SSL / TLS Implementation

[TechAspirant]

Is there any update on SSL / TLS implementation ?

[codepr]

I work on this project on and off, mainly during spare time, it should be easy enough of an addition, that's why I prioritized more inner-logic features, anyway PRs are welcome.

[nsf747]

Can you give some idea on how to add the ssl/tls functionality ??

[codepr]

I suppose the easiest way is to incrementally add it by using openssl/ssl.h library:

• add entries for certs on configuration, possibly specifying path on the config file as well
• write two read/write functions which uses a SSL structure and SSL_write/SSL_read
• on the server-side, after checking if the conf requires an encrypted communication, setup SSL context, load certificates and use ssl read/write functions
  Something similar to what I did on https://github.com/codepr/vessel/blob/master/src/networking.c, a PoC repository that I created some time ago.

[TechAspirant]

• add entries for certs on configuration, possibly specifying path on the config file as well
  -> for this I have added two entries in config file
  Check whether connection is over SSL - [If Yes then Set 1; If No then Set 0]
  SSL 0
  Certificate File Path
  filepath /home/user/Desktop/rootCA.crt

  added entries in struct config {} to read this two enteries from config files

• write two read/write functions which uses a SSL structure and SSL_write/SSL_read
  -> Added ssl_send,ssl_recv,load_certificates,create_ssl_context,openssl_cleanup,openssl_init in my network.c file

• on the server-side, after checking if the conf requires an encrypted communication, setup SSL context, load certificates and use ssl read/write functions
  -> for this do I have to add in accept_loop function of server.c
  can you show where to add above functions

[codepr]

You can see a rough work I started on ab112b7. Just some simple changes on reception parts on the server module, and accept of course.

• Check for encryption required
• Accept using SSL_new on the connecting client if encryption ON
• Use ssl_recv/ssl_send if encryption ON

[TechAspirant]

I have create certificates for my broker using openssl command like below
req -newkey rsa:2048 -nodes -keyout key.pem -x509 -days 365 -out certificate.pem

and Mentioned Below line in conf file
certfile /home/parth/Desktop/certificate.pem
keyfile /home/parth/Desktop/key.pem

but while connecting from MQTT Client its showing Droping client at server side. Not able to connect.

[TechAspirant]

I am getting connected message for my client Id but Client shows continuously connection error
1575029534 i New client connected as 814e1a4f-4885-42bb-a4bb-181890d1267d1575030492087 (c0, k10)
1575029534 # Sending CONNACK to 814e1a4f-4885-42bb-a4bb-181890d1267d1575030492087 (0, 0)

SSL_get_error(client->ssl,r) returns Error 2 Which I think it means error with certificates

[nsf747]

but while connecting from MQTT Client its showing Droping client at server side. Not able to connect.

Im facing the same issue. Were you able to resolve it ?

[IoTiA]

I start the server by making ssl=true and port=8883 it gives the error as follow...
1995538976:error:02001002:system library:fopen:No such file or directory:../crypto/bio/bss_file.c:288:fopen('','r')
1995538976:error:20074002:BIO routines:file_ctrl:system lib:../crypto/bio/bss_file.c:290:
1995538976:error:140AD002:SSL routines:SSL_CTX_use_certificate_file:system lib:../ssl/ssl_rsa.c:390:

[TechAspirant]

I start the server by making ssl=true and port=8883 it gives the error as follow...
1995538976:error:02001002:system library:fopen:No such file or directory:../crypto/bio/bss_file.c:288:fopen('','r')
1995538976:error:20074002:BIO routines:file_ctrl:system lib:../crypto/bio/bss_file.c:290:
1995538976:error:140AD002:SSL routines:SSL_CTX_use_certificate_file:system lib:../ssl/ssl_rsa.c:390:

For this you have to add two entries in .conf file as below
certfile ~/pathofcertificate/certificate.pem
keyfile ~/pathofcertificatekey/key.pem

[TechAspirant]

but while connecting from MQTT Client its showing Droping client at server side. Not able to connect.

Im facing the same issue. Were you able to resolve it ?

I am trying but no success; if you resolved then do let me know your solution

[IoTiA]

For this you have to add two entries in .conf file as below
certfile ~/pathofcertificate/certificate.pem
keyfile ~/pathofcertificatekey/key.pem

i add the certs in config file still i am getting same error. such as..
1995727392:error:02001002:system library:fopen:No such file or directory:../crypto/bio/bss_file.c:288:fopen('~/home/pi/certificate.pem','r')
1995727392:error:20074002:BIO routines:file_ctrl:system lib:../crypto/bio/bss_file.c:290:
1995727392:error:140AD002:SSL routines:SSL_CTX_use_certificate_file:system lib:../ssl/ssl_rsa.c:390:

[TechAspirant]

certificate.pem

Is certificate.pem file present at location /home/pi ?
Change from ~/home/pi/certificate.pem to /home/pi/certificate.pem

[IoTiA]

Now getting this permission error as follow..
1995821600:error:0200100D:system library:fopen:Permission denied:../crypto/bio/bss_file.c:288:fopen('/home/pi/key.pem','r')
1995821600:error:20074002:BIO routines:file_ctrl:system lib:../crypto/bio/bss_file.c:290:
1995821600:error:140B0002:SSL routines:SSL_CTX_use_PrivateKey_file:system lib:../ssl/ssl_rsa.c:540: