IENBMB4XDTE4MDkxODEwNDk0N1oXDTI4MDkxNTEwNDk0N1ow -djELMAkGA1UEBhMCR0IxEzARBgNVBAgMCkRlcmJ5c2hpcmUxDjAMBgNVBAcMBURl -cmJ5MRowGAYDVQQKDBFNb3NxdWl0dG8gUHJvamVjdDEQMA4GA1UECwwHVGVzdGlu -ZzEUMBIGA1UEAwwLQmFkIFJvb3QgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ -AoGBANuiMnQx8FL6FD2kGa3xG0Tv4iH1yECdJ8hzcdxESC/ecmaXMwGPiEmUyymU -/xRyQysHafhchc1lJvDmeFL13z4vgNPpJDhVCdji2QAq2IAKasLSZ3rhCYFhjvIO -wPHZxLtWeOgVqYRxWC58eF5H8wnBMOcfRBy5R/N9PYA2sZjdAgMBAAGjUDBOMB0G -A1UdDgQWBBTi2KR5GQHHN6hKI+Tfhqy4mLDMUTAfBgNVHSMEGDAWgBTi2KR5GQHH -N6hKI+Tfhqy4mLDMUTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4GBAIr6 -ie8HXzJYNZagjLVV/BkYKKe65FpmVk+3DdPqTtDhKGr8MpqkQlbBH8Ovocm3+eeN -om2qrwfymji5FGh9SV6kI7UCiIZ4r3VCo+npmwh8QKTv5yP5nCiUGrDEFUkg4VOt -HZTDW6L52WTHDJc/5Dh/MRhT07wox7BesgNWv21w +MIICxTCCAi6gAwIBAgIUA0+BIjY/izJBfY9rCIK0rFj1LTkwDQYJKoZIhvcNAQEL +BQAwdjELMAkGA1UEBhMCR0IxEzARBgNVBAgMCkRlcmJ5c2hpcmUxDjAMBgNVBAcM +BURlcmJ5MRowGAYDVQQKDBFNb3NxdWl0dG8gUHJvamVjdDEQMA4GA1UECwwHVGVz +dGluZzEUMBIGA1UEAwwLQmFkIFJvb3QgQ0EwHhcNMTkwOTEwMDkzMzQyWhcNMjkw +OTA3MDkzMzQyWjB2MQswCQYDVQQGEwJHQjETMBEGA1UECAwKRGVyYnlzaGlyZTEO +MAwGA1UEBwwFRGVyYnkxGjAYBgNVBAoMEU1vc3F1aXR0byBQcm9qZWN0MRAwDgYD +VQQLDAdUZXN0aW5nMRQwEgYDVQQDDAtCYWQgUm9vdCBDQTCBnzANBgkqhkiG9w0B +AQEFAAOBjQAwgYkCgYEA3I5ZR4RbtdVfj/xvLffj0WMQ/fEuAboyd7Dfx9af713N +X3xmYC4m8sBEpYf/XKCmDlGYHOtS91SGj7Ylf+ipLIm3LWbovxq3jxIY/vCJMqLf +2t59xslBSAPdF4msU4AZxVrinDgkExrZ1iOev8v1xuQzHiJfGPZWdAYKZ7GTUfsC +AwEAAaNQME4wHQYDVR0OBBYEFF3Bl5CiFVGSsPDEjaacOTBH7a2HMB8GA1UdIwQY +MBaAFF3Bl5CiFVGSsPDEjaacOTBH7a2HMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcN +AQELBQADgYEAFpuMcEex7qxkVU1z7bkB5DEpzTI4FhM5iDxmXvNSa1yPLsJPxuih +29G+W5luDEnsdb9dV4KM/VHZ/HuSCwX69EBiXlBXqSHWDKGas9q2e7eRzdGCQGvL +KiUaEsCbEigrP6DasDHx7MYj2EcNYwcqSCQjWKf0lhWPVnbLQIy+Pjo= -----END CERTIFICATE----- diff --git a/test/ssl/test-bad-root-ca.key b/test/ssl/test-bad-root-ca.key index 936370df..4dcee7d6 100644 --- a/test/ssl/test-bad-root-ca.key +++ b/test/ssl/test-bad-root-ca.key @@ -1,15 +1,15 @@ -----BEGIN RSA PRIVATE KEY----- -MIICXgIBAAKBgQDbojJ0MfBS+hQ9pBmt8RtE7+Ih9chAnSfIc3HcREgv3nJmlzMB -j4hJlMsplP8UckMrB2n4XIXNZSbw5nhS9d8+L4DT6SQ4VQnY4tkAKtiACmrC0md6 -4QmBYY7yDsDx2cS7VnjoFamEcVgufHheR/MJwTDnH0QcuUfzfT2ANrGY3QIDAQAB -AoGBANXsSIpGbdbUP8y+Pkjes3nU0IPVWmQc7jfewgMR+uGtH+5uzL5zaAKLS8rH -lh/7HxMVGJFQxP6GzIQNZxse4n1oXVstqa9xCoXQhUHpq6a/HdzbtMvg25SK6BXy -0F5d3y+MZAkat2JBIIRhpEm9A42Zy2z+uD5t/tJoF8hGw5g9AkEA8K1hUZYlf77p -hsHK79bAa9LTCqA+GX18Dbwixq1m01Mf1+JUJVURfuZOPlHldmUR30ELu6ojo84f -2TCLnenPawJBAOmd13FummA+UZNqK7GjXE0gYXqR99Q1zV8ZL5fgE3femiUIPIor -WpjzxNOcDqgGaHmXsh7s4HBJsAAKuWJUstcCQQDhE7PkYb815WttK8TGYRZYf7P/ -xvXsTq76BUyccsOrs5we/7ljpFeVTnozy9EE1OZO2/zGBwoHgZfFPKIFDwh7AkBM -jQdCyS5W6TTL7Fdi/xfIwhqPEnO2GucwCU26I5fdiJjUF63WzLwEMKTHfnSjBG6J -oXahgZdN1CeS6/CxUvXDAkEA48RD37aRhPBhE7s4Z0oODABYst+dKLOfbvnM8KY1 -XXYblkJPmmBfWb4bG+huYIaDYkfjZ6KJfJtk3tG8E3TWbA== +MIICXAIBAAKBgQDcjllHhFu11V+P/G8t9+PRYxD98S4BujJ3sN/H1p/vXc1ffGZg +LibywESlh/9coKYOUZgc61L3VIaPtiV/6KksibctZui/GrePEhj+8Ikyot/a3n3G +yUFIA90XiaxTgBnFWuKcOCQTGtnWI56/y/XG5DMeIl8Y9lZ0BgpnsZNR+wIDAQAB +AoGBALjqtFns1AORIS0UhZax5pUwjReMNXmHRjbp2cWv4aoMKFttblwndcpDf4qV +inl7y53ntTRR7N6nRKaLHcevJt48/YrK6TrFcOMVrOpqN5CcPz91miWH+PSbHtNo +aF8b5ZJe85gjJ2UewOXI41je64nVTYw8BC/kYOH9CixNOTBJAkEA9LFY6IyLyNO5 +eBVxrZjXBmXovqOPsESJlVf6IFu8Ecrvh59PIQGzY10YWt5QxA3BWmOguMigWjlF +uRLvUh8vTwJBAOa/eGanpn4l0o+xsS/KVOTO+98v1Dt50VB+weu7Rr/G/sQzTTVA +oN41W5YyJd05FwnUZxVvL8NfP7nOPtdcZ5UCQAYyp8ncJX5EvqHoCSUYhfnHgwmx +IuaYFdQOkmtXZ4Ab381Tn7F6VYziwscqcmlE3+zmMR/9FPK0GKwDasRtvckCQBen +PPJY8SoxOlpcfqtFdFpYFV2Vi43lON2lgL9nXSM/hNIb6CgzTco5cf/9eAArX/8z +9LUvxpeiZefoCm0NHdkCQBA+vqQPkmqKV40II55+5zXW1vmi76lk0NDJPRQ/gGlA +PF9wokWex61Dl3iixIG5lOASoMBo5b8g1szhbZHeqFE= -----END RSA PRIVATE KEY----- diff --git a/test/ssl/test-ca.srl b/test/ssl/test-ca.srl deleted file mode 100644 index 53b55300..00000000 --- a/test/ssl/test-ca.srl +++ /dev/null @@ -1 +0,0 @@ -CDAE0E564A2891AA diff --git a/test/ssl/test-fake-root-ca.crt b/test/ssl/test-fake-root-ca.crt index 55343803..04d17b5b 100644 --- a/test/ssl/test-fake-root-ca.crt +++ b/test/ssl/test-fake-root-ca.crt @@ -1,17 +1,17 @@ -----BEGIN CERTIFICATE----- -MIICsjCCAhugAwIBAgIJANlFsLqxEDJbMA0GCSqGSIb3DQEBCwUAMHIxCzAJBgNV -BAYTAkdCMRMwEQYDVQQIDApEZXJieXNoaXJlMQ4wDAYDVQQHDAVEZXJieTEaMBgG -A1UECgwRTW9zcXVpdHRvIFByb2plY3QxEDAOBgNVBAsMB1Rlc3RpbmcxEDAOBgNV -BAMMB1Jvb3QgQ0EwHhcNMTgwOTE4MTA0OTQ3WhcNMjgwOTE1MTA0OTQ3WjByMQsw -CQYDVQQGEwJHQjETMBEGA1UECAwKRGVyYnlzaGlyZTEOMAwGA1UEBwwFRGVyYnkx -GjAYBgNVBAoMEU1vc3F1aXR0byBQcm9qZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRAw -DgYDVQQDDAdSb290IENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDX3o3H -JPVGSfB/MdMNIBw+goqXmJdeAm4Ied0pkvC+KqIIp3xn0tiIdn+cKzn2hRk9UnW1 -IxAxKwVYRrASIRkFSFieRzhCTbZ1DxoI+DxLiE9RNH6b9M4u8nhlb9qApRgfpQsL -6gM5mG7QbXADyKPS9ToHU0YM3MpOiLOEDDbV/QIDAQABo1AwTjAdBgNVHQ4EFgQU -tQbx/zTi/+cZAQS63KiVZy+KaHAwHwYDVR0jBBgwFoAUtQbx/zTi/+cZAQS63KiV -Zy+KaHAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQBLHJkJGaeAZoMq -d+wHJ+W/QJuU2xPACbCb7b5nA3WXnCj7A81IoFOJzdvlaHf9re7FvuVjK5kdhbVR -jz79e/RWHu2Q1vb8ftFqx8XISy3+wQR07NPmrFRmT0cfV06yiYjL0obQFyiXQ1y+ -xXVWHQ/2EkTGVBFKyuRBBmqWbzFj7w== +MIICvTCCAiagAwIBAgIUEV/NxsOd+AgPP9s5/+r8yDhZeGEwDQYJKoZIhvcNAQEL +BQAwcjELMAkGA1UEBhMCR0IxEzARBgNVBAgMCkRlcmJ5c2hpcmUxDjAMBgNVBAcM +BURlcmJ5MRowGAYDVQQKDBFNb3NxdWl0dG8gUHJvamVjdDEQMA4GA1UECwwHVGVz +dGluZzEQMA4GA1UEAwwHUm9vdCBDQTAeFw0xOTA5MTAwOTMzNDJaFw0yOTA5MDcw +OTMzNDJaMHIxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApEZXJieXNoaXJlMQ4wDAYD +VQQHDAVEZXJieTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3QxEDAOBgNVBAsM +B1Rlc3RpbmcxEDAOBgNVBAMMB1Jvb3QgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0A +MIGJAoGBAL/ovHlwesKZg8IwhZv9IC48HvbVSwd2FZydjOp677hDnlbZPuLBoEvO +XJFh+LlS7RWBul0IGg3S0LnW4w1Zib9ECy98R2vapSCsZFlOi0+NO4/StLqkVKjm +Pce1+g5rN3UgqZRpsPVIEuct2ikZxECydzzTwveofUUOIqujQ3oHAgMBAAGjUDBO +MB0GA1UdDgQWBBQHDEMQ7QUiy/OT0knUpuwYWcf4MTAfBgNVHSMEGDAWgBQHDEMQ +7QUiy/OT0knUpuwYWcf4MTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4GB +AGFKPpRPPIgzpAVIlW8tATyzkNeD6W9/kCky0TPWul7k+CII3agJYRz/Ms2F/ASR +E5Ejr7iE97hHfxCSB3xLts5ouSHclwaymz9/gcw0I6SRqP/x+Bb0BYZ4bIeH1aye +3NO9TKRyyzVf1E+3aBWbVJroFNPX0FO9JG54qRcxc6aS -----END CERTIFICATE----- diff --git a/test/ssl/test-fake-root-ca.key