From 494d3d29a09b010f6181c8eaa2e9da361b63e702 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Sun, 4 Aug 2019 23:00:26 +0100 Subject: [PATCH 01/57] Fix missing function warnings on NetBSD. Thanks to Greg Troxel. --- ChangeLog.txt | 4 ++++ lib/mosquitto.c | 1 + lib/property_mosq.c | 4 ++++ 3 files changed, 9 insertions(+) diff --git a/ChangeLog.txt b/ChangeLog.txt index ba660d80..d010dad4 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -1,3 +1,7 @@ +Build: +- Fix missing function warnings on NetBSD. + + 1.6.4 - 20190801 ================ diff --git a/lib/mosquitto.c b/lib/mosquitto.c index 4b5768f3..795013eb 100644 --- a/lib/mosquitto.c +++ b/lib/mosquitto.c @@ -21,6 +21,7 @@ Contributors: #include #ifndef WIN32 #include +#include #endif #include "mosquitto.h" diff --git a/lib/property_mosq.c b/lib/property_mosq.c index d3854cff..f489136c 100644 --- a/lib/property_mosq.c +++ b/lib/property_mosq.c @@ -20,6 +20,10 @@ Contributors: #include #include +#ifndef WIN32 +# include +#endif + #include "logging_mosq.h" #include "memory_mosq.h" #include "mqtt_protocol.h" From 50695f8103907fdb6a99425db0542926cf53287e Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Mon, 5 Aug 2019 21:13:23 +0100 Subject: [PATCH 02/57] Fix v5 DISCONNECT packets with remaining length == 2. These were being treated as a protocol error. Closes #1367. Thanks to Frank Pagliughi. --- ChangeLog.txt | 4 ++++ src/handle_disconnect.c | 6 +++--- test/broker/01-connect-disconnect-v5.py | 26 ++++++++++++++++++++----- 3 files changed, 28 insertions(+), 8 deletions(-) diff --git a/ChangeLog.txt b/ChangeLog.txt index d010dad4..f449d651 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -1,3 +1,7 @@ +Broker: +- Fix v5 DISCONNECT packets with remaining length == 2 being treated as a + protocol error. Closes #1367. + Build: - Fix missing function warnings on NetBSD. diff --git a/src/handle_disconnect.c b/src/handle_disconnect.c index 72db7dd3..77671aca 100644 --- a/src/handle_disconnect.c +++ b/src/handle_disconnect.c @@ -34,12 +34,12 @@ int handle__disconnect(struct mosquitto_db *db, struct mosquitto *context) return MOSQ_ERR_INVAL; } - if(context->protocol == mosq_p_mqtt5 && context->in_packet.remaining_length > 1){ + if(context->protocol == mosq_p_mqtt5 && context->in_packet.remaining_length > 0){ /* FIXME - must handle reason code */ rc = packet__read_byte(&context->in_packet, &reason_code); if(rc) return rc; - if(context->in_packet.remaining_length > 2){ + if(context->in_packet.remaining_length > 1){ rc = property__read_all(CMD_DISCONNECT, &context->in_packet, &properties); if(rc) return rc; } @@ -54,7 +54,7 @@ int handle__disconnect(struct mosquitto_db *db, struct mosquitto *context) } mosquitto_property_free_all(&properties); /* FIXME - TEMPORARY UNTIL PROPERTIES PROCESSED */ - if(context->in_packet.remaining_length != 0){ + if(context->in_packet.pos != context->in_packet.remaining_length){ return MOSQ_ERR_PROTOCOL; } log__printf(NULL, MOSQ_LOG_DEBUG, "Received DISCONNECT from %s", context->id); diff --git a/test/broker/01-connect-disconnect-v5.py b/test/broker/01-connect-disconnect-v5.py index 45fa601f..5486fdf6 100755 --- a/test/broker/01-connect-disconnect-v5.py +++ b/test/broker/01-connect-disconnect-v5.py @@ -7,16 +7,32 @@ from mosq_test_helper import * def disco_test(test, disconnect_packet): global rc - sock = mosq_test.do_client_connect(connect_packet, connack_packet, port=port) - sock.send(disconnect_packet) - sock.close() + sock1 = mosq_test.do_client_connect(connect1_packet, connack1_packet, port=port) + mosq_test.do_send_receive(sock1, subscribe1_packet, suback1_packet, "suback1") + + + sock2 = mosq_test.do_client_connect(connect2_packet, connack2_packet, port=port) + sock2.send(disconnect_packet) + sock2.close() + + # If this fails then we probably received the will + mosq_test.do_ping(sock1) + rc -= 1 rc = 4 keepalive = 10 -connect_packet = mosq_test.gen_connect("connect-disconnect-test", proto_ver=5, keepalive=keepalive) -connack_packet = mosq_test.gen_connack(rc=0, proto_ver=5) + +connect1_packet = mosq_test.gen_connect("sub", proto_ver=5, keepalive=keepalive) +connack1_packet = mosq_test.gen_connack(rc=0, proto_ver=5) + +mid = 1 +subscribe1_packet = mosq_test.gen_subscribe(mid, "#", 0, proto_ver=5) +suback1_packet = mosq_test.gen_suback(mid, 0, proto_ver=5) + +connect2_packet = mosq_test.gen_connect("connect-disconnect-test", proto_ver=5, keepalive=keepalive, will_topic="failure", will_payload=b"failure") +connack2_packet = mosq_test.gen_connack(rc=0, proto_ver=5) port = mosq_test.get_port() broker = mosq_test.start_broker(filename=os.path.basename(__file__), port=port) From a0e7165a9cfa639a4c2cefe967e09bade4955998 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Tue, 6 Aug 2019 12:01:29 +0100 Subject: [PATCH 03/57] Fix WITH_STATIC_LIBRARIES using CMake on Windows Closes #1369. Thanks to TimmvonderMehden --- CMakeLists.txt | 3 +++ ChangeLog.txt | 1 + client/CMakeLists.txt | 13 +++++++++---- lib/CMakeLists.txt | 4 +--- lib/cpp/CMakeLists.txt | 2 +- lib/cpp/mosquittopp.h | 2 +- 6 files changed, 16 insertions(+), 9 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index c670628d..ff1c4e23 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -50,6 +50,9 @@ endif (WITH_SOCKS) option(WITH_SRV "Include SRV lookup support?" OFF) +option(WITH_STATIC_LIBRARIES "Build static versions of the libmosquitto/pp libraries?" OFF) +option(WITH_PIC "Build the static library with PIC (Position Independent Code) enabled archives?" OFF) + option(WITH_THREADING "Include client library threading support?" ON) if (WITH_THREADING) add_definitions("-DWITH_THREADING") diff --git a/ChangeLog.txt b/ChangeLog.txt index f449d651..22bdc2d8 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -4,6 +4,7 @@ Broker: Build: - Fix missing function warnings on NetBSD. +- Fix WITH_STATIC_LIBRARIES using CMake on Windows. Closes #1369. 1.6.4 - 20190801 diff --git a/client/CMakeLists.txt b/client/CMakeLists.txt index d928650c..6aa24b2b 100644 --- a/client/CMakeLists.txt +++ b/client/CMakeLists.txt @@ -13,10 +13,15 @@ add_executable(mosquitto_pub pub_client.c pub_shared.c ${shared_src}) add_executable(mosquitto_sub sub_client.c sub_client_output.c ${shared_src}) add_executable(mosquitto_rr rr_client.c pub_shared.c sub_client_output.c ${shared_src}) - -target_link_libraries(mosquitto_pub libmosquitto) -target_link_libraries(mosquitto_sub libmosquitto) -target_link_libraries(mosquitto_rr libmosquitto) +if (WITH_STATIC_LIBRARIES) + target_link_libraries(mosquitto_pub libmosquitto_static) + target_link_libraries(mosquitto_sub libmosquitto_static) + target_link_libraries(mosquitto_rr libmosquitto_static) +else() + target_link_libraries(mosquitto_pub libmosquitto) + target_link_libraries(mosquitto_sub libmosquitto) + target_link_libraries(mosquitto_rr libmosquitto) +endif() if (QNX) target_link_libraries(mosquitto_pub socket) diff --git a/lib/CMakeLists.txt b/lib/CMakeLists.txt index 221c2307..e1521f12 100644 --- a/lib/CMakeLists.txt +++ b/lib/CMakeLists.txt @@ -1,5 +1,3 @@ -option(WITH_STATIC_LIBRARIES "Build static versions of the libmosquitto/pp libraries?" OFF) -option(WITH_PIC "Build the static library with PIC (Position Independent Code) enabled archives?" OFF) add_subdirectory(cpp) include_directories(${mosquitto_SOURCE_DIR} ${mosquitto_SOURCE_DIR}/lib @@ -102,7 +100,7 @@ if (WITH_STATIC_LIBRARIES) target_link_libraries(libmosquitto_static ${LIBRARIES}) set_target_properties(libmosquitto_static PROPERTIES - OUTPUT_NAME mosquitto + OUTPUT_NAME mosquitto_static VERSION ${VERSION} ) diff --git a/lib/cpp/CMakeLists.txt b/lib/cpp/CMakeLists.txt index 89eb560f..b39ac3f5 100644 --- a/lib/cpp/CMakeLists.txt +++ b/lib/cpp/CMakeLists.txt @@ -29,7 +29,7 @@ if (WITH_STATIC_LIBRARIES) target_link_libraries(mosquittopp_static ${LIBRARIES}) set_target_properties(mosquittopp_static PROPERTIES - OUTPUT_NAME mosquittopp + OUTPUT_NAME mosquittopp_static VERSION ${VERSION} ) diff --git a/lib/cpp/mosquittopp.h b/lib/cpp/mosquittopp.h index 8d2e98b0..d3f388c0 100644 --- a/lib/cpp/mosquittopp.h +++ b/lib/cpp/mosquittopp.h @@ -17,7 +17,7 @@ Contributors: #ifndef MOSQUITTOPP_H #define MOSQUITTOPP_H -#ifdef _WIN32 +#if defined(_WIN32) && !defined(LIBMOSQUITTO_STATIC) # ifdef mosquittopp_EXPORTS # define mosqpp_EXPORT __declspec(dllexport) # else From be07c842d1a8266244f9a68f96fc67cbc504de1d Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Wed, 7 Aug 2019 11:32:26 +0100 Subject: [PATCH 04/57] Don't error trying to cleanup missing persistence file. --- test/broker/04-retain-check-source-persist-diff-port.py | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/test/broker/04-retain-check-source-persist-diff-port.py b/test/broker/04-retain-check-source-persist-diff-port.py index aa6fc246..fddeba48 100755 --- a/test/broker/04-retain-check-source-persist-diff-port.py +++ b/test/broker/04-retain-check-source-persist-diff-port.py @@ -3,6 +3,7 @@ # Test for CVE-2018-12546, with the broker being stopped to write the persistence file, plus subscriber on different port. from mosq_test_helper import * +import os.path import signal def write_config(filename, port1, port2, per_listener): @@ -79,6 +80,8 @@ def do_test(per_listener, username): write_acl_2(acl_file, username) broker.terminate() broker.wait() + if os.path.isfile(persistence_file) == False: + raise FileNotFoundError("Persistence file not written") broker = mosq_test.start_broker(filename=os.path.basename(__file__), use_conf=True, port=port1) @@ -94,7 +97,10 @@ def do_test(per_listener, username): broker.wait() os.remove(conf_file) os.remove(acl_file) - os.remove(persistence_file) + try: + os.remove(persistence_file) + except FileNotFoundError: + pass (stdo, stde) = broker.communicate() if rc: print(stde.decode('utf-8')) From c169ad6abb8ddae9220f87ba6319f0a666c142f7 Mon Sep 17 00:00:00 2001 From: Dan Langille Date: Mon, 12 Aug 2019 18:46:45 -0400 Subject: [PATCH 05/57] $HOME/.config/mosquitto_sub or pub? Should $HOME/.config/mosquitto_sub be $HOME/.config/mosquitto_pub? It seems to be that way based on my testing. I think this is a copy/paste error. --- man/mosquitto_pub.1.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/man/mosquitto_pub.1.xml b/man/mosquitto_pub.1.xml index 2c1a425c..b51a79bc 100644 --- a/man/mosquitto_pub.1.xml +++ b/man/mosquitto_pub.1.xml @@ -116,7 +116,7 @@ The options below may be given on the command line, but may also be placed in a config file located at or - with one pair of + with one pair of per line. The values in the config file will be used as defaults and can be overridden by using the command line. The exceptions to From abfdc2f8a64b49ff1bd2944360995ee3e2d1a5ae Mon Sep 17 00:00:00 2001 From: YangHau Date: Fri, 16 Aug 2019 01:55:59 +0800 Subject: [PATCH 06/57] Remove useless if statement If statement for detecting if a pointer is NULL is totally unnecessary. Signed-off-by: YangHau --- src/db_dump/db_dump.c | 28 +++++++--------------------- 1 file changed, 7 insertions(+), 21 deletions(-) diff --git a/src/db_dump/db_dump.c b/src/db_dump/db_dump.c index 618a6784..455f1eeb 100644 --- a/src/db_dump/db_dump.c +++ b/src/db_dump/db_dump.c @@ -100,42 +100,28 @@ struct msg_store_chunk *msgs_by_id = NULL; static void free__db_sub(struct db_sub *sub) { - if (sub->client_id) { - free(sub->client_id); - } - if (sub->topic) { - free(sub->topic); - } + free(sub->client_id); + free(sub->topic); } static void free__db_client(struct db_client *client) { - if (client->client_id) { - free(client->client_id); - } + free(client->client_id); } static void free__db_client_msg(struct db_client_msg *msg) { - if (msg->client_id) { - free(msg->client_id); - } + free(msg->client_id); } static void free__db_msg(struct db_msg *msg) { - if (msg->source_id) { - free(msg->source_id); - } - if (msg->topic) { - free(msg->topic); - } - if (msg->payload) { - free(msg->payload); - } + free(msg->source_id); + free(msg->topic); + free(msg->payload); } static void From 4c4ca389383df3006556d8608d5f4e44467d8224 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Thu, 29 Aug 2019 12:12:05 +0100 Subject: [PATCH 07/57] Fix support for libwebsockets 3.x. --- ChangeLog.txt | 1 + src/websockets.c | 14 +++----------- 2 files changed, 4 insertions(+), 11 deletions(-) diff --git a/ChangeLog.txt b/ChangeLog.txt index 22bdc2d8..526a3c87 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -1,6 +1,7 @@ Broker: - Fix v5 DISCONNECT packets with remaining length == 2 being treated as a protocol error. Closes #1367. +- Fix support for libwebsockets 3.x. Build: - Fix missing function warnings on NetBSD. diff --git a/src/websockets.c b/src/websockets.c index 8a6d3aa4..02a1e56c 100644 --- a/src/websockets.c +++ b/src/websockets.c @@ -180,7 +180,7 @@ static int callback_mqtt(struct libwebsocket_context *context, struct mosquitto_db *db; struct mosquitto *mosq = NULL; struct mosquitto__packet *packet; - int count, i, j; + int count; const struct libwebsocket_protocols *p; struct libws_mqtt_data *u = (struct libws_mqtt_data *)user; size_t pos; @@ -195,16 +195,7 @@ static int callback_mqtt(struct libwebsocket_context *context, mosq = context__init(db, WEBSOCKET_CLIENT); if(mosq){ p = libwebsockets_get_protocol(wsi); - for (i=0; iconfig->listener_count; i++){ - if (db->config->listeners[i].protocol == mp_websockets) { - for (j=0; db->config->listeners[i].ws_protocol[j].name; j++){ - if (p == &db->config->listeners[i].ws_protocol[j]){ - mosq->listener = &db->config->listeners[i]; - mosq->listener->client_count++; - } - } - } - } + mosq->listener = p->user; if(!mosq->listener){ mosquitto__free(mosq); return -1; @@ -715,6 +706,7 @@ struct libwebsocket_context *mosq_websockets_init(struct mosquitto__listener *li p[i].callback = protocols[i].callback; p[i].per_session_data_size = protocols[i].per_session_data_size; p[i].rx_buffer_size = protocols[i].rx_buffer_size; + p[i].user = listener; } memset(&info, 0, sizeof(info)); From 4658dba6b35c823ecf4f8c4c203bdf82ee7610c8 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Thu, 29 Aug 2019 13:23:26 +0100 Subject: [PATCH 08/57] Fix slow websockets performance when sending large messages. Closes #1390. Thanks to aalibasic. --- ChangeLog.txt | 1 + src/websockets.c | 21 +++++++++++++++++---- 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/ChangeLog.txt b/ChangeLog.txt index 526a3c87..722eaf41 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -2,6 +2,7 @@ Broker: - Fix v5 DISCONNECT packets with remaining length == 2 being treated as a protocol error. Closes #1367. - Fix support for libwebsockets 3.x. +- Fix slow websockets performance when sending large messages. Closes #1390. Build: - Fix missing function warnings on NetBSD. diff --git a/src/websockets.c b/src/websockets.c index 02a1e56c..df5dd4d1 100644 --- a/src/websockets.c +++ b/src/websockets.c @@ -47,6 +47,12 @@ POSSIBILITY OF SUCH DAMAGE. # include #endif +/* Be careful if changing these, if TX is not bigger than SERV then there can + * be very large write performance penalties. + */ +#define WS_SERV_BUF_SIZE 4096 +#define WS_TX_BUF_SIZE (WS_SERV_BUF_SIZE*2) + extern struct mosquitto_db int_db; #if defined(LWS_LIBRARY_VERSION_NUMBER) @@ -97,7 +103,7 @@ static struct libwebsocket_protocols protocols[] = { #ifdef LWS_LIBRARY_VERSION_NUMBER NULL, /* user v1.4 on */ # if LWS_LIBRARY_VERSION_NUMBER >= 2003000 - 0 /* tx_packet_size v2.3.0 */ + WS_TX_BUF_SIZE /* tx_packet_size v2.3.0 */ # endif #endif }, @@ -115,7 +121,7 @@ static struct libwebsocket_protocols protocols[] = { #ifdef LWS_LIBRARY_VERSION_NUMBER NULL, /* user v1.4 on */ # if LWS_LIBRARY_VERSION_NUMBER >= 2003000 - 0 /* tx_packet_size v2.3.0 */ + WS_TX_BUF_SIZE /* tx_packet_size v2.3.0 */ # endif #endif }, @@ -133,7 +139,7 @@ static struct libwebsocket_protocols protocols[] = { #ifdef LWS_LIBRARY_VERSION_NUMBER NULL, /* user v1.4 on */ # if LWS_LIBRARY_VERSION_NUMBER >= 2003000 - 0 /* tx_packet_size v2.3.0 */ + WS_TX_BUF_SIZE /* tx_packet_size v2.3.0 */ # endif #endif }, @@ -180,6 +186,7 @@ static int callback_mqtt(struct libwebsocket_context *context, struct mosquitto_db *db; struct mosquitto *mosq = NULL; struct mosquitto__packet *packet; + size_t txlen; int count; const struct libwebsocket_protocols *p; struct libws_mqtt_data *u = (struct libws_mqtt_data *)user; @@ -287,7 +294,12 @@ static int callback_mqtt(struct libwebsocket_context *context, memmove(&packet->payload[LWS_SEND_BUFFER_PRE_PADDING], packet->payload, packet->packet_length); packet->pos += LWS_SEND_BUFFER_PRE_PADDING; } - count = libwebsocket_write(wsi, &packet->payload[packet->pos], packet->to_process, LWS_WRITE_BINARY); + if(packet->to_process > WS_TX_BUF_SIZE){ + txlen = WS_TX_BUF_SIZE; + }else{ + txlen = packet->to_process; + } + count = libwebsocket_write(wsi, &packet->payload[packet->pos], txlen, LWS_WRITE_BINARY); if(count < 0){ if (mosq->state == mosq_cs_disconnect_ws || mosq->state == mosq_cs_disconnecting){ return -1; @@ -757,6 +769,7 @@ struct libwebsocket_context *mosq_websockets_init(struct mosquitto__listener *li } info.user = user; + info.pt_serv_buf_size = WS_SERV_BUF_SIZE; listener->ws_protocol = p; lws_set_log_level(conf->websockets_log_level, log_wrap); From 6f4e472260caa4c63a3ecf9f5c7a5a3dcd8aa567 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Wed, 4 Sep 2019 13:45:21 +0100 Subject: [PATCH 09/57] Improve details on global/per listener options in the mosquitto.conf man page. Closes #274. --- ChangeLog.txt | 4 + man/mosquitto.conf.5.xml | 170 +++++++++++++++++++++++++++++++++------ 2 files changed, 151 insertions(+), 23 deletions(-) diff --git a/ChangeLog.txt b/ChangeLog.txt index 722eaf41..35b8a953 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -4,6 +4,10 @@ Broker: - Fix support for libwebsockets 3.x. - Fix slow websockets performance when sending large messages. Closes #1390. +Documentation: +- Improve details on global/per listener options in the mosquitto.conf man page. + Closes #274. + Build: - Fix missing function warnings on NetBSD. - Fix WITH_STATIC_LIBRARIES using CMake on Windows. Closes #1369. diff --git a/man/mosquitto.conf.5.xml b/man/mosquitto.conf.5.xml index bcc88bc6..68d48b5d 100644 --- a/man/mosquitto.conf.5.xml +++ b/man/mosquitto.conf.5.xml @@ -132,7 +132,7 @@ for the topic keyword, but using pattern as the keyword. pattern [read|write|readwrite] <topic> - + The patterns available for substition are: %c to match the client id of the client @@ -151,6 +151,13 @@ If the first character of a line of the ACL file is a # it is treated as a comment. + If is + true, this option applies to + the current listener being configured only. If + is + false, this option applies + to all listeners. + Reloaded on reload signal. The currently loaded ACLs will be freed and reloaded. Existing subscriptions will be affected after the reload. @@ -171,6 +178,14 @@ username/password or TLS-PSK checks, then defaults to false. + + If is + true, this option applies to + the current listener being configured only. If + is + false, this option applies + to all listeners. + Reloaded on reload signal. @@ -196,17 +211,28 @@ correctly deal with duplicate messages even when then have QoS=2. Defaults to true. + + This option applies globally. + Reloaded on reload signal. [ true | false ] - MQTT 3.1.1 allows clients to connect with a zero + MQTT 3.1.1 and MQTT 5 allow clients to connect with a zero length client id and have the broker generate a client id for them. Use this option to allow/disallow this behaviour. Defaults to true. See also the option. + + If is + true, this option applies to + the current listener being configured only. If + is + false, this option applies + to all listeners. + Reloaded on reload signal. @@ -214,7 +240,9 @@ value Options to be passed to the auth plugin. See the - specific plugin instructions. + specific plugin instructions. + + Applies to the current authentication plugin being configured. @@ -256,6 +284,8 @@ checks delivered to your plugin by setting this option to false. Defaults to true. + + Applies to the current authentication plugin being configured. Not currently reloaded on reload signal. @@ -267,6 +297,14 @@ to set a string that will be prefixed to the automatically generated client ids to aid visibility in logs. Defaults to . + + If is + true, this option applies to + the current listener being configured only. If + is + false, this option applies + to all listeners. + Reloaded on reload signal. @@ -280,6 +318,9 @@ SIGUSR1 signal. Note that this setting only has an effect if persistence is enabled. Defaults to 1800 seconds (30 minutes). + + This option applies globally. + Reloaded on reload signal. @@ -295,6 +336,9 @@ the in-memory database to disk by treating as a time in seconds. + + This option applies globally. + Reloaded on reload signal. @@ -325,6 +369,9 @@ "secure-" here would mean a client "secure-client" could connect but another with clientid "mqtt" couldn't. By default, all client ids are valid. + + This option applies globally. + Reloaded on reload signal. Note that currently connected clients will be unaffected by any changes. @@ -337,6 +384,9 @@ will include entries when clients connect and disconnect. If set to false, these entries will not appear. + + This option applies globally. + Reloaded on reload signal. @@ -502,9 +552,11 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S count QoS 1 and 2 messages will be allowed in flight until this byte - limit is reached. Defaults to 0. (No limit) - See also the option. - + limit is reached. Defaults to 0. (No limit) + See also the option. + + This option applies globally. + Reloaded on reload signal. @@ -518,6 +570,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S Defaults to 20. Set to 0 for no maximum. If set to 1, this will guarantee in-order delivery of messages. + + This option applies globally. + Reloaded on reload signal. @@ -537,6 +592,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S max_keepalive. This only applies to MQTT v5 clients. The maximum value allowable, and default value, is 65535. Do not set below 10 seconds. + + This option applies globally. + Reloaded on reload signal. @@ -559,6 +617,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S Setting below 20 bytes is forbidden because it is likely to interfere with normal client operation even with small payloads. + + This option applies globally. + Reloaded on reload signal. @@ -572,6 +633,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S If both max_queued_messages and max_queued_bytes are specified, packets will be queued until the first limit is reached. + + This option applies globally. + Reloaded on reload signal. @@ -583,8 +647,10 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S in flight. Defaults to 100. Set to 0 for no maximum (not recommended). See also the and - options. - + options. + + This option applies globally. + Reloaded on reload signal. @@ -615,6 +681,10 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S The default value is 0, which means that all valid MQTT messages are accepted. MQTT imposes a maximum payload size of 268435455 bytes. + + This option applies globally. + + Reloaded on reload signal. @@ -638,6 +708,14 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S valid and could be used with acl_file to have e.g. read only guest/anonymous accounts and defined users that can publish. + + If is + true, this option applies to + the current listener being configured only. If + is + false, this option applies + to all listeners. + Reloaded on reload signal. The currently loaded username and password data will be freed and reloaded. Clients that are already connected will not be @@ -693,6 +771,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S copy of the persistence file before installing a new version so that they can roll back to an earlier version if necessary. + + This option applies globally. + Reloaded on reload signal. @@ -701,6 +782,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S The filename to use for the persistent database. Defaults to mosquitto.db. + + This option applies globally. + Reloaded on reload signal. @@ -710,6 +794,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S The path where the persistence database should be stored. Must end in a trailing slash. If not given, then the current directory is used. + + This option applies globally. + Reloaded on reload signal. @@ -735,6 +822,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S As this is a non-standard option, the default if not set is to never expire persistent clients. + + This option applies globally. + Reloaded on reload signal. @@ -765,6 +855,14 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S listener that has PSK support enabled must provide a matching identity and PSK to allow the encrypted connection to proceed. + + If is + true, this option applies to + the current listener being configured only. If + is + false, this option applies + to all listeners. + Reloaded on reload signal. The currently loaded identity and key data will be freed and reloaded. Clients that are already connected will not be @@ -781,6 +879,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S Note that the MQTT v3.1.1 spec states that only QoS 1 and 2 messages should be saved in this situation so this is a non-standard option. + + This option applies globally. + Reloaded on reload signal. @@ -791,6 +892,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S supported. Clients that send a message with the retain bit will be disconnected if this option is set to false. Defaults to true. + + This option applies globally. + Reloaded on reload signal. @@ -810,6 +914,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S has the effect of reducing latency of some messages at potentially increasing the number of TCP packets being sent. Defaults to false. + + This option applies globally. + Reloaded on reload signal. @@ -822,6 +929,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S seconds. Set to 0 to disable publishing the $SYS hierarchy completely. + + This option applies globally. + Reloaded on reload signal. @@ -838,6 +948,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S subscription. This is a non-standard option not provided for by the spec. Defaults to false. + + This option applies globally. + Reloaded on reload signal. @@ -848,7 +961,8 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S group on startup. If