From 8dbfdc0495b787379b40f7311a75268aaa47ee6b Mon Sep 17 00:00:00 2001 From: "Roger A. Light" Date: Thu, 15 Apr 2021 09:52:34 +0100 Subject: [PATCH] Add `--no-tls` option for all clients. This disables all TLS options for that instance. This is useful for negating TLS options provided in a config file, or to disable the automatic use of TLS when using port 8883. Closes #2180. Thanks to Elliott Balsley. --- ChangeLog.txt | 4 ++ client/client_shared.c | 119 ++++++++++++++++++++++------------------ client/client_shared.h | 5 +- client/pub_client.c | 1 + client/rr_client.c | 1 + client/sub_client.c | 1 + man/mosquitto_pub.1.xml | 33 +++++++++-- man/mosquitto_rr.1.xml | 33 +++++++++-- man/mosquitto_sub.1.xml | 33 +++++++++-- 9 files changed, 157 insertions(+), 73 deletions(-) diff --git a/ChangeLog.txt b/ChangeLog.txt index d71d242e..f9cbc67c 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -29,6 +29,10 @@ Client library: Clients: - Add `-o` option for all clients loading options from a specific file. +- Add `--no-tls` option for all clients which disables all TLS options for + that instance. This is useful for negating TLS options provided in a config + file, or to disable the automatic use of TLS when using port 8883. + Closes #2180. 2.0.9 - 2021-03-xx diff --git a/client/client_shared.c b/client/client_shared.c index 491dd701..84817cdf 100644 --- a/client/client_shared.c +++ b/client/client_shared.c @@ -861,6 +861,8 @@ int client_config_line_proc(struct mosq_config *cfg, int pub_or_sub, int argc, c i++; }else if(!strcmp(argv[i], "--nodelay")){ cfg->tcp_nodelay = true; + }else if(!strcmp(argv[i], "--no-tls")){ + cfg->no_tls = true; }else if(!strcmp(argv[i], "-n") || !strcmp(argv[i], "--null-message")){ if(pub_or_sub == CLIENT_SUB){ goto unknown_option; @@ -1271,9 +1273,71 @@ unknown_option: return 1; } + +#ifdef WITH_TLS +static int client_tls_opts_set(struct mosquitto *mosq, struct mosq_config *cfg) +{ + int rc; + + if(cfg->no_tls){ + return MOSQ_ERR_SUCCESS; + } + + if(cfg->cafile || cfg->capath){ + rc = mosquitto_tls_set(mosq, cfg->cafile, cfg->capath, cfg->certfile, cfg->keyfile, NULL); + if(rc){ + if(rc == MOSQ_ERR_INVAL){ + err_printf(cfg, "Error: Problem setting TLS options: File not found.\n"); + }else{ + err_printf(cfg, "Error: Problem setting TLS options: %s.\n", mosquitto_strerror(rc)); + } + return 1; + } + }else if(cfg->port == 8883){ + mosquitto_int_option(mosq, MOSQ_OPT_TLS_USE_OS_CERTS, 1); + } + if(cfg->tls_use_os_certs){ + mosquitto_int_option(mosq, MOSQ_OPT_TLS_USE_OS_CERTS, 1); + } + + if(cfg->insecure && mosquitto_tls_insecure_set(mosq, true)){ + err_printf(cfg, "Error: Problem setting TLS insecure option.\n"); + return 1; + } + if(cfg->tls_engine && mosquitto_string_option(mosq, MOSQ_OPT_TLS_ENGINE, cfg->tls_engine)){ + err_printf(cfg, "Error: Problem setting TLS engine, is %s a valid engine?\n", cfg->tls_engine); + return 1; + } + if(cfg->keyform && mosquitto_string_option(mosq, MOSQ_OPT_TLS_KEYFORM, cfg->keyform)){ + err_printf(cfg, "Error: Problem setting key form, it must be one of 'pem' or 'engine'.\n"); + return 1; + } + if(cfg->tls_engine_kpass_sha1 && mosquitto_string_option(mosq, MOSQ_OPT_TLS_ENGINE_KPASS_SHA1, cfg->tls_engine_kpass_sha1)){ + err_printf(cfg, "Error: Problem setting TLS engine key pass sha, is it a 40 character hex string?\n"); + return 1; + } + if(cfg->tls_alpn && mosquitto_string_option(mosq, MOSQ_OPT_TLS_ALPN, cfg->tls_alpn)){ + err_printf(cfg, "Error: Problem setting TLS ALPN protocol.\n"); + return 1; + } +# ifdef FINAL_WITH_TLS_PSK + if(cfg->psk && mosquitto_tls_psk_set(mosq, cfg->psk, cfg->psk_identity, NULL)){ + err_printf(cfg, "Error: Problem setting TLS-PSK options.\n"); + return 1; + } +# endif + if((cfg->tls_version || cfg->ciphers) && mosquitto_tls_opts_set(mosq, 1, cfg->tls_version, cfg->ciphers)){ + err_printf(cfg, "Error: Problem setting TLS options, check the options are valid.\n"); + return 1; + } + return MOSQ_ERR_SUCCESS; +} +#endif + + int client_opts_set(struct mosquitto *mosq, struct mosq_config *cfg) { -#if defined(WITH_TLS) || defined(WITH_SOCKS) +#if defined(WITH_SOCKS) int rc; #endif @@ -1295,58 +1359,7 @@ int client_opts_set(struct mosquitto *mosq, struct mosq_config *cfg) return 1; } #ifdef WITH_TLS - if(cfg->cafile || cfg->capath){ - rc = mosquitto_tls_set(mosq, cfg->cafile, cfg->capath, cfg->certfile, cfg->keyfile, NULL); - if(rc){ - if(rc == MOSQ_ERR_INVAL){ - err_printf(cfg, "Error: Problem setting TLS options: File not found.