b/test/ssl/test-fake-root-ca.key index 81c538d4..7b750762 100644 --- a/test/ssl/test-fake-root-ca.key +++ b/test/ssl/test-fake-root-ca.key @@ -1,15 +1,15 @@ -----BEGIN RSA PRIVATE KEY----- -MIICXQIBAAKBgQDX3o3HJPVGSfB/MdMNIBw+goqXmJdeAm4Ied0pkvC+KqIIp3xn -0tiIdn+cKzn2hRk9UnW1IxAxKwVYRrASIRkFSFieRzhCTbZ1DxoI+DxLiE9RNH6b -9M4u8nhlb9qApRgfpQsL6gM5mG7QbXADyKPS9ToHU0YM3MpOiLOEDDbV/QIDAQAB -AoGAKzBjvUwvpnh0nX4ic6XRANCtWdc1saFa0mdPUFoNwH5XHNQll8Afgm3y6hPb -7O6ENjihRDRXsP6iex7pazckAgQ9zvIhXwyfAxHJ8T8+xJrb2ohMNbl/mdWkZzJS -HmfLwmTl8n2FTnUWOCRZ4DWZmxoqK04VcxFK2/ZvY9neZCECQQD88xjgt8zfk9k0 -UAKRQyqnoWbpthMDecLGwL3jjfGDts79TvSv7iwtq10uSQycFApMQlKysz7a4wsV -IMir+Z2XAkEA2nj7o7kiN/lhREcTf865mjo6Lol4vk6UDcNGQ8zHeoYiQMwIyhiR -MnFYzMeZT/tjD6O5JuJwyO74dCHqhYaDiwJBAIlhVp+l88VyPUOmON7ARghpJsXE -N6tplBnyUK+oRgWtYdo96bMrfh8HtUIQNqMGV1l3pAaeR4MGUNyWw6Zzmd0CQQDB -6E+w6Ujt1XH3X/52mc0yjivF0k5Q2v2dmYxr8P28SgFs8at7dIKq+t+OIjp5Ou6Z -mv9i++iO70umB9RX3yQxAkBY1E0dLGusSZ8BWugiminaZ8E0QdAwENIl02NleerY -ANdCQvvt3/KtfqiAhwakyGv4sdxa7Uo5KUaDKhqZ++0N +MIICXAIBAAKBgQC/6Lx5cHrCmYPCMIWb/SAuPB721UsHdhWcnYzqeu+4Q55W2T7i +waBLzlyRYfi5Uu0VgbpdCBoN0tC51uMNWYm/RAsvfEdr2qUgrGRZTotPjTuP0rS6 +pFSo5j3HtfoOazd1IKmUabD1SBLnLdopGcRAsnc808L3qH1FDiKro0N6BwIDAQAB +AoGAVoDs+/x0iWUzXAQNJbwallypRG/uawWSRk9KJqOVjMSGCfXQ/9txitoRJcM4 +nyi/D3Ozcp3lSJffV/WB0RGsIc/lrvqu0NkR4nn5uPARE03yujRTpiRt/37s77Ge +X86an1H0Z/fo7R+m6iJhBdRTMmXEch3pEJXSkeLIzCA8wKkCQQDnJB9jEO3ZviQ9 +bSBBJ14EMrd/idzvGhrGtPot7FZahLJrVCz4iWncrTfKMiRlU7F1WvENXiV2mGW3 +WiLJ/0D1AkEA1Ix2NLPz6/WF0v6meo4OgVj8c9+4QwTyy71mTo36yMscy1SA5B4U +xPWMyKFaPAbG6uX2L+880A3vIA+PrVlBiwJAEklwVkUjnEOH2HhGwgDcVlaw391H +Zn9ZOPlehb2aA2VWPFmXiT5N6tClhlC7Qm0BsDg2tAkLy7s46O2vrO2N9QJBALmZ +CaMNvCI/26KZwK9lml7yYEeihFjpWkX0VgCkU+fADJ20ZXRMnCA8trl+w7eEx2/Y +bHgA9N5MPJGHZROey+8CQCoK0Z3bPgqv9GP81wa2Sy84p9vAqTMyjalRVy1WssaD +0d9Q9s0P/JWWtg9IonzYcT6CCrVy8RhMcZ6Tq1yE3fc= -----END RSA PRIVATE KEY----- diff --git a/test/ssl/test-root-ca.crt b/test/ssl/test-root-ca.crt index d0bf051e..88ad6f2d 100644 --- a/test/ssl/test-root-ca.crt +++ b/test/ssl/test-root-ca.crt @@ -1,17 +1,17 @@ -----BEGIN CERTIFICATE----- -MIICsjCCAhugAwIBAgIJAOcAUKw/VPlMMA0GCSqGSIb3DQEBCwUAMHIxCzAJBgNV -BAYTAkdCMRMwEQYDVQQIDApEZXJieXNoaXJlMQ4wDAYDVQQHDAVEZXJieTEaMBgG -A1UECgwRTW9zcXVpdHRvIFByb2plY3QxEDAOBgNVBAsMB1Rlc3RpbmcxEDAOBgNV -BAMMB1Jvb3QgQ0EwHhcNMTgwOTE4MTA0OTQ3WhcNMjgwOTE1MTA0OTQ3WjByMQsw -CQYDVQQGEwJHQjETMBEGA1UECAwKRGVyYnlzaGlyZTEOMAwGA1UEBwwFRGVyYnkx -GjAYBgNVBAoMEU1vc3F1aXR0byBQcm9qZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRAw -DgYDVQQDDAdSb290IENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCeTh1y -KRZ1NIeLVvhBxSQC3Cvfe9L3IC8415CVbgipLgZKe7Nl1JBqFYDxXKBn2eVQ6EwL -sCz+U2oa2oCql8r5eYEKpmWFiIcKdrL8aSXNvMKEOu0AJlsIXBe2sDFPxuuw143n -W/odqBiWedciVd5pmJWZZ93neWdkkjnPZZMN4wIDAQABo1AwTjAdBgNVHQ4EFgQU -2iCr4JgiOSjgcNZ0ZVMm4GtMljkwHwYDVR0jBBgwFoAU2iCr4JgiOSjgcNZ0ZVMm -4GtMljkwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQBIs2GY/GQL76rz -+0qSWZvQ7l+HovHdp7C49auI+hiSRAzv3p2y7y3DmZrpmYJlTZJWlaA8eg769sLg -Cyfkt6AIsZPadJiTTUayh8oCF5aMH+OetC+63USFBNYXJN6AOXp9vu/K3TdM8ao6 -WsAf26+DKYAPmvu+oU7ScpCrCSdC+Q== +MIICvTCCAiagAwIBAgIUCq9EuGevQyFmQpXhKjTK8l6q2VYwDQYJKoZIhvcNAQEL +BQAwcjELMAkGA1UEBhMCR0IxEzARBgNVBAgMCkRlcmJ5c2hpcmUxDjAMBgNVBAcM +BURlcmJ5MRowGAYDVQQKDBFNb3NxdWl0dG8gUHJvamVjdDEQMA4GA1UECwwHVGVz +dGluZzEQMA4GA1UEAwwHUm9vdCBDQTAeFw0xOTA5MTAwOTMzNDJaFw0yOTA5MDcw +OTMzNDJaMHIxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApEZXJieXNoaXJlMQ4wDAYD +VQQHDAVEZXJieTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3QxEDAOBgNVBAsM +B1Rlc3RpbmcxEDAOBgNVBAMMB1Jvb3QgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0A +MIGJAoGBAOGwkYR+cUbrn3AGkbdFImPx4tnYIsqT+MwGDNmQ33Q4Ng9ZwEJhsT2C +qGl0Txsj1HLo3goAFU/lZcvedtLT3sZKw1Jamwc7SS3H15Et9Ne9kQczaLekr74d +NpRWvgJMy3+YkBHsB04vFA45ruc4F7UnpljaovJ4sVadx0FyWdxbAgMBAAGjUDBO +MB0GA1UdDgQWBBTP8527vysU1aLl7EHPnBbQTauEBDAfBgNVHSMEGDAWgBTP8527 +vysU1aLl7EHPnBbQTauEBDAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4GB +ABRmECRQbiR9m27Qg8x8Auwus2xdxZTlKz2n8WV1HN8jE2b22g9kqAcamqcQXWYU +JklO18dNdpI2rpJa/rSi/Wcakp2STUnV03kqw7IZWyzCaDNZLRWWDHqsJhH91jzv +jFOhj81GLFVsAwsiTMV2FFk9XzYVpiV2syC7EgFvtjzH -----END CERTIFICATE----- diff --git a/test/ssl/test-root-ca.key b/test/ssl/test-root-ca.key index 7b7843f7..eb574d91 100644 --- a/test/ssl/test-root-ca.key +++ b/test/ssl/test-root-ca.key @@ -1,15 +1,15 @@ -----BEGIN RSA PRIVATE KEY----- -MIICXAIBAAKBgQCeTh1yKRZ1NIeLVvhBxSQC3Cvfe9L3IC8415CVbgipLgZKe7Nl -1JBqFYDxXKBn2eVQ6EwLsCz+U2oa2oCql8r5eYEKpmWFiIcKdrL8aSXNvMKEOu0A -JlsIXBe2sDFPxuuw143nW/odqBiWedciVd5pmJWZZ93neWdkkjnPZZMN4wIDAQAB -AoGAYXzLh20kJmOGAVo6og4sohJCdmtDvOo2CnQ91rgfX0g3mZDaJqCjmqDJelnH -cozuOkgD5MLGwoxN8GGVEPlPhiCzPIAp4ZIKcdpHxlAPmVRAhkLDgJuMD66OksPn -FxE5AqCUfZG+jpGy5KzlU2fyXyXt3zu9G6+Y9dbghXpnDekCQQDOxaGk50S2vJrJ -y5U+DaiSjr9+Qt6bDgdg2Q2ZE8oF3T6jI0QG/c9S3NbIRWe5HydrZ4YRn7GNmKQz -+Moy/43lAkEAw/6EwrUAfrJJ8TVeRsHLYs8H68Nswo0RQPqXSeLcqJc5AwqVfWpe -dJWSFpoHtelWfC7MMGrH26dwzt3YGUuwJwJBAIFqqyimY5ioZY1mMcv8CoVoeSyS -t/d+iVmxoNQt0aVn+7tp6DskAu6PMJN69VelyytrSTugoyXH4wZwckYHM40CQGYD -1JaEH/3STyp93NR3iqWjnTvaPIIHazOnO5f5vWEDVWl/2M+uzftg3ulkwx6slZeN -xDpvWhe6z7zdO93ux4ECQCXOCNFRha+Rs5Leyd4us6/6yo9o0rgHowNY8HIHBH9F -sEgq1pJxpSO3L7S5LpnhYkecIAHRzeGs1ikIDzIU/k4= +MIICXQIBAAKBgQDhsJGEfnFG659wBpG3RSJj8eLZ2CLKk/jMBgzZkN90ODYPWcBC +YbE9gqhpdE8bI9Ry6N4KABVP5WXL3nbS097GSsNSWpsHO0ktx9eRLfTXvZEHM2i3 +pK++HTaUVr4CTMt/mJAR7AdOLxQOOa7nOBe1J6ZY2qLyeLFWncdBclncWwIDAQAB +AoGAU6B1iz6/AqR0Y7JLdDlt0NLkWAw6eA30dsUXJdcEta/OeEmtb+t7HWu4s7qh +RVE1e47GF7aILx61ZaF9LgnL1cObEShIOHyr7WJHo5YXQhnHUMT/ltp0434vWTcp +40nOpkkb+QX92wRYsKBeB6byAsmSHgbVzwXY0ahy45IB/UECQQD+WVCh45eVWxb6 +xdCoxMPG8upMjkSoxQYulbgvKYNHGRZD7VRGnsULMUROsRUDB7QBmB3uvGEKV44Y +EN9OPXlTAkEA4yegcpPBEIaLtXHVHz0QSKk34sJfeyO1aW7QMdYVT6N7rRRnA1Pc +53ZzIC3Zk4ryeozSYLT1lTsh8lSjcwhH2QJBALBnJ4ov+/jFRUnFmnMCjLnVzfQs +k6fthd0XT7e99eOAnbWcy19zTDv3/mUJYgZI+GpGozPpiPAQS2ebhBSShCsCQQC0 +g/w0sYieyl1iLvkP3yX+qENaN99K62CyTbaztA6xgBi7vdfzRATsCCyLKQScBLKX +gyt4YLY9BoX+nxZZRv5ZAkBquUNGjXcKande80tMRKkU0LOfetMOQ/LllIe+TpNc +zBv71H8p0X9X32XV7cCmLUGG7mvc9R8jNfloBabamJfI -----END RSA PRIVATE KEY----- diff --git a/test/ssl/test-signing-ca.crt b/test/ssl/test-signing-ca.crt index f22216c8..1afb4ab0 100644 --- a/test/ssl/test-signing-ca.crt +++ b/test/ssl/test-signing-ca.crt @@ -2,57 +2,57 @@ Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) - Signature Algorithm: sha256WithRSAEncryption + Signature Algorithm: sha256WithRSAEncryption Issuer: C=GB, ST=Derbyshire, L=Derby, O=Mosquitto Project, OU=Testing, CN=Root CA Validity - Not Before: Sep 18 10:49:47 2018 GMT - Not After : Sep 17 10:49:47 2023 GMT + Not Before: Sep 10 09:33:42 2019 GMT + Not After : Sep 8 09:33:42 2024 GMT Subject: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Signing CA Subject Public Key Info: Public Key Algorithm: rsaEncryption - Public-Key: (1024 bit) + RSA Public-Key: (1024 bit) Modulus: - 00:b7:32:f2:08:04:4c:77:03:70:3e:10:88:84:cd: - cd:f2:87:2f:3c:67:8f:78:01:5e:d5:51:f1:11:68: - 4d:a7:e2:73:b0:69:b5:67:07:59:88:cc:b8:7f:ce: - 97:52:bc:fb:73:7b:60:95:a2:7b:c2:9a:f1:4d:5a: - c4:42:55:c4:6e:02:50:a1:71:41:68:d1:6c:96:e0: - 3d:af:10:3f:7b:64:c1:3a:3a:c3:a9:39:71:08:29: - 45:c8:cc:da:33:65:b4:70:fb:36:bc:15:0d:a7:31: - ef:d5:ec:59:ac:75:2b:77:35:0b:f0:db:3d:14:f5: - 9a:41:e6:a0:b7:b7:62:2b:e7 + 00:e3:39:bc:07:48:ed:c3:d2:3e:4f:a0:61:9a:2b: + e9:46:7a:68:33:52:01:1b:7f:45:88:49:05:85:fd: + 30:8c:2e:60:17:77:b3:38:c3:06:7c:fc:87:a8:61: + 29:03:86:07:20:8f:f8:d2:f0:bb:66:93:33:91:37: + ed:f6:64:b7:46:a5:f6:7d:f7:94:98:52:bc:78:90: + 6d:0b:db:61:c6:00:23:79:c2:a6:3b:2b:ee:c7:3d: + 96:97:9b:4e:eb:78:56:95:52:13:d4:5f:ea:18:85: + 18:0a:d6:d9:cd:4b:b0:15:ef:2f:f0:27:ef:b1:af: + d2:4f:ca:b8:93:c1:2f:2e:4f Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: - EE:60:BB:C7:17:5F:D3:72:AC:33:EE:8E:84:CC:2D:DB:1A:CC:8A:52 + EA:BE:42:EF:98:17:84:D5:FC:28:89:5A:4B:A5:B6:41:4F:7B:BB:28 X509v3 Authority Key Identifier: - keyid:DA:20:AB:E0:98:22:39:28:E0:70:D6:74:65:53:26:E0:6B:4C:96:39 + keyid:CF:F3:9D:BB:BF:2B:14:D5:A2:E5:EC:41:CF:9C:16:D0:4D:AB:84:04 X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha256WithRSAEncryption - 8a:98:17:cd:e1:dc:2b:1b:5b:16:40:99:21:c4:d4:db:3f:5c: - 6a:ed:7b:a2:b6:df:aa:7c:d8:6a:3f:11:39:da:4c:ce:3f:e5: - 99:6a:a4:b8:82:1e:53:7a:5d:f1:52:be:df:f1:3b:59:9a:a8: - bb:7e:f1:30:33:4b:7c:c3:ab:85:1e:c4:0e:ac:d1:7e:2b:cb: - 9d:19:5b:df:94:b4:89:e1:da:5d:31:19:85:34:d5:33:55:f8: - af:92:ea:9a:17:c9:da:68:00:df:10:e9:e4:33:35:cd:15:57: - 80:56:1a:58:94:37:d7:f2:02:de:9b:0b:d3:02:64:c5:8e:6f: - 25:31 + 0f:7d:4c:71:ef:5e:5d:a2:0e:09:da:37:bd:21:77:73:77:b1: + 02:7e:56:7d:82:c0:b9:53:77:c3:bb:9b:08:cf:00:b3:73:18: + 2d:c5:9c:1a:57:8c:2b:46:21:bf:28:2e:f4:6d:12:6a:c3:7f: + 8c:c6:a5:9b:bf:ed:47:cd:88:58:94:35:1f:5c:1e:a7:0d:17: + 96:5f:1b:70:ad:da:05:26:0c:52:d1:87:52:3c:e3:e1:23:ac: + aa:fa:f3:80:48:52:30:da:59:e2:de:0c:61:95:3c:63:ef:1d: + ec:b3:6d:c7:89:e6:e3:65:6c:be:d4:e7:a7:90:8c:f4:ff:1d: + 65:72 -----BEGIN CERTIFICATE----- MIICnTCCAgagAwIBAgIBATANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJHQjET MBEGA1UECAwKRGVyYnlzaGlyZTEOMAwGA1UEBwwFRGVyYnkxGjAYBgNVBAoMEU1v c3F1aXR0byBQcm9qZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRAwDgYDVQQDDAdSb290 -IENBMB4XDTE4MDkxODEwNDk0N1oXDTIzMDkxNzEwNDk0N1owZTELMAkGA1UEBhMC +IENBMB4XDTE5MDkxMDA5MzM0MloXDTI0MDkwODA5MzM0MlowZTELMAkGA1UEBhMC R0IxEzARBgNVBAgMCkRlcmJ5c2hpcmUxGjAYBgNVBAoMEU1vc3F1aXR0byBQcm9q ZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRMwEQYDVQQDDApTaWduaW5nIENBMIGfMA0G -CSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3MvIIBEx3A3A+EIiEzc3yhy88Z494AV7V -UfERaE2n4nOwabVnB1mIzLh/zpdSvPtze2CVonvCmvFNWsRCVcRuAlChcUFo0WyW -4D2vED97ZME6OsOpOXEIKUXIzNozZbRw+za8FQ2nMe/V7FmsdSt3NQvw2z0U9ZpB -5qC3t2Ir5wIDAQABo1AwTjAdBgNVHQ4EFgQU7mC7xxdf03KsM+6OhMwt2xrMilIw -HwYDVR0jBBgwFoAU2iCr4JgiOSjgcNZ0ZVMm4GtMljkwDAYDVR0TBAUwAwEB/zAN -BgkqhkiG9w0BAQsFAAOBgQCKmBfN4dwrG1sWQJkhxNTbP1xq7Xuitt+qfNhqPxE5 -2kzOP+WZaqS4gh5Tel3xUr7f8TtZmqi7fvEwM0t8w6uFHsQOrNF+K8udGVvflLSJ -4dpdMRmFNNUzVfivkuqaF8naaADfEOnkMzXNFVeAVhpYlDfX8gLemwvTAmTFjm8l -MQ== +CSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjObwHSO3D0j5PoGGaK+lGemgzUgEbf0WI +SQWF/TCMLmAXd7M4wwZ8/IeoYSkDhgcgj/jS8LtmkzORN+32ZLdGpfZ995SYUrx4 +kG0L22HGACN5wqY7K+7HPZaXm07reFaVUhPUX+oYhRgK1tnNS7AV7y/wJ++xr9JP +yriTwS8uTwIDAQABo1AwTjAdBgNVHQ4EFgQU6r5C75gXhNX8KIlaS6W2QU97uygw +HwYDVR0jBBgwFoAUz/Odu78rFNWi5exBz5wW0E2rhAQwDAYDVR0TBAUwAwEB/zAN +BgkqhkiG9w0BAQsFAAOBgQAPfUxx715dog4J2je9IXdzd7ECflZ9gsC5U3fDu5sI +zwCzcxgtxZwaV4wrRiG/KC70bRJqw3+MxqWbv+1HzYhYlDUfXB6nDReWXxtwrdoF +JgxS0YdSPOPhI6yq+vOASFIw2lni3gxhlTxj7x3ss23HiebjZWy+1OenkIz0/x1l +cg== -----END CERTIFICATE----- diff --git a/test/ssl/test-signing-ca.key b/test/ssl/test-signing-ca.key index 24262283..c41c1383 100644 --- a/test/ssl/test-signing-ca.key +++ b/test/ssl/test-signing-ca.key @@ -1,15 +1,15 @@ -----BEGIN RSA PRIVATE KEY----- -MIICXQIBAAKBgQC3MvIIBEx3A3A+EIiEzc3yhy88Z494AV7VUfERaE2n4nOwabVn -B1mIzLh/zpdSvPtze2CVonvCmvFNWsRCVcRuAlChcUFo0WyW4D2vED97ZME6OsOp -OXEIKUXIzNozZbRw+za8FQ2nMe/V7FmsdSt3NQvw2z0U9ZpB5qC3t2Ir5wIDAQAB -AoGAU6dZybtcx0O0r0KRdEMd9c8xDJ4lbyEBEtu1/sLoIu9O8JF0mjVK9yK0ZPgL -NWbCU3tVIT7u0HA8G5yE3d2YMfVCHTqkzrJ2pWlntgYcnYQSR2gjDnZl6iG/1VJ5 -aZh5+CjlwOstDiQLv+TKCfNVAa5Z4CC0jNt57tVuq/L0ieECQQDq4r+H5+DMUxaU -sXQgLizqTubMlhumcRTa+edgBWGLMbgK00wVeDpQD+j6qZFbiklll2fB5fF/Qj/c -D5RyByFZAkEAx6rEzYfIQLrJmy4RYcAlMFDMBvkpGTc1IGTDyjjsUmnOdF3ydnBx -GUqQzuf6Iv9Af64r1WUwSzA+iy200brPPwJBAODsEyasZ/qhEf1/VElAjmgs+Bwv -HfkrTiJGrkanwHmPOcK8BZ6Fi6mBIsNtvzDeYlxzOLtXWwNWyFoNXUQ4CbkCQQC8 -WhSjCibXIR1T/QY6nya1yFJfdaXWeqTsNQIZfs84A0XVslYqcnHOeO/Xry/g2cd/ -as9A097V3uHxKyG7Ay3DAkAtD9ifXcuCvtCeG5bsUlClOGmtzHX0Vw6ItYrI7WlX -lKJux35Y2z5E3/x2nHHvw1tuQnuwldU6lbSs3/cy67+d +MIICWwIBAAKBgQDjObwHSO3D0j5PoGGaK+lGemgzUgEbf0WISQWF/TCMLmAXd7M4 +wwZ8/IeoYSkDhgcgj/jS8LtmkzORN+32ZLdGpfZ995SYUrx4kG0L22HGACN5wqY7 +K+7HPZaXm07reFaVUhPUX+oYhRgK1tnNS7AV7y/wJ++xr9JPyriTwS8uTwIDAQAB +AoGAXKqD8xib1ptcTA7lHwG/bb2n1x4fU35w9eaJuR4LeW/EQm3PiluGvtwh2tpc +5pH3QCFW4XfJhUiM5DFB+5URZJpklcFZ77WNTm6T4ib1769MQWeh+Cyjm65VJZb7 +Bx4vlmxXs/pS47QNUG/xCMRZAxkHVlwIUFTolcJ51/2nbUECQQD/0L29S7F7yUX8 +1yWZYmnKPhNesien7ruD7NaVslDZanzCo3X0JTyVOnVYsTPt27yOcinyGnvEF0mN +bjwIRiLvAkEA42O2MLCzlNIw2AxlQiPskDN+s4lCs8T2rqZQ7O6aZgBFinKKQEtR +x5uQv8QALTi5yv/GWbTyhBgGBzIfyigqoQI/C/285yKlLyhAH5n2KTpzuwct4UJ4 +mWaXY5e2d03kfEyBjJ4c6VTVgik7Vuz3gi7Kp+KyFKcpJgfxaq/AIKMpAkAxHqAD +opgYZNNSSFMzV2lJuSX8iIEVLk4PajP/Cofl0tcy0g1VWC/hS5SYKDHVkvRnipsB +U9ozeLEMquI9HDIhAkEAgC/ceGB0UR7PjlTw3U4Fe2Shnv+0pdnFfSTKh6dS034y +JmHrZRqBMjHX4Hsph3Xjf6sy6SFKg67xeaeNmFoXZg== -----END RSA PRIVATE KEY----- diff --git a/www/pages/download.md