mosquitto is unable to change to this user and group, it will exit with an error. The user specified must have read/write access to the - persistence database if it is to be written. If run as + persistence database if it is to be written, and read + access to certificate, password, and ACL files. If run as a non-root user, this setting has no effect. Defaults to mosquitto. This setting has no effect on Windows and so you @@ -876,8 +990,14 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S to restrict access to certain network interfaces. To restrict access to mosquitto to the local host only, use "bind_address localhost". This only - applies to the default listener. Use the listener - variable to control other listeners. + applies to the default listener. Use the + option to control other + listeners. + + It is recommended to use an explicit + rather than rely on the + implicit default listener options like this. + Not reloaded on reload signal. @@ -955,7 +1075,7 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S count - Limit the QoS value allowed when using this + Limit the QoS value allowed for clients connecting to this listener. Defaults to 2, which means any QoS can be used. Set to 0 or 1 to limit to those QoS values. This makes use of an MQTT v5 feature to notify @@ -970,9 +1090,9 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S number This option sets the maximum number topic aliases - that an MQTT v5 client is allowed to create. It + that an MQTT v5 client is allowed to create. This option applies per listener. Defaults to 10. Set to 0 to - disallow topic aliases. + disallow topic aliases. The maximum value possible is 65535. Not reloaded on reload signal. @@ -998,12 +1118,16 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S Set the network port for the default listener to listen on. Defaults to 1883. Not reloaded on reload signal. + + It is recommended to use an explicit + rather than rely on the + implicit default listener options like this. value - Set the protocol to accept for this listener. Can + Set the protocol to accept for the current listener. Can be , the default, or if available. Websockets support is currently disabled by @@ -1095,7 +1219,7 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S file path At least one of or - must be provided to allow + must be provided to enable SSL support. is used to define the path to a file containing the PEM encoded CA @@ -1106,7 +1230,7 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S directory path At least one of or - must be provided to allow + must be provided to enable SSL support. is used to define a directory that contains PEM encoded CA certificates @@ -1170,11 +1294,11 @@ openssl dhparam -out dhparam.pem 2048 trusted certificate. The overall aim is encryption of the network traffic. By setting to - true, the client must - provide a valid certificate in order for the - network connection to proceed. This allows access - to the broker to be controlled outside of the - mechanisms provided by MQTT. + true, a client connecting + to this listener must provide a valid certificate in + order for the network connection to proceed. This + allows access to the broker to be controlled outside + of the mechanisms provided by MQTT. @@ -1462,7 +1586,7 @@ openssl dhparam -out dhparam.pem 2048 [ true | false ] If set to true, only publish - notification messages to the local broker giving + notification messages to the local broker giving information about the state of the bridge connection. Defaults to false. From 14e1ae09dc5444a1b4fc336d5a60f9d8865c1321 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Wed, 4 Sep 2019 13:59:12 +0100 Subject: [PATCH 10/57] max_packet_size applies to 3.1.1 and 3.1 clients as well --- man/mosquitto.conf.5.xml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/man/mosquitto.conf.5.xml b/man/mosquitto.conf.5.xml index 68d48b5d..2ed50cf2 100644 --- a/man/mosquitto.conf.5.xml +++ b/man/mosquitto.conf.5.xml @@ -614,6 +614,11 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S using, but v3.1.1 and earlier clients will of course not have received the maximum packet size information. Defaults to no limit. + + This option applies to all clients, not just those + using MQTT v5, but it is not possible to notify clients + using MQTT v3.1.1 or MQTT v3.1 of the limit. + Setting below 20 bytes is forbidden because it is likely to interfere with normal client operation even with small payloads. From 01530a3f074aba95cc5837d95630e1077ee41fa9 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Wed, 4 Sep 2019 17:11:13 +0100 Subject: [PATCH 11/57] Improve message_size_limit and various max_* option docs. Closes #448. --- ChangeLog.txt | 3 +++ man/mosquitto.conf.5.xml | 29 ++++++++++++++++++++--------- 2 files changed, 23 insertions(+), 9 deletions(-) diff --git a/ChangeLog.txt b/ChangeLog.txt index 35b8a953..a3515e7f 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -7,6 +7,9 @@ Broker: Documentation: - Improve details on global/per listener options in the mosquitto.conf man page. Closes #274. +- Clarify behaviour when clients exceed the `message_size_limit`. Closes #448. +- Improve documentation for `max_inflight_bytes`, `max_inflight_messages`, + and `max_queued_messages`. Build: - Fix missing function warnings on NetBSD. diff --git a/man/mosquitto.conf.5.xml b/man/mosquitto.conf.5.xml index 2ed50cf2..c4c728ae 100644 --- a/man/mosquitto.conf.5.xml +++ b/man/mosquitto.conf.5.xml @@ -551,9 +551,12 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S count - QoS 1 and 2 messages will be allowed in flight until this byte - limit is reached. Defaults to 0. (No limit) - See also the option. + Outgoing QoS 1 and 2 messages will be allowed in flight until this byte + limit is reached. This allows control of outgoing message rate based on + message size rather than message count. If the limit is set to 100, + messages of over 100 bytes are still allowed, but only a single message + can be in flight at once. Defaults to 0. (No limit). + See also the option. This option applies globally. @@ -563,7 +566,7 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S count - The maximum number of QoS 1 or 2 messages that can be + The maximum number of outgoing QoS 1 or 2 messages that can be in the process of being transmitted simultaneously. This includes messages currently going through handshakes and messages that are being retried. @@ -631,9 +634,12 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S count - QoS 1 and 2 messages above those currently in-flight will be - queued (per client) until this limit is exceeded. - Defaults to 0. (No maximum) See also the + The number of outgoing QoS 1 and 2 messages above those currently in-flight will be + queued (per client) by the broker. Once this limit has been reached, subsequent + messages will be silently dropped. This is an important option if you are sending + messages at a high rate and/or have clients who are slow to respond or may be offline + for extended periods of time. Defaults to 0. (No maximum). + See also the option. If both max_queued_messages and max_queued_bytes are specified, packets will be queued until the first limit is reached. @@ -682,8 +688,13 @@ log_timestamp_format %Y-%m-%dT%H:%M:%S This option sets the maximum publish payload size that the broker will allow. Received messages that - exceed this size will not be accepted by the broker. - The default value is 0, which means that all valid MQTT + exceed this size will not be accepted by the broker. This means that the + message will not be forwarded on to subscribing clients, but the QoS flow + will be completed for QoS 1 or QoS 2 messages. MQTT v5 clients using QoS 1 + or QoS 2 will receive a PUBACK or PUBREC with the "implementation specific + error" reason code. + + The default value is 0, which means that all valid MQTT messages are accepted. MQTT imposes a maximum payload size of 268435455 bytes. From 76865707b2adf07efe1466ef590d54a92f376f8b Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Wed, 4 Sep 2019 17:30:44 +0100 Subject: [PATCH 12/57] Guard ssize_t definition on Windows. Closes #522. Thanks to trinytron. --- ChangeLog.txt | 1 + lib/net_mosq.h | 7 +++++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/ChangeLog.txt b/ChangeLog.txt index a3515e7f..b7340480 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -14,6 +14,7 @@ Documentation: Build: - Fix missing function warnings on NetBSD. - Fix WITH_STATIC_LIBRARIES using CMake on Windows. Closes #1369. +- Guard ssize_t definition on Windows. Closes #522. 1.6.4 - 20190801 diff --git a/lib/net_mosq.h b/lib/net_mosq.h index b843ebe3..0ed4c219 100644 --- a/lib/net_mosq.h +++ b/lib/net_mosq.h @@ -17,10 +17,13 @@ Contributors: #define NET_MOSQ_H #ifndef WIN32 -#include +# include #else -#include +# include +# ifndef _SSIZE_T_DEFINED typedef SSIZE_T ssize_t; +# define _SSIZE_T_DEFINED +# endif #endif #include "mosquitto_internal.h" From 412379b03baaf546652c787ec1b734ea564be884 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Wed, 4 Sep 2019 17:51:16 +0100 Subject: [PATCH 13/57] Fix bridges potentially not connecting on Windows. Closes #478. --- ChangeLog.txt | 1 + lib/packet_mosq.c | 6 +++++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/ChangeLog.txt b/ChangeLog.txt index b7340480..e794a95a 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -3,6 +3,7 @@ Broker: protocol error. Closes #1367. - Fix support for libwebsockets 3.x. - Fix slow websockets performance when sending large messages. Closes #1390. +- Fix bridges potentially not connecting on Windows. Closes #478. Documentation: - Improve details on global/per listener options in the mosquitto.conf man page. diff --git a/lib/packet_mosq.c b/lib/packet_mosq.c index 22df79e5..dc545435 100644 --- a/lib/packet_mosq.c +++ b/lib/packet_mosq.c @@ -239,7 +239,11 @@ int packet__write(struct mosquitto *mosq) #ifdef WIN32 errno = WSAGetLastError(); #endif - if(errno == EAGAIN || errno == COMPAT_EWOULDBLOCK){ + if(errno == EAGAIN || errno == COMPAT_EWOULDBLOCK +#ifdef WIN32 + || errno == WSAENOTCONN +#endif + ){ pthread_mutex_unlock(&mosq->current_out_packet_mutex); return MOSQ_ERR_SUCCESS; }else{ From ba918ac73e1e3f2707eb78964a14749164aa6b9a Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Wed, 4 Sep 2019 22:20:13 +0100 Subject: [PATCH 14/57] Fix reconnect backoff where connections are dropped Closes #737. Thanks to chelliwell. --- ChangeLog.txt | 4 ++++ lib/handle_connack.c | 3 +++ lib/loop.c | 12 +++++------- lib/mosquitto_internal.h | 1 + 4 files changed, 13 insertions(+), 7 deletions(-) diff --git a/ChangeLog.txt b/ChangeLog.txt index e794a95a..09bb0eec 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -5,6 +5,10 @@ Broker: - Fix slow websockets performance when sending large messages. Closes #1390. - Fix bridges potentially not connecting on Windows. Closes #478. +Client library: +- Fix reconnect backoff for the situation where connections are dropped rather + than refused. Closes #737. + Documentation: - Improve details on global/per listener options in the mosquitto.conf man page. Closes #274. diff --git a/lib/handle_connack.c b/lib/handle_connack.c index 60780f6c..ab66ff0f 100644 --- a/lib/handle_connack.c +++ b/lib/handle_connack.c @@ -31,6 +31,9 @@ Contributors: static void connack_callback(struct mosquitto *mosq, uint8_t reason_code, uint8_t connect_flags, const mosquitto_property *properties) { log__printf(mosq, MOSQ_LOG_DEBUG, "Client %s received CONNACK (%d)", mosq->id, reason_code); + if(reason_code == MQTT_RC_SUCCESS){ + mosq->reconnects = 0; + } pthread_mutex_lock(&mosq->callback_mutex); if(mosq->on_connect){ mosq->in_callback = true; diff --git a/lib/loop.c b/lib/loop.c index 36763e06..0f751a9c 100644 --- a/lib/loop.c +++ b/lib/loop.c @@ -194,7 +194,6 @@ int mosquitto_loop_forever(struct mosquitto *mosq, int timeout, int max_packets) { int run = 1; int rc; - unsigned int reconnects = 0; unsigned long reconnect_delay; #ifndef WIN32 struct timespec req, rem; @@ -202,6 +201,8 @@ int mosquitto_loop_forever(struct mosquitto *mosq, int timeout, int max_packets) if(!mosq) return MOSQ_ERR_INVAL; + mosq->reconnects = 0; + if(mosq->state == mosq_cs_connect_async){ mosquitto_reconnect(mosq); } @@ -209,9 +210,6 @@ int mosquitto_loop_forever(struct mosquitto *mosq, int timeout, int max_packets) while(run){ do{ rc = mosquitto_loop(mosq, timeout, max_packets); - if (reconnects !=0 && rc == MOSQ_ERR_SUCCESS){ - reconnects = 0; - } }while(run && rc == MOSQ_ERR_SUCCESS); /* Quit after fatal errors. */ switch(rc){ @@ -245,9 +243,9 @@ int mosquitto_loop_forever(struct mosquitto *mosq, int timeout, int max_packets) if(mosq->reconnect_delay_max > mosq->reconnect_delay){ if(mosq->reconnect_exponential_backoff){ - reconnect_delay = mosq->reconnect_delay*(reconnects+1)*(reconnects+1); + reconnect_delay = mosq->reconnect_delay*(mosq->reconnects+1)*(mosq->reconnects+1); }else{ - reconnect_delay = mosq->reconnect_delay*(reconnects+1); + reconnect_delay = mosq->reconnect_delay*(mosq->reconnects+1); } }else{ reconnect_delay = mosq->reconnect_delay; @@ -256,7 +254,7 @@ int mosquitto_loop_forever(struct mosquitto *mosq, int timeout, int max_packets) if(reconnect_delay > mosq->reconnect_delay_max){ reconnect_delay = mosq->reconnect_delay_max; }else{ - reconnects++; + mosq->reconnects++; } #ifdef WIN32 diff --git a/lib/mosquitto_internal.h b/lib/mosquitto_internal.h index ff656a43..da16dae0 100644 --- a/lib/mosquitto_internal.h +++ b/lib/mosquitto_internal.h @@ -326,6 +326,7 @@ struct mosquitto { char *host; int port; char *bind_address; + unsigned int reconnects; unsigned int reconnect_delay; unsigned int reconnect_delay_max; bool reconnect_exponential_backoff; From f6b22f824841574b121689efad485dd7807a71b5 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Thu, 5 Sep 2019 11:37:43 +0100 Subject: [PATCH 15/57] Fix clients using `use_identity_as_*` being disconnected on SIGHUP. Closes #1402. Thanks to twegener-embertec. --- ChangeLog.txt | 2 + src/security_default.c | 133 ++++++++++++++++++++++++++- test/broker/08-ssl-hup-disconnect.py | 72 +++++++++++++++ test/broker/Makefile | 1 + test/broker/test.py | 1 + 5 files changed, 205 insertions(+), 4 deletions(-) create mode 100755 test/broker/08-ssl-hup-disconnect.py diff --git a/ChangeLog.txt b/ChangeLog.txt index 09bb0eec..44faf4ef 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -4,6 +4,8 @@ Broker: - Fix support for libwebsockets 3.x. - Fix slow websockets performance when sending large messages. Closes #1390. - Fix bridges potentially not connecting on Windows. Closes #478. +- Fix clients authorised using `use_identity_as_username` or + `use_subject_as_username` being disconnected on SIGHUP. Closes #1402. Client library: - Fix reconnect backoff for the situation where connections are dropped rather diff --git a/src/security_default.c b/src/security_default.c index cf5d81b6..c14f8c5f 100644 --- a/src/security_default.c +++ b/src/security_default.c @@ -21,6 +21,8 @@ Contributors: #include "mosquitto_broker_internal.h" #include "memory_mosq.h" +#include "mqtt_protocol.h" +#include "send_mosq.h" #include "util_mosq.h" static int aclfile__parse(struct mosquitto_db *db, struct mosquitto__security_options *security_opts); @@ -939,6 +941,18 @@ static int unpwd__cleanup(struct mosquitto__unpwd **root, bool reload) return MOSQ_ERR_SUCCESS; } + +#ifdef WITH_TLS +static void security__disconnect_auth(struct mosquitto_db *db, struct mosquitto *context) +{ + if(context->protocol == mosq_p_mqtt5){ + send__disconnect(context, MQTT_RC_ADMINISTRATIVE_ACTION, NULL); + } + context__set_state(context, mosq_cs_disconnecting); + do_disconnect(db, context, MOSQ_ERR_AUTH); +} +#endif + /* Apply security settings after a reload. * Includes: * - Disconnecting anonymous users if appropriate @@ -951,6 +965,13 @@ int mosquitto_security_apply_default(struct mosquitto_db *db) struct mosquitto__acl_user *acl_user_tail; bool allow_anonymous; struct mosquitto__security_options *security_opts = NULL; +#ifdef WITH_TLS + int i; + X509 *client_cert = NULL; + X509_NAME *name; + X509_NAME_ENTRY *name_entry; + ASN1_STRING *name_asn1 = NULL; +#endif if(!db) return MOSQ_ERR_INVAL; @@ -973,12 +994,116 @@ int mosquitto_security_apply_default(struct mosquitto_db *db) do_disconnect(db, context, MOSQ_ERR_AUTH); continue; } + /* Check for connected clients that are no longer authorised */ - if(mosquitto_unpwd_check(db, context, context->username, context->password) != MOSQ_ERR_SUCCESS){ - context__set_state(context, mosq_cs_disconnecting); - do_disconnect(db, context, MOSQ_ERR_AUTH); - continue; +#ifdef WITH_TLS + if(context->listener->ssl_ctx && (context->listener->use_identity_as_username || context->listener->use_subject_as_username)){ + /* Client must have either a valid certificate, or valid PSK used as a username. */ + if(!context->ssl){ + if(context->protocol == mosq_p_mqtt5){ + send__disconnect(context, MQTT_RC_ADMINISTRATIVE_ACTION, NULL); + } + context__set_state(context, mosq_cs_disconnecting); + do_disconnect(db, context, MOSQ_ERR_AUTH); + continue; + } +#ifdef FINAL_WITH_TLS_PSK + if(context->listener->psk_hint){ + /* Client should have provided an identity to get this far. */ + if(!context->username){ + security__disconnect_auth(db, context); + continue; + } + }else +#endif /* FINAL_WITH_TLS_PSK */ + { + client_cert = SSL_get_peer_certificate(context->ssl); + if(!client_cert){ + security__disconnect_auth(db, context); + continue; + } + name = X509_get_subject_name(client_cert); + if(!name){ + X509_free(client_cert); + client_cert = NULL; + security__disconnect_auth(db, context); + continue; + } + if (context->listener->use_identity_as_username) { //use_identity_as_username + i = X509_NAME_get_index_by_NID(name, NID_commonName, -1); + if(i == -1){ + X509_free(client_cert); + client_cert = NULL; + security__disconnect_auth(db, context); + continue; + } + name_entry = X509_NAME_get_entry(name, i); + if(name_entry){ + name_asn1 = X509_NAME_ENTRY_get_data(name_entry); + if (name_asn1 == NULL) { + X509_free(client_cert); + client_cert = NULL; + security__disconnect_auth(db, context); + continue; + } +#if OPENSSL_VERSION_NUMBER < 0x10100000L + context->username = mosquitto__strdup((char *) ASN1_STRING_data(name_asn1)); +#else + context->username = mosquitto__strdup((char *) ASN1_STRING_get0_data(name_asn1)); +#endif + if(!context->username){ + X509_free(client_cert); + client_cert = NULL; + security__disconnect_auth(db, context); + continue; + } + /* Make sure there isn't an embedded NUL character in the CN */ + if ((size_t)ASN1_STRING_length(name_asn1) != strlen(context->username)) { + X509_free(client_cert); + client_cert = NULL; + security__disconnect_auth(db, context); + continue; + } + } + } else { // use_subject_as_username + BIO *subject_bio = BIO_new(BIO_s_mem()); + X509_NAME_print_ex(subject_bio, X509_get_subject_name(client_cert), 0, XN_FLAG_RFC2253); + char *data_start = NULL; + long name_length = BIO_get_mem_data(subject_bio, &data_start); + char *subject = mosquitto__malloc(sizeof(char)*name_length+1); + if(!subject){ + BIO_free(subject_bio); + X509_free(client_cert); + client_cert = NULL; + security__disconnect_auth(db, context); + continue; + } + memcpy(subject, data_start, name_length); + subject[name_length] = '\0'; + BIO_free(subject_bio); + context->username = subject; + } + if(!context->username){ + X509_free(client_cert); + client_cert = NULL; + security__disconnect_auth(db, context); + continue; + } + X509_free(client_cert); + client_cert = NULL; + } + }else +#endif + { + /* Username/password check only if the identity/subject check not used */ + if(mosquitto_unpwd_check(db, context, context->username, context->password) != MOSQ_ERR_SUCCESS){ + context__set_state(context, mosq_cs_disconnecting); + do_disconnect(db, context, MOSQ_ERR_AUTH); + continue; + } } + + /* Check for ACLs and apply to user. */ if(db->config->per_listener_settings){ if(context->listener){ diff --git a/test/broker/08-ssl-hup-disconnect.py b/test/broker/08-ssl-hup-disconnect.py new file mode 100755 index 00000000..bd591823 --- /dev/null +++ b/test/broker/08-ssl-hup-disconnect.py @@ -0,0 +1,72 @@ +#!/usr/bin/env python3 + +# Test whether a client connected with a client certificate when +# use_identity_as_username is true is then disconnected when a SIGHUP is +# received. +# https://github.com/eclipse/mosquitto/issues/1402 + +from mosq_test_helper import * +import signal + +if sys.version < '2.7': + print("WARNING: SSL not supported on Python 2.6") + exit(0) + +def write_config(filename, pw_file, port, option): + with open(filename, 'w') as f: + f.write("listener %d\n" % (port)) + f.write("cafile ../ssl/all-ca.crt\n") + f.write("certfile ../ssl/server.crt\n") + f.write("keyfile ../ssl/server.key\n") + f.write("require_certificate true\n") + f.write("%s true\n" % (option)) + f.write("password_file %s\n" % (pw_file)) + +def write_pwfile(filename): + with open(filename, 'w') as f: + # Username "test client", password test + f.write('test client:$6$njERlZMi/7DzNB9E$iiavfuXvUm8iyDZArTy7smTxh07GXXOrOsqxfW6gkOYVXHGk+W+i/8d3xDxrMwEPygEBhoA8A/gjQC0N2M4Lkw==\n') + +def do_test(option): + port = mosq_test.get_port() + conf_file = os.path.basename(__file__).replace('.py', '.conf') + pw_file = os.path.basename(__file__).replace('.py', '.pwfile') + write_config(conf_file, pw_file, port, option) + write_pwfile(pw_file) + + rc = 1 + keepalive = 10 + connect_packet = mosq_test.gen_connect("connect-success-test", keepalive=keepalive) + connack_packet = mosq_test.gen_connack(rc=0) + + broker = mosq_test.start_broker(filename=os.path.basename(__file__), port=port, use_conf=True) + + try: + sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) + ssock = ssl.wrap_socket(sock, ca_certs="../ssl/test-root-ca.crt", certfile="../ssl/client.crt", keyfile="../ssl/client.key", cert_reqs=ssl.CERT_REQUIRED) + ssock.settimeout(20) + ssock.connect(("localhost", port)) + mosq_test.do_send_receive(ssock, connect_packet, connack_packet, "connack") + + broker.send_signal(signal.SIGHUP) + time.sleep(1) + + # This will fail if we've been disconnected + mosq_test.do_ping(ssock) + rc = 0 + + ssock.close() + finally: + os.remove(conf_file) + os.remove(pw_file) + broker.terminate() + broker.wait() + (stdo, stde) = broker.communicate() + if rc: + print(stde.decode('utf-8')) + exit(rc) + +do_test("use_identity_as_username") +do_test("use_subject_as_username") +exit(0) + diff --git a/test/broker/Makefile b/test/broker/Makefile index 8da4d7fa..cf5d6d1b 100644 --- a/test/broker/Makefile +++ b/test/broker/Makefile @@ -160,6 +160,7 @@ ifeq ($(WITH_TLS),yes) ./08-ssl-connect-no-auth-wrong-ca.py ./08-ssl-connect-no-auth.py ./08-ssl-connect-no-identity.py + ./08-ssl-hup-disconnect.py ifeq ($(WITH_TLS_PSK),yes) ./08-tls-psk-pub.py ./08-tls-psk-bridge.py diff --git a/test/broker/test.py b/test/broker/test.py index afaa5388..3c681531 100755 --- a/test/broker/test.py +++ b/test/broker/test.py @@ -132,6 +132,7 @@ tests = [ (2, './08-ssl-connect-no-auth-wrong-ca.py'), (2, './08-ssl-connect-no-auth.py'), (2, './08-ssl-connect-no-identity.py'), + (1, './08-ssl-hup-disconnect.py'), (2, './08-tls-psk-pub.py'), (3, './08-tls-psk-bridge.py'), From 779c6cc234acab3622ae0831ba58ff7942824781 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Thu, 5 Sep 2019 12:10:04 +0100 Subject: [PATCH 16/57] Fix leak introduced in previous commit. --- src/security_default.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/src/security_default.c b/src/security_default.c index c14f8c5f..369b6d85 100644 --- a/src/security_default.c +++ b/src/security_default.c @@ -1017,6 +1017,12 @@ int mosquitto_security_apply_default(struct mosquitto_db *db) }else #endif /* FINAL_WITH_TLS_PSK */ { + /* Free existing credentials and then recover them. */ + mosquitto__free(context->username); + context->username = NULL; + mosquitto__free(context->password); + context->password = NULL; + client_cert = SSL_get_peer_certificate(context->ssl); if(!client_cert){ security__disconnect_auth(db, context); From f1516f86cbf193a39d6b4815743b36636ce37046 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Thu, 5 Sep 2019 12:31:52 +0100 Subject: [PATCH 17/57] Improve error messages in some situations when clients disconnect. Reduces the number of "Socket error on client X, disconnecting" messages. --- ChangeLog.txt | 2 ++ src/loop.c | 11 +++++++---- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/ChangeLog.txt b/ChangeLog.txt index 44faf4ef..54d16ff9 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -6,6 +6,8 @@ Broker: - Fix bridges potentially not connecting on Windows. Closes #478. - Fix clients authorised using `use_identity_as_username` or `use_subject_as_username` being disconnected on SIGHUP. Closes #1402. +- Improve error messages in some situations when clients disconnect. Reduces + the number of "Socket error on client X, disconnecting" messages. Client library: - Fix reconnect backoff for the situation where connections are dropped rather diff --git a/src/loop.c b/src/loop.c index 50959599..4e2e4c5c 100644 --- a/src/loop.c +++ b/src/loop.c @@ -709,6 +709,7 @@ static void loop_handle_reads_writes(struct mosquitto_db *db, struct pollfd *pol #endif int err; socklen_t len; + int rc; #ifdef WITH_EPOLL int i; @@ -780,8 +781,9 @@ static void loop_handle_reads_writes(struct mosquitto_db *db, struct pollfd *pol continue; } } - if(packet__write(context)){ - do_disconnect(db, context, MOSQ_ERR_CONN_LOST); + rc = packet__write(context); + if(rc){ + do_disconnect(db, context, rc); continue; } } @@ -822,8 +824,9 @@ static void loop_handle_reads_writes(struct mosquitto_db *db, struct pollfd *pol #endif #endif do{ - if(packet__read(db, context)){ - do_disconnect(db, context, MOSQ_ERR_CONN_LOST); + rc = packet__read(db, context); + if(rc){ + do_disconnect(db, context, rc); continue; } }while(SSL_DATA_PENDING(context)); From 3c35c6cdd98b695d58b005de6c0e8387f1eaf050 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Thu, 5 Sep 2019 12:46:46 +0100 Subject: [PATCH 18/57] Fix Will not being sent if will delay greater than session expiry. Closes #1401. Thanks to Will Lisac. --- ChangeLog.txt | 2 + src/session_expiry.c | 3 ++ test/broker/07-will-delay-session-expiry.py | 52 +++++++++++++++++++++ test/broker/Makefile | 1 + test/broker/test.py | 1 + 5 files changed, 59 insertions(+) create mode 100755 test/broker/07-will-delay-session-expiry.py diff --git a/ChangeLog.txt b/ChangeLog.txt index 54d16ff9..65817c97 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -8,6 +8,8 @@ Broker: `use_subject_as_username` being disconnected on SIGHUP. Closes #1402. - Improve error messages in some situations when clients disconnect. Reduces the number of "Socket error on client X, disconnecting" messages. +- Fix Will for v5 clients not being sent if will delay interval was greater + than the session expiry interval. Closes #1401. Client library: - Fix reconnect backoff for the situation where connections are dropped rather diff --git a/src/session_expiry.c b/src/session_expiry.c index 68540a71..c0270e37 100644 --- a/src/session_expiry.c +++ b/src/session_expiry.c @@ -100,7 +100,10 @@ void session_expiry__check(struct mosquitto_db *db, time_t now) context = item->context; session_expiry__remove(context); + /* Session has now expired, so clear interval */ context->session_expiry_interval = 0; + /* Session has expired, so will delay should be cleared. */ + context->will_delay_interval = 0; context__send_will(db, context); context__add_to_disused(db, context); }else{ diff --git a/test/broker/07-will-delay-session-expiry.py b/test/broker/07-will-delay-session-expiry.py new file mode 100755 index 00000000..833c84cc --- /dev/null +++ b/test/broker/07-will-delay-session-expiry.py @@ -0,0 +1,52 @@ +#!