\n"); - }else{ - err_printf(cfg, "Error: Problem setting TLS options: %s.\n", mosquitto_strerror(rc)); - } - mosquitto_lib_cleanup(); - return 1; - } - }else if(cfg->port == 8883){ - mosquitto_int_option(mosq, MOSQ_OPT_TLS_USE_OS_CERTS, 1); - } - if(cfg->tls_use_os_certs){ - mosquitto_int_option(mosq, MOSQ_OPT_TLS_USE_OS_CERTS, 1); - } - - if(cfg->insecure && mosquitto_tls_insecure_set(mosq, true)){ - err_printf(cfg, "Error: Problem setting TLS insecure option.\n"); - mosquitto_lib_cleanup(); - return 1; - } - if(cfg->tls_engine && mosquitto_string_option(mosq, MOSQ_OPT_TLS_ENGINE, cfg->tls_engine)){ - err_printf(cfg, "Error: Problem setting TLS engine, is %s a valid engine?\n", cfg->tls_engine); - mosquitto_lib_cleanup(); - return 1; - } - if(cfg->keyform && mosquitto_string_option(mosq, MOSQ_OPT_TLS_KEYFORM, cfg->keyform)){ - err_printf(cfg, "Error: Problem setting key form, it must be one of 'pem' or 'engine'.\n"); - mosquitto_lib_cleanup(); - return 1; - } - if(cfg->tls_engine_kpass_sha1 && mosquitto_string_option(mosq, MOSQ_OPT_TLS_ENGINE_KPASS_SHA1, cfg->tls_engine_kpass_sha1)){ - err_printf(cfg, "Error: Problem setting TLS engine key pass sha, is it a 40 character hex string?\n"); - mosquitto_lib_cleanup(); - return 1; - } - if(cfg->tls_alpn && mosquitto_string_option(mosq, MOSQ_OPT_TLS_ALPN, cfg->tls_alpn)){ - err_printf(cfg, "Error: Problem setting TLS ALPN protocol.\n"); - mosquitto_lib_cleanup(); - return 1; - } -# ifdef FINAL_WITH_TLS_PSK - if(cfg->psk && mosquitto_tls_psk_set(mosq, cfg->psk, cfg->psk_identity, NULL)){ - err_printf(cfg, "Error: Problem setting TLS-PSK options.\n"); - mosquitto_lib_cleanup(); - return 1; - } -# endif - if((cfg->tls_version || cfg->ciphers) && mosquitto_tls_opts_set(mosq, 1, cfg->tls_version, cfg->ciphers)){ - err_printf(cfg, "Error: Problem setting TLS options, check the options are valid.\n"); + if(client_tls_opts_set(mosq, cfg)){ mosquitto_lib_cleanup(); return 1; } diff --git a/client/client_shared.h b/client/client_shared.h index 9babc4a0..39e090d8 100644 --- a/client/client_shared.h +++ b/client/client_shared.h @@ -123,10 +123,11 @@ struct mosq_config { mosquitto_property *unsubscribe_props; mosquitto_property *disconnect_props; mosquitto_property *will_props; - bool have_topic_alias; /* pub */ char *response_topic; /* rr */ - bool tcp_nodelay; char *options_file; + bool have_topic_alias; /* pub */ + bool tcp_nodelay; + bool no_tls; }; int client_config_load(struct mosq_config *config, int pub_or_sub, int argc, char *argv[]); diff --git a/client/pub_client.c b/client/pub_client.c index a6b1a626..63a9ee55 100644 --- a/client/pub_client.c +++ b/client/pub_client.c @@ -416,6 +416,7 @@ void print_usage(void) printf(" [-u username [-P password]]\n"); printf(" [--will-topic [--will-payload payload] [--will-qos qos] [--will-retain]]\n"); #ifdef WITH_TLS + printf(" [--no-tls]\n"); printf(" [{--cafile file | --capath dir} [--cert file] [--key file]\n"); printf(" [--ciphers ciphers] [--insecure]\n"); printf(" [--tls-alpn protocol]\n"); diff --git a/client/rr_client.c b/client/rr_client.c index 4e8ab49e..a4a52e99 100644 --- a/client/rr_client.c +++ b/client/rr_client.c @@ -211,6 +211,7 @@ void print_usage(void) printf(" [-d] [-N] [--quiet] [-v]\n"); printf(" [--will-topic [--will-payload payload] [--will-qos qos] [--will-retain]]\n"); #ifdef WITH_TLS + printf(" [--no-tls]\n"); printf(" [{--cafile file | --capath dir} [--cert file] [--key file]\n"); printf(" [--ciphers ciphers] [--insecure]\n"); printf(" [--tls-alpn protocol]\n"); diff --git a/client/sub_client.c b/client/sub_client.c index e0ea5274..ef9b1e8c 100644 --- a/client/sub_client.c +++ b/client/sub_client.c @@ -217,6 +217,7 @@ void print_usage(void) printf(" [-d] [-N] [--quiet] [-v]\n"); printf(" [--will-topic [--will-payload payload] [--will-qos qos] [--will-retain]]\n"); #ifdef WITH_TLS + printf(" [--no-tls]\n"); printf(" [{--cafile file | --capath dir} [--cert file] [--key file]\n"); printf(" [--ciphers