b/www/pages/download.md index a2acb0e2..248fa01f 100644 --- a/www/pages/download.md +++ b/www/pages/download.md @@ -1,7 +1,7 @@ + +This is a bugfix release. + +# Compatibility +- The most recent version of libwebsockets (3.2.0) changed its behaviour and is + not compatible with Mosquitto. This has been fixed for the next libwebsockets + release. The 1.6.5 release refuses to compile with libwebsockets 3.2.0. All + previous versions of Mosquitto that use websockets are affected by the change + in behaviour. + +# Broker +- Fix v5 DISCONNECT packets with remaining length == 2 being treated as a + protocol error. Closes [#1367]. +- Fix support for libwebsockets 3.x (excluding 3.2.0) +- Fix slow websockets performance when sending large messages. Closes [#1390]. +- Fix bridges potentially not connecting on Windows. Closes [#478]. +- Fix clients authorised using `use_identity_as_username` or + `use_subject_as_username` being disconnected on SIGHUP. Closes [#1402]. +- Improve error messages in some situations when clients disconnect. Reduces + the number of "Socket error on client X, disconnecting" messages. +- Fix Will for v5 clients not being sent if will delay interval was greater + than the session expiry interval. Closes [#1401]. +- Fix CRL file not being reloaded on HUP. Closes [#35]. +- Fix repeated "Error in poll" messages on Windows when only websockets + listeners are defined. Closes [#1391]. + +# Client library +- Fix reconnect backoff for the situation where connections are dropped rather + than refused. Closes [#737]. +- Fix missing locks on `mosq->state`. Closes [#1374]. + +# Documentation +- Improve details on global/per listener options in the mosquitto.conf man page. + Closes [#274]. +- Clarify behaviour when clients exceed the `message_size_limit`. Closes [#448]. +- Improve documentation for `max_inflight_bytes`, `max_inflight_messages`, + and `max_queued_messages`. + +# Build +- Fix missing function warnings on NetBSD. +- Fix `WITH_STATIC_LIBRARIES` using CMake on Windows. Closes [#1369]. +- Guard `ssize_t` definition on Windows. Closes [#522]. + + +[#35]: https://github.com/eclipse/mosquitto/issues/35 +[#274]: https://github.com/eclipse/mosquitto/issues/274 +[#448]: https://github.com/eclipse/mosquitto/issues/448 +[#478]: https://github.com/eclipse/mosquitto/issues/478 +[#522]: https://github.com/eclipse/mosquitto/issues/522 +[#737]: https://github.com/eclipse/mosquitto/issues/737 +[#1367]: https://github.com/eclipse/mosquitto/issues/1367 +[#1369]: https://github.com/eclipse/mosquitto/issues/1369 +[#1374]: https://github.com/eclipse/mosquitto/issues/1374 +[#1390]: https://github.com/eclipse/mosquitto/issues/1390 +[#1391]: https://github.com/eclipse/mosquitto/issues/1391 +[#1401]: https://github.com/eclipse/mosquitto/issues/1401 +[#1402]: https://github.com/eclipse/mosquitto/issues/1402 diff --git a/www/posts/2019/09/version-1-6-6-released.md b/www/posts/2019/09/version-1-6-6-released.md new file mode 100644 index 00000000..8a3325c4 --- /dev/null +++ b/www/posts/2019/09/version-1-6-6-released.md @@ -0,0 +1,63 @@ + + +Mosquitto 1.6.6 and 1.5.9 have been released to address two security