/usr/bin/env python3 + +# Test whether a client that connects with a will delay that is longer than +# their session expiry interval has their will published. +# MQTT 5 +# https://github.com/eclipse/mosquitto/issues/1401 + +from mosq_test_helper import * + +rc = 1 +keepalive = 60 + +mid = 1 +connect1_packet = mosq_test.gen_connect("will-test", keepalive=keepalive, proto_ver=5) +connack1_packet = mosq_test.gen_connack(rc=0, proto_ver=5) + +will_props = mqtt5_props.gen_uint32_prop(mqtt5_props.PROP_WILL_DELAY_INTERVAL, 4) +connect_props = mqtt5_props.gen_uint32_prop(mqtt5_props.PROP_SESSION_EXPIRY_INTERVAL, 2) + +connect2_packet = mosq_test.gen_connect("will-helper", keepalive=keepalive, proto_ver=5, properties=connect_props, will_topic="will/test", will_payload=b"will delay", will_qos=2, will_properties=will_props) +connack2_packet = mosq_test.gen_connack(rc=0, proto_ver=5) + +subscribe_packet = mosq_test.gen_subscribe(mid, "will/test", 0, proto_ver=5) +suback_packet = mosq_test.gen_suback(mid, 0, proto_ver=5) + +publish_packet = mosq_test.gen_publish("will/test", qos=0, payload="will delay", proto_ver=5) + +port = mosq_test.get_port() +broker = mosq_test.start_broker(filename=os.path.basename(__file__), port=port) + +try: + sock1 = mosq_test.do_client_connect(connect1_packet, connack1_packet, timeout=30, port=port, connack_error="connack1") + mosq_test.do_send_receive(sock1, subscribe_packet, suback_packet, "suback") + + sock2 = mosq_test.do_client_connect(connect2_packet, connack2_packet, timeout=30, port=port, connack_error="connack2") + time.sleep(1) + sock2.close() + + # Wait for session to expire + time.sleep(3) + if mosq_test.expect_packet(sock1, "publish", publish_packet): + rc = 0 + + sock1.close() +finally: + broker.terminate() + broker.wait() + (stdo, stde) = broker.communicate() + if rc: + print(stde.decode('utf-8')) + exit(rc) + diff --git a/test/broker/Makefile b/test/broker/Makefile index cf5d6d1b..fb6cda1e 100644 --- a/test/broker/Makefile +++ b/test/broker/Makefile @@ -138,6 +138,7 @@ endif 07 : ./07-will-delay-reconnect.py ./07-will-delay-recover.py + ./07-will-delay-session-expiry.py ./07-will-delay.py ./07-will-disconnect-with-will.py ./07-will-invalid-utf8.py diff --git a/test/broker/test.py b/test/broker/test.py index 3c681531..5aadbbee 100755 --- a/test/broker/test.py +++ b/test/broker/test.py @@ -112,6 +112,7 @@ tests = [ (1, './07-will-delay-reconnect.py'), (1, './07-will-delay-recover.py'), + (1, './07-will-delay-session-expiry.py'), (1, './07-will-delay.py'), (1, './07-will-disconnect-with-will.py'), (1, './07-will-invalid-utf8.py'), From d03a318702ed62af99a14116e40883a37cbb48b8 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Thu, 5 Sep 2019 15:23:53 +0100 Subject: [PATCH 19/57] Ignore SSL artifacts. --- .gitignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitignore b/.gitignore index 134e17c6..443be88c 100644 --- a/.gitignore +++ b/.gitignore @@ -62,6 +62,8 @@ test/broker/c/auth_plugin.so test/broker/c/*.test test/ssl/*.csr +test/ssl/rootCA/ +test/ssl/signingCA/ test/lib/c/*.test test/lib/cpp/*.test From 5fd92cbfbd04dc2ade346dffadb004de3e9a408c Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Fri, 6 Sep 2019 22:28:11 +0100 Subject: [PATCH 20/57] Further fix for #1401. --- src/session_expiry.c | 2 ++ src/will_delay.c | 1 + 2 files changed, 3 insertions(+) diff --git a/src/session_expiry.c b/src/session_expiry.c index c0270e37..e720b703 100644 --- a/src/session_expiry.c +++ b/src/session_expiry.c @@ -79,6 +79,7 @@ void session_expiry__remove_all(struct mosquitto_db *db) session_expiry__remove(context); context->session_expiry_interval = 0; context->will_delay_interval = 0; + will_delay__remove(context); context__disconnect(db, context); } @@ -104,6 +105,7 @@ void session_expiry__check(struct mosquitto_db *db, time_t now) context->session_expiry_interval = 0; /* Session has expired, so will delay should be cleared. */ context->will_delay_interval = 0; + will_delay__remove(context); context__send_will(db, context); context__add_to_disused(db, context); }else{ diff --git a/src/will_delay.c b/src/will_delay.c index 4bed7a87..8d2be08a 100644 --- a/src/will_delay.c +++ b/src/will_delay.c @@ -96,6 +96,7 @@ void will_delay__remove(struct mosquitto *mosq) { if(mosq->will_delay_entry != NULL){ DL_DELETE(delay_list, mosq->will_delay_entry); + mosquitto__free(mosq->will_delay_entry); mosq->will_delay_entry = NULL; } } From b9638ddb1abf8e114e781fd761366bf9bef472f7 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Fri, 6 Sep 2019 22:35:30 +0100 Subject: [PATCH 21/57] alpine doesn't use glibc, so no memory tracking Closes #1404. Thanks to Lichard Torman. --- docker/1.5/Dockerfile | 1 - docker/1.6/Dockerfile | 1 - docker/local/Dockerfile | 1 - 3 files changed, 3 deletions(-) diff --git a/docker/1.5/Dockerfile b/docker/1.5/Dockerfile index 0d71797f..83dee964 100644 --- a/docker/1.5/Dockerfile +++ b/docker/1.5/Dockerfile @@ -59,7 +59,6 @@ RUN set -x && \ LDFLAGS="-L/build/lws/lib -flto" \ WITH_ADNS=no \ WITH_DOCS=no \ - WITH_MEMORY_TRACKING=no \ WITH_SHARED_LIBRARIES=no \ WITH_SRV=no \ WITH_STRIP=yes \ diff --git a/docker/1.6/Dockerfile b/docker/1.6/Dockerfile index e88e7c74..39baa657 100644 --- a/docker/1.6/Dockerfile +++ b/docker/1.6/Dockerfile @@ -59,7 +59,6 @@ RUN set -x && \ LDFLAGS="-L/build/lws/lib" \ WITH_ADNS=no \ WITH_DOCS=no \ - WITH_MEMORY_TRACKING=yes \ WITH_SHARED_LIBRARIES=yes \ WITH_SRV=no \ WITH_STRIP=yes \ diff --git a/docker/local/Dockerfile b/docker/local/Dockerfile index f0360e46..06527a69 100644 --- a/docker/local/Dockerfile +++ b/docker/local/Dockerfile @@ -40,7 +40,6 @@ RUN set -x && \ LDFLAGS="-L/build/lws/lib" \ WITH_ADNS=no \ WITH_DOCS=no \ - WITH_MEMORY_TRACKING=yes \ WITH_SHARED_LIBRARIES=yes \ WITH_SRV=no \ WITH_STRIP=yes \ From 034324c46d9cc0901ab4847878cf971e98561bfb Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Sat, 7 Sep 2019 21:45:56 +0100 Subject: [PATCH 22/57] Fix websockets 3.2 causing slow connection on non-websockets listeners Closes #1406. Thanks to pbrenna. --- src/loop.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/loop.c b/src/loop.c index 4e2e4c5c..25882954 100644 --- a/src/loop.c +++ b/src/loop.c @@ -590,7 +590,7 @@ int mosquitto_main_loop(struct mosquitto_db *db, mosq_sock_t *listensock, int li * will soon, so for now websockets clients are second class * citizens. */ if(db->config->listeners[i].ws_context){ - libwebsocket_service(db->config->listeners[i].ws_context, 0); + libwebsocket_service(db->config->listeners[i].ws_context, -1); } } if(db->config->have_websockets_listener){ From 39803e538f6092c4d38c4a68e08f7a758170558b Mon Sep 17 00:00:00 2001 From: Matt Woelfel Date: Thu, 5 Sep 2019 08:13:44 -0500 Subject: [PATCH 23/57] Fix usage of tls_engine and tls_keyform. The current implementation does not properly forward the engine parameters to OpenSSL causing OpenSSL to incorrectly attempt to open the engine key uri as a file. Sponsored-by: Trimble, Inc. Signed-off-by: Matt Woelfel --- src/bridge.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/bridge.c b/src/bridge.c index 7b46daf6..640fb407 100644 --- a/src/bridge.c +++ b/src/bridge.c @@ -88,6 +88,8 @@ int bridge__new(struct mosquitto_db *db, struct mosquitto__bridge *bridge) new_context->tls_version = new_context->bridge->tls_version; new_context->tls_insecure = new_context->bridge->tls_insecure; new_context->tls_alpn = new_context->bridge->tls_alpn; + new_context->tls_engine = db->config->default_listener.tls_engine; + new_context->tls_keyform = db->config->default_listener.tls_keyform; #ifdef FINAL_WITH_TLS_PSK new_context->tls_psk_identity = new_context->bridge->tls_psk_identity; new_context->tls_psk = new_context->bridge->tls_psk; From 43ed161ea01d13597eed88b5620a062327915ef2 Mon Sep 17 00:00:00 2001 From: Heiko Bornholdt Date: Mon, 26 Aug 2019 13:52:23 +0200 Subject: [PATCH 24/57] Add missing EXPOSE instruction to all Dockerfiles Signed-off-by: Heiko Bornholdt --- docker/1.4.12/Dockerfile | 1 + docker/1.5/Dockerfile | 1 + docker/1.6/Dockerfile | 1 + docker/generic/Dockerfile | 1 + docker/local/Dockerfile | 1 + 5 files changed, 5 insertions(+) diff --git a/docker/1.4.12/Dockerfile b/docker/1.4.12/Dockerfile index be20a14f..a8ab47d0 100644 --- a/docker/1.4.12/Dockerfile +++ b/docker/1.4.12/Dockerfile @@ -9,5 +9,6 @@ RUN apk --no-cache add mosquitto=1.4.12-r0 && \ chown -R mosquitto:mosquitto /mosquitto COPY docker-entrypoint.sh / +EXPOSE 1883 ENTRYPOINT ["/docker-entrypoint.sh"] CMD ["/usr/sbin/mosquitto", "-c", "/mosquitto/config/mosquitto.conf"] diff --git a/docker/1.5/Dockerfile b/docker/1.5/Dockerfile index 0d71797f..9ede1cd3 100644 --- a/docker/1.5/Dockerfile +++ b/docker/1.5/Dockerfile @@ -84,5 +84,6 @@ VOLUME ["/mosquitto/data", "/mosquitto/log"] # Set up the entry point script and default command COPY docker-entrypoint.sh / +EXPOSE 1883 ENTRYPOINT ["/docker-entrypoint.sh"] CMD ["/usr/sbin/mosquitto", "-c", "/mosquitto/config/mosquitto.conf"] diff --git a/docker/1.6/Dockerfile b/docker/1.6/Dockerfile index e88e7c74..a537f84a 100644 --- a/docker/1.6/Dockerfile +++ b/docker/1.6/Dockerfile @@ -86,5 +86,6 @@ VOLUME ["/mosquitto/data", "/mosquitto/log"] # Set up the entry point script and default command COPY docker-entrypoint.sh / +EXPOSE 1883 ENTRYPOINT ["/docker-entrypoint.sh"] CMD ["/usr/sbin/mosquitto", "-c", "/mosquitto/config/mosquitto.conf"] diff --git a/docker/generic/Dockerfile b/docker/generic/Dockerfile index 51c1d181..01f8d266 100644 --- a/docker/generic/Dockerfile +++ b/docker/generic/Dockerfile @@ -66,5 +66,6 @@ VOLUME ["/mosquitto/config", "/mosquitto/data", "/mosquitto/log"] # Set up the entry point script and default command COPY docker-entrypoint.sh / +EXPOSE 1883 ENTRYPOINT ["/docker-entrypoint.sh"] CMD ["/usr/sbin/mosquitto", "-c", "/mosquitto/config/mosquitto.conf"] diff --git a/docker/local/Dockerfile b/docker/local/Dockerfile index f0360e46..13c21aad 100644 --- a/docker/local/Dockerfile +++ b/docker/local/Dockerfile @@ -67,5 +67,6 @@ VOLUME ["/mosquitto/data", "/mosquitto/log"] # Set up the entry point script and default command COPY docker-entrypoint.sh / +EXPOSE 1883 ENTRYPOINT ["/docker-entrypoint.sh"] CMD ["/usr/sbin/mosquitto", "-c", "/mosquitto/config/mosquitto.conf"] From ee3591d228efdcea7165fa5589c39af4be1fb878 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Sun, 8 Sep 2019 21:11:20 +0100 Subject: [PATCH 25/57] Fix missing locks on `mosq->state`. Closes #1374. Thanks to Jeff Trull. --- ChangeLog.txt | 1 + lib/handle_ping.c | 8 +++++++- lib/handle_pubackcomp.c | 7 ++++++- lib/handle_publish.c | 7 ++++++- lib/handle_suback.c | 7 ++++++- lib/packet_mosq.c | 16 +++++++++++++--- lib/util_mosq.c | 7 ++++++- 7 files changed, 45 insertions(+), 8 deletions(-) diff --git a/ChangeLog.txt b/ChangeLog.txt index 65817c97..24c2c86a 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -14,6 +14,7 @@ Broker: Client library: - Fix reconnect backoff for the situation where connections are dropped rather than refused. Closes #737. +- Fix missing locks on `mosq->state`. Closes #1374. Documentation: - Improve details on global/per listener options in the mosquitto.conf man page. diff --git a/lib/handle_ping.c b/lib/handle_ping.c index 56d89a3c..69355be8 100644 --- a/lib/handle_ping.c +++ b/lib/handle_ping.c @@ -53,9 +53,15 @@ int handle__pingreq(struct mosquitto *mosq) int handle__pingresp(struct mosquitto *mosq) { + int state; + assert(mosq); - if(mosq->state != mosq_cs_connected){ + pthread_mutex_lock(&mosq->state_mutex); + state = mosq->state; + pthread_mutex_unlock(&mosq->state_mutex); + + if(state != mosq_cs_connected){ return MOSQ_ERR_PROTOCOL; } diff --git a/lib/handle_pubackcomp.c b/lib/handle_pubackcomp.c index 67921494..774e948c 100644 --- a/lib/handle_pubackcomp.c +++ b/lib/handle_pubackcomp.c @@ -47,10 +47,15 @@ int handle__pubackcomp(struct mosquitto *mosq, const char *type) int rc; mosquitto_property *properties = NULL; int qos; + int state; assert(mosq); - if(mosq->state != mosq_cs_connected){ + pthread_mutex_lock(&mosq->state_mutex); + state = mosq->state; + pthread_mutex_unlock(&mosq->state_mutex); + + if(state != mosq_cs_connected){ return MOSQ_ERR_PROTOCOL; } diff --git a/lib/handle_publish.c b/lib/handle_publish.c index 8c93e3ce..485742fa 100644 --- a/lib/handle_publish.c +++ b/lib/handle_publish.c @@ -40,10 +40,15 @@ int handle__publish(struct mosquitto *mosq) uint16_t mid; int slen; mosquitto_property *properties = NULL; + int state; assert(mosq); - if(mosq->state != mosq_cs_connected){ + pthread_mutex_lock(&mosq->state_mutex); + state = mosq->state; + pthread_mutex_unlock(&mosq->state_mutex); + + if(state != mosq_cs_connected){ return MOSQ_ERR_PROTOCOL; } diff --git a/lib/handle_suback.c b/lib/handle_suback.c index dadebcd7..8dfdab63 100644 --- a/lib/handle_suback.c +++ b/lib/handle_suback.c @@ -40,10 +40,15 @@ int handle__suback(struct mosquitto *mosq) int i = 0; int rc; mosquitto_property *properties = NULL; + int state; assert(mosq); - if(mosq->state != mosq_cs_connected){ + pthread_mutex_lock(&mosq->state_mutex); + state = mosq->state; + pthread_mutex_unlock(&mosq->state_mutex); + + if(state != mosq_cs_connected){ return MOSQ_ERR_PROTOCOL; } diff --git a/lib/packet_mosq.c b/lib/packet_mosq.c index dc545435..101e2f5a 100644 --- a/lib/packet_mosq.c +++ b/lib/packet_mosq.c @@ -202,6 +202,7 @@ int packet__write(struct mosquitto *mosq) { ssize_t write_length; struct mosquitto__packet *packet; + int state; if(!mosq) return MOSQ_ERR_INVAL; if(mosq->sock == INVALID_SOCKET) return MOSQ_ERR_NO_CONN; @@ -217,10 +218,14 @@ int packet__write(struct mosquitto *mosq) } pthread_mutex_unlock(&mosq->out_packet_mutex); + pthread_mutex_lock(&mosq->state_mutex); + state = mosq->state; + pthread_mutex_unlock(&mosq->state_mutex); + #if defined(WITH_TLS) && !defined(WITH_BROKER) - if((mosq->state == mosq_cs_connect_pending) || mosq->want_connect){ + if((state == mosq_cs_connect_pending) || mosq->want_connect){ #else - if(mosq->state == mosq_cs_connect_pending){ + if(state == mosq_cs_connect_pending){ #endif pthread_mutex_unlock(&mosq->current_out_packet_mutex); return MOSQ_ERR_SUCCESS; @@ -316,6 +321,7 @@ int packet__read(struct mosquitto *mosq) uint8_t byte; ssize_t read_length; int rc = 0; + int state; if(!mosq){ return MOSQ_ERR_INVAL; @@ -323,7 +329,11 @@ int packet__read(struct mosquitto *mosq) if(mosq->sock == INVALID_SOCKET){ return MOSQ_ERR_NO_CONN; } - if(mosq->state == mosq_cs_connect_pending){ + pthread_mutex_lock(&mosq->state_mutex); + state = mosq->state; + pthread_mutex_unlock(&mosq->state_mutex); + + if(state == mosq_cs_connect_pending){ return MOSQ_ERR_SUCCESS; } diff --git a/lib/util_mosq.c b/lib/util_mosq.c index 65fc2215..928d93cb 100644 --- a/lib/util_mosq.c +++ b/lib/util_mosq.c @@ -68,6 +68,7 @@ int mosquitto__check_keepalive(struct mosquitto *mosq) #ifndef WITH_BROKER int rc; #endif + int state; assert(mosq); #if defined(WITH_BROKER) && defined(WITH_BRIDGE) @@ -88,7 +89,11 @@ int mosquitto__check_keepalive(struct mosquitto *mosq) if(mosq->keepalive && mosq->sock != INVALID_SOCKET && (now >= next_msg_out || now - last_msg_in >= mosq->keepalive)){ - if(mosq->state == mosq_cs_connected && mosq->ping_t == 0){ + pthread_mutex_lock(&mosq->state_mutex); + state = mosq->state; + pthread_mutex_unlock(&mosq->state_mutex); + + if(state == mosq_cs_connected && mosq->ping_t == 0){ send__pingreq(mosq); /* Reset last msg times to give the server time to send a pingresp */ pthread_mutex_lock(&mosq->msgtime_mutex); From 367fc0cffc7670f04de47889c3ab3df0c7c0fef7 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Tue, 10 Sep 2019 10:24:48 +0100 Subject: [PATCH 26/57] Updated SSL test files, plus a new empty crl file. --- .../08-ssl-connect-cert-auth-expired.py | 2 +- test/ssl/all-ca.crt | 96 +++++++++---------- test/ssl/client-encrypted.crt | 72 +++++++------- test/ssl/client-encrypted.key | 28 +++--- test/ssl/client-expired.crt | 64 ++++++------- test/ssl/client-expired.key | 15 +++ test/ssl/client-revoked.crt | 72 +++++++------- test/ssl/client-revoked.key | 26 ++--- test/ssl/client.crt | 74 +++++++------- test/ssl/client.key | 26 ++--- test/ssl/crl-empty.pem | 9 ++ test/ssl/crl.pem | 12 +-- test/ssl/demoCA/crlnumber | 1 - test/ssl/demoCA/index.txt | 1 - test/ssl/demoCA/index.txt.attr | 1 - test/ssl/demoCA/serial | 1 - test/ssl/gen.sh | 27 ++++-- test/ssl/server-expired.crt | 61 ++++++++++++ test/ssl/server-expired.key | 15 +++ test/ssl/server.crt | 68 ++++++------- test/ssl/server.key | 26 ++--- test/ssl/signingCA/crlnumber | 2 +- test/ssl/signingCA/serial | 2 +- test/ssl/test-alt-ca.crt | 66 ++++++------- test/ssl/test-alt-ca.key | 26 ++--- test/ssl/test-bad-root-ca.crt | 30 +++--- test/ssl/test-bad-root-ca.key | 26 ++--- test/ssl/test-ca.srl | 1 - test/ssl/test-fake-root-ca.crt | 30 +++--- test/ssl/test-fake-root-ca.key | 26 ++--- test/ssl/test-root-ca.crt | 30 +++--- test/ssl/test-root-ca.key | 26 ++--- test/ssl/test-signing-ca.crt | 66 ++++++------- test/ssl/test-signing-ca.key | 26 ++--- 34 files changed, 581 insertions(+), 473 deletions(-) create mode 100644 test/ssl/client-expired.key create mode 100644 test/ssl/crl-empty.pem delete mode 100644 test/ssl/demoCA/crlnumber delete mode 100644 test/ssl/demoCA/index.txt delete mode 100644 test/ssl/demoCA/index.txt.attr delete mode 100644 test/ssl/demoCA/serial create mode 100644 test/ssl/server-expired.key delete mode 100644 test/ssl/test-ca.srl diff --git a/test/broker/08-ssl-connect-cert-auth-expired.py b/test/broker/08-ssl-connect-cert-auth-expired.py index a7de9dd0..6f3546c0 100755 --- a/test/broker/08-ssl-connect-cert-auth-expired.py +++ b/test/broker/08-ssl-connect-cert-auth-expired.py @@ -31,7 +31,7 @@ broker = mosq_test.start_broker(filename=os.path.basename(__file__), port=port2, try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) - ssock = ssl.wrap_socket(sock, ca_certs="../ssl/test-root-ca.crt", certfile="../ssl/client-expired.crt", keyfile="../ssl/client.key", cert_reqs=ssl.CERT_REQUIRED) + ssock = ssl.wrap_socket(sock, ca_certs="../ssl/test-root-ca.crt", certfile="../ssl/client-expired.crt", keyfile="../ssl/client-expired.key", cert_reqs=ssl.CERT_REQUIRED) ssock.settimeout(20) try: ssock.connect(("localhost", port1)) diff --git a/test/ssl/all-ca.crt b/test/ssl/all-ca.crt index 8ca6f20f..a27b07b0 100644 --- a/test/ssl/all-ca.crt +++ b/test/ssl/all-ca.crt @@ -2,74 +2,74 @@ Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) - Signature Algorithm: sha256WithRSAEncryption + Signature Algorithm: sha256WithRSAEncryption Issuer: C=GB, ST=Derbyshire, L=Derby, O=Mosquitto Project, OU=Testing, CN=Root CA Validity - Not Before: Sep 18 10:49:47 2018 GMT - Not After : Sep 17 10:49:47 2023 GMT + Not Before: Sep 10 09:33:42 2019 GMT + Not After : Sep 8 09:33:42 2024 GMT Subject: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Signing CA Subject Public Key Info: Public Key Algorithm: rsaEncryption - Public-Key: (1024 bit) + RSA Public-Key: (1024 bit) Modulus: - 00:b7:32:f2:08:04:4c:77:03:70:3e:10:88:84:cd: - cd:f2:87:2f:3c:67:8f:78:01:5e:d5:51:f1:11:68: - 4d:a7:e2:73:b0:69:b5:67:07:59:88:cc:b8:7f:ce: - 97:52:bc:fb:73:7b:60:95:a2:7b:c2:9a:f1:4d:5a: - c4:42:55:c4:6e:02:50:a1:71:41:68:d1:6c:96:e0: - 3d:af:10:3f:7b:64:c1:3a:3a:c3:a9:39:71:08:29: - 45:c8:cc:da:33:65:b4:70:fb:36:bc:15:0d:a7:31: - ef:d5:ec:59:ac:75:2b:77:35:0b:f0:db:3d:14:f5: - 9a:41:e6:a0:b7:b7:62:2b:e7 + 00:e3:39:bc:07:48:ed:c3:d2:3e:4f:a0:61:9a:2b: + e9:46:7a:68:33:52:01:1b:7f:45:88:49:05:85:fd: + 30:8c:2e:60:17:77:b3:38:c3:06:7c:fc:87:a8:61: + 29:03:86:07:20:8f:f8:d2:f0:bb:66:93:33:91:37: + ed:f6:64:b7:46:a5:f6:7d:f7:94:98:52:bc:78:90: + 6d:0b:db:61:c6:00:23:79:c2:a6:3b:2b:ee:c7:3d: + 96:97:9b:4e:eb:78:56:95:52:13:d4:5f:ea:18:85: + 18:0a:d6:d9:cd:4b:b0:15:ef:2f:f0:27:ef:b1:af: + d2:4f:ca:b8:93:c1:2f:2e:4f Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: - EE:60:BB:C7:17:5F:D3:72:AC:33:EE:8E:84:CC:2D:DB:1A:CC:8A:52 + EA:BE:42:EF:98:17:84:D5:FC:28:89:5A:4B:A5:B6:41:4F:7B:BB:28 X509v3 Authority Key Identifier: - keyid:DA:20:AB:E0:98:22:39:28:E0:70:D6:74:65:53:26:E0:6B:4C:96:39 + keyid:CF:F3:9D:BB:BF:2B:14:D5:A2:E5:EC:41:CF:9C:16:D0:4D:AB:84:04 X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha256WithRSAEncryption - 8a:98:17:cd:e1:dc:2b:1b:5b:16:40:99:21:c4:d4:db:3f:5c: - 6a:ed:7b:a2:b6:df:aa:7c:d8:6a:3f:11:39:da:4c:ce:3f:e5: - 99:6a:a4:b8:82:1e:53:7a:5d:f1:52:be:df:f1:3b:59:9a:a8: - bb:7e:f1:30:33:4b:7c:c3:ab:85:1e:c4:0e:ac:d1:7e:2b:cb: - 9d:19:5b:df:94:b4:89:e1:da:5d:31:19:85:34:d5:33:55:f8: - af:92:ea:9a:17:c9:da:68:00:df:10:e9:e4:33:35:cd:15:57: - 80:56:1a:58:94:37:d7:f2:02:de:9b:0b:d3:02:64:c5:8e:6f: - 25:31 + 0f:7d:4c:71:ef:5e:5d:a2:0e:09:da:37:bd:21:77:73:77:b1: + 02:7e:56:7d:82:c0:b9:53:77:c3:bb:9b:08:cf:00:b3:73:18: + 2d:c5:9c:1a:57:8c:2b:46:21:bf:28:2e:f4:6d:12:6a:c3:7f: + 8c:c6:a5:9b:bf:ed:47:cd:88:58:94:35:1f:5c:1e:a7:0d:17: + 96:5f:1b:70:ad:da:05:26:0c:52:d1:87:52:3c:e3:e1:23:ac: + aa:fa:f3:80:48:52:30:da:59:e2:de:0c:61:95:3c:63:ef:1d: + ec:b3:6d:c7:89:e6:e3:65:6c:be:d4:e7:a7:90:8c:f4:ff:1d: + 65:72 -----BEGIN CERTIFICATE----- MIICnTCCAgagAwIBAgIBATANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJHQjET MBEGA1UECAwKRGVyYnlzaGlyZTEOMAwGA1UEBwwFRGVyYnkxGjAYBgNVBAoMEU1v c3F1aXR0byBQcm9qZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRAwDgYDVQQDDAdSb290 -IENBMB4XDTE4MDkxODEwNDk0N1oXDTIzMDkxNzEwNDk0N1owZTELMAkGA1UEBhMC +IENBMB4XDTE5MDkxMDA5MzM0MloXDTI0MDkwODA5MzM0MlowZTELMAkGA1UEBhMC R0IxEzARBgNVBAgMCkRlcmJ5c2hpcmUxGjAYBgNVBAoMEU1vc3F1aXR0byBQcm9q ZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRMwEQYDVQQDDApTaWduaW5nIENBMIGfMA0G -CSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3MvIIBEx3A3A+EIiEzc3yhy88Z494AV7V -UfERaE2n4nOwabVnB1mIzLh/zpdSvPtze2CVonvCmvFNWsRCVcRuAlChcUFo0WyW -4D2vED97ZME6OsOpOXEIKUXIzNozZbRw+za8FQ2nMe/V7FmsdSt3NQvw2z0U9ZpB -5qC3t2Ir5wIDAQABo1AwTjAdBgNVHQ4EFgQU7mC7xxdf03KsM+6OhMwt2xrMilIw -HwYDVR0jBBgwFoAU2iCr4JgiOSjgcNZ0ZVMm4GtMljkwDAYDVR0TBAUwAwEB/zAN -BgkqhkiG9w0BAQsFAAOBgQCKmBfN4dwrG1sWQJkhxNTbP1xq7Xuitt+qfNhqPxE5 -2kzOP+WZaqS4gh5Tel3xUr7f8TtZmqi7fvEwM0t8w6uFHsQOrNF+K8udGVvflLSJ -4dpdMRmFNNUzVfivkuqaF8naaADfEOnkMzXNFVeAVhpYlDfX8gLemwvTAmTFjm8l -MQ== +CSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjObwHSO3D0j5PoGGaK+lGemgzUgEbf0WI +SQWF/TCMLmAXd7M4wwZ8/IeoYSkDhgcgj/jS8LtmkzORN+32ZLdGpfZ995SYUrx4 +kG0L22HGACN5wqY7K+7HPZaXm07reFaVUhPUX+oYhRgK1tnNS7AV7y/wJ++xr9JP +yriTwS8uTwIDAQABo1AwTjAdBgNVHQ4EFgQU6r5C75gXhNX8KIlaS6W2QU97uygw +HwYDVR0jBBgwFoAUz/Odu78rFNWi5exBz5wW0E2rhAQwDAYDVR0TBAUwAwEB/zAN +BgkqhkiG9w0BAQsFAAOBgQAPfUxx715dog4J2je9IXdzd7ECflZ9gsC5U3fDu5sI +zwCzcxgtxZwaV4wrRiG/KC70bRJqw3+MxqWbv+1HzYhYlDUfXB6nDReWXxtwrdoF +JgxS0YdSPOPhI6yq+vOASFIw2lni3gxhlTxj7x3ss23HiebjZWy+1OenkIz0/x1l +cg== -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- -MIICsjCCAhugAwIBAgIJAOcAUKw/VPlMMA0GCSqGSIb3DQEBCwUAMHIxCzAJBgNV -BAYTAkdCMRMwEQYDVQQIDApEZXJieXNoaXJlMQ4wDAYDVQQHDAVEZXJieTEaMBgG -A1UECgwRTW9zcXVpdHRvIFByb2plY3QxEDAOBgNVBAsMB1Rlc3RpbmcxEDAOBgNV -BAMMB1Jvb3QgQ0EwHhcNMTgwOTE4MTA0OTQ3WhcNMjgwOTE1MTA0OTQ3WjByMQsw -CQYDVQQGEwJHQjETMBEGA1UECAwKRGVyYnlzaGlyZTEOMAwGA1UEBwwFRGVyYnkx -GjAYBgNVBAoMEU1vc3F1aXR0byBQcm9qZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRAw -DgYDVQQDDAdSb290IENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCeTh1y -KRZ1NIeLVvhBxSQC3Cvfe9L3IC8415CVbgipLgZKe7Nl1JBqFYDxXKBn2eVQ6EwL -sCz+U2oa2oCql8r5eYEKpmWFiIcKdrL8aSXNvMKEOu0AJlsIXBe2sDFPxuuw143n -W/odqBiWedciVd5pmJWZZ93neWdkkjnPZZMN4wIDAQABo1AwTjAdBgNVHQ4EFgQU -2iCr4JgiOSjgcNZ0ZVMm4GtMljkwHwYDVR0jBBgwFoAU2iCr4JgiOSjgcNZ0ZVMm -4GtMljkwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQBIs2GY/GQL76rz -+0qSWZvQ7l+HovHdp7C49auI+hiSRAzv3p2y7y3DmZrpmYJlTZJWlaA8eg769sLg -Cyfkt6AIsZPadJiTTUayh8oCF5aMH+OetC+63USFBNYXJN6AOXp9vu/K3TdM8ao6 -WsAf26+DKYAPmvu+oU7ScpCrCSdC+Q== +MIICvTCCAiagAwIBAgIUCq9EuGevQyFmQpXhKjTK8l6q2VYwDQYJKoZIhvcNAQEL +BQAwcjELMAkGA1UEBhMCR0IxEzARBgNVBAgMCkRlcmJ5c2hpcmUxDjAMBgNVBAcM +BURlcmJ5MRowGAYDVQQKDBFNb3NxdWl0dG8gUHJvamVjdDEQMA4GA1UECwwHVGVz +dGluZzEQMA4GA1UEAwwHUm9vdCBDQTAeFw0xOTA5MTAwOTMzNDJaFw0yOTA5MDcw +OTMzNDJaMHIxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApEZXJieXNoaXJlMQ4wDAYD +VQQHDAVEZXJieTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3QxEDAOBgNVBAsM +B1Rlc3RpbmcxEDAOBgNVBAMMB1Jvb3QgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0A +MIGJAoGBAOGwkYR+cUbrn3AGkbdFImPx4tnYIsqT+MwGDNmQ33Q4Ng9ZwEJhsT2C +qGl0Txsj1HLo3goAFU/lZcvedtLT3sZKw1Jamwc7SS3H15Et9Ne9kQczaLekr74d +NpRWvgJMy3+YkBHsB04vFA45ruc4F7UnpljaovJ4sVadx0FyWdxbAgMBAAGjUDBO +MB0GA1UdDgQWBBTP8527vysU1aLl7EHPnBbQTauEBDAfBgNVHSMEGDAWgBTP8527 +vysU1aLl7EHPnBbQTauEBDAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4GB +ABRmECRQbiR9m27Qg8x8Auwus2xdxZTlKz2n8WV1HN8jE2b22g9kqAcamqcQXWYU +JklO18dNdpI2rpJa/rSi/Wcakp2STUnV03kqw7IZWyzCaDNZLRWWDHqsJhH91jzv +jFOhj81GLFVsAwsiTMV2FFk9XzYVpiV2syC7EgFvtjzH -----END CERTIFICATE----- diff --git a/test/ssl/client-encrypted.crt b/test/ssl/client-encrypted.crt index fa0ca023..98a6e890 100644 --- a/test/ssl/client-encrypted.crt +++ b/test/ssl/client-encrypted.crt @@ -1,26 +1,26 @@ Certificate: Data: Version: 3 (0x2) - Serial Number: 5 (0x5) - Signature Algorithm: sha256WithRSAEncryption + Serial Number: 6 (0x6) + Signature Algorithm: sha256WithRSAEncryption Issuer: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Signing CA Validity - Not Before: Sep 18 10:50:08 2018 GMT - Not After : Sep 17 10:50:08 2023 GMT + Not Before: Sep 10 09:33:43 2019 GMT + Not After : Sep 8 09:33:43 2024 GMT Subject: C=GB, ST=Nottinghamshire, L=Nottingham, O=Server, OU=Production, CN=test client encrypted Subject Public Key Info: Public Key Algorithm: rsaEncryption - Public-Key: (1024 bit) + RSA Public-Key: (1024 bit) Modulus: - 00:b6:a9:fe:16:1b:58:bb:96:6c:6e:a4:cf:39:60: - d0:0a:8c:18:9c:0c:75:eb:6f:5b:31:f9:1f:15:a5: - c8:7b:85:c1:cc:fc:1b:72:ba:af:ef:08:b8:e6:31: - bb:e7:20:cb:6a:f1:af:9c:db:df:12:71:3c:d2:98: - fb:14:dd:87:63:ed:6f:49:ab:30:12:aa:45:ab:ad: - 50:21:84:b5:9d:3e:b1:36:8e:92:87:e6:ee:b5:3b: - 9e:da:25:88:74:d9:28:c8:1f:6c:93:29:e7:1d:14: - dc:dc:14:72:1f:b9:84:32:a1:09:d7:cc:e5:21:a8: - 30:8c:d7:73:d7:b1:6f:2d:b7 + 00:b2:3b:8d:2d:d4:22:ee:5f:ea:f5:e5:eb:46:a5: + 10:0c:98:68:9f:d3:e1:bd:63:ca:e0:78:49:7c:54: + 96:49:a3:18:d6:a2:85:1e:7e:c1:65:3c:ba:14:93: + ff:1c:6f:43:f9:43:30:32:04:23:92:2f:1a:9f:a5: + f4:31:a1:d6:fd:b0:65:f6:e9:77:81:64:b6:2e:6e: + 00:71:da:0b:78:22:82:ba:e9:40:bb:a4:43:68:a1: + 28:b3:02:69:97:f9:21:55:c8:80:5c:8a:73:41:db: + 4f:a4:0e:8a:52:45:a4:a4:d7:9a:8c:9b:c0:7c:b6: + ec:dd:78:eb:93:c3:d2:f1:b5 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: @@ -28,34 +28,34 @@ Certificate: Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: - CD:6E:DB:18:BC:30:76:0F:58:6D:6A:5A:1D:3E:AB:0B:D0:DB:BA:8C + 12:37:21:26:74:8E:0E:22:74:95:FF:92:EC:7F:D7:3C:20:C9:B3:55 X509v3 Authority Key Identifier: - keyid:EE:60:BB:C7:17:5F:D3:72:AC:33:EE:8E:84:CC:2D:DB:1A:CC:8A:52 + keyid:EA:BE:42:EF:98:17:84:D5:FC:28:89:5A:4B:A5:B6:41:4F:7B:BB:28 Signature Algorithm: sha256WithRSAEncryption - 34:91:a4:18:93:ce:b6:8d:2a:17:c4:cc:48:34:3f:00:99:4f: - c2:2a:23:47:2f:75:fe:ef:34:da:39:12:16:63:86:9b:eb:30: - b3:d7:26:ff:96:4b:d6:00:c9:71:05:5d:08:c7:e1:52:70:d1: - ab:55:4f:2b:da:a7:ae:47:6d:b7:5d:84:2c:5e:c6:2a:3e:81: - 63:55:99:3f:8b:e1:43:a4:0a:5a:34:4e:50:3e:f8:0a:76:53: - 6b:e0:fc:42:14:b0:7e:ce:25:17:19:b9:d9:8b:dd:99:be:7e: - 6a:a9:7f:ae:d8:a3:7b:c6:48:7a:04:75:3b:8f:6b:85:c1:f0: - 43:18 + 54:e6:ae:58:21:74:be:ac:e8:0a:3e:da:4e:87:56:05:c2:51: + a8:6a:0c:83:dc:89:30:b8:3f:38:83:18:ed:4a:ce:d7:1d:0e: + 62:a7:eb:ec:97:4e:cc:db:c0:1d:12:c6:82:47:a7:a1:e7:1a: + b5:c0:2e:cf:a6:1b:d3:56:a9:f4:69:48:7d:f1:79:de:36:da: + 31:93:06:85:27:be:e8:94:57:64:ee:c9:fd:8e:d3:b1:65:19: + c7:d9:c0:6f:0e:bc:e5:92:09:b4:1f:4a:c6:59:20:15:3f:d3: + 8d:52:08:15:d0:e2:4f:71:c3:cc:b7:1e:20:1a:a3:ac:52:86: + 17:a4 -----BEGIN CERTIFICATE----- -MIIC2TCCAkKgAwIBAgIBBTANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET +MIIC2TCCAkKgAwIBAgIBBjANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET MBEGA1UECAwKRGVyYnlzaGlyZTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3Qx -EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTgwOTE4 -MTA1MDA4WhcNMjMwOTE3MTA1MDA4WjCBgjELMAkGA1UEBhMCR0IxGDAWBgNVBAgM +EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTkwOTEw +MDkzMzQzWhcNMjQwOTA4MDkzMzQzWjCBgjELMAkGA1UEBhMCR0IxGDAWBgNVBAgM D05vdHRpbmdoYW1zaGlyZTETMBEGA1UEBwwKTm90dGluZ2hhbTEPMA0GA1UECgwG U2VydmVyMRMwEQYDVQQLDApQcm9kdWN0aW9uMR4wHAYDVQQDDBV0ZXN0IGNsaWVu -dCBlbmNyeXB0ZWQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALap/hYbWLuW -bG6kzzlg0AqMGJwMdetvWzH5HxWlyHuFwcz8G3K6r+8IuOYxu+cgy2rxr5zb3xJx -PNKY+xTdh2Ptb0mrMBKqRautUCGEtZ0+sTaOkofm7rU7ntoliHTZKMgfbJMp5x0U -3NwUch+5hDKhCdfM5SGoMIzXc9exby23AgMBAAGjezB5MAkGA1UdEwQCMAAwLAYJ +dCBlbmNyeXB0ZWQwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALI7jS3UIu5f +6vXl60alEAyYaJ/T4b1jyuB4SXxUlkmjGNaihR5+wWU8uhST/xxvQ/lDMDIEI5Iv +Gp+l9DGh1v2wZfbpd4Fkti5uAHHaC3gigrrpQLukQ2ihKLMCaZf5IVXIgFyKc0Hb +T6QOilJFpKTXmoybwHy27N1465PD0vG1AgMBAAGjezB5MAkGA1UdEwQCMAAwLAYJ YIZIAYb4QgENBB8WHU9wZW5TU0wgR2VuZXJhdGVkIENlcnRpZmljYXRlMB0GA1Ud -DgQWBBTNbtsYvDB2D1htalodPqsL0Nu6jDAfBgNVHSMEGDAWgBTuYLvHF1/Tcqwz -7o6EzC3bGsyKUjANBgkqhkiG9w0BAQsFAAOBgQA0kaQYk862jSoXxMxIND8AmU/C -KiNHL3X+7zTaORIWY4ab6zCz1yb/lkvWAMlxBV0Ix+FScNGrVU8r2qeuR223XYQs -XsYqPoFjVZk/i+FDpApaNE5QPvgKdlNr4PxCFLB+ziUXGbnZi92Zvn5qqX+u2KN7 -xkh6BHU7j2uFwfBDGA== +DgQWBBQSNyEmdI4OInSV/5Lsf9c8IMmzVTAfBgNVHSMEGDAWgBTqvkLvmBeE1fwo +iVpLpbZBT3u7KDANBgkqhkiG9w0BAQsFAAOBgQBU5q5YIXS+rOgKPtpOh1YFwlGo +agyD3IkwuD84gxjtSs7XHQ5ip+vsl07M28AdEsaCR6eh5xq1wC7PphvTVqn0aUh9 +8XneNtoxkwaFJ77olFdk7sn9jtOxZRnH2cBvDrzlkgm0H0rGWSAVP9ONUggV0OJP +ccPMtx4gGqOsUoYXpA== -----END CERTIFICATE----- diff --git a/test/ssl/client-encrypted.key b/test/ssl/client-encrypted.key index c6325d84..1d0e8abe 100644 --- a/test/ssl/client-encrypted.key +++ b/test/ssl/client-encrypted.key @@ -1,18 +1,18 @@ -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED -DEK-Info: DES-EDE3-CBC,A17E5BCB1FEA5A08 +DEK-Info: DES-EDE3-CBC,8AEA93E5EEF22B76 -bK5ojhRrYmfh0nhgiLPZoGT6i6NqLoVmHrtxJBumois0wznY0n693KktYs4bIikl -YG5xGU+oOyuPCsi6NH/krIuDpzZzN8r6lTNX3b9BQdiEEL02QO9RJ/qjBz7OqNJF -QrtBZQiXpXw3GgkB9CCnLYV8MzEeEWFJnRifKYZLSN8kEdcekudm7m+ih/yLzoFH -MsnWR52uSVv58vOPqsGSXT5mvIWxZIeHBF5qSgre55rZjzzj5dn3PM/wBOeFIwep -ZWQlm/Y3cg+cpBBe9GRkC+E0WA7iHmBL7WIvuiGq8EHq/LkPsNVPuL4K9YjXL7fH -GSIvJqNq6cZb/dSxHY+8rgckZpnE4y/QH5xRmN43T9uzsno1nkRmojm61M3viObJ -85dlaagMrBgatJABmbtvUzRYQqabFG0R4xcITuZFxWaBZFAWzpn6C65adtN4myoU -nREOHXVWX+oz6E8vZbCaEPH21d8No6geH6+RhRoe+49gnodf57ZY/tlHz+4TL2lP -UQRcEGnZCXHRUZ0lg1eqs50/HB37GMs15pKA+4Bw42eRYQiUbYErsGtzFQPYsLYP -jPyoK5dvq0ZdVOSw8wnIMVX0LgI6v8G9i5R4AOLGHigkUBApwtHA22f+6ubZP/tQ -QHZGBZgpxhwe1aRPGmra6GGpDzzg61zFIulSowt1TXYtzj1CNHCVFMt5DF93bSo6 -g0i9O6fiw6DbX3gB587jvqSgiI2ia+5AA9hrG/Nld9wIH2kvtEa9IUNg97bl+GTr -uen5Y2xlA7Q3HVsxAU9W1CzBIFJYdDBYVkrKHPlKt6HAp5m4NEy+2g== +rNTuFZJw1I+Bvsu4dOcaXFSRvSHHW0f3Sw169Hm5vbAmx6kq6lL8bD1t85aU/1uE +5ACZ/ZlpxID1EEWfKBHdbHnTL5rQ7BJ/dGD4WuNGk6Wo8KvYUFaSHec1Up3KG1PW +EXLsJtcH8iu+OBnVVTEPn+tQYUICCLiAnvBWXFmb5uWHi8mk2S+2jEYcy9H1Ixmr +cLhluK2h6F3uzS+V3uonkjIEty6Rw3oeSe0Nq8Wd74lOzgrPjalVypryJIcfJQ/u +TqZhMhSRQTBbmyKA1AwrOwLFmWhHzQVy+zRwRqvR2qKILyIPTdIWaAOPZjDpynVH +qRL3pXvhrJ4W/r6rx3Irbm9dWgRSmLb7eVkOPYau/qXlxTWm/QA0QXFexXg16iVe +VonEjffgJA2zUF6u7a5mde8bue3c++3SLGPig5GBbbw/ZN5DmnzY6eQXb2U/tKrt +Gl3MSCUFeG4jPF0rTJ4isdgYaQEvx66UaJ/bJ08eIGVryha8az6sEit1fpSb3xQC +/wzthbkkqAB9N+ubVeZ2uogM2waukWc8usB8eIZ1jWzNBaJP8Dl87mHBM3dJCwRH +yTctPZBeylLZP7f46IN3jo/MpNIxOrRrgOJB+RG/p/GnF2+k5/RZgmsrnnc4Dy5B +s1UeEdx2W62+apf85gEy9BBFgPxbDoQC9Bkr7DysxEQzNujLQY+WJXhnotfAOPeE +d0NNYYZERw0GzU5Di7eiHQjnwB2cIQCOhmMesek+ijyVr3gmM6Mh5It+F3zHXktB +N1Br+IyuHDRdAOeJMx7FbU19/iu3vOVVPPd7R+D+prDStwRThzJGsw== -----END RSA PRIVATE KEY----- diff --git a/test/ssl/client-expired.crt b/test/ssl/client-expired.crt index 3992793d..f1c92f02 100644 --- a/test/ssl/client-expired.crt +++ b/test/ssl/client-expired.crt @@ -1,8 +1,8 @@ Certificate: Data: Version: 3 (0x2) - Serial Number: 3 (0x3) - Signature Algorithm: sha256WithRSAEncryption + Serial Number: 4 (0x4) + Signature Algorithm: sha256WithRSAEncryption Issuer: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Signing CA Validity Not Before: Aug 20 00:00:00 2012 GMT @@ -10,17 +10,17 @@ Certificate: Subject: C=GB, ST=Nottinghamshire, L=Nottingham, O=Server, OU=Production, CN=test client expired Subject Public Key Info: Public Key Algorithm: rsaEncryption - Public-Key: (1024 bit) + RSA Public-Key: (1024 bit) Modulus: - 00:cf:a2:94:2e:b7:84:9f:ec:67:86:ce:6a:71:75: - 6a:9d:9a:a3:69:2b:83:8e:a8:23:05:51:bc:ab:98: - 1e:01:bc:06:03:26:bd:34:ec:52:15:a7:4b:45:a5: - 62:f4:3c:c1:95:fe:7b:07:16:f7:03:ae:9a:19:4b: - a2:b9:49:80:5d:63:8b:a8:cb:d4:ed:86:9d:da:71: - 4f:15:6f:c5:0d:c6:81:cb:ad:57:75:7c:d9:2e:65: - a7:86:a4:8f:84:70:0d:c5:3a:53:6c:da:29:a3:1d: - b2:ac:4b:a0:86:7f:f3:16:2e:8d:99:dd:44:30:2b: - 81:89:e3:ae:79:b8:d7:ae:e9 + 00:e3:03:9f:6f:4f:8b:c6:57:bd:04:88:10:bc:04: + e2:c4:a8:cd:a5:3a:ad:46:1e:e7:46:53:d6:f2:3f: + 93:92:cb:2c:31:7f:17:77:44:2f:cf:61:50:9f:ff: + e9:3d:b7:2a:82:84:7e:be:01:3a:17:e5:7b:78:b1: + b5:ab:0f:15:05:3f:85:cf:a7:11:33:c7:8b:9d:a6: + 8b:8b:3f:6e:61:fb:68:9b:0b:00:fe:9b:2d:a2:6f: + 0c:ea:d4:79:c7:11:94:e6:0d:e2:b8:3c:4f:08:3e: + 0a:1d:7d:89:e7:69:2d:06:35:e5:9e:b5:df:16:f8: + 56:c5:77:f2:e2:62:cc:10:87 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: @@ -28,34 +28,34 @@ Certificate: Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: - FB:66:3B:5D:45:33:5B:61:14:52:C0:E4:04:FF:12:73:AD:B3:9B:56 + 04:E8:D6:25:43:18:36:C9:BD:DA:3A:EE:34:CC:1A:49:CB:35:07:5F X509v3 Authority Key Identifier: - keyid:EE:60:BB:C7:17:5F:D3:72:AC:33:EE:8E:84:CC:2D:DB:1A:CC:8A:52 + keyid:EA:BE:42:EF:98:17:84:D5:FC:28:89:5A:4B:A5:B6:41:4F:7B:BB:28 Signature Algorithm: sha256WithRSAEncryption - 80:89:73:0e:35:ea:ce:88:27:9e:71:7a:6c:13:46:2f:e9:cd: - 2a:04:6d:86:98:83:e3:0d:c3:d4:75:9d:6a:96:ec:b4:92:d0: - 7a:3f:f5:e2:84:bb:67:3e:1f:9f:f6:3b:b4:98:2d:17:7f:c6: - 2b:27:8f:4d:e1:4b:5c:7e:ae:e6:e6:e8:b7:82:3f:50:4b:78: - af:ae:2f:13:bf:c6:f1:f1:95:16:c2:46:73:8d:d9:3e:25:cd: - 90:15:e3:63:7d:0a:a2:19:f8:00:70:1e:7a:a1:a6:4e:3c:79: - b9:e1:66:7c:fd:67:40:69:c5:6b:3a:15:55:81:10:b6:4d:d2: - 22:b1 + 45:3c:cf:52:b5:ce:52:a8:98:da:ed:f4:cc:81:42:d3:87:6e: + 29:da:ee:0a:62:02:96:78:04:f9:e7:c6:e0:55:fc:50:b6:4e: + 73:52:c9:44:2e:22:21:ec:70:e0:d6:b9:13:f5:1c:c0:86:b5: + 26:d9:75:69:3c:a9:b0:71:13:aa:2a:f9:f1:86:1d:82:66:1a: + cc:56:4e:3a:7a:d9:20:88:80:e5:42:02:b8:3a:8c:26:8a:57: + f7:5c:5a:a3:15:4e:74:06:a0:3c:ea:1f:67:53:d1:60:a3:5e: + c2:75:17:32:b8:35:08:a7:d8:36:3c:13:1f:9c:97:18:b5:69: + 9f:66 -----BEGIN CERTIFICATE----- -MIIC1zCCAkCgAwIBAgIBAzANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET +MIIC1zCCAkCgAwIBAgIBBDANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET MBEGA1UECAwKRGVyYnlzaGlyZTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3Qx EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTIwODIw MDAwMDAwWhcNMTIwODIxMDAwMDAwWjCBgDELMAkGA1UEBhMCR0IxGDAWBgNVBAgM D05vdHRpbmdoYW1zaGlyZTETMBEGA1UEBwwKTm90dGluZ2hhbTEPMA0GA1UECgwG U2VydmVyMRMwEQYDVQQLDApQcm9kdWN0aW9uMRwwGgYDVQQDDBN0ZXN0IGNsaWVu -dCBleHBpcmVkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPopQut4Sf7GeG -zmpxdWqdmqNpK4OOqCMFUbyrmB4BvAYDJr007FIVp0tFpWL0PMGV/nsHFvcDrpoZ -S6K5SYBdY4uoy9Tthp3acU8Vb8UNxoHLrVd1fNkuZaeGpI+EcA3FOlNs2imjHbKs -S6CGf/MWLo2Z3UQwK4GJ4655uNeu6QIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCG +dCBleHBpcmVkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjA59vT4vGV70E +iBC8BOLEqM2lOq1GHudGU9byP5OSyywxfxd3RC/PYVCf/+k9tyqChH6+AToX5Xt4 +sbWrDxUFP4XPpxEzx4udpouLP25h+2ibCwD+my2ibwzq1HnHEZTmDeK4PE8IPgod +fYnnaS0GNeWetd8W+FbFd/LiYswQhwIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCG SAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4E -FgQU+2Y7XUUzW2EUUsDkBP8Sc62zm1YwHwYDVR0jBBgwFoAU7mC7xxdf03KsM+6O -hMwt2xrMilIwDQYJKoZIhvcNAQELBQADgYEAgIlzDjXqzognnnF6bBNGL+nNKgRt -hpiD4w3D1HWdapbstJLQej/14oS7Zz4fn/Y7tJgtF3/GKyePTeFLXH6u5ubot4I/ -UEt4r64vE7/G8fGVFsJGc43ZPiXNkBXjY30Kohn4AHAeeqGmTjx5ueFmfP1nQGnF -azoVVYEQtk3SIrE= +FgQUBOjWJUMYNsm92jruNMwaScs1B18wHwYDVR0jBBgwFoAU6r5C75gXhNX8KIla +S6W2QU97uygwDQYJKoZIhvcNAQELBQADgYEARTzPUrXOUqiY2u30zIFC04duKdru +CmIClngE+efG4FX8ULZOc1LJRC4iIexw4Na5E/UcwIa1Jtl1aTypsHETqir58YYd +gmYazFZOOnrZIIiA5UICuDqMJopX91xaoxVOdAagPOofZ1PRYKNewnUXMrg1CKfY +NjwTH5yXGLVpn2Y= -----END CERTIFICATE----- diff --git a/test/ssl/client-expired.key b/test/ssl/client-expired.key new file mode 100644 index 00000000..d803b733 --- /dev/null +++ b/test/ssl/client-expired.key @@ -0,0 +1,15 @@ +-----BEGIN RSA PRIVATE KEY----- +MIICXQIBAAKBgQDjA59vT4vGV70EiBC8BOLEqM2lOq1GHudGU9byP5OSyywxfxd3 +RC/PYVCf/+k9tyqChH6+AToX5Xt4sbWrDxUFP4XPpxEzx4udpouLP25h+2ibCwD+ +my2ibwzq1HnHEZTmDeK4PE8IPgodfYnnaS0GNeWetd8W+FbFd/LiYswQhwIDAQAB +AoGAbh8AxS8yH4nKIBuc+ofoNPupniAjk6NED0J2P1cF0CyMiIodKPbDtnZ/dM3g +J9blYSDClorj0lm4lmimNo9/Yv0YEohdFBKAtpfwVufzpR3G9+JbuVpEueTnESpH +iIkhZoCU5EBZoTkNvqvEZkxv6cBCM9riHuBp09Nxf6u9Y3kCQQD++HaG2Vmuo7Tg +oFLL7G16oHVwAYaiguP9OPcwIfyBYLbYEETgAvZ8oSt6A89TjphtnWdK/zDHiXrW +TNdGRYfLAkEA4+5DnSY0iAJei4vOfBp2baHPrHFoOHV/tbpLrZ0oZRMdiPIhgQSX +BTqpSWM1r+WUfWKi2LAiFN6u5nB15RtqtQJBAMjpjKxx9ONSiKNAcj3SjepFKoUa +DrdcIL9W9iFthoWEalATcdJ7QzOt5I5/Fg4nnSEzGUPVluCFCtB3OGNdQsUCQEAY ++w6wdclh0TCxCkpALtm5zWsTIVnvQRDb6PhT3848x+uBHAbqQYYI7x5iNfDXQSDZ +oi4JqivwS4MmUSEyypkCQQCjYN5UYQBqDlD9zf5MTS1mEGpKW5RsDNXjX/eEMYJT +/Dsa3EMYRLCmZxL4FiLZ8GOAxljf9rSkScybxU8XBh0u +-----END RSA PRIVATE KEY----- diff --git a/test/ssl/client-revoked.crt b/test/ssl/client-revoked.crt index f6f10e6c..9f195b5a 100644 --- a/test/ssl/client-revoked.crt +++ b/test/ssl/client-revoked.crt @@ -1,26 +1,26 @@ Certificate: Data: Version: 3 (0x2) - Serial Number: 4 (0x4) - Signature Algorithm: sha256WithRSAEncryption + Serial Number: 5 (0x5) + Signature Algorithm: sha256WithRSAEncryption Issuer: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Signing CA Validity - Not Before: Sep 18 10:49:58 2018 GMT - Not After : Sep 17 10:49:58 2023 GMT + Not Before: Sep 10 09:33:42 2019 GMT + Not After : Sep 8 09:33:42 2024 GMT Subject: C=GB, ST=Nottinghamshire, L=Nottingham, O=Server, OU=Production, CN=test client revoked Subject Public Key Info: Public Key Algorithm: rsaEncryption - Public-Key: (1024 bit) + RSA Public-Key: (1024 bit) Modulus: - 00:cf:30:dc:74:50:c8:4b:4c:0f:c5:15:b1:cc:f4: - 2d:c1:f2:f5:14:16:d3:c9:ff:82:0e:56:f2:98:8b: - 6d:d5:b9:c8:95:fa:33:cc:b3:9e:26:1d:5f:2a:0d: - ce:8d:49:02:f3:6e:a5:c6:90:26:e3:15:4e:d2:bf: - 22:ac:1c:25:5b:b1:06:aa:03:6a:b9:d8:e6:09:e2: - f6:31:e9:e2:76:08:b9:5a:a6:9d:a2:f2:ca:ec:f1: - 97:87:a1:5c:14:4a:06:44:77:1d:13:36:43:b8:36: - bf:6d:6f:0a:c1:91:a6:0b:ea:37:34:08:7b:2d:9f: - e0:ec:ba:5d:52:77:9e:a0:9f + 00:c8:e5:d4:6f:72:06:f8:fa:b1:7a:d0:05:db:ea: + 13:1a:18:b6:c1:95:b3:d5:af:50:de:59:e4:2b:5a: + c3:b8:3f:d9:09:13:6e:42:64:89:8c:f1:42:29:c4: + 75:41:d4:a7:15:6e:76:0d:15:0a:73:7b:b6:54:24: + 8a:44:b1:19:ad:8d:15:5f:c9:d8:a0:ea:94:2d:9e: + 9d:ab:0a:d7:f1:5c:8f:ae:16:55:65:cf:d9:62:bb: + 93:5e:b5:94:1f:b2:d0:7d:3d:d1:45:ed:32:18:5b: + 73:d0:f7:f1:91:9d:18:d2:f9:62:fa:f7:2b:d4:05: + 72:30:83:a3:9a:96:01:1b:41 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: @@ -28,34 +28,34 @@ Certificate: Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: - 56:B4:1E:17:B3:35:C7:16:DB:45:A5:76:40:73:3E:C3:EA:42:5D:F8 + EB:4B:4C:32:62:0A:82:9B:7D:F3:9F:61:1F:2B:E8:2C:93:21:63:BF X509v3 Authority Key Identifier: - keyid:EE:60:BB:C7:17:5F:D3:72:AC:33:EE:8E:84:CC:2D:DB:1A:CC:8A:52 + keyid:EA:BE:42:EF:98:17:84:D5:FC:28:89:5A:4B:A5:B6:41:4F:7B:BB:28 Signature Algorithm: sha256WithRSAEncryption - b5:42:ed:22:06:a9:6d:55:e7:72:c2:09:cf:05:6d:f1:cb:2b: - ae:38:24:63:b4:e2:f3:d6:13:ab:85:08:3f:e1:6e:e4:f4:2c: - 30:7b:cd:ec:be:1d:c1:a6:4b:53:f6:0d:13:55:ef:10:60:b5: - 85:72:b8:85:34:82:28:97:4c:d8:0e:70:7f:4a:b2:ec:ec:13: - 50:14:53:94:ae:04:e3:bf:c8:02:19:ce:9e:d4:85:2a:59:27: - 9b:dc:e7:5f:5a:c7:83:2e:fb:2b:47:e4:51:11:6f:ad:51:bb: - 2e:85:2c:7c:a7:c3:a9:db:72:ab:54:93:f7:70:9e:9b:9c:50: - 20:73 + 9c:01:dd:df:a4:8f:13:51:55:fd:91:63:d3:50:64:03:d6:7d: + de:ea:63:8a:80:72:6f:86:18:4b:60:ba:a5:9d:53:6b:6f:ac: + a7:e2:09:b5:93:3b:47:53:9a:76:37:f8:35:4a:8e:a0:89:93: + ef:ad:a9:2b:46:61:0d:67:14:5e:9b:b5:5c:dc:c3:2a:4c:97: + f0:79:06:33:a5:9c:ec:a3:1d:d1:03:44:ec:f4:06:bc:45:9d: + 47:a0:d4:db:6f:c8:59:d2:2c:5d:38:cc:84:98:0c:61:2d:67: + fe:9e:d5:d4:c7:75:a1:ee:f0:aa:bf:c1:23:09:db:45:ee:76: + 14:22 -----BEGIN CERTIFICATE----- -MIIC1zCCAkCgAwIBAgIBBDANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET +MIIC1zCCAkCgAwIBAgIBBTANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET MBEGA1UECAwKRGVyYnlzaGlyZTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3Qx -EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTgwOTE4 -MTA0OTU4WhcNMjMwOTE3MTA0OTU4WjCBgDELMAkGA1UEBhMCR0IxGDAWBgNVBAgM +EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTkwOTEw +MDkzMzQyWhcNMjQwOTA4MDkzMzQyWjCBgDELMAkGA1UEBhMCR0IxGDAWBgNVBAgM D05vdHRpbmdoYW1zaGlyZTETMBEGA1UEBwwKTm90dGluZ2hhbTEPMA0GA1UECgwG U2VydmVyMRMwEQYDVQQLDApQcm9kdWN0aW9uMRwwGgYDVQQDDBN0ZXN0IGNsaWVu -dCByZXZva2VkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPMNx0UMhLTA/F -FbHM9C3B8vUUFtPJ/4IOVvKYi23VuciV+jPMs54mHV8qDc6NSQLzbqXGkCbjFU7S -vyKsHCVbsQaqA2q52OYJ4vYx6eJ2CLlapp2i8srs8ZeHoVwUSgZEdx0TNkO4Nr9t -bwrBkaYL6jc0CHstn+Dsul1Sd56gnwIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCG +dCByZXZva2VkMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDI5dRvcgb4+rF6 +0AXb6hMaGLbBlbPVr1DeWeQrWsO4P9kJE25CZImM8UIpxHVB1KcVbnYNFQpze7ZU +JIpEsRmtjRVfydig6pQtnp2rCtfxXI+uFlVlz9liu5NetZQfstB9PdFF7TIYW3PQ +9/GRnRjS+WL69yvUBXIwg6OalgEbQQIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCG SAGG+EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4E -FgQUVrQeF7M1xxbbRaV2QHM+w+pCXfgwHwYDVR0jBBgwFoAU7mC7xxdf03KsM+6O -hMwt2xrMilIwDQYJKoZIhvcNAQELBQADgYEAtULtIgapbVXncsIJzwVt8csrrjgk -Y7Ti89YTq4UIP+Fu5PQsMHvN7L4dwaZLU/YNE1XvEGC1hXK4hTSCKJdM2A5wf0qy -7OwTUBRTlK4E47/IAhnOntSFKlknm9znX1rHgy77K0fkURFvrVG7LoUsfKfDqdty -q1ST93Cem5xQIHM= +FgQU60tMMmIKgpt9859hHyvoLJMhY78wHwYDVR0jBBgwFoAU6r5C75gXhNX8KIla +S6W2QU97uygwDQYJKoZIhvcNAQELBQADgYEAnAHd36SPE1FV/ZFj01BkA9Z93upj +ioByb4YYS2C6pZ1Ta2+sp+IJtZM7R1Oadjf4NUqOoImT762pK0ZhDWcUXpu1XNzD +KkyX8HkGM6Wc7KMd0QNE7PQGvEWdR6DU22/IWdIsXTjMhJgMYS1n/p7V1Md1oe7w +qr/BIwnbRe52FCI= -----END CERTIFICATE----- diff --git a/test/ssl/client-revoked.key b/test/ssl/client-revoked.key index da145808..52075275 100644 --- a/test/ssl/client-revoked.key +++ b/test/ssl/client-revoked.key @@ -1,15 +1,15 @@ -----BEGIN RSA PRIVATE KEY----- -MIICXQIBAAKBgQDPMNx0UMhLTA/FFbHM9C3B8vUUFtPJ/4IOVvKYi23VuciV+jPM -s54mHV8qDc6NSQLzbqXGkCbjFU7SvyKsHCVbsQaqA2q52OYJ4vYx6eJ2CLlapp2i -8srs8ZeHoVwUSgZEdx0TNkO4Nr9tbwrBkaYL6jc0CHstn+Dsul1Sd56gnwIDAQAB -AoGBAMqQ0Nh/qnPDl59uiHkDOkFnEilj8AiL4FG4vFJb7zSIAQ5wong+HB7TlJj/ -CrSjb1klErrBcOOPj5MIABQZKINrwgsHlkQIzvC2EGF/I0tfFJDbUjlZ7y1Vh15O -pAOhhx2SuBwvNMHrz6L70Koqg9Y2v1WHQ2IBPuo8i5VBcWSxAkEA9DUZm/Tj4Gqb -pXWiSd2/gV5H2NgVT2t9Jth1Z9nfK9g6GTfVEMbKkp4EGHW3rqL3UbphNK72/v3S -2YTMU0JM7QJBANkyKUbgdUMcqYDypZoBliom2qUqk+kIvWdGSp+W3M5LEQgfuTkN -uW9qz7ncXT3d8cka7Xlg7KO2UKAKnGJbvjsCQQCTYXiTJrhgN/a3ZMcMzUdGTCAQ -PlieFcDyMLCqfFKzo0ts7MUp2s9mrPbLzD+OpcudB16i7PUj7wvROtQVa24BAkAW -5M6tBePWWyMS0IDcJuapMsdBOae1nJI6XJJpGAHWTNtSu+VOOkAdmmii8rNxXf+q -bwgxDyJib0k4VWX+iCUZAkBWqLqyXcclfqAsiTKdzEfQV8uoiu+6hQ6OCh0J1Np3 -7g9p/MLyXkwtAgrtz80zWxkQH+FcFgdTwebrEF1z5kpx +MIICWwIBAAKBgQDI5dRvcgb4+rF60AXb6hMaGLbBlbPVr1DeWeQrWsO4P9kJE25C +ZImM8UIpxHVB1KcVbnYNFQpze7ZUJIpEsRmtjRVfydig6pQtnp2rCtfxXI+uFlVl +z9liu5NetZQfstB9PdFF7TIYW3PQ9/GRnRjS+WL69yvUBXIwg6OalgEbQQIDAQAB +AoGAdlDNBPmN27KhNegvmy3HJDZr46TL7cw7f0hHlbT10ZxgsPStmhJl5AjuY3Td +bfDUmk2c3uWGay7v2axPdlcq/DwU3xWXyQlS8jXldhDMJrrhKe+U0IdY2F1BImts +XS1Xum2opS0B8XebIRIoi5h4q5w2zRqaaLVeVjrxQqprNMECQQD3lWnme2uUSSZK +KMrsgk7WhZV2HpSneSiwyieBk9ikfq68NI5pDnpiVBZAuDwfgXmZ6CIiLoP2h/qJ +DWqHflypAkEAz7oiYHaS8w4+Wvcgo5v9iwjWU+F3rPrSfG7XaS0oGnU5+qF+U0F7 +D9mcecFUy0cNyBLpUx53nDP9BcQbq4oQ2QJAHm0YRKDqSaDrubVlqscg1TA5e/iq +ICK9o2xUipIWz7BZ3PtAfRywYaEf0vhROzX4MbfbagP5Z7SyT2F8tAYNcQJAO4m+ +EKfrtn5+oNP0JvCu2wrNY31cL9g0PDYIx7yJogu3cn6XFoXOH9zfXIZtJ1ZWPOIu +vgQdhEfiXaS3yZLpAQJAacVbsZN0PGe7SEVbbGarTkXu6evyKUc3H436kP+3M2I4 +5YHtJdURVtWdL5rv9QdQz2HknV5Zz383UoOd6HnD5A== -----END RSA PRIVATE KEY----- diff --git a/test/ssl/client.crt b/test/ssl/client.crt index c6b0626f..4bd5414f 100644 --- a/test/ssl/client.crt +++ b/test/ssl/client.crt @@ -1,26 +1,26 @@ Certificate: Data: Version: 3 (0x2) - Serial Number: 2 (0x2) - Signature Algorithm: sha256WithRSAEncryption + Serial Number: 3 (0x3) + Signature Algorithm: sha256WithRSAEncryption Issuer: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Signing CA Validity - Not Before: Sep 18 10:49:56 2018 GMT - Not After : Sep 17 10:49:56 2023 GMT + Not Before: Sep 10 09:33:42 2019 GMT + Not After : Sep 8 09:33:42 2024 GMT Subject: C=GB, ST=Nottinghamshire, L=Nottingham, O=Server, OU=Production, CN=test client Subject Public Key Info: Public Key Algorithm: rsaEncryption - Public-Key: (1024 bit) + RSA Public-Key: (1024 bit) Modulus: - 00:cf:a2:94:2e:b7:84:9f:ec:67:86:ce:6a:71:75: - 6a:9d:9a:a3:69:2b:83:8e:a8:23:05:51:bc:ab:98: - 1e:01:bc:06:03:26:bd:34:ec:52:15:a7:4b:45:a5: - 62:f4:3c:c1:95:fe:7b:07:16:f7:03:ae:9a:19:4b: - a2:b9:49:80:5d:63:8b:a8:cb:d4:ed:86:9d:da:71: - 4f:15:6f:c5:0d:c6:81:cb:ad:57:75:7c:d9:2e:65: - a7:86:a4:8f:84:70:0d:c5:3a:53:6c:da:29:a3:1d: - b2:ac:4b:a0:86:7f:f3:16:2e:8d:99:dd:44:30:2b: - 81:89:e3:ae:79:b8:d7:ae:e9 + 00:ca:37:db:79:24:74:5c:ee:f6:63:a0:50:e9:cc: + 7b:52:f4:24:fb:86:5f:ac:9d:c4:7b:d3:df:5b:94: + ca:7e:fd:40:a8:8d:0a:50:7e:49:63:ce:08:84:2e: + e3:ff:a6:a5:79:80:cc:ae:a8:64:33:c5:16:1f:5d: + c8:3f:8c:e2:8c:ce:92:d4:1e:b8:9f:86:42:f3:c8: + 7c:b3:85:38:25:2c:e7:11:32:ae:f0:be:17:a3:99: + 5e:f2:66:2f:12:18:8d:4c:6b:4b:33:4c:0e:e6:35: + c4:ae:2a:fc:db:b6:b4:3e:80:cd:74:a0:fc:5c:ec: + ec:18:3f:7d:ac:dc:c0:45:7d Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: @@ -28,34 +28,34 @@ Certificate: Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: - FB:66:3B:5D:45:33:5B:61:14:52:C0:E4:04:FF:12:73:AD:B3:9B:56 + 0F:4E:AD:C9:5F:1E:BF:A9:00:B8:0A:0B:D1:48:04:1A:EB:86:25:37 X509v3 Authority Key Identifier: - keyid:EE:60:BB:C7:17:5F:D3:72:AC:33:EE:8E:84:CC:2D:DB:1A:CC:8A:52 + keyid:EA:BE:42:EF:98:17:84:D5:FC:28:89:5A:4B:A5:B6:41:4F:7B:BB:28 Signature Algorithm: sha256WithRSAEncryption - 48:b6:47:12:77:53:07:36:44:93:d7:ea:88:f0:f5:4f:b0:b4: - 52:06:36:ec:7b:df:80:cc:2a:31:fa:b3:b4:c9:0e:4a:6c:b0: - 83:0a:89:2d:58:25:f2:ee:0f:60:93:01:59:db:0a:6d:93:81: - ad:ea:21:cf:ee:d1:a9:b4:c2:b8:77:8c:bf:9d:1f:78:3c:35: - c2:2d:18:11:25:02:f8:7c:9c:42:fd:9b:0f:21:7b:81:88:b3: - c3:84:62:b1:b9:24:3c:8c:94:24:93:c2:74:33:2c:82:ca:b3: - 8f:37:3f:71:6d:b7:79:9b:dd:2e:ee:36:bd:7c:fa:0a:4d:3b: - 88:4b + 25:2d:ca:89:aa:45:42:3c:61:f8:37:56:fa:22:f0:b6:ab:83: + d3:a2:15:d6:cb:64:82:20:79:b1:50:ab:c8:70:02:74:1c:3e: + c1:35:5d:e8:bb:1a:db:d1:c2:7d:06:69:e3:ab:03:a1:63:29: + 11:e6:c1:3e:ef:23:65:32:69:e0:d5:63:07:01:4c:bb:9a:41: + 5d:8e:a9:58:4e:d8:8f:58:10:2f:37:aa:9d:23:68:e5:ab:82: + 3c:be:70:1f:e1:33:11:bb:88:62:cd:59:22:80:87:9d:e6:92: + 38:e8:96:84:89:73:60:c5:d8:20:70:1e:55:97:d4:76:b7:2d: + ac:0c -----BEGIN CERTIFICATE----- -MIICzjCCAjegAwIBAgIBAjANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET +MIICzjCCAjegAwIBAgIBAzANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET MBEGA1UECAwKRGVyYnlzaGlyZTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3Qx -EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTgwOTE4 -MTA0OTU2WhcNMjMwOTE3MTA0OTU2WjB4MQswCQYDVQQGEwJHQjEYMBYGA1UECAwP +EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTkwOTEw +MDkzMzQyWhcNMjQwOTA4MDkzMzQyWjB4MQswCQYDVQQGEwJHQjEYMBYGA1UECAwP Tm90dGluZ2hhbXNoaXJlMRMwEQYDVQQHDApOb3R0aW5naGFtMQ8wDQYDVQQKDAZT ZXJ2ZXIxEzARBgNVBAsMClByb2R1Y3Rpb24xFDASBgNVBAMMC3Rlc3QgY2xpZW50 -MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDPopQut4Sf7GeGzmpxdWqdmqNp -K4OOqCMFUbyrmB4BvAYDJr007FIVp0tFpWL0PMGV/nsHFvcDrpoZS6K5SYBdY4uo -y9Tthp3acU8Vb8UNxoHLrVd1fNkuZaeGpI+EcA3FOlNs2imjHbKsS6CGf/MWLo2Z -3UQwK4GJ4655uNeu6QIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQf -Fh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQU+2Y7XUUz -W2EUUsDkBP8Sc62zm1YwHwYDVR0jBBgwFoAU7mC7xxdf03KsM+6OhMwt2xrMilIw -DQYJKoZIhvcNAQELBQADgYEASLZHEndTBzZEk9fqiPD1T7C0UgY27HvfgMwqMfqz -tMkOSmywgwqJLVgl8u4PYJMBWdsKbZOBreohz+7RqbTCuHeMv50feDw1wi0YESUC -+HycQv2bDyF7gYizw4RisbkkPIyUJJPCdDMsgsqzjzc/cW23eZvdLu42vXz6Ck07 -iEs= +MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDKN9t5JHRc7vZjoFDpzHtS9CT7 +hl+sncR7099blMp+/UCojQpQfkljzgiELuP/pqV5gMyuqGQzxRYfXcg/jOKMzpLU +HrifhkLzyHyzhTglLOcRMq7wvhejmV7yZi8SGI1Ma0szTA7mNcSuKvzbtrQ+gM10 +oPxc7OwYP32s3MBFfQIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG+EIBDQQf +Fh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQUD06tyV8e +v6kAuAoL0UgEGuuGJTcwHwYDVR0jBBgwFoAU6r5C75gXhNX8KIlaS6W2QU97uygw +DQYJKoZIhvcNAQELBQADgYEAJS3KiapFQjxh+DdW+iLwtquD06IV1stkgiB5sVCr +yHACdBw+wTVd6Lsa29HCfQZp46sDoWMpEebBPu8jZTJp4NVjBwFMu5pBXY6pWE7Y +j1gQLzeqnSNo5auCPL5wH+EzEbuIYs1ZIoCHneaSOOiWhIlzYMXYIHAeVZfUdrct +rAw= -----END CERTIFICATE----- diff --git a/test/ssl/client.key b/test/ssl/client.key index 64eb5c55..2ebe2695 100644 --- a/test/ssl/client.key +++ b/test/ssl/client.key @@ -1,15 +1,15 @@ -----BEGIN RSA PRIVATE KEY----- -MIICXwIBAAKBgQDPopQut4Sf7GeGzmpxdWqdmqNpK4OOqCMFUbyrmB4BvAYDJr00 -7FIVp0tFpWL0PMGV/nsHFvcDrpoZS6K5SYBdY4uoy9Tthp3acU8Vb8UNxoHLrVd1 -fNkuZaeGpI+EcA3FOlNs2imjHbKsS6CGf/MWLo2Z3UQwK4GJ4655uNeu6QIDAQAB -AoGBAMwdfSK30i8MzXEedlF3JgotPLtkxX12GIdgJONjNQxrdFWgvZvLPZ5/yWV8 -Al0rZPs5ImSD1OzPtjlru1n+wapHp8zE2xtl3druicErs1A0hF73yx5lJx9rO5V4 -c7FoTFDDs3LJVy9P9gsV/+1iWwgJvvxDs01DWhhi35zFZmoBAkEA5wuDEScxYXbx -KY5irMhsPACwNgzx/c3GBwZ56nx0hGVrqDmghw03sf6leTceKRhLE6xzyk56Z4kD -6/QtpTZMyQJBAOYPxg80W5uZPC7R56jlAzo8fnpwEidTjJlctbS4sDSnITe9yugs -x7SzLhqxzuEuJiLOfzCs/X5TL1UdN1azASECQQCgF6763MBvu34BgILJHJs6vHNd -EH1BkyrrRUaG/zOxZaFCUKP10GfOMxevtUx1xzqGaFFXViekxCDuhyR1vPlZAkEA -h+GBJbHS+ZAED9NCdGrvARKB0WcoEbozLNGpMNh0mmSsJfQfSApK2duKu5GRk0Zi -l+RHE0TZZCdVqXvcF4UagQJBAK3Jdi/F/n6+BYIU6IcFtsHCcm8Nr+Lz3iSt4CT5 -gIZstvNrIy/fJoN/NrrfVUh8JD0UZpEUt1lNclNLxCh/wec= +MIICXAIBAAKBgQDKN9t5JHRc7vZjoFDpzHtS9CT7hl+sncR7099blMp+/UCojQpQ +fkljzgiELuP/pqV5gMyuqGQzxRYfXcg/jOKMzpLUHrifhkLzyHyzhTglLOcRMq7w +vhejmV7yZi8SGI1Ma0szTA7mNcSuKvzbtrQ+gM10oPxc7OwYP32s3MBFfQIDAQAB +AoGBAKGiRCtwmBIwb4Dyg7pdV7XWsDjcD11KPeM8Vyw8oh8fDq+rDLOKPd8osGX3 +lQajjWCxMunoby9yOVyY+ZbSZcH6tIp1gqsn2D/deIeJvwF0Y0+qAThb3rL2dF5r +s/ZtzY7V7M1VsFQz0RagBdJiwudrBy+M7wh/6gWPn0xP9IwBAkEA7srVGiOuP5m2 +wvjyU9T5unPnDOCgnHhqLOHy39ILm9OiMSR2nyrY9s4jZ+0ELD8haaHqsJk2PCTN +icGd8V3XeQJBANjKURH3df6NNUCqM1eDVHsvHjKL/qtwjKxByHo7ZHcTchGDTNlQ +sKWGXSuzLEJCtVcPQoeeAMXMvQ6xca3r6SUCQEL1e2YWBUFuT/JCLmlVeiVPZMWW +o1Lc7SDixuD+HCU45e0TxXOCZ05lpUX6D0Z8+ViOf6m/fJbG1x++vBQ3dTkCQGts +nY2UnTCdEmVPsY9M8aD08TbE7lZPuDVnh4siQR9MUHrjIEKTXGU5VpPf/i97VNam +JiaDoghh8tEEFrvDKc0CQHYPQtEElSAtLfW2G3jWvsUfk+cO4kDnzzXn1HJyLKKt +Qy+zJgnebGJtZSdqH0cpjAJmglx72+ATD2hM5H2Q8c8= -----END RSA PRIVATE KEY----- diff --git a/test/ssl/crl-empty.pem b/test/ssl/crl-empty.pem new file mode 100644 index 00000000..5c83d7f1 --- /dev/null +++ b/test/ssl/crl-empty.pem @@ -0,0 +1,9 @@ +-----BEGIN X509 CRL----- +MIIBPzCBqQIBATANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjETMBEGA1UE +CAwKRGVyYnlzaGlyZTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3QxEDAOBgNV +BAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EXDTE5MDkxMDA5MzM0MloY +DzIxMDExMDMwMDkzMzQyWqAOMAwwCgYDVR0UBAMCAQEwDQYJKoZIhvcNAQELBQAD +gYEAXKXAfdg47KKCs+qvU2BLR7+yGpvBekrkG9BRjKCXHDYO5e8HtLJJCik6DB9m +DZNMX4djcdGfuype4FXmRF4mJChLNfJmXXZ3zuyDjESOlhiC/aX5Xv1961ZwdQOh ++3RtJnFZVu5yOvq5oS+HuoXtMbLl8UwBdWeEH9BrzA22TpU= +-----END X509 CRL----- diff --git a/test/ssl/crl.pem b/test/ssl/crl.pem index 04b09321..6777a1cf 100644 --- a/test/ssl/crl.pem +++ b/test/ssl/crl.pem @@ -1,10 +1,10 @@ -----BEGIN X509 CRL----- MIIBVTCBvwIBATANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjETMBEGA1UE CAwKRGVyYnlzaGlyZTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3QxEDAOBgNV -BAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EXDTE4MDkxODEwNDk1OVoY -DzIxMDAxMTA3MTA0OTU5WjAUMBICAQQXDTE4MDkxODEwNDk1OVqgDjAMMAoGA1Ud -FAQDAgEBMA0GCSqGSIb3DQEBCwUAA4GBABMwUjGo9PMd1kqWqrfqTO3eaesPATX9 -xm6OQyoPEJ0CIwhm9jjWrvKMoJth8W7qnS91AK5vt0avGlUFIC+VG4aNc8MLFzmk -2g425K4d8dQ92OBCc3d6U8cUmpfB2bpK5kPxDliWtH+iBnuWkjTIsaXsfdmnnXhz -3PAFwU9beIef +BAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EXDTE5MDkxMDA5MzM0MloY +DzIxMDExMDMwMDkzMzQyWjAUMBICAQUXDTE5MDkxMDA5MzM0MlqgDjAMMAoGA1Ud +FAQDAgECMA0GCSqGSIb3DQEBCwUAA4GBANir3QTTixD5aAkLwrpMozAbjafitQL8 +XBnbg6Yudy94x6Dlh2sb0RbyLkIP0VhzHZq8fM4mn+FQ7THTlzPlNWv/Sn2iF/y2 +/yCFrYU3dBU3JoQ+Xq5TI/kI3h6naE/083ogRfJD+WkwqVQLQ7dPyPTzJumHjb9I +5RZG6P56JIcs -----END X509 CRL----- diff --git a/test/ssl/demoCA/crlnumber b/test/ssl/demoCA/crlnumber deleted file mode 100644 index eeee65ec..00000000 --- a/test/ssl/demoCA/crlnumber +++ /dev/null @@ -1 +0,0 @@ -05 diff --git a/test/ssl/demoCA/index.txt b/test/ssl/demoCA/index.txt deleted file mode 100644 index ced7051c..00000000 --- a/test/ssl/demoCA/index.txt +++ /dev/null @@ -1 +0,0 @@ -R 391118144000Z 120703155846Z CDAE0E564A2891A7 unknown /C=GB/ST=United Kingdom/L=Derby/O=Mosquitto Test Suite/OU=Broker Test/CN=localhost-client-test diff --git a/test/ssl/demoCA/index.txt.attr b/test/ssl/demoCA/index.txt.attr deleted file mode 100644 index 3a7e39e6..00000000 --- a/test/ssl/demoCA/index.txt.attr +++ /dev/null @@ -1 +0,0 @@ -unique_subject = no diff --git a/test/ssl/demoCA/serial b/test/ssl/demoCA/serial deleted file mode 100644 index 8a0f05e1..00000000 --- a/test/ssl/demoCA/serial +++ /dev/null @@ -1 +0,0 @@ -01 diff --git a/test/ssl/gen.sh b/test/ssl/gen.sh index a52159c1..0267c8e0 100755 --- a/test/ssl/gen.sh +++ b/test/ssl/gen.sh @@ -32,44 +32,57 @@ openssl req -new -x509 -days 3650 -key test-fake-root-ca.key -out test-fake-root openssl genrsa -out test-signing-ca.key 1024 openssl req -out test-signing-ca.csr -key test-signing-ca.key -new -config openssl.cnf -subj "${BASESUBJ}/CN=Signing CA/" openssl ca -batch -config openssl.cnf -name CA_root -extensions v3_ca -out test-signing-ca.crt -infiles test-signing-ca.csr +rm -f test-signing-ca.csr # An alternative intermediate CA, signed by the root CA, not used to sign anything. openssl genrsa -out test-alt-ca.key 1024 openssl req -out test-alt-ca.csr -key test-alt-ca.key -new -config openssl.cnf -subj "${BASESUBJ}/CN=Alternative Signing CA/" openssl ca -batch -config openssl.cnf -name CA_root -extensions v3_ca -out test-alt-ca.crt -infiles test-alt-ca.csr +rm -f test-alt-ca.csr # Valid server key and certificate. openssl genrsa -out server.key 1024 openssl req -new -key server.key -out server.