Mirrors_Framework/mosquitto
1
0
Fork 0
mirror of https://github.com/eclipse-mosquitto/mosquitto.git synced 2026-09-21 23:47:52 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add --no-tls option for all clients.

Browse Source 
This disables all TLS options for that instance. This is useful for
negating TLS options provided in a config file, or to disable the
automatic use of TLS when using port 8883.

Closes #2180. Thanks to Elliott Balsley.
This commit is contained in:
Roger A. Light
2021-04-15 09:52:34 +01:00
parent efad820706
commit 8dbfdc0495
9 changed files with 157 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ChangeLog.txt
+4
View File
@@ -29,6 +29,10 @@ Client library:
Clients:
- Add `-o` option for all clients loading options from a specific file.
- Add `--no-tls` option for all clients which disables all TLS options for
that instance. This is useful for negating TLS options provided in a config
file, or to disable the automatic use of TLS when using port 8883.
Closes #2180.
2.0.9 - 2021-03-xx
client/client_shared.c
+66 -53
View File
@@ -861,6 +861,8 @@ int client_config_line_proc(struct mosq_config *cfg, int pub_or_sub, int argc, c
i++;
}else if(!strcmp(argv[i], "--nodelay")){
cfg->tcp_nodelay = true;
}else if(!strcmp(argv[i], "--no-tls")){
cfg->no_tls = true;
}else if(!strcmp(argv[i], "-n") || !strcmp(argv[i], "--null-message")){
if(pub_or_sub == CLIENT_SUB){
goto unknown_option;
@@ -1271,9 +1273,71 @@ unknown_option:
return 1;
}
#ifdef WITH_TLS
static int client_tls_opts_set(struct mosquitto *mosq, struct mosq_config *cfg)
{
int rc;
if(cfg->no_tls){
return MOSQ_ERR_SUCCESS;
}
if(cfg->cafile || cfg->capath){
rc = mosquitto_tls_set(mosq, cfg->cafile, cfg->capath, cfg->certfile, cfg->keyfile, NULL);
if(rc){
if(rc == MOSQ_ERR_INVAL){
err_printf(cfg, "Error: Problem setting TLS options: File not found.\n");
}else{
err_printf(cfg, "Error: Problem setting TLS options: %s.\n", mosquitto_strerror(rc));
}
return 1;
}
}else if(cfg->port == 8883){
mosquitto_int_option(mosq, MOSQ_OPT_TLS_USE_OS_CERTS, 1);
}
if(cfg->tls_use_os_certs){
mosquitto_int_option(mosq, MOSQ_OPT_TLS_USE_OS_CERTS, 1);
}
if(cfg->insecure && mosquitto_tls_insecure_set(mosq, true)){
err_printf(cfg, "Error: Problem setting TLS insecure option.\n");
return 1;
}
if(cfg->tls_engine && mosquitto_string_option(mosq, MOSQ_OPT_TLS_ENGINE, cfg->tls_engine)){
err_printf(cfg, "Error: Problem setting TLS engine, is %s a valid engine?\n", cfg->tls_engine);
return 1;
}
if(cfg->keyform && mosquitto_string_option(mosq, MOSQ_OPT_TLS_KEYFORM, cfg->keyform)){
err_printf(cfg, "Error: Problem setting key form, it must be one of 'pem' or 'engine'.\n");
return 1;
}
if(cfg->tls_engine_kpass_sha1 && mosquitto_string_option(mosq, MOSQ_OPT_TLS_ENGINE_KPASS_SHA1, cfg->tls_engine_kpass_sha1)){
err_printf(cfg, "Error: Problem setting TLS engine key pass sha, is it a 40 character hex string?\n");
return 1;
}
if(cfg->tls_alpn && mosquitto_string_option(mosq, MOSQ_OPT_TLS_ALPN, cfg->tls_alpn)){
err_printf(cfg, "Error: Problem setting TLS ALPN protocol.\n");
return 1;
}
# ifdef FINAL_WITH_TLS_PSK
if(cfg->psk && mosquitto_tls_psk_set(mosq, cfg->psk, cfg->psk_identity, NULL)){
err_printf(cfg, "Error: Problem setting TLS-PSK options.\n");
return 1;
}
# endif
if((cfg->tls_version || cfg->ciphers) && mosquitto_tls_opts_set(mosq, 1, cfg->tls_version, cfg->ciphers)){
err_printf(cfg, "Error: Problem setting TLS options, check the options are valid.\n");
return 1;
}
return MOSQ_ERR_SUCCESS;
}
#endif
int client_opts_set(struct mosquitto *mosq, struct mosq_config *cfg)
{
#if defined(WITH_TLS) || defined(WITH_SOCKS)
#if defined(WITH_SOCKS)
int rc;
#endif
@@ -1295,58 +1359,7 @@ int client_opts_set(struct mosquitto *mosq, struct mosq_config *cfg)
return 1;
}
#ifdef WITH_TLS
if(cfg->cafile || cfg->capath){
rc = mosquitto_tls_set(mosq, cfg->cafile, cfg->capath, cfg->certfile, cfg->keyfile, NULL);
if(rc){
if(rc == MOSQ_ERR_INVAL){
err_printf(cfg, "Error: Problem setting TLS options: File not found.\n");
}else{
err_printf(cfg, "Error: Problem setting TLS options: %s.\n", mosquitto_strerror(rc));
}
mosquitto_lib_cleanup();