vulnerabilities. + +Titles and links will be updated once the CVE numbers are assigned. + +# CVE-2019-11779 + +A vulnerability exists in Mosquitto versions 1.5 to 1.6.5 inclusive, known as +[CVE-2019-11779]. + +If a client sends a SUBSCRIBE packet containing a topic that consists of +approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, +then a stack overflow will occur. + +The issue is fixed in Mosquitto 1.6.6 and 1.5.9. Patches for older versions are +available at + +The fix addresses the problem by restricting the allowed number of topic +hierarchy levels to 200. An alternative fix is to increase the size of the +stack by a small amount. + +# CVE-2019-11778 + +A vulnerability exists in Mosquitto version 1.6 to 1.6.4 inclusive, known as +[CVE-2019-11778] + +If an MQTT v5 client connects to Mosquitto, sets a last will and testament, +sets a will delay interval, sets a session expiry interval, and the will delay +interval is set longer than the session expiry interval, then a use after free +error occurs, which has the potential to cause a crash in some situations. + +The issue is fixed in Mosquitto 1.6.5. Patches for older versions are available +at + +# Version 1.6.6 Changes + +The complete list of fixes addressed in version 1.6.6 is: + +## Security + +* Restrict topic hierarchy to 200 levels to prevent possible stack overflow. + Closes [#1412]. + +## Broker +* Restrict topic hierarchy to 200 levels to prevent possible stack overflow. + Closes [#1412]. +* `mosquitto_passwd` now returns 1 when attempting to update a user that does + not exist. Closes [#1414]. + +[CVE-2019-11778]: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11778 +[CVE-2019-11779]: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11779 +[#1412]: https://github.com/eclipse/mosquitto/issues/1412 +[#1414]: https://github.com/eclipse/mosquitto/issues/1414 diff --git a/www/posts/2019/09/version-1-6-7-released.md b/www/posts/2019/09/version-1-6-7-released.md new file mode 100644 index 00000000..6ebf9ba5 --- /dev/null +++ b/www/posts/2019/09/version-1-6-7-released.md @@ -0,0 +1,35 @@ + + +Mosquitto 1.6.7 has been released, this is a bugfix release. + +# Broker +- Add workaround for working with libwebsockets 3.2.0. +- Fix potential crash when reloading config. Closes [#1424], [#1425]. + +# Client library +- Don't use `/` in autogenerated client ids, to avoid confusing with topics. +- Fix `mosquitto_max_inflight_messages_set()` and `mosquitto_int_option(..., + MOSQ_OPT_*_MAX, ...)` behaviour. Closes [#1417]. +- Fix regression on use of `mosquitto_connect_async()` not working. + Closes [#1415] and [#1422]. + +# Clients +- mosquitto_sub: Fix `-E` incorrectly not working unless `-d` was also + specified. [Closes #1418]. +- Updated documentation around automatic client ids. + +[#1415]: https://github.com/eclipse/mosquitto/issues/1415 +[#1417]: https://github.com/eclipse/mosquitto/issues/1417 +[#1418]: https://github.com/eclipse/mosquitto/issues/1418 +[#1422]: https://github.com/eclipse/mosquitto/issues/1422 +[#1424]: https://github.com/eclipse/mosquitto/issues/1424 +[#1425]: https://github.com/eclipse/mosquitto/issues/1425