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=localhost/" openssl ca -batch -config openssl.cnf -name CA_signing -out server.crt -infiles server.csr +rm -f server.csr -# Expired server certificate, based on the above server key. -openssl req -new -days 1 -key server.key -out server-expired.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=localhost/" +# Expired server certificate +openssl genrsa -out server-expired.key 1024 +openssl req -new -key server-expired.key -out server-expired.csr -config openssl.cnf -subj "${SBASESUBJ}-expired/CN=localhost/" openssl ca -batch -config openssl.cnf -name CA_signing -days 1 -startdate 120820000000Z -enddate 120821000000Z -out server-expired.crt -infiles server-expired.csr +rm -f server-expired.csr # Valid client key and certificate. openssl genrsa -out client.key 1024 openssl req -new -key client.key -out client.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=test client/" openssl ca -batch -config openssl.cnf -name CA_signing -out client.crt -infiles client.csr +rm -f client.csr -# Expired client certificate, based on the above client key. -openssl req -new -days 1 -key client.key -out client-expired.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=test client expired/" +# Expired client certificate +openssl genrsa -out client-expired.key 1024 +openssl req -new -key client-expired.key -out client-expired.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=test client expired/" openssl ca -batch -config openssl.cnf -name CA_signing -days 1 -startdate 120820000000Z -enddate 120821000000Z -out client-expired.crt -infiles client-expired.csr +rm -f client-expired.csr -# Revoked client certificate, based on a new client key. +# Empty CRL file +openssl ca -batch -config openssl.cnf -name CA_signing -gencrl -out crl-empty.pem + +# Revoked client certificate openssl genrsa -out client-revoked.key 1024 -openssl req -new -days 1 -key client-revoked.key -out client-revoked.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=test client revoked/" +openssl req -new -key client-revoked.key -out client-revoked.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=test client revoked/" openssl ca -batch -config openssl.cnf -name CA_signing -out client-revoked.crt -infiles client-revoked.csr openssl ca -batch -config openssl.cnf -name CA_signing -revoke client-revoked.crt openssl ca -batch -config openssl.cnf -name CA_signing -gencrl -out crl.pem +rm -f client-revoked.csr # Valid client key and certificate, encrypted (use "password" as password) openssl genrsa -des3 -out client-encrypted.key -passout pass:password 1024 openssl req -new -key client-encrypted.key -out client-encrypted.csr -config openssl.cnf -subj "${SBASESUBJ}/CN=test client encrypted/" -passin pass:password openssl ca -batch -config openssl.cnf -name CA_signing -out client-encrypted.crt -infiles client-encrypted.csr +rm -f client-encrypted.csr cat test-signing-ca.crt test-root-ca.crt > all-ca.crt #mkdir certs #cp test-signing-ca.crt certs/test-signing-ca.pem #cp test-root-ca.crt certs/test-root.ca.pem -openssl rehash certs +#openssl rehash certs diff --git a/test/ssl/server-expired.crt b/test/ssl/server-expired.crt index e69de29b..0b820674 100644 --- a/test/ssl/server-expired.crt +++ b/test/ssl/server-expired.crt @@ -0,0 +1,61 @@ +Certificate: + Data: + Version: 3 (0x2) + Serial Number: 2 (0x2) + Signature Algorithm: sha256WithRSAEncryption + Issuer: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Signing CA + Validity + Not Before: Aug 20 00:00:00 2012 GMT + Not After : Aug 21 00:00:00 2012 GMT + Subject: C=GB, ST=Nottinghamshire, L=Nottingham, O=Server, OU=Production-expired, CN=localhost + Subject Public Key Info: + Public Key Algorithm: rsaEncryption + RSA Public-Key: (1024 bit) + Modulus: + 00:9e:17:15:22:13:1e:22:b2:b5:e2:8c:d3:ac:f5: + 4c:bc:ef:55:92:46:8e:96:6d:b7:c1:af:50:4d:5f: + 88:49:92:74:b1:91:b1:70:50:74:f3:d4:6f:83:e1: + 21:58:44:7d:d4:c0:9f:51:fe:95:55:14:fe:30:e8: + 50:cf:18:a0:99:94:99:1e:ae:87:e2:63:10:7a:1b: + 17:da:f1:72:2b:63:59:bf:e4:9c:79:bb:63:c7:40: + 31:47:7b:8a:b7:82:44:69:d6:a9:24:38:5e:fb:e2: + c0:0b:d0:42:70:dc:4e:a0:7b:44:23:45:8b:92:db: + 3c:7b:7f:ea:60:8d:5a:a9:0b + Exponent: 65537 (0x10001) + X509v3 extensions: + X509v3 Basic Constraints: + CA:FALSE + Netscape Comment: + OpenSSL Generated Certificate + X509v3 Subject Key Identifier: + 6C:37:48:ED:A0:0E:E7:67:BF:20:1D:76:48:75:82:1D:16:BA:ED:54 + X509v3 Authority Key Identifier: + keyid:EA:BE:42:EF:98:17:84:D5:FC:28:89:5A:4B:A5:B6:41:4F:7B:BB:28 + + Signature Algorithm: sha256WithRSAEncryption + 02:bb:c3:b6:e5:50:25:ef:32:c7:54:54:0c:3a:fd:2b:21:c8: + e0:1b:df:29:c8:0e:b1:ce:44:6d:9f:51:42:f2:d0:8a:42:a0: + 96:10:45:b9:d5:e8:7e:5d:5c:f0:ef:3c:8d:89:58:11:16:84: + 71:da:1e:98:84:9b:b2:d1:a3:a5:3f:fd:d9:8b:df:90:ab:22: + 7e:12:16:ef:1f:02:fd:86:07:ad:85:83:e6:59:d7:ff:ee:b1: + 44:b1:2c:29:8d:90:c0:73:53:e2:13:20:21:2b:8e:89:e2:4b: + 20:16:13:ea:20:ae:d8:fc:6e:61:31:11:33:2f:dc:40:a0:6b: + a1:a1 +-----BEGIN CERTIFICATE----- +MIIC1DCCAj2gAwIBAgIBAjANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET +MBEGA1UECAwKRGVyYnlzaGlyZTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3Qx +EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTIwODIw +MDAwMDAwWhcNMTIwODIxMDAwMDAwWjB+MQswCQYDVQQGEwJHQjEYMBYGA1UECAwP +Tm90dGluZ2hhbXNoaXJlMRMwEQYDVQQHDApOb3R0aW5naGFtMQ8wDQYDVQQKDAZT +ZXJ2ZXIxGzAZBgNVBAsMElByb2R1Y3Rpb24tZXhwaXJlZDESMBAGA1UEAwwJbG9j +YWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCeFxUiEx4isrXijNOs +9Uy871WSRo6WbbfBr1BNX4hJknSxkbFwUHTz1G+D4SFYRH3UwJ9R/pVVFP4w6FDP +GKCZlJkerofiYxB6Gxfa8XIrY1m/5Jx5u2PHQDFHe4q3gkRp1qkkOF774sAL0EJw +3E6ge0QjRYuS2zx7f+pgjVqpCwIDAQABo3sweTAJBgNVHRMEAjAAMCwGCWCGSAGG ++EIBDQQfFh1PcGVuU1NMIEdlbmVyYXRlZCBDZXJ0aWZpY2F0ZTAdBgNVHQ4EFgQU +bDdI7aAO52e/IB12SHWCHRa67VQwHwYDVR0jBBgwFoAU6r5C75gXhNX8KIlaS6W2 +QU97uygwDQYJKoZIhvcNAQELBQADgYEAArvDtuVQJe8yx1RUDDr9KyHI4BvfKcgO +sc5EbZ9RQvLQikKglhBFudXofl1c8O88jYlYERaEcdoemISbstGjpT/92YvfkKsi +fhIW7x8C/YYHrYWD5lnX/+6xRLEsKY2QwHNT4hMgISuOieJLIBYT6iCu2PxuYTER +My/cQKBroaE= +-----END CERTIFICATE----- diff --git a/test/ssl/server-expired.key b/test/ssl/server-expired.key new file mode 100644 index 00000000..1f024d02 --- /dev/null +++ b/test/ssl/server-expired.key @@ -0,0 +1,15 @@ +-----BEGIN RSA PRIVATE KEY----- +MIICXAIBAAKBgQCeFxUiEx4isrXijNOs9Uy871WSRo6WbbfBr1BNX4hJknSxkbFw +UHTz1G+D4SFYRH3UwJ9R/pVVFP4w6FDPGKCZlJkerofiYxB6Gxfa8XIrY1m/5Jx5 +u2PHQDFHe4q3gkRp1qkkOF774sAL0EJw3E6ge0QjRYuS2zx7f+pgjVqpCwIDAQAB +AoGAdHSCf9BfcaX98D5XK+CjP8Z6Xb+WB+AY7heL6wNFrRSy2598e0T5cih6YUa1 +PoVtwAyJEGiebseBHFv2MyhsHK4Ae7oZaL+xmQ//klWJa+1jEBpdgX8D1NWklqYx +ZnRKaPQB1xbuAqYIEYb1ioM2x+P8mp78iDy5uzSP/fMreekCQQDK/id7GsuAifPi +vHs6JUpR5a+BvRZWhx4VWvMLk5swvhx8OxNfxadfR7JlikT9TLtRY8uu3gIE+ELi +sEznet5tAkEAx188sgXYk8R43AGpFt9sStxdvCK1CZLdDVNFcUDqeXMZhE6E81x+ +frx8hq+H3T1zGQWJnz24J8ZjPx+fvsoaVwJAe1Jym+iIb5vfzgTh/E5BW4Xl3TUK +CCFoVmL9uy++nZsx5Qti1tFWwJznNacOCLEAMA8n5CG+KlTFFcEzx4Gu9QJAb8SQ +PizQ0WYfaxbzOANgrkcDtWivnQJcMhAwqeD+kb9Y2rc6CUQdFeeM1+Sngfvk/m4A +TOlIx+OL1+NeppKeWQJBAKru6FO8OwA4ttqyMRF9YhSvlF/sNB4rSHQHs0IVtAgI +86p4/oC6F+cTS48QgEFREeh8IRYVnBHYA103dcqdFm4= +-----END RSA PRIVATE KEY----- diff --git a/test/ssl/server.crt b/test/ssl/server.crt index 843e29d4..7d26b682 100644 --- a/test/ssl/server.crt +++ b/test/ssl/server.crt @@ -2,25 +2,25 @@ Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) - Signature Algorithm: sha256WithRSAEncryption + Signature Algorithm: sha256WithRSAEncryption Issuer: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Signing CA Validity - Not Before: Sep 18 10:49:54 2018 GMT - Not After : Sep 17 10:49:54 2023 GMT + Not Before: Sep 10 09:33:42 2019 GMT + Not After : Sep 8 09:33:42 2024 GMT Subject: C=GB, ST=Nottinghamshire, L=Nottingham, O=Server, OU=Production, CN=localhost Subject Public Key Info: Public Key Algorithm: rsaEncryption - Public-Key: (1024 bit) + RSA Public-Key: (1024 bit) Modulus: - 00:cc:a0:1e:6a:7c:20:f0:3f:b2:48:2d:61:8d:b9: - db:a8:a5:65:6b:13:88:37:c7:12:d7:32:dc:b6:fd: - 89:4c:fd:2e:bf:e6:34:f5:ac:9d:db:82:54:b1:9c: - 84:7b:a7:af:3a:7e:89:fd:7e:fe:f1:3d:6f:46:1b: - 28:f2:d9:65:76:0d:11:4a:10:8b:a9:eb:bd:11:2c: - a8:5d:0a:30:65:c7:99:1f:96:88:2e:f1:a5:15:62: - a9:4a:2b:50:9e:70:04:0c:3d:24:55:4b:c3:d2:86: - 57:4f:76:91:6b:2b:35:40:10:b2:f0:c2:17:3f:da: - dd:d1:00:a7:32:64:37:24:b5 + 00:e6:df:91:e3:42:94:b4:4d:ca:4b:74:9f:bb:f3: + b2:7f:04:f1:77:69:f0:9d:0a:10:d3:e4:c5:cf:be: + 70:65:83:37:cb:28:92:fb:45:fb:93:62:47:da:2d: + d6:0d:b3:4e:11:5b:bc:c1:a5:10:f8:be:81:65:51: + 3b:69:7c:99:30:a6:46:89:5f:ad:b9:03:cf:4c:87: + 51:27:ca:46:64:ad:7b:5b:fc:94:85:48:4d:b7:42: + 2e:98:84:af:36:fa:f7:ba:55:da:ea:7b:c8:52:9f: + 68:1a:0c:4d:38:cd:c1:3e:58:6b:9d:11:1b:4b:0e: + 4e:28:a9:58:3c:e6:c2:34:1b Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: @@ -28,33 +28,33 @@ Certificate: Netscape Comment: OpenSSL Generated Certificate X509v3 Subject Key Identifier: - F9:F6:14:B3:4E:D1:D5:35:9F:15:D4:74:10:0E:85:F5:FF:8C:D2:C9 + D9:14:AF:ED:6A:06:A9:D2:17:2D:16:9E:59:2B:09:7E:2E:4F:59:9E X509v3 Authority Key Identifier: - keyid:EE:60:BB:C7:17:5F:D3:72:AC:33:EE:8E:84:CC:2D:DB:1A:CC:8A:52 + keyid:EA:BE:42:EF:98:17:84:D5:FC:28:89:5A:4B:A5:B6:41:4F:7B:BB:28 Signature Algorithm: sha256WithRSAEncryption - 94:f9:64:c6:99:00:68:03:bb:58:e8:cd:71:65:82:02:30:ff: - cf:87:c3:5f:98:51:c8:96:93:c2:92:c0:f5:d4:78:5b:a2:0b: - ee:1a:77:6c:1e:bb:f8:d9:d9:93:b5:d2:9e:84:1b:bd:e3:0d: - 43:91:5b:a3:87:b3:a5:87:6b:ed:a3:93:e2:5a:7c:1e:09:f0: - 2a:27:97:39:3b:c4:a0:23:b4:84:50:c1:a2:1c:4d:0b:dc:66: - 16:d4:ef:1b:3b:bf:ef:69:a2:de:e1:01:b8:ca:e3:d3:be:f0: - e2:87:e1:1f:b5:92:93:25:32:e9:12:19:cb:78:dc:16:56:48: - ea:7c + 29:f6:76:33:b1:13:25:7f:b0:3a:d7:a0:7b:f0:e3:df:88:ef: + f0:57:dc:a6:c2:40:ee:9d:34:b9:a3:35:70:e6:30:72:b8:dd: + cf:b5:81:32:6d:d4:e3:61:45:43:eb:1c:74:32:42:3c:21:fa: + c0:32:de:f8:26:f9:3b:13:37:3c:1a:61:02:4b:b0:29:a6:47: + 4c:91:ec:ed:43:d9:01:a6:eb:85:5b:34:a4:78:cc:cb:cb:87: + e8:4b:74:38:42:c1:30:d3:f7:b8:59:43:93:8d:e8:f6:1f:95: + df:7d:e3:25:78:3c:bf:40:28:9c:a4:e2:e1:12:20:65:9a:50: + f3:54 -----BEGIN CERTIFICATE----- MIICzDCCAjWgAwIBAgIBATANBgkqhkiG9w0BAQsFADBlMQswCQYDVQQGEwJHQjET MBEGA1UECAwKRGVyYnlzaGlyZTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3Qx -EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTgwOTE4 -MTA0OTU0WhcNMjMwOTE3MTA0OTU0WjB2MQswCQYDVQQGEwJHQjEYMBYGA1UECAwP +EDAOBgNVBAsMB1Rlc3RpbmcxEzARBgNVBAMMClNpZ25pbmcgQ0EwHhcNMTkwOTEw +MDkzMzQyWhcNMjQwOTA4MDkzMzQyWjB2MQswCQYDVQQGEwJHQjEYMBYGA1UECAwP Tm90dGluZ2hhbXNoaXJlMRMwEQYDVQQHDApOb3R0aW5naGFtMQ8wDQYDVQQKDAZT ZXJ2ZXIxEzARBgNVBAsMClByb2R1Y3Rpb24xEjAQBgNVBAMMCWxvY2FsaG9zdDCB -nzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAzKAeanwg8D+ySC1hjbnbqKVlaxOI -N8cS1zLctv2JTP0uv+Y09ayd24JUsZyEe6evOn6J/X7+8T1vRhso8tlldg0RShCL -qeu9ESyoXQowZceZH5aILvGlFWKpSitQnnAEDD0kVUvD0oZXT3aRays1QBCy8MIX -P9rd0QCnMmQ3JLUCAwEAAaN7MHkwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0EHxYd -T3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFPn2FLNO0dU1 -nxXUdBAOhfX/jNLJMB8GA1UdIwQYMBaAFO5gu8cXX9NyrDPujoTMLdsazIpSMA0G -CSqGSIb3DQEBCwUAA4GBAJT5ZMaZAGgDu1jozXFlggIw/8+Hw1+YUciWk8KSwPXU -eFuiC+4ad2weu/jZ2ZO10p6EG73jDUORW6OHs6WHa+2jk+JafB4J8Conlzk7xKAj -tIRQwaIcTQvcZhbU7xs7v+9pot7hAbjK49O+8OKH4R+1kpMlMukSGct43BZWSOp8 +nzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA5t+R40KUtE3KS3Sfu/OyfwTxd2nw +nQoQ0+TFz75wZYM3yyiS+0X7k2JH2i3WDbNOEVu8waUQ+L6BZVE7aXyZMKZGiV+t +uQPPTIdRJ8pGZK17W/yUhUhNt0IumISvNvr3ulXa6nvIUp9oGgxNOM3BPlhrnREb +Sw5OKKlYPObCNBsCAwEAAaN7MHkwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0EHxYd +T3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFNkUr+1qBqnS +Fy0WnlkrCX4uT1meMB8GA1UdIwQYMBaAFOq+Qu+YF4TV/CiJWkultkFPe7soMA0G +CSqGSIb3DQEBCwUAA4GBACn2djOxEyV/sDrXoHvw49+I7/BX3KbCQO6dNLmjNXDm +MHK43c+1gTJt1ONhRUPrHHQyQjwh+sAy3vgm+TsTNzwaYQJLsCmmR0yR7O1D2QGm +64VbNKR4zMvLh+hLdDhCwTDT97hZQ5ON6PYfld994yV4PL9AKJyk4uESIGWaUPNU -----END CERTIFICATE----- diff --git a/test/ssl/server.key b/test/ssl/server.key index fe26ae2f..06531bf6 100644 --- a/test/ssl/server.key +++ b/test/ssl/server.key @@ -1,15 +1,15 @@ -----BEGIN RSA PRIVATE KEY----- -MIICXAIBAAKBgQDMoB5qfCDwP7JILWGNuduopWVrE4g3xxLXMty2/YlM/S6/5jT1 -rJ3bglSxnIR7p686fon9fv7xPW9GGyjy2WV2DRFKEIup670RLKhdCjBlx5kflogu -8aUVYqlKK1CecAQMPSRVS8PShldPdpFrKzVAELLwwhc/2t3RAKcyZDcktQIDAQAB -AoGBAKS4MEPf8FP1snpPrbv85Un4+o8bhggAhLYfB3V22tPS65MmqXMqpVhSrgLb -z/oKnhAkVMhvNqLTpYN10ZzMS9MvaUK2G7TeNAFVuZcs4bit0YJchf/s947SOuZp -lSjIqbjiAkHsediyqsSZxMMwP2SxpevlmgPcdJfvwFeL6siBAkEA5vf1XPLF/etj -bcGim24wo5rbfq2pgszbKRbhr3syeRSv7NFsC2adRswQ7ZL3pIP0KezlEXCuoY0Z -fxs6QcFB/QJBAOLNSoihg26Z1omRR9LGS6iXrsLkznB/O6wGZl2dPMUO6fhXjOx0 -jXvubvrsuaZlavPc3U1bz9Q0r8xt++sXbxkCQHgEqzxUbyvmEDGtaBjKZn3tb1dh -WG8+kjfEyxuLsguXA1/U5wb5mIp8aeN59jNH2i2bCuFII4aRMomJFXmrueUCQGdX -r4yOO7sbsdvBLP7nh/XsF5+Kbl5oOyJpUB971ALehtG34uijOwyrWjpPv1AIijFQ -BC6JlStWTnxR6SX36ZECQGtidHZtfChaaeGi5rgORalVSngj+b5qjeR/x6KbDw6y -XmRC0C20CEyTgVwVsQVSAUoDiJSi4ol3/k5Yo5R9Lc0= +MIICXQIBAAKBgQDm35HjQpS0TcpLdJ+787J/BPF3afCdChDT5MXPvnBlgzfLKJL7 +RfuTYkfaLdYNs04RW7zBpRD4voFlUTtpfJkwpkaJX625A89Mh1EnykZkrXtb/JSF +SE23Qi6YhK82+ve6Vdrqe8hSn2gaDE04zcE+WGudERtLDk4oqVg85sI0GwIDAQAB +AoGANWbrQMzqxpXjv/ZW6EujMvw6uitYC4sDf2/ATaA4MVLbufNFpDd4zIuEITRO ++dZKrXsxuvzqYw71sTDL9Edsy0KBft/gOD/eEEGLMCTSxAVzIlnk3iIjGJ+vcHp7 +K0TPy7yfk8CiHKUcxTfTWykr7x+gGu+XRmYlJv9izcA8nSkCQQD1np5HahyGzRgE +N5xeL6B0We+WwvXxsuBe96EAF1WdN35weKx4Y1330qRE0aia5A9lJw2TTXNH+5vF +8Bj6X+PVAkEA8KFpALzuGtot5hZ1nryOJS8BJMwjdbmUOAGu/J6sY9RSLj+qty7C +LHLrUvteikGKsQN/8WnVls7kSivqqBngLwJBALyu2jZQLJPdb+qlccjk22UmRahS +Iq9G05gAsLyqMEmy/L2X5h4hb2lWdnyrdtNuCOmSw5n58GpGvhajZ/zGtvUCQQC6 +y+JSY1fHWpWE5ux5xE/oR5vwr9PbIKwR6iSoEJksifcd1ei1eUPc830Alwgl9Ykv +rtLUWl8nSgZoGb14r1WbAkAQANc9yjhDyk9mQwBzDrvQiQnBJWROrgtNCgq2g9m6 +zawZwPtI6lbvvsR2t5kEDR4piXDiwiadXDdd3pq8m/LS -----END RSA PRIVATE KEY----- diff --git a/test/ssl/signingCA/crlnumber b/test/ssl/signingCA/crlnumber index 9e22bcb8..75016ea3 100644 --- a/test/ssl/signingCA/crlnumber +++ b/test/ssl/signingCA/crlnumber @@ -1 +1 @@ -02 +03 diff --git a/test/ssl/signingCA/serial b/test/ssl/signingCA/serial index cd672a53..2c7456e3 100644 --- a/test/ssl/signingCA/serial +++ b/test/ssl/signingCA/serial @@ -1 +1 @@ -06 +07 diff --git a/test/ssl/test-alt-ca.crt b/test/ssl/test-alt-ca.crt index 161b8066..2e7fa1ef 100644 --- a/test/ssl/test-alt-ca.crt +++ b/test/ssl/test-alt-ca.crt @@ -2,57 +2,57 @@ Certificate: Data: Version: 3 (0x2) Serial Number: 2 (0x2) - Signature Algorithm: sha256WithRSAEncryption + Signature Algorithm: sha256WithRSAEncryption Issuer: C=GB, ST=Derbyshire, L=Derby, O=Mosquitto Project, OU=Testing, CN=Root CA Validity - Not Before: Sep 18 10:49:53 2018 GMT - Not After : Sep 17 10:49:53 2023 GMT + Not Before: Sep 10 09:33:42 2019 GMT + Not After : Sep 8 09:33:42 2024 GMT Subject: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Alternative Signing CA Subject Public Key Info: Public Key Algorithm: rsaEncryption - Public-Key: (1024 bit) + RSA Public-Key: (1024 bit) Modulus: - 00:d9:91:e8:a7:67:b4:bf:8e:c9:6a:23:ee:00:14: - 6b:1f:b9:73:4d:af:ab:d3:96:5f:76:e5:0d:59:d4: - 0b:35:d4:48:5d:9b:9f:fc:e0:c2:29:b2:32:a9:e7: - 5b:81:bf:9c:55:e5:7f:e1:64:c5:c7:bc:10:3f:6e: - 05:16:82:47:e9:ae:86:97:75:2f:93:56:b2:4b:df: - 80:e1:a3:75:22:03:e0:de:93:5d:2d:98:ae:a9:c7: - 53:7d:a2:1a:c9:5d:83:0e:e2:60:52:a5:a8:82:fe: - 04:ae:be:1d:c4:c6:5c:ae:08:41:33:7a:88:4d:82: - e8:da:93:b8:01:ad:c6:1b:75 + 00:b3:5e:a7:16:47:3f:40:b1:a6:2b:30:72:23:83: + a6:bd:06:f8:ad:a9:01:91:cb:90:5e:7d:ca:f9:0a: + fb:bf:76:bc:0e:97:4b:4a:68:26:71:2b:23:78:b4: + 55:2a:91:63:19:a7:a1:9c:67:47:39:dd:b9:c0:76: + 6a:93:59:ae:a0:c5:67:89:82:1c:da:e4:3a:a4:d6: + c1:b8:ae:78:0e:8c:07:a7:a4:94:b8:0b:78:48:a8: + f7:a4:78:af:93:a0:77:d4:0a:19:f3:ef:37:2c:b9: + 14:fb:da:14:41:06:64:f9:70:90:c2:b2:93:6f:ad: + 1e:77:5f:0f:32:00:c7:d8:f5 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: - EC:E8:0A:3E:42:B9:F1:5D:F9:74:6E:07:8D:39:3F:63:53:7A:2C:17 + D6:68:84:29:27:27:1B:55:39:A5:42:93:95:08:B4:4B:55:FB:98:AA X509v3 Authority Key Identifier: - keyid:DA:20:AB:E0:98:22:39:28:E0:70:D6:74:65:53:26:E0:6B:4C:96:39 + keyid:CF:F3:9D:BB:BF:2B:14:D5:A2:E5:EC:41:CF:9C:16:D0:4D:AB:84:04 X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha256WithRSAEncryption - 0a:14:f7:e7:54:44:59:39:14:b0:aa:d3:0e:bd:94:e2:0a:b3: - e9:65:31:c7:8c:0b:af:55:b9:c0:96:bb:2f:12:40:6a:4e:3e: - 13:c8:7e:cc:02:06:83:41:ad:22:2b:15:ea:fe:c4:09:25:2d: - e7:d4:f4:91:59:4e:6b:c9:8c:c5:a3:e0:f7:d2:56:1a:ea:82: - a6:06:15:d8:25:03:2f:71:c4:78:5c:ba:ce:8c:a4:80:67:58: - 33:12:86:df:ae:da:bd:d2:ff:e5:71:d0:8a:1f:ad:b4:0a:70: - 52:d7:04:0f:f8:2c:b9:1c:8e:1b:5b:c2:df:f8:ca:c9:97:4e: - 1a:0c + a1:9a:e1:2a:68:5d:54:f9:a1:fb:a4:7c:c0:ad:05:db:1c:4b: + 01:af:5f:96:f3:bd:33:e3:eb:24:f1:7e:16:0f:58:64:fe:ef: + 33:a4:30:4e:64:31:3b:52:b5:ca:7e:2f:cd:6e:7d:ed:ff:81: + 85:c9:bd:a4:51:e5:ba:d6:ca:3b:93:94:26:3c:61:8b:e1:e2: + fc:3e:23:57:27:22:47:fa:aa:e3:f6:90:c6:2c:e9:33:22:65: + 82:19:c8:9e:35:f4:b2:98:94:19:03:c0:c8:62:5b:42:6a:71: + 7b:d9:9d:8f:79:c1:7c:e7:ae:59:63:39:bf:e8:36:68:3e:be: + 49:c7 -----BEGIN CERTIFICATE----- MIICqTCCAhKgAwIBAgIBAjANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJHQjET MBEGA1UECAwKRGVyYnlzaGlyZTEOMAwGA1UEBwwFRGVyYnkxGjAYBgNVBAoMEU1v c3F1aXR0byBQcm9qZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRAwDgYDVQQDDAdSb290 -IENBMB4XDTE4MDkxODEwNDk1M1oXDTIzMDkxNzEwNDk1M1owcTELMAkGA1UEBhMC +IENBMB4XDTE5MDkxMDA5MzM0MloXDTI0MDkwODA5MzM0MlowcTELMAkGA1UEBhMC R0IxEzARBgNVBAgMCkRlcmJ5c2hpcmUxGjAYBgNVBAoMEU1vc3F1aXR0byBQcm9q ZWN0MRAwDgYDVQQLDAdUZXN0aW5nMR8wHQYDVQQDDBZBbHRlcm5hdGl2ZSBTaWdu -aW5nIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDZkeinZ7S/jslqI+4A -FGsfuXNNr6vTll925Q1Z1As11Ehdm5/84MIpsjKp51uBv5xV5X/hZMXHvBA/bgUW -gkfproaXdS+TVrJL34Dho3UiA+Dek10tmK6px1N9ohrJXYMO4mBSpaiC/gSuvh3E -xlyuCEEzeohNgujak7gBrcYbdQIDAQABo1AwTjAdBgNVHQ4EFgQU7OgKPkK58V35 -dG4HjTk/Y1N6LBcwHwYDVR0jBBgwFoAU2iCr4JgiOSjgcNZ0ZVMm4GtMljkwDAYD -VR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQAKFPfnVERZORSwqtMOvZTiCrPp -ZTHHjAuvVbnAlrsvEkBqTj4TyH7MAgaDQa0iKxXq/sQJJS3n1PSRWU5ryYzFo+D3 -0lYa6oKmBhXYJQMvccR4XLrOjKSAZ1gzEobfrtq90v/lcdCKH620CnBS1wQP+Cy5 -HI4bW8Lf+MrJl04aDA== +aW5nIENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCzXqcWRz9AsaYrMHIj +g6a9BvitqQGRy5Befcr5Cvu/drwOl0tKaCZxKyN4tFUqkWMZp6GcZ0c53bnAdmqT +Wa6gxWeJghza5Dqk1sG4rngOjAenpJS4C3hIqPekeK+ToHfUChnz7zcsuRT72hRB +BmT5cJDCspNvrR53Xw8yAMfY9QIDAQABo1AwTjAdBgNVHQ4EFgQU1miEKScnG1U5 +pUKTlQi0S1X7mKowHwYDVR0jBBgwFoAUz/Odu78rFNWi5exBz5wW0E2rhAQwDAYD +VR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQChmuEqaF1U+aH7pHzArQXbHEsB +r1+W870z4+sk8X4WD1hk/u8zpDBOZDE7UrXKfi/Nbn3t/4GFyb2kUeW61so7k5Qm +PGGL4eL8PiNXJyJH+qrj9pDGLOkzImWCGcieNfSymJQZA8DIYltCanF72Z2PecF8 +565ZYzm/6DZoPr5Jxw== -----END CERTIFICATE----- diff --git a/test/ssl/test-alt-ca.key b/test/ssl/test-alt-ca.key index 3e59fb4c..a26e35ae 100644 --- a/test/ssl/test-alt-ca.key +++ b/test/ssl/test-alt-ca.key @@ -1,15 +1,15 @@ -----BEGIN RSA PRIVATE KEY----- -MIICXQIBAAKBgQDZkeinZ7S/jslqI+4AFGsfuXNNr6vTll925Q1Z1As11Ehdm5/8 -4MIpsjKp51uBv5xV5X/hZMXHvBA/bgUWgkfproaXdS+TVrJL34Dho3UiA+Dek10t -mK6px1N9ohrJXYMO4mBSpaiC/gSuvh3ExlyuCEEzeohNgujak7gBrcYbdQIDAQAB -AoGBAKh2ovekhD7i17AYu/tR1BSPaulXQaumvqp39tt8JWX7xkC89KdAfPb+JN6L -5r3TWMDl4BvtBHuAcfA7RzNDk1u/DZUT25ZnkbnL9iuQhBweRLETGSbBcrJ/VvGi -BXBB9bQfAbtUqF4MiPVIjgBSZn/Jtgz0A9PAKYpnhqvpIVStAkEA8kBBNAOA0ZI7 -r3DPEiL9QEMad0tDBIkM8hcFYVwPqi0O5mRt4YXDev0OzyvTVYX5Z1BaF5uJvUSH -y1lvDdpYkwJBAOXrDhnmW0K6xCYIqLVfdXG4LIx/exCQuYr78QGVV1rE4UCuIDZl -zOlRmmLzFsP1T8bArYGSxWqtU1ZYgv8uaNcCQQDlT1VpOvexaU7+Hzaj4GMBdYOT -8LYbkO+kKY56Pn7Fg6lbBS3OEKSdwvVFviJqDkurNDBTsHONqVUxdBLfdhPpAkB8 -9ZLVasig7OcckMo4wWgQZXv45HRbXX0qV6H2LVer4qNWRw0E47FKAer56oqt+E7i -g+gJK18Wiptnq3WPAYdDAkAdaJWEoOWkQROPvlKWlD51hAqCReb9ElxAeJOcte/Y -k1xir4zsMLo8cjqr/GLWVMhYv4zw9ZoKMNR7tfmYLZUC +MIICXQIBAAKBgQCzXqcWRz9AsaYrMHIjg6a9BvitqQGRy5Befcr5Cvu/drwOl0tK +aCZxKyN4tFUqkWMZp6GcZ0c53bnAdmqTWa6gxWeJghza5Dqk1sG4rngOjAenpJS4 +C3hIqPekeK+ToHfUChnz7zcsuRT72hRBBmT5cJDCspNvrR53Xw8yAMfY9QIDAQAB +AoGAE83rnOYY8cerlTEwKQOsMUrHwkTay4IyWnyBIKY5zZYKhYHm6jw9olkk/XrL +vHt4+agsi9xLXPRCQiHQ+pv4T9CiuwmjhYyZmurSSIBEtHrMKuVXvwhNDRyqiGb1 +XyW23x1hoQ/G3CBQh+7n8Z+x+sNgdyipV1ia4tryuxsvgQECQQDd4CbsGARJ/E0z +fSo3Y4ZhTHvOrwYYPmjBFBOFPt/acwl6IH7XhtJKL7MlveapGyLk65ksptjREIMu +ED51Q3IlAkEAzvTt0seXV1ZGf9i/DlES3m6NSSNh2eRZjDMzf55WQ8D59frteMVN +BLyE3jrhYdS37iqpjdTQh1mKsrVuvIfKkQJBAJmkDI/UmbO5+KO8+qzcSEO8OMeI +v4muPc/l3RaZ0V1t55QgSHVqsNgaa82o0L8tQV6QHsOizeUHsC8HpJiDGdkCQAJv +STj4liQ15KBuaVj+xS0OueTJYMZSdGc81vdCYptrcsVdDVwlXhGXMiz3Hl2rRfqs +T9BWV5mwCPyvO71GD7ECQQDRjmnHPm7kehGeHW11LVbRA9TauZClJnsvI4XgYgsN +Gbd96uWaQHzWt9qovtuxQsk618ZlajGlOrmCO2BDC0Vm -----END RSA PRIVATE KEY----- diff --git a/test/ssl/test-bad-root-ca.crt b/test/ssl/test-bad-root-ca.crt index 1e72d2e9..0dcb8386 100644 --- a/test/ssl/test-bad-root-ca.crt +++ b/test/ssl/test-bad-root-ca.crt @@ -1,17 +1,17 @@ -----BEGIN CERTIFICATE----- -MIICujCCAiOgAwIBAgIJAOk0UydITfTbMA0GCSqGSIb3DQEBCwUAMHYxCzAJBgNV -BAYTAkdCMRMwEQYDVQQIDApEZXJieXNoaXJlMQ4wDAYDVQQHDAVEZXJieTEaMBgG -A1UECgwRTW9zcXVpdHRvIFByb2plY3QxEDAOBgNVBAsMB1Rlc3RpbmcxFDASBgNV -BAMMC0JhZCBSb290IENBMB4XDTE4MDkxODEwNDk0N1oXDTI4MDkxNTEwNDk0N1ow -djELMAkGA1UEBhMCR0IxEzARBgNVBAgMCkRlcmJ5c2hpcmUxDjAMBgNVBAcMBURl -cmJ5MRowGAYDVQQKDBFNb3NxdWl0dG8gUHJvamVjdDEQMA4GA1UECwwHVGVzdGlu -ZzEUMBIGA1UEAwwLQmFkIFJvb3QgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJ -AoGBANuiMnQx8FL6FD2kGa3xG0Tv4iH1yECdJ8hzcdxESC/ecmaXMwGPiEmUyymU -/xRyQysHafhchc1lJvDmeFL13z4vgNPpJDhVCdji2QAq2IAKasLSZ3rhCYFhjvIO -wPHZxLtWeOgVqYRxWC58eF5H8wnBMOcfRBy5R/N9PYA2sZjdAgMBAAGjUDBOMB0G -A1UdDgQWBBTi2KR5GQHHN6hKI+Tfhqy4mLDMUTAfBgNVHSMEGDAWgBTi2KR5GQHH -N6hKI+Tfhqy4mLDMUTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4GBAIr6 -ie8HXzJYNZagjLVV/BkYKKe65FpmVk+3DdPqTtDhKGr8MpqkQlbBH8Ovocm3+eeN -om2qrwfymji5FGh9SV6kI7UCiIZ4r3VCo+npmwh8QKTv5yP5nCiUGrDEFUkg4VOt -HZTDW6L52WTHDJc/5Dh/MRhT07wox7BesgNWv21w +MIICxTCCAi6gAwIBAgIUA0+BIjY/izJBfY9rCIK0rFj1LTkwDQYJKoZIhvcNAQEL +BQAwdjELMAkGA1UEBhMCR0IxEzARBgNVBAgMCkRlcmJ5c2hpcmUxDjAMBgNVBAcM +BURlcmJ5MRowGAYDVQQKDBFNb3NxdWl0dG8gUHJvamVjdDEQMA4GA1UECwwHVGVz +dGluZzEUMBIGA1UEAwwLQmFkIFJvb3QgQ0EwHhcNMTkwOTEwMDkzMzQyWhcNMjkw +OTA3MDkzMzQyWjB2MQswCQYDVQQGEwJHQjETMBEGA1UECAwKRGVyYnlzaGlyZTEO +MAwGA1UEBwwFRGVyYnkxGjAYBgNVBAoMEU1vc3F1aXR0byBQcm9qZWN0MRAwDgYD +VQQLDAdUZXN0aW5nMRQwEgYDVQQDDAtCYWQgUm9vdCBDQTCBnzANBgkqhkiG9w0B +AQEFAAOBjQAwgYkCgYEA3I5ZR4RbtdVfj/xvLffj0WMQ/fEuAboyd7Dfx9af713N +X3xmYC4m8sBEpYf/XKCmDlGYHOtS91SGj7Ylf+ipLIm3LWbovxq3jxIY/vCJMqLf +2t59xslBSAPdF4msU4AZxVrinDgkExrZ1iOev8v1xuQzHiJfGPZWdAYKZ7GTUfsC +AwEAAaNQME4wHQYDVR0OBBYEFF3Bl5CiFVGSsPDEjaacOTBH7a2HMB8GA1UdIwQY +MBaAFF3Bl5CiFVGSsPDEjaacOTBH7a2HMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcN +AQELBQADgYEAFpuMcEex7qxkVU1z7bkB5DEpzTI4FhM5iDxmXvNSa1yPLsJPxuih +29G+W5luDEnsdb9dV4KM/VHZ/HuSCwX69EBiXlBXqSHWDKGas9q2e7eRzdGCQGvL +KiUaEsCbEigrP6DasDHx7MYj2EcNYwcqSCQjWKf0lhWPVnbLQIy+Pjo= -----END CERTIFICATE----- diff --git a/test/ssl/test-bad-root-ca.key b/test/ssl/test-bad-root-ca.key index 936370df..4dcee7d6 100644 --- a/test/ssl/test-bad-root-ca.key +++ b/test/ssl/test-bad-root-ca.key @@ -1,15 +1,15 @@ -----BEGIN RSA