return 1;
}
}else if(cfg->port == 8883){
mosquitto_int_option(mosq, MOSQ_OPT_TLS_USE_OS_CERTS, 1);
}
if(cfg->tls_use_os_certs){
mosquitto_int_option(mosq, MOSQ_OPT_TLS_USE_OS_CERTS, 1);
}
if(cfg->insecure && mosquitto_tls_insecure_set(mosq, true)){
err_printf(cfg, "Error: Problem setting TLS insecure option.\n");
mosquitto_lib_cleanup();
return 1;
}
if(cfg->tls_engine && mosquitto_string_option(mosq, MOSQ_OPT_TLS_ENGINE, cfg->tls_engine)){
err_printf(cfg, "Error: Problem setting TLS engine, is %s a valid engine?\n", cfg->tls_engine);
mosquitto_lib_cleanup();
return 1;
}
if(cfg->keyform && mosquitto_string_option(mosq, MOSQ_OPT_TLS_KEYFORM, cfg->keyform)){
err_printf(cfg, "Error: Problem setting key form, it must be one of 'pem' or 'engine'.\n");
mosquitto_lib_cleanup();
return 1;
}
if(cfg->tls_engine_kpass_sha1 && mosquitto_string_option(mosq, MOSQ_OPT_TLS_ENGINE_KPASS_SHA1, cfg->tls_engine_kpass_sha1)){
err_printf(cfg, "Error: Problem setting TLS engine key pass sha, is it a 40 character hex string?\n");
mosquitto_lib_cleanup();
return 1;
}
if(cfg->tls_alpn && mosquitto_string_option(mosq, MOSQ_OPT_TLS_ALPN, cfg->tls_alpn)){
err_printf(cfg, "Error: Problem setting TLS ALPN protocol.\n");
mosquitto_lib_cleanup();
return 1;
}
# ifdef FINAL_WITH_TLS_PSK
if(cfg->psk && mosquitto_tls_psk_set(mosq, cfg->psk, cfg->psk_identity, NULL)){
err_printf(cfg, "Error: Problem setting TLS-PSK options.\n");
mosquitto_lib_cleanup();
return 1;
}
# endif
if((cfg->tls_version || cfg->ciphers) && mosquitto_tls_opts_set(mosq, 1, cfg->tls_version, cfg->ciphers)){
err_printf(cfg, "Error: Problem setting TLS options, check the options are valid.\n");
if(client_tls_opts_set(mosq, cfg)){
mosquitto_lib_cleanup();
return 1;
}
client/client_shared.h
+3 -2
View File
@@ -123,10 +123,11 @@ struct mosq_config {
mosquitto_property *unsubscribe_props;
mosquitto_property *disconnect_props;
mosquitto_property *will_props;
bool have_topic_alias; /* pub */
char *response_topic; /* rr */
bool tcp_nodelay;
char *options_file;
bool have_topic_alias; /* pub */
bool tcp_nodelay;
bool no_tls;
};
int client_config_load(struct mosq_config *config, int pub_or_sub, int argc, char *argv[]);
client/pub_client.c
+1
View File
@@ -416,6 +416,7 @@ void print_usage(void)
printf(" [-u username [-P password]]\n");
printf(" [--will-topic [--will-payload payload] [--will-qos qos] [--will-retain]]\n");
#ifdef WITH_TLS
printf(" [--no-tls]\n");
printf(" [{--cafile file | --capath dir} [--cert file] [--key file]\n");
printf(" [--ciphers ciphers] [--insecure]\n");
printf(" [--tls-alpn protocol]\n");
client/rr_client.c
+1
View File
@@ -211,6 +211,7 @@ void print_usage(void)
printf(" [-d] [-N] [--quiet] [-v]\n");
printf(" [--will-topic [--will-payload payload] [--will-qos qos] [--will-retain]]\n");
#ifdef WITH_TLS
printf(" [--no-tls]\n");
printf(" [{--cafile file | --capath dir} [--cert file] [--key file]\n");
printf(" [--ciphers ciphers] [--insecure]\n");
printf(" [--tls-alpn protocol]\n");
client/sub_client.c
+1
View File
@@ -217,6 +217,7 @@ void print_usage(void)
printf(" [-d] [-N] [--quiet] [-v]\n");
printf(" [--will-topic [--will-payload payload] [--will-qos qos] [--will-retain]]\n");
#ifdef WITH_TLS
printf(" [--no-tls]\n");
printf(" [{--cafile file | --capath dir} [--cert file] [--key file]\n");
printf(" [--ciphers ciphers] [--insecure]\n");
printf(" [--tls-alpn protocol]\n");
man/mosquitto_pub.1.xml
+27 -6
View File
@@ -57,6 +57,7 @@
<arg><option>--will-qos</option> <replaceable>qos</replaceable></arg>
<arg><option>--will-retain</option></arg>
</arg>
<arg><option>--no-tls</option></arg>
<group>
<arg>
<group choice='req'>
@@ -142,9 +143,12 @@
options will override the same options set in the config
file. The exceptions to this are the message type options, of which
only one can be specified. Note also that currently some options
cannot be negated, e.g. <option>-S</option>. Config file lines that have a
<option>#</option> as the first character are treated as comments
and not processed any further.
cannot be negated, e.g. <option>-S</option>. TLS encryption options
can be negated with the <option>--no-tls</option> option.