ciphers] [--insecure]\n"); printf(" [--tls-alpn protocol]\n"); diff --git a/man/mosquitto_pub.1.xml b/man/mosquitto_pub.1.xml index 7c33736f..e5a143db 100644 --- a/man/mosquitto_pub.1.xml +++ b/man/mosquitto_pub.1.xml @@ -57,6 +57,7 @@ qos + @@ -142,9 +143,12 @@ options will override the same options set in the config file. The exceptions to this are the message type options, of which only one can be specified. Note also that currently some options - cannot be negated, e.g. . Config file lines that have a - as the first character are treated as comments - and not processed any further. + cannot be negated, e.g. . TLS encryption options + can be negated with the option. + + + Config file lines that have a as the first + character are treated as comments and not processed any further. It is suggested that config files are primarily used for @@ -399,13 +403,30 @@ being sent than would normally be necessary. + + + + + Disable all use of TLS encryption. This is useful if you + specify TLS options in a configuration file but want to + disable those options. It also stops the automatic use + of TLS when connecting to port 8883. + + + - Connect to the port specified. If not given, the - default of 1883 for plain MQTT or 8883 for MQTT over - TLS will be used. + + Connect to the port specified. If not given, the + default of 1883 for plain MQTT or 8883 for MQTT over + TLS will be used. + + + See the if you want to use + port 8883 without TLS. + diff --git a/man/mosquitto_rr.1.xml b/man/mosquitto_rr.1.xml index 1355f54f..b71bf080 100644 --- a/man/mosquitto_rr.1.xml +++ b/man/mosquitto_rr.1.xml @@ -63,6 +63,7 @@ qos + @@ -153,9 +154,12 @@ options will override the same options set in the config file. The exceptions to this are the message type options, of which only one can be specified. Note also that currently some options - cannot be negated, e.g. . Config file lines that have a - as the first character are treated as comments - and not processed any further. + cannot be negated, e.g. . TLS encryption options + can be negated with the option. + + + Config file lines that have a as the first + character are treated as comments and not processed any further. It is suggested that config files are primarily used for @@ -431,13 +435,30 @@ being sent than would normally be necessary. + + + + + Disable all use of TLS encryption. This is useful if you + specify TLS options in a configuration file but want to + disable those options. It also stops the automatic use + of TLS when connecting to port 8883. + + + - Connect to the port specified. If not given, the - default of 1883 for plain MQTT or 8883 for MQTT over - TLS will be used. + + Connect to the port specified. If not given, the + default of 1883 for plain MQTT or 8883 for MQTT over + TLS will be used. + + + See the if you want to use + port 8883 without TLS. + diff --git a/man/mosquitto_sub.1.xml b/man/mosquitto_sub.1.xml index 982f5628..d9415394 100644 --- a/man/mosquitto_sub.1.xml +++ b/man/mosquitto_sub.1.xml @@ -66,6 +66,7 @@ qos + @@ -154,9 +155,12 @@ options will override the same options set in the config file. The exceptions to this are the message type options, of which only one can be specified. Note also that currently some options - cannot be negated, e.g. . Config file lines that have a - as the first character are treated as comments - and not processed any further. + cannot be negated, e.g. . TLS encryption options + can be negated with the option. + + + Config file lines that have a as the first + character are treated as comments and not processed any further. It is suggested that config files are primarily used for @@ -430,13 +434,30 @@ being sent than would normally be necessary. + + + + + Disable all use of TLS encryption. This is useful if you + specify TLS options in a configuration file but want to + disable those options. It also stops the automatic use + of TLS when connecting to port 8883. + + + - Connect to the port specified. If not given, the - default of 1883 for plain MQTT or 8883 for MQTT over - TLS will be used. + + Connect to the port specified. If not given, the + default of 1883 for plain MQTT or 8883 for MQTT over + TLS will be used. + + + See the if you want to use + port 8883 without TLS. +