PRIVATE KEY----- -MIICXgIBAAKBgQDbojJ0MfBS+hQ9pBmt8RtE7+Ih9chAnSfIc3HcREgv3nJmlzMB -j4hJlMsplP8UckMrB2n4XIXNZSbw5nhS9d8+L4DT6SQ4VQnY4tkAKtiACmrC0md6 -4QmBYY7yDsDx2cS7VnjoFamEcVgufHheR/MJwTDnH0QcuUfzfT2ANrGY3QIDAQAB -AoGBANXsSIpGbdbUP8y+Pkjes3nU0IPVWmQc7jfewgMR+uGtH+5uzL5zaAKLS8rH -lh/7HxMVGJFQxP6GzIQNZxse4n1oXVstqa9xCoXQhUHpq6a/HdzbtMvg25SK6BXy -0F5d3y+MZAkat2JBIIRhpEm9A42Zy2z+uD5t/tJoF8hGw5g9AkEA8K1hUZYlf77p -hsHK79bAa9LTCqA+GX18Dbwixq1m01Mf1+JUJVURfuZOPlHldmUR30ELu6ojo84f -2TCLnenPawJBAOmd13FummA+UZNqK7GjXE0gYXqR99Q1zV8ZL5fgE3femiUIPIor -WpjzxNOcDqgGaHmXsh7s4HBJsAAKuWJUstcCQQDhE7PkYb815WttK8TGYRZYf7P/ -xvXsTq76BUyccsOrs5we/7ljpFeVTnozy9EE1OZO2/zGBwoHgZfFPKIFDwh7AkBM -jQdCyS5W6TTL7Fdi/xfIwhqPEnO2GucwCU26I5fdiJjUF63WzLwEMKTHfnSjBG6J -oXahgZdN1CeS6/CxUvXDAkEA48RD37aRhPBhE7s4Z0oODABYst+dKLOfbvnM8KY1 -XXYblkJPmmBfWb4bG+huYIaDYkfjZ6KJfJtk3tG8E3TWbA== +MIICXAIBAAKBgQDcjllHhFu11V+P/G8t9+PRYxD98S4BujJ3sN/H1p/vXc1ffGZg +LibywESlh/9coKYOUZgc61L3VIaPtiV/6KksibctZui/GrePEhj+8Ikyot/a3n3G +yUFIA90XiaxTgBnFWuKcOCQTGtnWI56/y/XG5DMeIl8Y9lZ0BgpnsZNR+wIDAQAB +AoGBALjqtFns1AORIS0UhZax5pUwjReMNXmHRjbp2cWv4aoMKFttblwndcpDf4qV +inl7y53ntTRR7N6nRKaLHcevJt48/YrK6TrFcOMVrOpqN5CcPz91miWH+PSbHtNo +aF8b5ZJe85gjJ2UewOXI41je64nVTYw8BC/kYOH9CixNOTBJAkEA9LFY6IyLyNO5 +eBVxrZjXBmXovqOPsESJlVf6IFu8Ecrvh59PIQGzY10YWt5QxA3BWmOguMigWjlF +uRLvUh8vTwJBAOa/eGanpn4l0o+xsS/KVOTO+98v1Dt50VB+weu7Rr/G/sQzTTVA +oN41W5YyJd05FwnUZxVvL8NfP7nOPtdcZ5UCQAYyp8ncJX5EvqHoCSUYhfnHgwmx +IuaYFdQOkmtXZ4Ab381Tn7F6VYziwscqcmlE3+zmMR/9FPK0GKwDasRtvckCQBen +PPJY8SoxOlpcfqtFdFpYFV2Vi43lON2lgL9nXSM/hNIb6CgzTco5cf/9eAArX/8z +9LUvxpeiZefoCm0NHdkCQBA+vqQPkmqKV40II55+5zXW1vmi76lk0NDJPRQ/gGlA +PF9wokWex61Dl3iixIG5lOASoMBo5b8g1szhbZHeqFE= -----END RSA PRIVATE KEY----- diff --git a/test/ssl/test-ca.srl b/test/ssl/test-ca.srl deleted file mode 100644 index 53b55300..00000000 --- a/test/ssl/test-ca.srl +++ /dev/null @@ -1 +0,0 @@ -CDAE0E564A2891AA diff --git a/test/ssl/test-fake-root-ca.crt b/test/ssl/test-fake-root-ca.crt index 55343803..04d17b5b 100644 --- a/test/ssl/test-fake-root-ca.crt +++ b/test/ssl/test-fake-root-ca.crt @@ -1,17 +1,17 @@ -----BEGIN CERTIFICATE----- -MIICsjCCAhugAwIBAgIJANlFsLqxEDJbMA0GCSqGSIb3DQEBCwUAMHIxCzAJBgNV -BAYTAkdCMRMwEQYDVQQIDApEZXJieXNoaXJlMQ4wDAYDVQQHDAVEZXJieTEaMBgG -A1UECgwRTW9zcXVpdHRvIFByb2plY3QxEDAOBgNVBAsMB1Rlc3RpbmcxEDAOBgNV -BAMMB1Jvb3QgQ0EwHhcNMTgwOTE4MTA0OTQ3WhcNMjgwOTE1MTA0OTQ3WjByMQsw -CQYDVQQGEwJHQjETMBEGA1UECAwKRGVyYnlzaGlyZTEOMAwGA1UEBwwFRGVyYnkx -GjAYBgNVBAoMEU1vc3F1aXR0byBQcm9qZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRAw -DgYDVQQDDAdSb290IENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDX3o3H -JPVGSfB/MdMNIBw+goqXmJdeAm4Ied0pkvC+KqIIp3xn0tiIdn+cKzn2hRk9UnW1 -IxAxKwVYRrASIRkFSFieRzhCTbZ1DxoI+DxLiE9RNH6b9M4u8nhlb9qApRgfpQsL -6gM5mG7QbXADyKPS9ToHU0YM3MpOiLOEDDbV/QIDAQABo1AwTjAdBgNVHQ4EFgQU -tQbx/zTi/+cZAQS63KiVZy+KaHAwHwYDVR0jBBgwFoAUtQbx/zTi/+cZAQS63KiV -Zy+KaHAwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQBLHJkJGaeAZoMq -d+wHJ+W/QJuU2xPACbCb7b5nA3WXnCj7A81IoFOJzdvlaHf9re7FvuVjK5kdhbVR -jz79e/RWHu2Q1vb8ftFqx8XISy3+wQR07NPmrFRmT0cfV06yiYjL0obQFyiXQ1y+ -xXVWHQ/2EkTGVBFKyuRBBmqWbzFj7w== +MIICvTCCAiagAwIBAgIUEV/NxsOd+AgPP9s5/+r8yDhZeGEwDQYJKoZIhvcNAQEL +BQAwcjELMAkGA1UEBhMCR0IxEzARBgNVBAgMCkRlcmJ5c2hpcmUxDjAMBgNVBAcM +BURlcmJ5MRowGAYDVQQKDBFNb3NxdWl0dG8gUHJvamVjdDEQMA4GA1UECwwHVGVz +dGluZzEQMA4GA1UEAwwHUm9vdCBDQTAeFw0xOTA5MTAwOTMzNDJaFw0yOTA5MDcw +OTMzNDJaMHIxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApEZXJieXNoaXJlMQ4wDAYD +VQQHDAVEZXJieTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3QxEDAOBgNVBAsM +B1Rlc3RpbmcxEDAOBgNVBAMMB1Jvb3QgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0A +MIGJAoGBAL/ovHlwesKZg8IwhZv9IC48HvbVSwd2FZydjOp677hDnlbZPuLBoEvO +XJFh+LlS7RWBul0IGg3S0LnW4w1Zib9ECy98R2vapSCsZFlOi0+NO4/StLqkVKjm +Pce1+g5rN3UgqZRpsPVIEuct2ikZxECydzzTwveofUUOIqujQ3oHAgMBAAGjUDBO +MB0GA1UdDgQWBBQHDEMQ7QUiy/OT0knUpuwYWcf4MTAfBgNVHSMEGDAWgBQHDEMQ +7QUiy/OT0knUpuwYWcf4MTAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4GB +AGFKPpRPPIgzpAVIlW8tATyzkNeD6W9/kCky0TPWul7k+CII3agJYRz/Ms2F/ASR +E5Ejr7iE97hHfxCSB3xLts5ouSHclwaymz9/gcw0I6SRqP/x+Bb0BYZ4bIeH1aye +3NO9TKRyyzVf1E+3aBWbVJroFNPX0FO9JG54qRcxc6aS -----END CERTIFICATE----- diff --git a/test/ssl/test-fake-root-ca.key b/test/ssl/test-fake-root-ca.key index 81c538d4..7b750762 100644 --- a/test/ssl/test-fake-root-ca.key +++ b/test/ssl/test-fake-root-ca.key @@ -1,15 +1,15 @@ -----BEGIN RSA PRIVATE KEY----- -MIICXQIBAAKBgQDX3o3HJPVGSfB/MdMNIBw+goqXmJdeAm4Ied0pkvC+KqIIp3xn -0tiIdn+cKzn2hRk9UnW1IxAxKwVYRrASIRkFSFieRzhCTbZ1DxoI+DxLiE9RNH6b -9M4u8nhlb9qApRgfpQsL6gM5mG7QbXADyKPS9ToHU0YM3MpOiLOEDDbV/QIDAQAB -AoGAKzBjvUwvpnh0nX4ic6XRANCtWdc1saFa0mdPUFoNwH5XHNQll8Afgm3y6hPb -7O6ENjihRDRXsP6iex7pazckAgQ9zvIhXwyfAxHJ8T8+xJrb2ohMNbl/mdWkZzJS -HmfLwmTl8n2FTnUWOCRZ4DWZmxoqK04VcxFK2/ZvY9neZCECQQD88xjgt8zfk9k0 -UAKRQyqnoWbpthMDecLGwL3jjfGDts79TvSv7iwtq10uSQycFApMQlKysz7a4wsV -IMir+Z2XAkEA2nj7o7kiN/lhREcTf865mjo6Lol4vk6UDcNGQ8zHeoYiQMwIyhiR -MnFYzMeZT/tjD6O5JuJwyO74dCHqhYaDiwJBAIlhVp+l88VyPUOmON7ARghpJsXE -N6tplBnyUK+oRgWtYdo96bMrfh8HtUIQNqMGV1l3pAaeR4MGUNyWw6Zzmd0CQQDB -6E+w6Ujt1XH3X/52mc0yjivF0k5Q2v2dmYxr8P28SgFs8at7dIKq+t+OIjp5Ou6Z -mv9i++iO70umB9RX3yQxAkBY1E0dLGusSZ8BWugiminaZ8E0QdAwENIl02NleerY -ANdCQvvt3/KtfqiAhwakyGv4sdxa7Uo5KUaDKhqZ++0N +MIICXAIBAAKBgQC/6Lx5cHrCmYPCMIWb/SAuPB721UsHdhWcnYzqeu+4Q55W2T7i +waBLzlyRYfi5Uu0VgbpdCBoN0tC51uMNWYm/RAsvfEdr2qUgrGRZTotPjTuP0rS6 +pFSo5j3HtfoOazd1IKmUabD1SBLnLdopGcRAsnc808L3qH1FDiKro0N6BwIDAQAB +AoGAVoDs+/x0iWUzXAQNJbwallypRG/uawWSRk9KJqOVjMSGCfXQ/9txitoRJcM4 +nyi/D3Ozcp3lSJffV/WB0RGsIc/lrvqu0NkR4nn5uPARE03yujRTpiRt/37s77Ge +X86an1H0Z/fo7R+m6iJhBdRTMmXEch3pEJXSkeLIzCA8wKkCQQDnJB9jEO3ZviQ9 +bSBBJ14EMrd/idzvGhrGtPot7FZahLJrVCz4iWncrTfKMiRlU7F1WvENXiV2mGW3 +WiLJ/0D1AkEA1Ix2NLPz6/WF0v6meo4OgVj8c9+4QwTyy71mTo36yMscy1SA5B4U +xPWMyKFaPAbG6uX2L+880A3vIA+PrVlBiwJAEklwVkUjnEOH2HhGwgDcVlaw391H +Zn9ZOPlehb2aA2VWPFmXiT5N6tClhlC7Qm0BsDg2tAkLy7s46O2vrO2N9QJBALmZ +CaMNvCI/26KZwK9lml7yYEeihFjpWkX0VgCkU+fADJ20ZXRMnCA8trl+w7eEx2/Y +bHgA9N5MPJGHZROey+8CQCoK0Z3bPgqv9GP81wa2Sy84p9vAqTMyjalRVy1WssaD +0d9Q9s0P/JWWtg9IonzYcT6CCrVy8RhMcZ6Tq1yE3fc= -----END RSA PRIVATE KEY----- diff --git a/test/ssl/test-root-ca.crt b/test/ssl/test-root-ca.crt index d0bf051e..88ad6f2d 100644 --- a/test/ssl/test-root-ca.crt +++ b/test/ssl/test-root-ca.crt @@ -1,17 +1,17 @@ -----BEGIN CERTIFICATE----- -MIICsjCCAhugAwIBAgIJAOcAUKw/VPlMMA0GCSqGSIb3DQEBCwUAMHIxCzAJBgNV -BAYTAkdCMRMwEQYDVQQIDApEZXJieXNoaXJlMQ4wDAYDVQQHDAVEZXJieTEaMBgG -A1UECgwRTW9zcXVpdHRvIFByb2plY3QxEDAOBgNVBAsMB1Rlc3RpbmcxEDAOBgNV -BAMMB1Jvb3QgQ0EwHhcNMTgwOTE4MTA0OTQ3WhcNMjgwOTE1MTA0OTQ3WjByMQsw -CQYDVQQGEwJHQjETMBEGA1UECAwKRGVyYnlzaGlyZTEOMAwGA1UEBwwFRGVyYnkx -GjAYBgNVBAoMEU1vc3F1aXR0byBQcm9qZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRAw -DgYDVQQDDAdSb290IENBMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCeTh1y -KRZ1NIeLVvhBxSQC3Cvfe9L3IC8415CVbgipLgZKe7Nl1JBqFYDxXKBn2eVQ6EwL -sCz+U2oa2oCql8r5eYEKpmWFiIcKdrL8aSXNvMKEOu0AJlsIXBe2sDFPxuuw143n -W/odqBiWedciVd5pmJWZZ93neWdkkjnPZZMN4wIDAQABo1AwTjAdBgNVHQ4EFgQU -2iCr4JgiOSjgcNZ0ZVMm4GtMljkwHwYDVR0jBBgwFoAU2iCr4JgiOSjgcNZ0ZVMm -4GtMljkwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOBgQBIs2GY/GQL76rz -+0qSWZvQ7l+HovHdp7C49auI+hiSRAzv3p2y7y3DmZrpmYJlTZJWlaA8eg769sLg -Cyfkt6AIsZPadJiTTUayh8oCF5aMH+OetC+63USFBNYXJN6AOXp9vu/K3TdM8ao6 -WsAf26+DKYAPmvu+oU7ScpCrCSdC+Q== +MIICvTCCAiagAwIBAgIUCq9EuGevQyFmQpXhKjTK8l6q2VYwDQYJKoZIhvcNAQEL +BQAwcjELMAkGA1UEBhMCR0IxEzARBgNVBAgMCkRlcmJ5c2hpcmUxDjAMBgNVBAcM +BURlcmJ5MRowGAYDVQQKDBFNb3NxdWl0dG8gUHJvamVjdDEQMA4GA1UECwwHVGVz +dGluZzEQMA4GA1UEAwwHUm9vdCBDQTAeFw0xOTA5MTAwOTMzNDJaFw0yOTA5MDcw +OTMzNDJaMHIxCzAJBgNVBAYTAkdCMRMwEQYDVQQIDApEZXJieXNoaXJlMQ4wDAYD +VQQHDAVEZXJieTEaMBgGA1UECgwRTW9zcXVpdHRvIFByb2plY3QxEDAOBgNVBAsM +B1Rlc3RpbmcxEDAOBgNVBAMMB1Jvb3QgQ0EwgZ8wDQYJKoZIhvcNAQEBBQADgY0A +MIGJAoGBAOGwkYR+cUbrn3AGkbdFImPx4tnYIsqT+MwGDNmQ33Q4Ng9ZwEJhsT2C +qGl0Txsj1HLo3goAFU/lZcvedtLT3sZKw1Jamwc7SS3H15Et9Ne9kQczaLekr74d +NpRWvgJMy3+YkBHsB04vFA45ruc4F7UnpljaovJ4sVadx0FyWdxbAgMBAAGjUDBO +MB0GA1UdDgQWBBTP8527vysU1aLl7EHPnBbQTauEBDAfBgNVHSMEGDAWgBTP8527 +vysU1aLl7EHPnBbQTauEBDAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4GB +ABRmECRQbiR9m27Qg8x8Auwus2xdxZTlKz2n8WV1HN8jE2b22g9kqAcamqcQXWYU +JklO18dNdpI2rpJa/rSi/Wcakp2STUnV03kqw7IZWyzCaDNZLRWWDHqsJhH91jzv +jFOhj81GLFVsAwsiTMV2FFk9XzYVpiV2syC7EgFvtjzH -----END CERTIFICATE----- diff --git a/test/ssl/test-root-ca.key b/test/ssl/test-root-ca.key index 7b7843f7..eb574d91 100644 --- a/test/ssl/test-root-ca.key +++ b/test/ssl/test-root-ca.key @@ -1,15 +1,15 @@ -----BEGIN RSA PRIVATE KEY----- -MIICXAIBAAKBgQCeTh1yKRZ1NIeLVvhBxSQC3Cvfe9L3IC8415CVbgipLgZKe7Nl -1JBqFYDxXKBn2eVQ6EwLsCz+U2oa2oCql8r5eYEKpmWFiIcKdrL8aSXNvMKEOu0A -JlsIXBe2sDFPxuuw143nW/odqBiWedciVd5pmJWZZ93neWdkkjnPZZMN4wIDAQAB -AoGAYXzLh20kJmOGAVo6og4sohJCdmtDvOo2CnQ91rgfX0g3mZDaJqCjmqDJelnH -cozuOkgD5MLGwoxN8GGVEPlPhiCzPIAp4ZIKcdpHxlAPmVRAhkLDgJuMD66OksPn -FxE5AqCUfZG+jpGy5KzlU2fyXyXt3zu9G6+Y9dbghXpnDekCQQDOxaGk50S2vJrJ -y5U+DaiSjr9+Qt6bDgdg2Q2ZE8oF3T6jI0QG/c9S3NbIRWe5HydrZ4YRn7GNmKQz -+Moy/43lAkEAw/6EwrUAfrJJ8TVeRsHLYs8H68Nswo0RQPqXSeLcqJc5AwqVfWpe -dJWSFpoHtelWfC7MMGrH26dwzt3YGUuwJwJBAIFqqyimY5ioZY1mMcv8CoVoeSyS -t/d+iVmxoNQt0aVn+7tp6DskAu6PMJN69VelyytrSTugoyXH4wZwckYHM40CQGYD -1JaEH/3STyp93NR3iqWjnTvaPIIHazOnO5f5vWEDVWl/2M+uzftg3ulkwx6slZeN -xDpvWhe6z7zdO93ux4ECQCXOCNFRha+Rs5Leyd4us6/6yo9o0rgHowNY8HIHBH9F -sEgq1pJxpSO3L7S5LpnhYkecIAHRzeGs1ikIDzIU/k4= +MIICXQIBAAKBgQDhsJGEfnFG659wBpG3RSJj8eLZ2CLKk/jMBgzZkN90ODYPWcBC +YbE9gqhpdE8bI9Ry6N4KABVP5WXL3nbS097GSsNSWpsHO0ktx9eRLfTXvZEHM2i3 +pK++HTaUVr4CTMt/mJAR7AdOLxQOOa7nOBe1J6ZY2qLyeLFWncdBclncWwIDAQAB +AoGAU6B1iz6/AqR0Y7JLdDlt0NLkWAw6eA30dsUXJdcEta/OeEmtb+t7HWu4s7qh +RVE1e47GF7aILx61ZaF9LgnL1cObEShIOHyr7WJHo5YXQhnHUMT/ltp0434vWTcp +40nOpkkb+QX92wRYsKBeB6byAsmSHgbVzwXY0ahy45IB/UECQQD+WVCh45eVWxb6 +xdCoxMPG8upMjkSoxQYulbgvKYNHGRZD7VRGnsULMUROsRUDB7QBmB3uvGEKV44Y +EN9OPXlTAkEA4yegcpPBEIaLtXHVHz0QSKk34sJfeyO1aW7QMdYVT6N7rRRnA1Pc +53ZzIC3Zk4ryeozSYLT1lTsh8lSjcwhH2QJBALBnJ4ov+/jFRUnFmnMCjLnVzfQs +k6fthd0XT7e99eOAnbWcy19zTDv3/mUJYgZI+GpGozPpiPAQS2ebhBSShCsCQQC0 +g/w0sYieyl1iLvkP3yX+qENaN99K62CyTbaztA6xgBi7vdfzRATsCCyLKQScBLKX +gyt4YLY9BoX+nxZZRv5ZAkBquUNGjXcKande80tMRKkU0LOfetMOQ/LllIe+TpNc +zBv71H8p0X9X32XV7cCmLUGG7mvc9R8jNfloBabamJfI -----END RSA PRIVATE KEY----- diff --git a/test/ssl/test-signing-ca.crt b/test/ssl/test-signing-ca.crt index f22216c8..1afb4ab0 100644 --- a/test/ssl/test-signing-ca.crt +++ b/test/ssl/test-signing-ca.crt @@ -2,57 +2,57 @@ Certificate: Data: Version: 3 (0x2) Serial Number: 1 (0x1) - Signature Algorithm: sha256WithRSAEncryption + Signature Algorithm: sha256WithRSAEncryption Issuer: C=GB, ST=Derbyshire, L=Derby, O=Mosquitto Project, OU=Testing, CN=Root CA Validity - Not Before: Sep 18 10:49:47 2018 GMT - Not After : Sep 17 10:49:47 2023 GMT + Not Before: Sep 10 09:33:42 2019 GMT + Not After : Sep 8 09:33:42 2024 GMT Subject: C=GB, ST=Derbyshire, O=Mosquitto Project, OU=Testing, CN=Signing CA Subject Public Key Info: Public Key Algorithm: rsaEncryption - Public-Key: (1024 bit) + RSA Public-Key: (1024 bit) Modulus: - 00:b7:32:f2:08:04:4c:77:03:70:3e:10:88:84:cd: - cd:f2:87:2f:3c:67:8f:78:01:5e:d5:51:f1:11:68: - 4d:a7:e2:73:b0:69:b5:67:07:59:88:cc:b8:7f:ce: - 97:52:bc:fb:73:7b:60:95:a2:7b:c2:9a:f1:4d:5a: - c4:42:55:c4:6e:02:50:a1:71:41:68:d1:6c:96:e0: - 3d:af:10:3f:7b:64:c1:3a:3a:c3:a9:39:71:08:29: - 45:c8:cc:da:33:65:b4:70:fb:36:bc:15:0d:a7:31: - ef:d5:ec:59:ac:75:2b:77:35:0b:f0:db:3d:14:f5: - 9a:41:e6:a0:b7:b7:62:2b:e7 + 00:e3:39:bc:07:48:ed:c3:d2:3e:4f:a0:61:9a:2b: + e9:46:7a:68:33:52:01:1b:7f:45:88:49:05:85:fd: + 30:8c:2e:60:17:77:b3:38:c3:06:7c:fc:87:a8:61: + 29:03:86:07:20:8f:f8:d2:f0:bb:66:93:33:91:37: + ed:f6:64:b7:46:a5:f6:7d:f7:94:98:52:bc:78:90: + 6d:0b:db:61:c6:00:23:79:c2:a6:3b:2b:ee:c7:3d: + 96:97:9b:4e:eb:78:56:95:52:13:d4:5f:ea:18:85: + 18:0a:d6:d9:cd:4b:b0:15:ef:2f:f0:27:ef:b1:af: + d2:4f:ca:b8:93:c1:2f:2e:4f Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: - EE:60:BB:C7:17:5F:D3:72:AC:33:EE:8E:84:CC:2D:DB:1A:CC:8A:52 + EA:BE:42:EF:98:17:84:D5:FC:28:89:5A:4B:A5:B6:41:4F:7B:BB:28 X509v3 Authority Key Identifier: - keyid:DA:20:AB:E0:98:22:39:28:E0:70:D6:74:65:53:26:E0:6B:4C:96:39 + keyid:CF:F3:9D:BB:BF:2B:14:D5:A2:E5:EC:41:CF:9C:16:D0:4D:AB:84:04 X509v3 Basic Constraints: CA:TRUE Signature Algorithm: sha256WithRSAEncryption - 8a:98:17:cd:e1:dc:2b:1b:5b:16:40:99:21:c4:d4:db:3f:5c: - 6a:ed:7b:a2:b6:df:aa:7c:d8:6a:3f:11:39:da:4c:ce:3f:e5: - 99:6a:a4:b8:82:1e:53:7a:5d:f1:52:be:df:f1:3b:59:9a:a8: - bb:7e:f1:30:33:4b:7c:c3:ab:85:1e:c4:0e:ac:d1:7e:2b:cb: - 9d:19:5b:df:94:b4:89:e1:da:5d:31:19:85:34:d5:33:55:f8: - af:92:ea:9a:17:c9:da:68:00:df:10:e9:e4:33:35:cd:15:57: - 80:56:1a:58:94:37:d7:f2:02:de:9b:0b:d3:02:64:c5:8e:6f: - 25:31 + 0f:7d:4c:71:ef:5e:5d:a2:0e:09:da:37:bd:21:77:73:77:b1: + 02:7e:56:7d:82:c0:b9:53:77:c3:bb:9b:08:cf:00:b3:73:18: + 2d:c5:9c:1a:57:8c:2b:46:21:bf:28:2e:f4:6d:12:6a:c3:7f: + 8c:c6:a5:9b:bf:ed:47:cd:88:58:94:35:1f:5c:1e:a7:0d:17: + 96:5f:1b:70:ad:da:05:26:0c:52:d1:87:52:3c:e3:e1:23:ac: + aa:fa:f3:80:48:52:30:da:59:e2:de:0c:61:95:3c:63:ef:1d: + ec:b3:6d:c7:89:e6:e3:65:6c:be:d4:e7:a7:90:8c:f4:ff:1d: + 65:72 -----BEGIN CERTIFICATE----- MIICnTCCAgagAwIBAgIBATANBgkqhkiG9w0BAQsFADByMQswCQYDVQQGEwJHQjET MBEGA1UECAwKRGVyYnlzaGlyZTEOMAwGA1UEBwwFRGVyYnkxGjAYBgNVBAoMEU1v c3F1aXR0byBQcm9qZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRAwDgYDVQQDDAdSb290 -IENBMB4XDTE4MDkxODEwNDk0N1oXDTIzMDkxNzEwNDk0N1owZTELMAkGA1UEBhMC +IENBMB4XDTE5MDkxMDA5MzM0MloXDTI0MDkwODA5MzM0MlowZTELMAkGA1UEBhMC R0IxEzARBgNVBAgMCkRlcmJ5c2hpcmUxGjAYBgNVBAoMEU1vc3F1aXR0byBQcm9q ZWN0MRAwDgYDVQQLDAdUZXN0aW5nMRMwEQYDVQQDDApTaWduaW5nIENBMIGfMA0G -CSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3MvIIBEx3A3A+EIiEzc3yhy88Z494AV7V -UfERaE2n4nOwabVnB1mIzLh/zpdSvPtze2CVonvCmvFNWsRCVcRuAlChcUFo0WyW -4D2vED97ZME6OsOpOXEIKUXIzNozZbRw+za8FQ2nMe/V7FmsdSt3NQvw2z0U9ZpB -5qC3t2Ir5wIDAQABo1AwTjAdBgNVHQ4EFgQU7mC7xxdf03KsM+6OhMwt2xrMilIw -HwYDVR0jBBgwFoAU2iCr4JgiOSjgcNZ0ZVMm4GtMljkwDAYDVR0TBAUwAwEB/zAN -BgkqhkiG9w0BAQsFAAOBgQCKmBfN4dwrG1sWQJkhxNTbP1xq7Xuitt+qfNhqPxE5 -2kzOP+WZaqS4gh5Tel3xUr7f8TtZmqi7fvEwM0t8w6uFHsQOrNF+K8udGVvflLSJ -4dpdMRmFNNUzVfivkuqaF8naaADfEOnkMzXNFVeAVhpYlDfX8gLemwvTAmTFjm8l -MQ== +CSqGSIb3DQEBAQUAA4GNADCBiQKBgQDjObwHSO3D0j5PoGGaK+lGemgzUgEbf0WI +SQWF/TCMLmAXd7M4wwZ8/IeoYSkDhgcgj/jS8LtmkzORN+32ZLdGpfZ995SYUrx4 +kG0L22HGACN5wqY7K+7HPZaXm07reFaVUhPUX+oYhRgK1tnNS7AV7y/wJ++xr9JP +yriTwS8uTwIDAQABo1AwTjAdBgNVHQ4EFgQU6r5C75gXhNX8KIlaS6W2QU97uygw +HwYDVR0jBBgwFoAUz/Odu78rFNWi5exBz5wW0E2rhAQwDAYDVR0TBAUwAwEB/zAN +BgkqhkiG9w0BAQsFAAOBgQAPfUxx715dog4J2je9IXdzd7ECflZ9gsC5U3fDu5sI +zwCzcxgtxZwaV4wrRiG/KC70bRJqw3+MxqWbv+1HzYhYlDUfXB6nDReWXxtwrdoF +JgxS0YdSPOPhI6yq+vOASFIw2lni3gxhlTxj7x3ss23HiebjZWy+1OenkIz0/x1l +cg== -----END CERTIFICATE----- diff --git a/test/ssl/test-signing-ca.key b/test/ssl/test-signing-ca.key index 24262283..c41c1383 100644 --- a/test/ssl/test-signing-ca.key +++ b/test/ssl/test-signing-ca.key @@ -1,15 +1,15 @@ -----BEGIN RSA PRIVATE KEY----- -MIICXQIBAAKBgQC3MvIIBEx3A3A+EIiEzc3yhy88Z494AV7VUfERaE2n4nOwabVn -B1mIzLh/zpdSvPtze2CVonvCmvFNWsRCVcRuAlChcUFo0WyW4D2vED97ZME6OsOp -OXEIKUXIzNozZbRw+za8FQ2nMe/V7FmsdSt3NQvw2z0U9ZpB5qC3t2Ir5wIDAQAB -AoGAU6dZybtcx0O0r0KRdEMd9c8xDJ4lbyEBEtu1/sLoIu9O8JF0mjVK9yK0ZPgL -NWbCU3tVIT7u0HA8G5yE3d2YMfVCHTqkzrJ2pWlntgYcnYQSR2gjDnZl6iG/1VJ5 -aZh5+CjlwOstDiQLv+TKCfNVAa5Z4CC0jNt57tVuq/L0ieECQQDq4r+H5+DMUxaU -sXQgLizqTubMlhumcRTa+edgBWGLMbgK00wVeDpQD+j6qZFbiklll2fB5fF/Qj/c -D5RyByFZAkEAx6rEzYfIQLrJmy4RYcAlMFDMBvkpGTc1IGTDyjjsUmnOdF3ydnBx -GUqQzuf6Iv9Af64r1WUwSzA+iy200brPPwJBAODsEyasZ/qhEf1/VElAjmgs+Bwv -HfkrTiJGrkanwHmPOcK8BZ6Fi6mBIsNtvzDeYlxzOLtXWwNWyFoNXUQ4CbkCQQC8 -WhSjCibXIR1T/QY6nya1yFJfdaXWeqTsNQIZfs84A0XVslYqcnHOeO/Xry/g2cd/ -as9A097V3uHxKyG7Ay3DAkAtD9ifXcuCvtCeG5bsUlClOGmtzHX0Vw6ItYrI7WlX -lKJux35Y2z5E3/x2nHHvw1tuQnuwldU6lbSs3/cy67+d +MIICWwIBAAKBgQDjObwHSO3D0j5PoGGaK+lGemgzUgEbf0WISQWF/TCMLmAXd7M4 +wwZ8/IeoYSkDhgcgj/jS8LtmkzORN+32ZLdGpfZ995SYUrx4kG0L22HGACN5wqY7 +K+7HPZaXm07reFaVUhPUX+oYhRgK1tnNS7AV7y/wJ++xr9JPyriTwS8uTwIDAQAB +AoGAXKqD8xib1ptcTA7lHwG/bb2n1x4fU35w9eaJuR4LeW/EQm3PiluGvtwh2tpc +5pH3QCFW4XfJhUiM5DFB+5URZJpklcFZ77WNTm6T4ib1769MQWeh+Cyjm65VJZb7 +Bx4vlmxXs/pS47QNUG/xCMRZAxkHVlwIUFTolcJ51/2nbUECQQD/0L29S7F7yUX8 +1yWZYmnKPhNesien7ruD7NaVslDZanzCo3X0JTyVOnVYsTPt27yOcinyGnvEF0mN +bjwIRiLvAkEA42O2MLCzlNIw2AxlQiPskDN+s4lCs8T2rqZQ7O6aZgBFinKKQEtR +x5uQv8QALTi5yv/GWbTyhBgGBzIfyigqoQI/C/285yKlLyhAH5n2KTpzuwct4UJ4 +mWaXY5e2d03kfEyBjJ4c6VTVgik7Vuz3gi7Kp+KyFKcpJgfxaq/AIKMpAkAxHqAD +opgYZNNSSFMzV2lJuSX8iIEVLk4PajP/Cofl0tcy0g1VWC/hS5SYKDHVkvRnipsB +U9ozeLEMquI9HDIhAkEAgC/ceGB0UR7PjlTw3U4Fe2Shnv+0pdnFfSTKh6dS034y +JmHrZRqBMjHX4Hsph3Xjf6sy6SFKg67xeaeNmFoXZg== -----END RSA PRIVATE KEY----- From 9bbf5bb65f2258511ec12bc85c2db4b81f7077c5 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Wed, 11 Sep 2019 08:51:51 +0100 Subject: [PATCH 27/57] Fix 11-message-expiry test when running under valgrind --- test/broker/11-message-expiry.py | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/test/broker/11-message-expiry.py b/test/broker/11-message-expiry.py index d7b107c5..b976d2fd 100755 --- a/test/broker/11-message-expiry.py +++ b/test/broker/11-message-expiry.py @@ -39,7 +39,7 @@ helper_connect = mosq_test.gen_connect("helper", proto_ver=5) helper_connack = mosq_test.gen_connack(rc=0, proto_ver=5) mid=1 -props = mqtt5_props.gen_uint32_prop(mqtt5_props.PROP_MESSAGE_EXPIRY_INTERVAL, 1) +props = mqtt5_props.gen_uint32_prop(mqtt5_props.PROP_MESSAGE_EXPIRY_INTERVAL, 5) publish1s_packet = mosq_test.gen_publish("subpub/qos1", mid=mid, qos=1, payload="message1", proto_ver=5, properties=props) puback1s_packet = mosq_test.gen_puback(mid) @@ -75,10 +75,7 @@ try: sock.close() broker = mosq_test.start_broker(filename=os.path.basename(__file__), use_conf=True, port=port) - if os.environ.get('TRAVIS') is not None: - time.sleep(5) - else: - time.sleep(2) + time.sleep(5) sock = mosq_test.do_client_connect(connect_packet, connack2_packet, timeout=20, port=port) packet = sock.recv(len(publish2s_packet)) From 4dc98c4cefcc32b93f8dfa3f439eae7912afb0b8 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Wed, 11 Sep 2019 09:08:02 +0100 Subject: [PATCH 28/57] Fix CRL file not being reloaded on HUP. Closes #35. --- ChangeLog.txt | 1 + src/mosquitto_broker_internal.h | 2 + src/net.c | 287 +++++++++++++++++--------------- src/security_default.c | 17 +- 4 files changed, 168 insertions(+), 139 deletions(-) diff --git a/ChangeLog.txt b/ChangeLog.txt index 24c2c86a..12e3341a 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -10,6 +10,7 @@ Broker: the number of "Socket error on client X, disconnecting" messages. - Fix Will for v5 clients not being sent if will delay interval was greater than the session expiry interval. Closes #1401. +- Fix CRL file not being reloaded on HUP. Closes #35. Client library: - Fix reconnect backoff for the situation where connections are dropped rather diff --git a/src/mosquitto_broker_internal.h b/src/mosquitto_broker_internal.h index 540dbcbe..16361d3e 100644 --- a/src/mosquitto_broker_internal.h +++ b/src/mosquitto_broker_internal.h @@ -582,6 +582,8 @@ void net__broker_cleanup(void); int net__socket_accept(struct mosquitto_db *db, mosq_sock_t listensock); int net__socket_listen(struct mosquitto__listener *listener); int net__socket_get_address(mosq_sock_t sock, char *buf, int len); +int net__tls_load_verify(struct mosquitto__listener *listener); +int net__tls_server_ctx(struct mosquitto__listener *listener); /* ============================================================ * Read handling functions diff --git a/src/net.c b/src/net.c index 0b57558c..ce4e56a4 100644 --- a/src/net.c +++ b/src/net.c @@ -310,13 +310,17 @@ static unsigned int psk_server_callback(SSL *ssl, const char *identity, unsigned #endif #ifdef WITH_TLS -static int mosquitto__tls_server_ctx(struct mosquitto__listener *listener) +int net__tls_server_ctx(struct mosquitto__listener *listener) { char buf[256]; int rc; FILE *dhparamfile; DH *dhparam = NULL; + if(listener->ssl_ctx){ + SSL_CTX_free(listener->ssl_ctx); + } + #if OPENSSL_VERSION_NUMBER < 0x10100000L listener->ssl_ctx = SSL_CTX_new(SSLv23_server_method()); #else @@ -406,6 +410,147 @@ static int mosquitto__tls_server_ctx(struct mosquitto__listener *listener) } #endif + +int net__load_crl_file(struct mosquitto__listener *listener) +{ +#ifdef WITH_TLS + X509_STORE *store; + X509_LOOKUP *lookup; + int rc; + + store = SSL_CTX_get_cert_store(listener->ssl_ctx); + if(!store){ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to obtain TLS store."); + net__print_error(MOSQ_LOG_ERR, "Error: %s"); + return 1; + } + lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file()); + rc = X509_load_crl_file(lookup, listener->crlfile, X509_FILETYPE_PEM); + if(rc != 1){ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load certificate revocation file \"%s\". Check crlfile.", listener->crlfile); + net__print_error(MOSQ_LOG_ERR, "Error: %s"); + return 1; + } + X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK); +#endif + + return MOSQ_ERR_SUCCESS; +} + + +int net__tls_load_verify(struct mosquitto__listener *listener) +{ +#ifdef WITH_TLS + ENGINE *engine = NULL; +#endif + int rc; + + rc = SSL_CTX_load_verify_locations(listener->ssl_ctx, listener->cafile, listener->capath); + if(rc == 0){ + if(listener->cafile && listener->capath){ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load CA certificates. Check cafile \"%s\" and capath \"%s\".", listener->cafile, listener->capath); + }else if(listener->cafile){ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load CA certificates. Check cafile \"%s\".", listener->cafile); + }else{ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load CA certificates. Check capath \"%s\".", listener->capath); + } + net__print_error(MOSQ_LOG_ERR, "Error: %s"); + return 1; + } + if(listener->tls_engine){ +#if !defined(OPENSSL_NO_ENGINE) + engine = ENGINE_by_id(listener->tls_engine); + if(!engine){ + log__printf(NULL, MOSQ_LOG_ERR, "Error loading %s engine\n", listener->tls_engine); + return 1; + } + if(!ENGINE_init(engine)){ + log__printf(NULL, MOSQ_LOG_ERR, "Failed engine initialisation\n"); + ENGINE_free(engine); + return 1; + } + ENGINE_set_default(engine, ENGINE_METHOD_ALL); + ENGINE_free(engine); /* release the structural reference from ENGINE_by_id() */ +#endif + } + /* FIXME user data? */ + if(listener->require_certificate){ + SSL_CTX_set_verify(listener->ssl_ctx, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, client_certificate_verify); + }else{ + SSL_CTX_set_verify(listener->ssl_ctx, SSL_VERIFY_NONE, client_certificate_verify); + } + rc = SSL_CTX_use_certificate_chain_file(listener->ssl_ctx, listener->certfile); + if(rc != 1){ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load server certificate \"%s\". Check certfile.", listener->certfile); + net__print_error(MOSQ_LOG_ERR, "Error: %s"); +#if !defined(OPENSSL_NO_ENGINE) + ENGINE_FINISH(engine); +#endif + return 1; + } + if(listener->tls_engine && listener->tls_keyform == mosq_k_engine){ +#if !defined(OPENSSL_NO_ENGINE) + UI_METHOD *ui_method = net__get_ui_method(); + if(listener->tls_engine_kpass_sha1){ + if(!ENGINE_ctrl_cmd(engine, ENGINE_SECRET_MODE, ENGINE_SECRET_MODE_SHA, NULL, NULL, 0)){ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to set engine secret mode sha"); + ENGINE_FINISH(engine); + return 1; + } + if(!ENGINE_ctrl_cmd(engine, ENGINE_PIN, 0, listener->tls_engine_kpass_sha1, NULL, 0)){ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to set engine pin"); + ENGINE_FINISH(engine); + return 1; + } + ui_method = NULL; + } + EVP_PKEY *pkey = ENGINE_load_private_key(engine, listener->keyfile, ui_method, NULL); + if(!pkey){ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load engine private key file \"%s\".", listener->keyfile); + ENGINE_FINISH(engine); + return 1; + } + if(SSL_CTX_use_PrivateKey(listener->ssl_ctx, pkey) <= 0){ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to use engine private key file \"%s\".", listener->keyfile); + ENGINE_FINISH(engine); + return 1; + } +#endif + }else{ + rc = SSL_CTX_use_PrivateKey_file(listener->ssl_ctx, listener->keyfile, SSL_FILETYPE_PEM); + if(rc != 1){ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load server key file \"%s\". Check keyfile.", listener->keyfile); + net__print_error(MOSQ_LOG_ERR, "Error: %s"); +#if !defined(OPENSSL_NO_ENGINE) + ENGINE_FINISH(engine); +#endif + return 1; + } + } + rc = SSL_CTX_check_private_key(listener->ssl_ctx); + if(rc != 1){ + log__printf(NULL, MOSQ_LOG_ERR, "Error: Server certificate/key are inconsistent."); + net__print_error(MOSQ_LOG_ERR, "Error: %s"); +#if !defined(OPENSSL_NO_ENGINE) + ENGINE_FINISH(engine); +#endif + return 1; + } + /* Load CRLs if they exist. */ + if(listener->crlfile){ + rc = net__load_crl_file(listener); + if(rc){ +#if !defined(OPENSSL_NO_ENGINE) + ENGINE_FINISH(engine); +#endif + return rc; + } + } + + return MOSQ_ERR_SUCCESS; +} + + /* Creates a socket and listens on port 'port'. * Returns 1 on failure * Returns 0 on success. @@ -422,11 +567,6 @@ int net__socket_listen(struct mosquitto__listener *listener) #else char ss_opt = 1; #endif -#ifdef WITH_TLS - X509_STORE *store; - X509_LOOKUP *lookup; - ENGINE *engine = NULL; -#endif #ifdef SO_BINDTODEVICE struct ifreq ifr; #endif @@ -519,138 +659,15 @@ int net__socket_listen(struct mosquitto__listener *listener) if(listener->sock_count > 0){ #ifdef WITH_TLS if((listener->cafile || listener->capath) && listener->certfile && listener->keyfile){ - if(mosquitto__tls_server_ctx(listener)){ + if(net__tls_server_ctx(listener)){ COMPAT_CLOSE(sock); return 1; } - rc = SSL_CTX_load_verify_locations(listener->ssl_ctx, listener->cafile, listener->capath); - if(rc == 0){ - if(listener->cafile && listener->capath){ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load CA certificates. Check cafile \"%s\" and capath \"%s\".", listener->cafile, listener->capath); - }else if(listener->cafile){ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load CA certificates. Check cafile \"%s\".", listener->cafile); - }else{ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load CA certificates. Check capath \"%s\".", listener->capath); - } - net__print_error(MOSQ_LOG_ERR, "Error: %s"); + if(net__tls_load_verify(listener)){ COMPAT_CLOSE(sock); return 1; } - if(listener->tls_engine){ -#if !defined(OPENSSL_NO_ENGINE) - engine = ENGINE_by_id(listener->tls_engine); - if(!engine){ - log__printf(NULL, MOSQ_LOG_ERR, "Error loading %s engine\n", listener->tls_engine); - COMPAT_CLOSE(sock); - return 1; - } - if(!ENGINE_init(engine)){ - log__printf(NULL, MOSQ_LOG_ERR, "Failed engine initialisation\n"); - ENGINE_free(engine); - COMPAT_CLOSE(sock); - return 1; - } - ENGINE_set_default(engine, ENGINE_METHOD_ALL); - ENGINE_free(engine); /* release the structural reference from ENGINE_by_id() */ -#endif - } - /* FIXME user data? */ - if(listener->require_certificate){ - SSL_CTX_set_verify(listener->ssl_ctx, SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, client_certificate_verify); - }else{ - SSL_CTX_set_verify(listener->ssl_ctx, SSL_VERIFY_NONE, client_certificate_verify); - } - rc = SSL_CTX_use_certificate_chain_file(listener->ssl_ctx, listener->certfile); - if(rc != 1){ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load server certificate \"%s\". Check certfile.", listener->certfile); - net__print_error(MOSQ_LOG_ERR, "Error: %s"); - COMPAT_CLOSE(sock); -#if !defined(OPENSSL_NO_ENGINE) - ENGINE_FINISH(engine); -#endif - return 1; - } - if(listener->tls_keyform == mosq_k_engine){ -#if !defined(OPENSSL_NO_ENGINE) - UI_METHOD *ui_method = net__get_ui_method(); - if(listener->tls_engine_kpass_sha1){ - if(!ENGINE_ctrl_cmd(engine, ENGINE_SECRET_MODE, ENGINE_SECRET_MODE_SHA, NULL, NULL, 0)){ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to set engine secret mode sha"); - COMPAT_CLOSE(sock); - ENGINE_FINISH(engine); - return 1; - } - if(!ENGINE_ctrl_cmd(engine, ENGINE_PIN, 0, listener->tls_engine_kpass_sha1, NULL, 0)){ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to set engine pin"); - COMPAT_CLOSE(sock); - ENGINE_FINISH(engine); - return 1; - } - ui_method = NULL; - } - EVP_PKEY *pkey = ENGINE_load_private_key(engine, listener->keyfile, ui_method, NULL); - if(!pkey){ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load engine private key file \"%s\".", listener->keyfile); - COMPAT_CLOSE(sock); - ENGINE_FINISH(engine); - return 1; - } - if(SSL_CTX_use_PrivateKey(listener->ssl_ctx, pkey) <= 0){ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to use engine private key file \"%s\".", listener->keyfile); - COMPAT_CLOSE(sock); - ENGINE_FINISH(engine); - return 1; - } -#endif - }else{ - rc = SSL_CTX_use_PrivateKey_file(listener->ssl_ctx, listener->keyfile, SSL_FILETYPE_PEM); - if(rc != 1){ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load server key file \"%s\". Check keyfile.", listener->keyfile); - net__print_error(MOSQ_LOG_ERR, "Error: %s"); - COMPAT_CLOSE(sock); -#if !defined(OPENSSL_NO_ENGINE) - ENGINE_FINISH(engine); -#endif - return 1; - } - } - rc = SSL_CTX_check_private_key(listener->ssl_ctx); - if(rc != 1){ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Server certificate/key are inconsistent."); - net__print_error(MOSQ_LOG_ERR, "Error: %s"); - COMPAT_CLOSE(sock); -#if !defined(OPENSSL_NO_ENGINE) - ENGINE_FINISH(engine); -#endif - return 1; - } - /* Load CRLs if they exist. */ - if(listener->crlfile){ - store = SSL_CTX_get_cert_store(listener->ssl_ctx); - if(!store){ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to obtain TLS store."); - net__print_error(MOSQ_LOG_ERR, "Error: %s"); - COMPAT_CLOSE(sock); -#if !defined(OPENSSL_NO_ENGINE) - ENGINE_FINISH(engine); -#endif - return 1; - } - lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file()); - rc = X509_load_crl_file(lookup, listener->crlfile, X509_FILETYPE_PEM); - if(rc != 1){ - log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to load certificate revocation file \"%s\". Check crlfile.", listener->crlfile); - net__print_error(MOSQ_LOG_ERR, "Error: %s"); - COMPAT_CLOSE(sock); -#if !defined(OPENSSL_NO_ENGINE) - ENGINE_FINISH(engine); -#endif - return 1; - } - X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK); - } - # ifdef FINAL_WITH_TLS_PSK }else if(listener->psk_hint){ if(tls_ex_index_context == -1){ @@ -660,11 +677,8 @@ int net__socket_listen(struct mosquitto__listener *listener) tls_ex_index_listener = SSL_get_ex_new_index(0, "listener", NULL, NULL, NULL); } - if(mosquitto__tls_server_ctx(listener)){ + if(net__tls_server_ctx(listener)){ COMPAT_CLOSE(sock); -#if !defined(OPENSSL_NO_ENGINE) - ENGINE_FINISH(engine); -#endif return 1; } SSL_CTX_set_psk_server_callback(listener->ssl_ctx, psk_server_callback); @@ -674,9 +688,6 @@ int net__socket_listen(struct mosquitto__listener *listener) log__printf(NULL, MOSQ_LOG_ERR, "Error: Unable to set TLS PSK hint."); net__print_error(MOSQ_LOG_ERR, "Error: %s"); COMPAT_CLOSE(sock); -#if !defined(OPENSSL_NO_ENGINE) - ENGINE_FINISH(engine); -#endif return 1; } } diff --git a/src/security_default.c b/src/security_default.c index 369b6d85..15a47fce 100644 --- a/src/security_default.c +++ b/src/security_default.c @@ -971,11 +971,26 @@ int mosquitto_security_apply_default(struct mosquitto_db *db) X509_NAME *name; X509_NAME_ENTRY *name_entry; ASN1_STRING *name_asn1 = NULL; + struct mosquitto__listener *listener; #endif if(!db) return MOSQ_ERR_INVAL; - +#ifdef WITH_TLS + for(i=0; iconfig->listener_count; i++){ + listener = &db->config->listeners[i]; + if(listener && listener->ssl_ctx && (listener->cafile || listener->capath) && listener->crlfile && listener->require_certificate){ + if(net__tls_server_ctx(listener)){ + return 1; + } + + if(net__tls_load_verify(listener)){ + return 1; + } + } + } +#endif + HASH_ITER(hh_id, db->contexts_by_id, context, ctxt_tmp){ /* Check for anonymous clients when allow_anonymous is false */ if(db->config->per_listener_settings){ From 9ad5fe7d9539d53e4cb3f7d99838acfc80dbcac6 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Wed, 11 Sep 2019 15:53:36 +0100 Subject: [PATCH 29/57] Fix repeated "Error in poll" messages on Windows. This occurs when only websockets listeners are defined. Closes #1391. Thanks to stopak. --- ChangeLog.txt | 2 ++ src/loop.c | 13 ++++++++++++- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/ChangeLog.txt b/ChangeLog.txt index 12e3341a..765d80d6 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -11,6 +11,8 @@ Broker: - Fix Will for v5 clients not being sent if will delay interval was greater than the session expiry interval. Closes #1401. - Fix CRL file not being reloaded on HUP. Closes #35. +- Fix repeated "Error in poll" messages on Windows when only websockets + listeners are defined. Closes #1391. Client library: - Fix reconnect backoff for the situation where connections are dropped rather diff --git a/src/loop.c b/src/loop.c index 25882954..b72534c4 100644 --- a/src/loop.c +++ b/src/loop.c @@ -532,7 +532,18 @@ int mosquitto_main_loop(struct mosquitto_db *db, mosq_sock_t *listensock, int li } #else if(fdcount == -1){ - log__printf(NULL, MOSQ_LOG_ERR, "Error in poll: %s.", strerror(errno)); +# ifdef WIN32 + if(pollfd_index == 0 && WSAGetLastError() == WSAEINVAL){ + /* WSAPoll() immediately returns an error if it is not given + * any sockets to wait on. This can happen if we only have + * websockets listeners. Sleep a little to prevent a busy loop. + */ + Sleep(10); + }else +# endif + { + log__printf(NULL, MOSQ_LOG_ERR, "Error in poll: %s.", strerror(errno)); + } }else{ loop_handle_reads_writes(db, pollfds); From 5941291bd5153435be25ddb9a8ee847e5ddb4ca8 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Wed, 11 Sep 2019 16:16:38 +0100 Subject: [PATCH 30/57] Fix build WITH_TLS=no --- src/net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/net.c b/src/net.c index ce4e56a4..392972f8 100644 --- a/src/net.c +++ b/src/net.c @@ -442,7 +442,6 @@ int net__tls_load_verify(struct mosquitto__listener *listener) { #ifdef WITH_TLS ENGINE *engine = NULL; -#endif int rc; rc = SSL_CTX_load_verify_locations(listener->ssl_ctx, listener->cafile, listener->capath); @@ -546,6 +545,7 @@ int net__tls_load_verify(struct mosquitto__listener *listener) return rc; } } +#endif return MOSQ_ERR_SUCCESS; } From 808bbedb6a9616a2300f6fbf85ff4908c0bc62bd Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Wed, 11 Sep 2019 17:35:50 +0100 Subject: [PATCH 31/57] Possible fix for #1385. --- lib/connect.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/lib/connect.c b/lib/connect.c index 8559cd72..1f119ecd 100644 --- a/lib/connect.c +++ b/lib/connect.c @@ -214,9 +214,6 @@ static int mosquitto__reconnect(struct mosquitto *mosq, bool blocking, const mos }else #endif { - pthread_mutex_lock(&mosq->state_mutex); - mosq->state = mosq_cs_connecting; - pthread_mutex_unlock(&mosq->state_mutex); rc = net__socket_connect(mosq, mosq->host, mosq->port, mosq->bind_address, blocking); } if(rc>0){ @@ -233,9 +230,6 @@ static int mosquitto__reconnect(struct mosquitto *mosq, bool blocking, const mos if(rc){ packet__cleanup_all(mosq); net__socket_close(mosq); - pthread_mutex_lock(&mosq->state_mutex); - mosq->state = mosq_cs_new; - pthread_mutex_unlock(&mosq->state_mutex); } return rc; } From 8f6ac1b64a184619c7d07e4cda3cb96b0552a5de Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Thu, 12 Sep 2019 13:31:01 +0100 Subject: [PATCH 32/57] Fix for websockets regression. --- src/loop.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/loop.c b/src/loop.c index b72534c4..f0b1e18e 100644 --- a/src/loop.c +++ b/src/loop.c @@ -601,7 +601,12 @@ int mosquitto_main_loop(struct mosquitto_db *db, mosq_sock_t *listensock, int li * will soon, so for now websockets clients are second class * citizens. */ if(db->config->listeners[i].ws_context){ +#if LWS_LIBRARY_VERSION_NUMBER > 3002000 libwebsocket_service(db->config->listeners[i].ws_context, -1); +#else + libwebsocket_service(db->config->listeners[i].ws_context, 0); +#endif + } } if(db->config->have_websockets_listener){ From ce68040f2273b1d12fc550bae6924f20abab6674 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Thu, 12 Sep 2019 14:44:27 +0100 Subject: [PATCH 33/57] Refuse to compile with lws 3.2.0. --- src/mosquitto_broker_internal.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/mosquitto_broker_internal.h b/src/mosquitto_broker_internal.h index 16361d3e..25d4a5b0 100644 --- a/src/mosquitto_broker_internal.h +++ b/src/mosquitto_broker_internal.h @@ -37,6 +37,9 @@ Contributors: # define libwebsocket_protocols lws_protocols # define libwebsocket_callback_reasons lws_callback_reasons # define libwebsocket lws +# if LWS_LIBRARY_VERSION_NUMBER == 3002000 +# error "libwebsockets 3.2.0 is not compatible with Mosquitto. <3.1.0, or >=3.2.1 will work fine" +# endif # else # define lws_pollfd pollfd # define lws_service_fd(A, B) libwebsocket_service_fd((A), (B)) From 6e2be258810ffa198c3074a56f457968e3567b63 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Thu, 12 Sep 2019 14:56:15 +0100 Subject: [PATCH 34/57] Bump version numbers, add release info. --- CMakeLists.txt | 2 +- ChangeLog.txt | 3 + config.mk | 2 +- installer/mosquitto.nsi | 2 +- installer/mosquitto64.nsi | 2 +- lib/mosquitto.h | 2 +- set-version.sh | 2 +- snap/snapcraft.yaml | 2 +- www/pages/download.md | 8 +-- www/posts/2019/09/version-1-6-5-released.md | 67 +++++++++++++++++++++ 10 files changed, 81 insertions(+), 11 deletions(-) create mode 100644 www/posts/2019/09/version-1-6-5-released.md diff --git a/CMakeLists.txt b/CMakeLists.txt index ff1c4e23..7fc2595b 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -11,7 +11,7 @@ project(mosquitto) cmake_minimum_required(VERSION 2.8) # Only for version 3 and up. cmake_policy(SET CMP0042 NEW) -set (VERSION 1.6.4) +set (VERSION 1.6.5) add_definitions (-DCMAKE -DVERSION=\"${VERSION}\") diff --git a/ChangeLog.txt b/ChangeLog.txt index 765d80d6..8fcb17d3 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -1,3 +1,6 @@ +1.6.5 - 20190912 +================ + Broker: - Fix v5 DISCONNECT packets with remaining length == 2 being treated as a protocol error. Closes #1367. diff --git a/config.mk b/config.mk index 6c23bef9..471ed41c 100644 --- a/config.mk +++ b/config.mk @@ -104,7 +104,7 @@ WITH_COVERAGE:=no # Also bump lib/mosquitto.h, CMakeLists.txt, # installer/mosquitto.nsi, installer/mosquitto64.nsi -VERSION=1.6.4 +VERSION=1.6.5 # Client library SO version. Bump if incompatible API/ABI changes are made. SOVERSION=1 diff --git a/installer/mosquitto.nsi b/installer/mosquitto.nsi index 2190683d..d59028b6 100644 --- a/installer/mosquitto.nsi +++ b/installer/mosquitto.nsi @@ -9,7 +9,7 @@ !define env_hklm 'HKLM "SYSTEM\CurrentControlSet\Control\Session Manager\Environment"' Name "Eclipse Mosquitto" -!define VERSION 1.6.4 +!define VERSION 1.6.5 OutFile "mosquitto-${VERSION}-install-windows-x86.exe" InstallDir "$PROGRAMFILES\mosquitto" diff --git a/installer/mosquitto64.nsi b/installer/mosquitto64.nsi index 12a98b84..c89d9a7d 100644 --- a/installer/mosquitto64.nsi +++ b/installer/mosquitto64.nsi @@ -9,7 +9,7 @@ !define env_hklm 'HKLM "SYSTEM\CurrentControlSet\Control\Session Manager\Environment"' Name "Eclipse Mosquitto" -!define VERSION 1.6.4 +!define VERSION 1.6.5 OutFile "mosquitto-${VERSION}-install-windows-x64.exe" !include "x64.nsh" diff --git a/lib/mosquitto.h b/lib/mosquitto.h index 6957b619..c8116fa9 100644 --- a/lib/mosquitto.h +++ b/lib/mosquitto.h @@ -48,7 +48,7 @@ extern "C" { #define LIBMOSQUITTO_MAJOR 1 #define LIBMOSQUITTO_MINOR 6 -#define LIBMOSQUITTO_REVISION 4 +#define LIBMOSQUITTO_REVISION 5 /* LIBMOSQUITTO_VERSION_NUMBER looks like 1002001 for e.g. version 1.2.1. */ #define LIBMOSQUITTO_VERSION_NUMBER (LIBMOSQUITTO_MAJOR*1000000+LIBMOSQUITTO_MINOR*1000+LIBMOSQUITTO_REVISION) diff --git a/set-version.sh b/set-version.sh index 5fe6c80c..8c9f65e6 100755 --- a/set-version.sh +++ b/set-version.sh @@ -2,7 +2,7 @@ MAJOR=1 MINOR=6 -REVISION=4 +REVISION=5 sed -i "s/^VERSION=.*/VERSION=${MAJOR}.${MINOR}.${REVISION}/" config.mk diff --git a/snap/snapcraft.yaml b/snap/snapcraft.yaml index 95a4eb1f..dec36750 100644 --- a/snap/snapcraft.yaml +++ b/snap/snapcraft.yaml @@ -1,5 +1,5 @@ name: mosquitto -version: 1.6.4 +version: 1.6.5 summary: Eclipse Mosquitto MQTT broker description: This is a message broker that supports version 3.1 and 3.1.1 of the MQTT protocol. diff --git a/www/pages/download.md b/www/pages/download.md index a2acb0e2..5499441d 100644 --- a/www/pages/download.md +++ b/www/pages/download.md @@ -1,7 +1,7 @@ + +This is a bugfix release. + +# Compatibility +- The most recent version of libwebsockets (3.2.0) changed its behaviour and is + not compatible with Mosquitto. This has been fixed for the next libwebsockets + release. The 1.6.5 release refuses to compile with libwebsockets 3.2.0. All + previous versions of Mosquitto that use websockets are affected by the change + in behaviour. + +# Broker +- Fix v5 DISCONNECT packets with remaining length == 2 being treated as a + protocol error. Closes [#1367]. +- Fix support for libwebsockets 3.x (excluding 3.2.0) +- Fix slow websockets performance when sending large messages. Closes [#1390]. +- Fix bridges potentially not connecting on Windows. Closes [#478]. +- Fix clients authorised using `use_identity_as_username` or + `use_subject_as_username` being disconnected on SIGHUP. Closes [#1402]. +- Improve error messages in some situations when clients disconnect. Reduces + the number of "Socket error on client X, disconnecting" messages. +- Fix Will for v5 clients not being sent if will delay interval was greater + than the session expiry interval. Closes [#1401]. +- Fix CRL file not being reloaded on HUP. Closes [#35]. +- Fix repeated "Error in poll" messages on Windows when only websockets + listeners are defined. Closes [#1391]. + +# Client library +- Fix reconnect backoff for the situation where connections are dropped rather + than refused. Closes [#737]. +- Fix missing locks on `mosq->state`. Closes [#1374]. + +# Documentation +- Improve details on global/per listener options in the mosquitto.conf man page. + Closes [#274]. +- Clarify behaviour when clients exceed the `message_size_limit`. Closes [#448]. +- Improve documentation for `max_inflight_bytes`, `max_inflight_messages`, + and `max_queued_messages`. + +# Build +- Fix missing function warnings on NetBSD. +- Fix `WITH_STATIC_LIBRARIES` using CMake on Windows. Closes [#1369]. +- Guard `ssize_t` definition on Windows. Closes [#522]. + + +[#35]: https://github.com/eclipse/mosquitto/issues/35 +[#274]: https://github.com/eclipse/mosquitto/issues/274 +[#448]: https://github.com/eclipse/mosquitto/issues/448 +[#478]: https://github.com/eclipse/mosquitto/issues/478 +[#522]: https://github.com/eclipse/mosquitto/issues/522 +[#737]: https://github.com/eclipse/mosquitto/issues/737 +[#1367]: https://github.com/eclipse/mosquitto/issues/1367 +[#1369]: https://github.com/eclipse/mosquitto/issues/1369 +[#1374]: https://github.com/eclipse/mosquitto/issues/1374 +[#1390]: https://github.com/eclipse/mosquitto/issues/1390 +[#1391]: https://github.com/eclipse/mosquitto/issues/1391 +[#1401]: https://github.com/eclipse/mosquitto/issues/1401 +[#1402]: https://github.com/eclipse/mosquitto/issues/1402 From 0a0ad4cd6cf7d6d37db2e5b4647f7fd85393c1b7 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Thu, 12 Sep 2019 17:15:46 +0100 Subject: [PATCH 35/57] Fix for old libwebsockets versions. --- src/websockets.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/websockets.c b/src/websockets.c index df5dd4d1..b297534f 100644 --- a/src/websockets.c +++ b/src/websockets.c @@ -769,7 +769,9 @@ struct libwebsocket_context *mosq_websockets_init(struct mosquitto__listener *li } info.user = user; +#if defined(LWS_LIBRARY_VERSION_NUMBER) && LWS_LIBRARY_VERSION_NUMBER>=2004000 info.pt_serv_buf_size = WS_SERV_BUF_SIZE; +#endif listener->ws_protocol = p; lws_set_log_level(conf->websockets_log_level, log_wrap); From 344bbd087cf132998795422e26af9dc1eefacfa9 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Thu, 12 Sep 2019 17:19:46 +0100 Subject: [PATCH 36/57] Install mqtt_protocol.h --- lib/Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/Makefile b/lib/Makefile index e3800b2d..eca694f0 100644 --- a/lib/Makefile +++ b/lib/Makefile @@ -70,6 +70,7 @@ ifeq ($(WITH_STATIC_LIBRARIES),yes) endif $(INSTALL) -d "${DESTDIR}${incdir}/" $(INSTALL) mosquitto.h "${DESTDIR}${incdir}/mosquitto.h" + $(INSTALL) mqtt_protocol.h "${DESTDIR}${incdir}/mqtt_protocol.h" $(INSTALL) -d "${DESTDIR}${libdir}/pkgconfig" $(INSTALL) -m644 ../libmosquitto.pc.in "${DESTDIR}${libdir}/pkgconfig/libmosquitto.pc" sed -i -e "s#@CMAKE_INSTALL_PREFIX@#${prefix}#" -e "s#@VERSION@#${VERSION}#" "${DESTDIR}${libdir}/pkgconfig/libmosquitto.pc" From 095bbb5e441e45538e924d90483dacb51d62b927 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Thu, 12 Sep 2019 22:03:00 +0100 Subject: [PATCH 37/57] Update Docker for 1.6.5. --- docker/1.6/Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker/1.6/Dockerfile b/docker/1.6/Dockerfile index 0a5c8b5c..c8102ed4 100644 --- a/docker/1.6/Dockerfile +++ b/docker/1.6/Dockerfile @@ -3,8 +3,8 @@ FROM alpine:3.8 LABEL maintainer="Roger Light " \ description="Eclipse Mosquitto MQTT Broker" -ENV VERSION=1.6.4 \ - DOWNLOAD_SHA256=a3d5822c249f6a6e13311b1b09eff6807ea01608a5a77934e1769842e9d146ef \ +ENV VERSION=1.6.5 \ + DOWNLOAD_SHA256=bc71b38b5a26fc7cc772853e5607c657868db9f9a6d2b15e2b677649a0f85d20 \ GPG_KEYS=A0D6EEA1DCAE49A635A3B2F0779B22DFB3E717B7 \ LWS_VERSION=2.4.2 From 106675093177335b18521bc0e5ad1d95343ad652 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Sun, 15 Sep 2019 22:35:08 +0100 Subject: [PATCH 38/57] Restrict topic hierarchy to 200 levels to prevent possible stack overflow. Closes #1412. Thanks to Ryan Shaw. --- ChangeLog.txt | 8 +++++ lib/util_topic.c | 45 ++++++++++++++++++++++++++ src/mosquitto_broker_internal.h | 3 ++ src/subs.c | 7 ++++ test/broker/02-subscribe-long-topic.py | 36 +++++++++++++++++++++ test/broker/03-publish-long-topic.py | 37 +++++++++++++++++++++ test/broker/Makefile | 2 ++ test/broker/test.py | 2 ++ test/mosq_test.py | 18 +++++++---- 9 files changed, 152 insertions(+), 6 deletions(-) create mode 100755 test/broker/02-subscribe-long-topic.py create mode 100755 test/broker/03-publish-long-topic.py diff --git a/ChangeLog.txt b/ChangeLog.txt index 8fcb17d3..e8e5ff98 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -1,3 +1,11 @@ +1.6.6 - 20190915 +================ + +Broker: +- Restrict topic hierarchy to 200 levels to prevent possible stack overflow. + Closes #1412. + + 1.6.5 - 20190912 ================ diff --git a/lib/util_topic.c b/lib/util_topic.c index 67b78782..673cc6ca 100644 --- a/lib/util_topic.c +++ b/lib/util_topic.c @@ -49,14 +49,25 @@ Contributors: int mosquitto_pub_topic_check(const char *str) { int len = 0; +#ifdef WITH_BROKER + int hier_count = 0; +#endif while(str && str[0]){ if(str[0] == '+' || str[0] == '#'){ return MOSQ_ERR_INVAL; } +#ifdef WITH_BROKER + else if(str[0] == '/'){ + hier_count++; + } +#endif len++; str = &str[1]; } if(len > 65535) return MOSQ_ERR_INVAL; +#ifdef WITH_BROKER + if(hier_count > TOPIC_HIERARCHY_LIMIT) return MOSQ_ERR_INVAL; +#endif return MOSQ_ERR_SUCCESS; } @@ -64,6 +75,9 @@ int mosquitto_pub_topic_check(const char *str) int mosquitto_pub_topic_check2(const char *str, size_t len) { size_t i; +#ifdef WITH_BROKER + int hier_count = 0; +#endif if(len > 65535) return MOSQ_ERR_INVAL; @@ -71,7 +85,15 @@ int mosquitto_pub_topic_check2(const char *str, size_t len) if(str[i] == '+' || str[i] == '#'){ return MOSQ_ERR_INVAL; } +#ifdef WITH_BROKER + else if(str[i] == '/'){ + hier_count++; + } +#endif } +#ifdef WITH_BROKER + if(hier_count > TOPIC_HIERARCHY_LIMIT) return MOSQ_ERR_INVAL; +#endif return MOSQ_ERR_SUCCESS; } @@ -87,6 +109,10 @@ int mosquitto_sub_topic_check(const char *str) { char c = '\0'; int len = 0; +#ifdef WITH_BROKER + int hier_count = 0; +#endif + while(str && str[0]){ if(str[0] == '+'){ if((c != '\0' && c != '/') || (str[1] != '\0' && str[1] != '/')){ @@ -97,11 +123,19 @@ int mosquitto_sub_topic_check(const char *str) return MOSQ_ERR_INVAL; } } +#ifdef WITH_BROKER + else if(str[0] == '/'){ + hier_count++; + } +#endif len++; c = str[0]; str = &str[1]; } if(len > 65535) return MOSQ_ERR_INVAL; +#ifdef WITH_BROKER + if(hier_count > TOPIC_HIERARCHY_LIMIT) return MOSQ_ERR_INVAL; +#endif return MOSQ_ERR_SUCCESS; } @@ -110,6 +144,9 @@ int mosquitto_sub_topic_check2(const char *str, size_t len) { char c = '\0'; size_t i; +#ifdef WITH_BROKER + int hier_count = 0; +#endif if(len > 65535) return MOSQ_ERR_INVAL; @@ -123,8 +160,16 @@ int mosquitto_sub_topic_check2(const char *str, size_t len) return MOSQ_ERR_INVAL; } } +#ifdef WITH_BROKER + else if(str[i] == '/'){ + hier_count++; + } +#endif c = str[i]; } +#ifdef WITH_BROKER + if(hier_count > TOPIC_HIERARCHY_LIMIT) return MOSQ_ERR_INVAL; +#endif return MOSQ_ERR_SUCCESS; } diff --git a/src/mosquitto_broker_internal.h b/src/mosquitto_broker_internal.h index 25d4a5b0..322c6a8a 100644 --- a/src/mosquitto_broker_internal.h +++ b/src/mosquitto_broker_internal.h @@ -73,6 +73,9 @@ Contributors: #define WEBSOCKET_CLIENT -2 + +#define TOPIC_HIERARCHY_LIMIT 200 + /* ======================================== * UHPA data types * ======================================== */ diff --git a/src/subs.c b/src/subs.c index aae32666..c059874f 100644 --- a/src/subs.c +++ b/src/subs.c @@ -220,6 +220,7 @@ static int sub__topic_tokenise(const char *subtopic, struct sub__token **topics) int start, stop, tlen; int i; char *topic; + int count = 0; assert(subtopic); assert(topics); @@ -242,6 +243,7 @@ static int sub__topic_tokenise(const char *subtopic, struct sub__token **topics) stop = 0; for(i=start; i TOPIC_HIERARCHY_LIMIT){ + /* Set limit on hierarchy levels, to restrict stack usage. */ + goto cleanup; + } + return MOSQ_ERR_SUCCESS; cleanup: diff --git a/test/broker/02-subscribe-long-topic.py b/test/broker/02-subscribe-long-topic.py new file mode 100755 index 00000000..c2e7a107 --- /dev/null +++ b/test/broker/02-subscribe-long-topic.py @@ -0,0 +1,36 @@ +#!/usr/bin/env python3 + +# Test whether a SUBSCRIBE to a topic with 65535 hierarchy characters fails +# This needs checking with MOSQ_USE_VALGRIND=1 to detect memory failures +# https://github.com/eclipse/mosquitto/issues/1412 + +from mosq_test_helper import * + +rc = 1 +mid = 1 +keepalive = 60 +connect_packet = mosq_test.gen_connect("subscribe-long-test", keepalive=keepalive) +connack_packet = mosq_test.gen_connack(rc=0) + +subscribe_packet = mosq_test.gen_subscribe(mid, "/"*65535, 0) +suback_packet = mosq_test.gen_suback(mid, 0) + +port = mosq_test.get_port() +broker = mosq_test.start_broker(filename=os.path.basename(__file__), port=port) + +try: + sock = mosq_test.do_client_connect(connect_packet, connack_packet, port=port) + mosq_test.do_send_receive(sock, subscribe_packet, b"", "suback") + + rc = 0 + + sock.close() +finally: + broker.terminate() + broker.wait() + (stdo, stde) = broker.communicate() + if rc: + print(stde.decode('utf-8')) + +exit(rc) + diff --git a/test/broker/03-publish-long-topic.py b/test/broker/03-publish-long-topic.py new file mode 100755 index 00000000..f57c33bb --- /dev/null +++ b/test/broker/03-publish-long-topic.py @@ -0,0 +1,37 @@ +#!