</para>
<para>
Config file lines that have a <option>#</option> as the first
character are treated as comments and not processed any further.
</para>
<para>
It is suggested that config files are primarily used for
@@ -399,13 +403,30 @@
being sent than would normally be necessary.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><option>--no-tls</option></term>
<listitem>
<para>
Disable all use of TLS encryption. This is useful if you
specify TLS options in a configuration file but want to
disable those options. It also stops the automatic use
of TLS when connecting to port 8883.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><option>-p</option></term>
<term><option>--port</option></term>
<listitem>
<para>Connect to the port specified. If not given, the
default of 1883 for plain MQTT or 8883 for MQTT over
TLS will be used.</para>
<para>
Connect to the port specified. If not given, the
default of 1883 for plain MQTT or 8883 for MQTT over
TLS will be used.
</para>
<para>
See the <option>--no-tls</option> if you want to use
port 8883 without TLS.
</para>
</listitem>
</varlistentry>
<varlistentry>
man/mosquitto_rr.1.xml
+27 -6
View File
@@ -63,6 +63,7 @@
<arg><option>--will-qos</option> <replaceable>qos</replaceable></arg>
<arg><option>--will-retain</option></arg>
</arg>
<arg><option>--no-tls</option></arg>
<group>
<arg>
<group choice='req'>
@@ -153,9 +154,12 @@
options will override the same options set in the config
file. The exceptions to this are the message type options, of which
only one can be specified. Note also that currently some options
cannot be negated, e.g. <option>-S</option>. Config file lines that have a
<option>#</option> as the first character are treated as comments
and not processed any further.
cannot be negated, e.g. <option>-S</option>. TLS encryption options
can be negated with the <option>--no-tls</option> option.
</para>
<para>
Config file lines that have a <option>#</option> as the first
character are treated as comments and not processed any further.
</para>
<para>
It is suggested that config files are primarily used for
@@ -431,13 +435,30 @@
being sent than would normally be necessary.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><option>--no-tls</option></term>
<listitem>
<para>
Disable all use of TLS encryption. This is useful if you
specify TLS options in a configuration file but want to
disable those options. It also stops the automatic use
of TLS when connecting to port 8883.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><option>-p</option></term>
<term><option>--port</option></term>
<listitem>
<para>Connect to the port specified. If not given, the
default of 1883 for plain MQTT or 8883 for MQTT over
TLS will be used.</para>
<para>
Connect to the port specified. If not given, the
default of 1883 for plain MQTT or 8883 for MQTT over
TLS will be used.
</para>
<para>
See the <option>--no-tls</option> if you want to use
port 8883 without TLS.
</para>
</listitem>
</varlistentry>
<varlistentry>
man/mosquitto_sub.1.xml
+27 -6
View File
@@ -66,6 +66,7 @@
<arg><option>--will-qos</option> <replaceable>qos</replaceable></arg>
<arg><option>--will-retain</option></arg>
</arg>
<arg><option>--no-tls</option></arg>
<group>
<arg>
<group choice='req'>
@@ -154,9 +155,12 @@
options will override the same options set in the config
file. The exceptions to this are the message type options, of which
only one can be specified. Note also that currently some options
cannot be negated, e.g. <option>-S</option>. Config file lines that have a
<option>#</option> as the first character are treated as comments
and not processed any further.
cannot be negated, e.g. <option>-S</option>. TLS encryption options
can be negated with the <option>--no-tls</option> option.
</para>
<para>
Config file lines that have a <option>#</option> as the first
character are treated as comments and not processed any further.
</para>
<para>
It is suggested that config files are primarily used for
@@ -430,13 +434,30 @@
being sent than would normally be necessary.</para>
</listitem>
</varlistentry>
<varlistentry>
<term><option>--no-tls</option></term>
<listitem>
<para>
Disable all use of TLS encryption. This is useful if you
specify TLS options in a configuration file but want to
disable those options. It also stops the automatic use
of TLS when connecting to port 8883.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><option>-p</option></term>
<term><option>--port</option></term>
<listitem>
<para>Connect to the port specified. If not given, the
default of 1883 for plain MQTT or 8883 for MQTT over
TLS will be used.</para>
<para>
Connect to the port specified. If not given, the
default of 1883 for plain MQTT or 8883 for MQTT over
TLS will be used.
</para>
<para>
See the <option>--no-tls</option> if you want to use
port 8883 without TLS.
</para>
</listitem>
</varlistentry>
<varlistentry>