/usr/bin/env python3 + +# Test whether a PUBLISH to a topic with 65535 hierarchy characters fails +# This needs checking with MOSQ_USE_VALGRIND=1 to detect memory failures +# https://github.com/eclipse/mosquitto/issues/1412 + + +from mosq_test_helper import * + +rc = 1 +mid = 19 +keepalive = 60 +connect_packet = mosq_test.gen_connect("pub-qos1-test", keepalive=keepalive) +connack_packet = mosq_test.gen_connack(rc=0) + +publish_packet = mosq_test.gen_publish("/"*65535, qos=1, mid=mid, payload="message") +puback_packet = mosq_test.gen_puback(mid) + +port = mosq_test.get_port() +broker = mosq_test.start_broker(filename=os.path.basename(__file__), port=port) + +try: + sock = mosq_test.do_client_connect(connect_packet, connack_packet, port=port) + mosq_test.do_send_receive(sock, publish_packet, b"", "puback") + + rc = 0 + + sock.close() +finally: + broker.terminate() + broker.wait() + (stdo, stde) = broker.communicate() + if rc: + print(stde.decode('utf-8')) + +exit(rc) + diff --git a/test/broker/Makefile b/test/broker/Makefile index fb6cda1e..0b938042 100644 --- a/test/broker/Makefile +++ b/test/broker/Makefile @@ -75,6 +75,7 @@ endif ./02-subpub-qos2.py ./02-subscribe-dollar-v5.py ./02-subscribe-invalid-utf8.py + ./02-subscribe-long-topic.py ./02-subscribe-persistence-flipflop.py ./02-subscribe-qos0.py ./02-subscribe-qos1.py @@ -99,6 +100,7 @@ endif ./03-publish-dollar-v5.py ./03-publish-dollar.py ./03-publish-invalid-utf8.py + ./03-publish-long-topic.py ./03-publish-qos1-no-subscribers-v5.py ./03-publish-qos1-retain-disabled.py ./03-publish-qos1.py diff --git a/test/broker/test.py b/test/broker/test.py index 5aadbbee..2d010904 100755 --- a/test/broker/test.py +++ b/test/broker/test.py @@ -54,6 +54,7 @@ tests = [ (1, './02-subpub-qos2.py'), (1, './02-subscribe-dollar-v5.py'), (1, './02-subscribe-invalid-utf8.py'), + (1, './02-subscribe-long-topic.py'), (1, './02-subscribe-persistence-flipflop.py'), (1, './02-subscribe-qos0.py'), (1, './02-subscribe-qos1.py'), @@ -77,6 +78,7 @@ tests = [ (1, './03-publish-dollar-v5.py'), (1, './03-publish-dollar.py'), (1, './03-publish-invalid-utf8.py'), + (1, './03-publish-long-topic.py'), (1, './03-publish-qos1-no-subscribers-v5.py'), (1, './03-publish-qos1-retain-disabled.py'), (1, './03-publish-qos1.py'), diff --git a/test/mosq_test.py b/test/mosq_test.py index 2093e326..1669f566 100644 --- a/test/mosq_test.py +++ b/test/mosq_test.py @@ -478,19 +478,25 @@ def gen_pubrel(mid, dup=False, proto_ver=4, reason_code=-1, properties=None): def gen_pubcomp(mid, proto_ver=4, reason_code=-1, properties=None): return _gen_command_with_mid(112, mid, proto_ver, reason_code, properties) + def gen_subscribe(mid, topic, qos, proto_ver=4, properties=b""): topic = topic.encode("utf-8") + packet = struct.pack("!B", 130) if proto_ver == 5: if properties == b"": - pack_format = "!BBHBH"+str(len(topic))+"sB" - return struct.pack(pack_format, 130, 2+1+2+len(topic)+1, mid, 0, len(topic), topic, qos) + packet += pack_remaining_length(2+1+2+len(topic)+1) + pack_format = "!HBH"+str(len(topic))+"sB" + return packet + struct.pack(pack_format, mid, 0, len(topic), topic, qos) else: properties = mqtt5_props.prop_finalise(properties) - pack_format = "!BBH"+str(len(properties))+"s"+"H"+str(len(topic))+"sB" - return struct.pack(pack_format, 130, 2+1+2+len(topic)+len(properties), mid, properties, len(topic), topic, qos) + packet += pack_remaining_length(2+1+2+len(topic)+len(properties)) + pack_format = "!H"+str(len(properties))+"s"+"H"+str(len(topic))+"sB" + return packet + struct.pack(pack_format, mid, properties, len(topic), topic, qos) else: - pack_format = "!BBHH"+str(len(topic))+"sB" - return struct.pack(pack_format, 130, 2+2+len(topic)+1, mid, len(topic), topic, qos) + packet += pack_remaining_length(2+2+len(topic)+1) + pack_format = "!HH"+str(len(topic))+"sB" + return packet + struct.pack(pack_format, mid, len(topic), topic, qos) + def gen_suback(mid, qos, proto_ver=4): if proto_ver == 5: From 2fd7f5270a4e9110065a48f3c92a6fcb3548caab Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Tue, 17 Sep 2019 09:37:16 +0100 Subject: [PATCH 39/57] mosquitto_passwd returns 1 on an error condition When attempting to update a user that does not exist. Closes #1414. Thanks to kdgde. --- ChangeLog.txt | 2 ++ src/mosquitto_passwd.c | 1 + 2 files changed, 3 insertions(+) diff --git a/ChangeLog.txt b/ChangeLog.txt index e8e5ff98..9919c610 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -4,6 +4,8 @@ Broker: - Restrict topic hierarchy to 200 levels to prevent possible stack overflow. Closes #1412. +- mosquitto_passwd now returns 1 when attempting to update a user that does + not exist. Closes #1414. 1.6.5 - 20190912 diff --git a/src/mosquitto_passwd.c b/src/mosquitto_passwd.c index 00e048fb..41d32adb 100644 --- a/src/mosquitto_passwd.c +++ b/src/mosquitto_passwd.c @@ -223,6 +223,7 @@ int delete_pwuser(FILE *fptr, FILE *ftmp, const char *username) } if(!found){ fprintf(stderr, "Warning: User %s not found in password file.\n", username); + return 1; } return 0; } From e479a80cbe395975bc9393b486f1d474e735e9ba Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Tue, 17 Sep 2019 12:50:37 +0100 Subject: [PATCH 40/57] Extra test for issue 1401. --- test/broker/07-will-delay-session-expiry2.py | 52 ++++++++++++++++++++ test/broker/Makefile | 1 + test/broker/test.py | 1 + 3 files changed, 54 insertions(+) create mode 100755 test/broker/07-will-delay-session-expiry2.py diff --git a/test/broker/07-will-delay-session-expiry2.py b/test/broker/07-will-delay-session-expiry2.py new file mode 100755 index 00000000..506dac01 --- /dev/null +++ b/test/broker/07-will-delay-session-expiry2.py @@ -0,0 +1,52 @@ +#!/usr/bin/env python3 + +# Test whether a client that connects with a will delay that is shorter than +# their session expiry interval has their will published. +# MQTT 5 +# https://github.com/eclipse/mosquitto/issues/1401 + +from mosq_test_helper import * + +rc = 1 +keepalive = 60 + +mid = 1 +connect1_packet = mosq_test.gen_connect("will-test", keepalive=keepalive, proto_ver=5) +connack1_packet = mosq_test.gen_connack(rc=0, proto_ver=5) + +will_props = mqtt5_props.gen_uint32_prop(mqtt5_props.PROP_WILL_DELAY_INTERVAL, 2) +connect_props = mqtt5_props.gen_uint32_prop(mqtt5_props.PROP_SESSION_EXPIRY_INTERVAL, 4) + +connect2_packet = mosq_test.gen_connect("will-helper", keepalive=keepalive, proto_ver=5, properties=connect_props, will_topic="will/test", will_payload=b"will delay", will_qos=2, will_properties=will_props) +connack2_packet = mosq_test.gen_connack(rc=0, proto_ver=5) + +subscribe_packet = mosq_test.gen_subscribe(mid, "will/test", 0, proto_ver=5) +suback_packet = mosq_test.gen_suback(mid, 0, proto_ver=5) + +publish_packet = mosq_test.gen_publish("will/test", qos=0, payload="will delay", proto_ver=5) + +port = mosq_test.get_port() +broker = mosq_test.start_broker(filename=os.path.basename(__file__), port=port) + +try: + sock1 = mosq_test.do_client_connect(connect1_packet, connack1_packet, timeout=30, port=port, connack_error="connack1") + mosq_test.do_send_receive(sock1, subscribe_packet, suback_packet, "suback") + + sock2 = mosq_test.do_client_connect(connect2_packet, connack2_packet, timeout=30, port=port, connack_error="connack2") + time.sleep(1) + sock2.close() + + # Wait for session to expire + time.sleep(3) + if mosq_test.expect_packet(sock1, "publish", publish_packet): + rc = 0 + + sock1.close() +finally: + broker.terminate() + broker.wait() + (stdo, stde) = broker.communicate() + if rc: + print(stde.decode('utf-8')) + exit(rc) + diff --git a/test/broker/Makefile b/test/broker/Makefile index 0b938042..e4c32c63 100644 --- a/test/broker/Makefile +++ b/test/broker/Makefile @@ -141,6 +141,7 @@ endif ./07-will-delay-reconnect.py ./07-will-delay-recover.py ./07-will-delay-session-expiry.py + ./07-will-delay-session-expiry2.py ./07-will-delay.py ./07-will-disconnect-with-will.py ./07-will-invalid-utf8.py diff --git a/test/broker/test.py b/test/broker/test.py index 2d010904..7a2f9f66 100755 --- a/test/broker/test.py +++ b/test/broker/test.py @@ -115,6 +115,7 @@ tests = [ (1, './07-will-delay-reconnect.py'), (1, './07-will-delay-recover.py'), (1, './07-will-delay-session-expiry.py'), + (1, './07-will-delay-session-expiry2.py'), (1, './07-will-delay.py'), (1, './07-will-disconnect-with-will.py'), (1, './07-will-invalid-utf8.py'), From 3e094991c496eb447b7023141a949163a0d67518 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Tue, 17 Sep 2019 12:50:48 +0100 Subject: [PATCH 41/57] Hopeful fix for travis. --- test/broker/11-message-expiry.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/broker/11-message-expiry.py b/test/broker/11-message-expiry.py index b976d2fd..253b7ddb 100755 --- a/test/broker/11-message-expiry.py +++ b/test/broker/11-message-expiry.py @@ -75,7 +75,7 @@ try: sock.close() broker = mosq_test.start_broker(filename=os.path.basename(__file__), use_conf=True, port=port) - time.sleep(5) + time.sleep(7) sock = mosq_test.do_client_connect(connect_packet, connack2_packet, timeout=20, port=port) packet = sock.recv(len(publish2s_packet)) From 9883652dde79dc9d70ae17490f0bb6826fc57efb Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Tue, 17 Sep 2019 16:31:22 +0100 Subject: [PATCH 42/57] Bump version, update www and changelog. --- CMakeLists.txt | 2 +- ChangeLog.txt | 6 ++- config.mk | 2 +- installer/mosquitto.nsi | 2 +- installer/mosquitto64.nsi | 2 +- lib/mosquitto.h | 2 +- set-version.sh | 2 +- snap/snapcraft.yaml | 2 +- www/pages/download.md | 8 +-- www/posts/2019/09/version-1-6-5-released.md | 2 +- www/posts/2019/09/version-1-6-6-released.md | 59 +++++++++++++++++++++ 11 files changed, 76 insertions(+), 13 deletions(-) create mode 100644 www/posts/2019/09/version-1-6-6-released.md diff --git a/CMakeLists.txt b/CMakeLists.txt index 7fc2595b..9840ec0a 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -11,7 +11,7 @@ project(mosquitto) cmake_minimum_required(VERSION 2.8) # Only for version 3 and up. cmake_policy(SET CMP0042 NEW) -set (VERSION 1.6.5) +set (VERSION 1.6.6) add_definitions (-DCMAKE -DVERSION=\"${VERSION}\") diff --git a/ChangeLog.txt b/ChangeLog.txt index 9919c610..abf74289 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -1,6 +1,10 @@ -1.6.6 - 20190915 +1.6.6 - 20190917 ================ +Security: +- Restrict topic hierarchy to 200 levels to prevent possible stack overflow. + Closes #1412. + Broker: - Restrict topic hierarchy to 200 levels to prevent possible stack overflow. Closes #1412. diff --git a/config.mk b/config.mk index 471ed41c..a8a6debe 100644 --- a/config.mk +++ b/config.mk @@ -104,7 +104,7 @@ WITH_COVERAGE:=no # Also bump lib/mosquitto.h, CMakeLists.txt, # installer/mosquitto.nsi, installer/mosquitto64.nsi -VERSION=1.6.5 +VERSION=1.6.6 # Client library SO version. Bump if incompatible API/ABI changes are made. SOVERSION=1 diff --git a/installer/mosquitto.nsi b/installer/mosquitto.nsi index d59028b6..11d37731 100644 --- a/installer/mosquitto.nsi +++ b/installer/mosquitto.nsi @@ -9,7 +9,7 @@ !define env_hklm 'HKLM "SYSTEM\CurrentControlSet\Control\Session Manager\Environment"' Name "Eclipse Mosquitto" -!define VERSION 1.6.5 +!define VERSION 1.6.6 OutFile "mosquitto-${VERSION}-install-windows-x86.exe" InstallDir "$PROGRAMFILES\mosquitto" diff --git a/installer/mosquitto64.nsi b/installer/mosquitto64.nsi index c89d9a7d..c43a66a8 100644 --- a/installer/mosquitto64.nsi +++ b/installer/mosquitto64.nsi @@ -9,7 +9,7 @@ !define env_hklm 'HKLM "SYSTEM\CurrentControlSet\Control\Session Manager\Environment"' Name "Eclipse Mosquitto" -!define VERSION 1.6.5 +!define VERSION 1.6.6 OutFile "mosquitto-${VERSION}-install-windows-x64.exe" !include "x64.nsh" diff --git a/lib/mosquitto.h b/lib/mosquitto.h index c8116fa9..1e1dff2e 100644 --- a/lib/mosquitto.h +++ b/lib/mosquitto.h @@ -48,7 +48,7 @@ extern "C" { #define LIBMOSQUITTO_MAJOR 1 #define LIBMOSQUITTO_MINOR 6 -#define LIBMOSQUITTO_REVISION 5 +#define LIBMOSQUITTO_REVISION 6 /* LIBMOSQUITTO_VERSION_NUMBER looks like 1002001 for e.g. version 1.2.1. */ #define LIBMOSQUITTO_VERSION_NUMBER (LIBMOSQUITTO_MAJOR*1000000+LIBMOSQUITTO_MINOR*1000+LIBMOSQUITTO_REVISION) diff --git a/set-version.sh b/set-version.sh index 8c9f65e6..f7b82643 100755 --- a/set-version.sh +++ b/set-version.sh @@ -2,7 +2,7 @@ MAJOR=1 MINOR=6 -REVISION=5 +REVISION=6 sed -i "s/^VERSION=.*/VERSION=${MAJOR}.${MINOR}.${REVISION}/" config.mk diff --git a/snap/snapcraft.yaml b/snap/snapcraft.yaml index dec36750..91f7ed0d 100644 --- a/snap/snapcraft.yaml +++ b/snap/snapcraft.yaml @@ -1,5 +1,5 @@ name: mosquitto -version: 1.6.5 +version: 1.6.6 summary: Eclipse Mosquitto MQTT broker description: This is a message broker that supports version 3.1 and 3.1.1 of the MQTT protocol. diff --git a/www/pages/download.md b/www/pages/download.md index 5499441d..a18abc72 100644 --- a/www/pages/download.md +++ b/www/pages/download.md @@ -1,7 +1,7 @@ + +Mosquitto 1.6.6 and 1.5.9 have been released to address two security vulnerabilities. + +Titles and links will be updated once the CVE numbers are assigned. + +# CVE-xxxx-xxxxx + +A vulnerability exists in Mosquitto versions 1.5 to 1.6.5 inclusive. + +If a client sends a SUBSCRIBE packet containing a topic that consists of +approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, +then a stack overflow will occur. + +The issue is fixed in Mosquitto 1.6.6 and 1.5.9. Patches for older versions are +available at + +The fix addresses the problem by restricting the allowed number of topic +hierarchy levels to 200. An alternative fix is to increase the size of the +stack by a small amount. + +# CVE-yyyy-yyyyy + +A vulnerability exists in Mosquitto version 1.6 to 1.6.4 inclusive. + +If an MQTT v5 client connects to Mosquitto, sets a last will and testament, +sets a will delay interval, sets a session expiry interval, and the will delay +interval is set longer than the session expiry interval, then a use after free +error occurs, which has the potential to cause a crash in some situations. + +The issue is fixed in Mosquitto 1.6.5. Patches for older versions are available +at + +# Version 1.6.6 Changes + +The complete list of fixes addressed in version 1.6.6 is: + +## Security + +* Restrict topic hierarchy to 200 levels to prevent possible stack overflow. + Closes [#1412]. + +## Broker +* Restrict topic hierarchy to 200 levels to prevent possible stack overflow. + Closes [#1412]. +* `mosquitto_passwd` now returns 1 when attempting to update a user that does + not exist. Closes [#1414]. + +[#1412]: https://github.com/eclipse/mosquitto/issues/1412 +[#1414]: https://github.com/eclipse/mosquitto/issues/1414 From 2e94e5999bc794afe618051176926ed67812106a Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Tue, 17 Sep 2019 16:56:37 +0100 Subject: [PATCH 43/57] Update Docker for 1.6.6, 1.5.9. --- docker/1.5/Dockerfile | 4 ++-- docker/1.6/Dockerfile | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docker/1.5/Dockerfile b/docker/1.5/Dockerfile index 28beacad..6e224636 100644 --- a/docker/1.5/Dockerfile +++ b/docker/1.5/Dockerfile @@ -3,8 +3,8 @@ FROM alpine:3.8 LABEL maintainer="Roger Light " \ description="Eclipse Mosquitto MQTT Broker" -ENV VERSION=1.5.8 \ - DOWNLOAD_SHA256=78d7e70c3794dc3a1d484b4f2f8d3addebe9c2da3f5a1cebe557f7d13beb0da4 \ +ENV VERSION=1.5.9 \ + DOWNLOAD_SHA256=d7b62aa0ca680b0d869d6883373903362f98326a6465fc6cd01a0b9e0e8f0333 \ GPG_KEYS=A0D6EEA1DCAE49A635A3B2F0779B22DFB3E717B7 \ LWS_VERSION=2.4.2 diff --git a/docker/1.6/Dockerfile b/docker/1.6/Dockerfile index c8102ed4..1982934b 100644 --- a/docker/1.6/Dockerfile +++ b/docker/1.6/Dockerfile @@ -3,8 +3,8 @@ FROM alpine:3.8 LABEL maintainer="Roger Light " \ description="Eclipse Mosquitto MQTT Broker" -ENV VERSION=1.6.5 \ - DOWNLOAD_SHA256=bc71b38b5a26fc7cc772853e5607c657868db9f9a6d2b15e2b677649a0f85d20 \ +ENV VERSION=1.6.6 \ + DOWNLOAD_SHA256=82676bf4201ff102be1511b56b041a9450fbbfeda40b21aa28be0fee56e8de17 \ GPG_KEYS=A0D6EEA1DCAE49A635A3B2F0779B22DFB3E717B7 \ LWS_VERSION=2.4.2 From 744293aab7d109084d830a3d87c6bc3d9430c36e Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Wed, 18 Sep 2019 10:46:46 +0100 Subject: [PATCH 44/57] Update CVE-2019-11778 information. --- www/posts/2019/09/version-1-6-6-released.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/www/posts/2019/09/version-1-6-6-released.md b/www/posts/2019/09/version-1-6-6-released.md index 4f6ef8bb..7f479154 100644 --- a/www/posts/2019/09/version-1-6-6-released.md +++ b/www/posts/2019/09/version-1-6-6-released.md @@ -28,9 +28,10 @@ The fix addresses the problem by restricting the allowed number of topic hierarchy levels to 200. An alternative fix is to increase the size of the stack by a small amount. -# CVE-yyyy-yyyyy +# CVE-2019-11778 -A vulnerability exists in Mosquitto version 1.6 to 1.6.4 inclusive. +A vulnerability exists in Mosquitto version 1.6 to 1.6.4 inclusive, known as +[CVE-2019-11778] If an MQTT v5 client connects to Mosquitto, sets a last will and testament, sets a will delay interval, sets a session expiry interval, and the will delay @@ -55,5 +56,6 @@ The complete list of fixes addressed in version 1.6.6 is: * `mosquitto_passwd` now returns 1 when attempting to update a user that does not exist. Closes [#1414]. +[CVE-2019-11778]: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11778 [#1412]: https://github.com/eclipse/mosquitto/issues/1412 [#1414]: https://github.com/eclipse/mosquitto/issues/1414 From 83ee01474be519899d584eff88e5093ce06f3ed4 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Wed, 18 Sep 2019 17:23:30 +0100 Subject: [PATCH 45/57] Update security page. --- www/pages/security.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/www/pages/security.md b/www/pages/security.md index 098babff..3fa00822 100644 --- a/www/pages/security.md +++ b/www/pages/security.md @@ -19,6 +19,10 @@ follow the steps on [Eclipse Security] page to report it. Listed with most recent first. Further information on security related issues can be found in the [security category]. +* September 2019: [CVE-2019-11779]. Affecting versions **1.5** to **1.6.5** + inclusive, fixed in **1.6.6** and **1.5.9**. More details at [version-166-released]. +* September 2019: [CVE-2019-11778]. Affecting versions **1.6** to **1.6.4** + inclusive, fixed in **1.6.5**. More details at [version-166-released]. * April 2019: No CVE assigned. Affecting versions **1.6** and **1.6.1**, fixed in **1.6.2**. More details at [version-162-released]. * December 2018: [CVE-2018-20145]. Affecting versions **1.5** to **1.5.4** @@ -47,6 +51,7 @@ can be found in the [security category]. inclusive, fixed in **1.4.12**. More details at [security-advisory-cve-2017-7650]. +[version-166-released]: /2019/09/version-1-6-6-released/ [version-162-released]: /2019/04/version-1-6-2-released/ [version-155-released]: /2018/11/version-155-released/ [version-154-released]: /2018/11/version-154-released/ @@ -58,6 +63,8 @@ can be found in the [security category]. [Eclipse Security]: https://www.eclipse.org/security/ [security category]: /blog/categories/security/ +[CVE-2019-11779]: https://nvd.nist.gov/vuln/detail/CVE-2019-11779 +[CVE-2019-11778]: https://nvd.nist.gov/vuln/detail/CVE-2019-11778 [CVE-2018-20145]: https://nvd.nist.gov/vuln/detail/CVE-2018-20145 [CVE-2018-12543]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12543 [CVE-2017-9868]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9868 From 0a8358243ba52074449e4007776426a6fda4bb73 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Sat, 21 Sep 2019 22:28:33 +0100 Subject: [PATCH 46/57] mosquitto_sub: Fix `-E` not working unless `-d` was also specified. Closes #1418. Thanks to Lichard Torman. --- ChangeLog.txt | 4 ++++ client/sub_client.c | 12 +++++++----- 2 files changed, 11 insertions(+), 5 deletions(-) diff --git a/ChangeLog.txt b/ChangeLog.txt index abf74289..1bb417d7 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -1,3 +1,7 @@ +Clients: +- mosquitto_sub: Fix `-E` incorrectly not working unless `-d` was also + specified. Closes #1418. + 1.6.6 - 20190917 ================ diff --git a/client/sub_client.c b/client/sub_client.c index 68b0e790..faa68ebd 100644 --- a/client/sub_client.c +++ b/client/sub_client.c @@ -145,11 +145,13 @@ void my_subscribe_callback(struct mosquitto *mosq, void *obj, int mid, int qos_c UNUSED(obj); - if(!cfg.quiet) printf("Subscribed (mid: %d): %d", mid, granted_qos[0]); - for(i=1; i Date: Mon, 23 Sep 2019 12:04:37 +0100 Subject: [PATCH 47/57] Update CVE info on release post. --- www/posts/2019/09/version-1-6-6-released.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/www/posts/2019/09/version-1-6-6-released.md b/www/posts/2019/09/version-1-6-6-released.md index 7f479154..d00c076e 100644 --- a/www/posts/2019/09/version-1-6-6-released.md +++ b/www/posts/2019/09/version-1-6-6-released.md @@ -13,16 +13,17 @@ Mosquitto 1.6.6 and 1.5.9 have been released to address two security vulnerabili Titles and links will be updated once the CVE numbers are assigned. -# CVE-xxxx-xxxxx +# CVE-2019-11779 -A vulnerability exists in Mosquitto versions 1.5 to 1.6.5 inclusive. +A vulnerability exists in Mosquitto versions 1.5 to 1.6.5 inclusive, known as +[CVE-2019-11779]. If a client sends a SUBSCRIBE packet containing a topic that consists of approximately 65400 or more '/' characters, i.e. the topic hierarchy separator, then a stack overflow will occur. The issue is fixed in Mosquitto 1.6.6 and 1.5.9. Patches for older versions are -available at +available at The fix addresses the problem by restricting the allowed number of topic hierarchy levels to 200. An alternative fix is to increase the size of the @@ -39,7 +40,7 @@ interval is set longer than the session expiry interval, then a use after free error occurs, which has the potential to cause a crash in some situations. The issue is fixed in Mosquitto 1.6.5. Patches for older versions are available -at +at # Version 1.6.6 Changes @@ -57,5 +58,6 @@ The complete list of fixes addressed in version 1.6.6 is: not exist. Closes [#1414]. [CVE-2019-11778]: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11778 +[CVE-2019-11779]: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11779 [#1412]: https://github.com/eclipse/mosquitto/issues/1412 [#1414]: https://github.com/eclipse/mosquitto/issues/1414 From a98e336e8c03c43dc7ab3db1f5ed83fa02893cc2 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Mon, 23 Sep 2019 12:22:38 +0100 Subject: [PATCH 48/57] Fix post title. --- www/posts/2019/09/version-1-6-6-released.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/www/posts/2019/09/version-1-6-6-released.md b/www/posts/2019/09/version-1-6-6-released.md index d00c076e..8a3325c4 100644 --- a/www/posts/2019/09/version-1-6-6-released.md +++ b/www/posts/2019/09/version-1-6-6-released.md @@ -1,6 +1,6 @@ + +Mosquitto 1.6.7 has been released, this is a bugfix release. + +# Broker +- Add workaround for working with libwebsockets 3.2.0. +- Fix potential crash when reloading config. Closes [#1424], [#1425]. + +# Client library +- Don't use `/` in autogenerated client ids, to avoid confusing with topics. +- Fix `mosquitto_max_inflight_messages_set()` and `mosquitto_int_option(..., + MOSQ_OPT_*_MAX, ...)` behaviour. Closes [#1417]. +- Fix regression on use of `mosquitto_connect_async()` not working. + Closes [#1415] and [#1422]. + +# Clients +- mosquitto_sub: Fix `-E` incorrectly not working unless `-d` was also + specified. [Closes #1418]. +- Updated documentation around automatic client ids. + +[#1415]: https://github.com/eclipse/mosquitto/issues/1415 +[#1417]: https://github.com/eclipse/mosquitto/issues/1417 +[#1418]: https://github.com/eclipse/mosquitto/issues/1418 +[#1422]: https://github.com/eclipse/mosquitto/issues/1422 +[#1424]: https://github.com/eclipse/mosquitto/issues/1424 +[#1425]: https://github.com/eclipse/mosquitto/issues/1425 From 6a01453ce0c39d56d49c684d5b0fcbb56c3b3d6e Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Wed, 25 Sep 2019 12:17:17 +0100 Subject: [PATCH 56/57] Build fixes. --- lib/loop.c | 3 +++ lib/net_mosq.c | 2 +- lib/socks_mosq.c | 1 + lib/srv_mosq.c | 3 ++- src/context.c | 1 + src/handle_auth.c | 1 + src/websockets.c | 3 ++- 7 files changed, 11 insertions(+), 3 deletions(-) diff --git a/lib/loop.c b/lib/loop.c index 1903feda..ad9bc0f3 100644 --- a/lib/loop.c +++ b/lib/loop.c @@ -47,6 +47,9 @@ int mosquitto_loop(struct mosquitto *mosq, int timeout, int max_packets) char pairbuf; int maxfd = 0; time_t now; +#ifdef WITH_SRV + int state; +#endif if(!mosq || max_packets < 1) return MOSQ_ERR_INVAL; #ifndef WIN32 diff --git a/lib/net_mosq.c b/lib/net_mosq.c index 9fd75856..c2907452 100644 --- a/lib/net_mosq.c +++ b/lib/net_mosq.c @@ -210,7 +210,7 @@ int net__socket_close(struct mosquitto *mosq) if(mosq->wsi) { if(mosq->state != mosq_cs_disconnecting){ - context__set_state(mosq, mosq_cs_disconnect_ws); + mosquitto__set_state(mosq, mosq_cs_disconnect_ws); } libwebsocket_callback_on_writable(mosq->ws_context, mosq->wsi); }else diff --git a/lib/socks_mosq.c b/lib/socks_mosq.c index 78959ecf..a9f0bbcd 100644 --- a/lib/socks_mosq.c +++ b/lib/socks_mosq.c @@ -37,6 +37,7 @@ Contributors: #include "net_mosq.h" #include "packet_mosq.h" #include "send_mosq.h" +#include "util_mosq.h" #define SOCKS_AUTH_NONE 0x00 #define SOCKS_AUTH_GSS 0x01 diff --git a/lib/srv_mosq.c b/lib/srv_mosq.c index 50f30118..b05d257d 100644 --- a/lib/srv_mosq.c +++ b/lib/srv_mosq.c @@ -28,6 +28,7 @@ Contributors: #include "memory_mosq.h" #include "mosquitto_internal.h" #include "mosquitto.h" +#include "util_mosq.h" #ifdef WITH_SRV static void srv_callback(void *arg, int status, int timeouts, unsigned char *abuf, int alen) @@ -91,7 +92,7 @@ int mosquitto_connect_srv(struct mosquitto *mosq, const char *host, int keepaliv mosquitto__free(h); } - mosquitto__set_state(mosq_cs_connect_srv); + mosquitto__set_state(mosq, mosq_cs_connect_srv); mosq->keepalive = keepalive; diff --git a/src/context.c b/src/context.c index 9996f8b8..35e57310 100644 --- a/src/context.c +++ b/src/context.c @@ -25,6 +25,7 @@ Contributors: #include "packet_mosq.h" #include "property_mosq.h" #include "time_mosq.h" +#include "util_mosq.h" #include "will_mosq.h" #include "uthash.h" diff --git a/src/handle_auth.c b/src/handle_auth.c index 254a832e..64baacc9 100644 --- a/src/handle_auth.c +++ b/src/handle_auth.c @@ -25,6 +25,7 @@ Contributors: #include "packet_mosq.h" #include "property_mosq.h" #include "send_mosq.h" +#include "util_mosq.h" #include "will_mosq.h" diff --git a/src/websockets.c b/src/websockets.c index b297534f..8c03a08a 100644 --- a/src/websockets.c +++ b/src/websockets.c @@ -38,6 +38,7 @@ POSSIBILITY OF SUCH DAMAGE. #include "memory_mosq.h" #include "packet_mosq.h" #include "sys_tree.h" +#include "util_mosq.h" #include #include @@ -424,7 +425,7 @@ static int callback_mqtt(struct libwebsocket_context *context, if(rc && (mosq->out_packet || mosq->current_out_packet)) { if(mosq->state != mosq_cs_disconnecting){ - context__set_state(mosq, mosq_cs_disconnect_ws); + mosquitto__set_state(mosq, mosq_cs_disconnect_ws); } libwebsocket_callback_on_writable(mosq->ws_context, mosq->wsi); } else if (rc) { From 194b4e261693003fe759d5fc07de6080fef53ed9 Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Wed, 25 Sep 2019 13:35:10 +0100 Subject: [PATCH 57/57] Update docker to 1.6.7. --- docker/1.6/Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docker/1.6/Dockerfile b/docker/1.6/Dockerfile index 1982934b..72c6b377 100644 --- a/docker/1.6/Dockerfile +++ b/docker/1.6/Dockerfile @@ -3,8 +3,8 @@ FROM alpine:3.8 LABEL maintainer="Roger Light " \ description="Eclipse Mosquitto MQTT Broker" -ENV VERSION=1.6.6 \ - DOWNLOAD_SHA256=82676bf4201ff102be1511b56b041a9450fbbfeda40b21aa28be0fee56e8de17 \ +ENV VERSION=1.6.7 \ + DOWNLOAD_SHA256=bcd31a8fbbd053fee328986fadd8666d3058357ded56b9782f7d4f19931d178e \ GPG_KEYS=A0D6EEA1DCAE49A635A3B2F0779B22DFB3E717B7 \ LWS_VERSION=2.4.2