Skip to content

Commit 501e01f

Browse files
Tico06tekka007
Tico06
authored and
tekka007
committed
New TLS implementation (mysensors#1520)
* New TLS implementation Implement TLS to mqtt server thanks to WiFiClientSecure class * New TLS implementation Implement TLS to mqtt server thanks to WiFiClientSecure class * New TLS implementation Implement TLS to mqtt server thanks to WiFiClientSecure class * New TLS implementation Implement TLS to mqtt server thanks to WiFiClientSecure class * Update MyConfig.h Typo * Update GatewayESP8266SecureMQTTClient.ino Typo * MyGatewayTransportMQTTClient.cpp updated Move tls settings to bool gatewayTransportInit(void) * MySensors code styling applied by GIT * Try to fix Doxygen warnings * Doxygen warnings fixed hopefuly * MY_GATEWAY_ESP8266_SECURE doc added * MY_GATEWAY_ESP8266_SECURE doc completed * Avoid platform cross compiling * Replaced spaces indent by tabs * Multilines comments to /*
1 parent 41959e8 commit 501e01f

File tree

6 files changed

+524
-30
lines changed

6 files changed

+524
-30
lines changed

‎.ci/arduino.groovy

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ def buildMySensorsMicro(config, sketches, String key) {
5151
for (sketch = 0; sketch < sketches.size(); sketch++) {
5252
if (sketches[sketch].path != config.library_root+'examples/GatewayESP8266/GatewayESP8266.ino' &&
5353
sketches[sketch].path != config.library_root+'examples/GatewayESP8266MQTTClient/GatewayESP8266MQTTClient.ino' &&
54+
sketches[sketch].path != config.library_root+'examples/GatewayESP8266SecureMQTTClient/GatewayESP8266SecureMQTTClient.ino' &&
5455
sketches[sketch].path != config.library_root+'examples/GatewayESP8266OTA/GatewayESP8266OTA.ino' &&
5556
sketches[sketch].path != config.library_root+'examples/GatewayGSMMQTTClient/GatewayGSMMQTTClient.ino' &&
5657
sketches[sketch].path != config.library_root+'examples/GatewayESP32/GatewayESP32.ino' &&
@@ -87,6 +88,7 @@ def buildMySensorsGw(config, sketches, String key) {
8788
if (sketches[sketch].path != config.library_root+'examples/BatteryPoweredSensor/BatteryPoweredSensor.ino' &&
8889
sketches[sketch].path != config.library_root+'examples/GatewayESP8266/GatewayESP8266.ino' &&
8990
sketches[sketch].path != config.library_root+'examples/GatewayESP8266MQTTClient/GatewayESP8266MQTTClient.ino' &&
91+
sketches[sketch].path != config.library_root+'examples/GatewayESP8266SecureMQTTClient/GatewayESP8266SecureMQTTClient.ino' &&
9092
sketches[sketch].path != config.library_root+'examples/GatewayESP8266OTA/GatewayESP8266OTA.ino' &&
9193
sketches[sketch].path != config.library_root+'examples/GatewayGSMMQTTClient/GatewayGSMMQTTClient.ino' &&
9294
sketches[sketch].path != config.library_root+'examples/GatewayESP32/GatewayESP32.ino' &&
@@ -123,6 +125,7 @@ def buildArduinoUno(config, sketches, String key) {
123125
for (sketch = 0; sketch < sketches.size(); sketch++) {
124126
if (sketches[sketch].path != config.library_root+'examples/GatewayESP8266/GatewayESP8266.ino' &&
125127
sketches[sketch].path != config.library_root+'examples/GatewayESP8266MQTTClient/GatewayESP8266MQTTClient.ino' &&
128+
sketches[sketch].path != config.library_root+'examples/GatewayESP8266SecureMQTTClient/GatewayESP8266SecureMQTTClient.ino' &&
126129
sketches[sketch].path != config.library_root+'examples/GatewayESP8266OTA/GatewayESP8266OTA.ino' &&
127130
sketches[sketch].path != config.library_root+'examples/GatewayESP32/GatewayESP32.ino' &&
128131
sketches[sketch].path != config.library_root+'examples/GatewayESP32OTA/GatewayESP32OTA.ino' &&
@@ -157,6 +160,7 @@ def buildArduinoMega(config, sketches, String key) {
157160
for (sketch = 0; sketch < sketches.size(); sketch++) {
158161
if (sketches[sketch].path != config.library_root+'examples/GatewayESP8266/GatewayESP8266.ino' &&
159162
sketches[sketch].path != config.library_root+'examples/GatewayESP8266MQTTClient/GatewayESP8266MQTTClient.ino' &&
163+
sketches[sketch].path != config.library_root+'examples/GatewayESP8266SecureMQTTClient/GatewayESP8266SecureMQTTClient.ino' &&
160164
sketches[sketch].path != config.library_root+'examples/GatewayESP8266OTA/GatewayESP8266OTA.ino' &&
161165
sketches[sketch].path != config.library_root+'examples/GatewayESP32/GatewayESP32.ino' &&
162166
sketches[sketch].path != config.library_root+'examples/GatewayESP32OTA/GatewayESP32OTA.ino' &&
@@ -191,6 +195,7 @@ def buildSTM32F1(config, sketches, String key) {
191195
for (sketch = 0; sketch < sketches.size(); sketch++) {
192196
if (sketches[sketch].path != config.library_root+'examples/GatewayESP8266/GatewayESP8266.ino' &&
193197
sketches[sketch].path != config.library_root+'examples/GatewayESP8266MQTTClient/GatewayESP8266MQTTClient.ino' &&
198+
sketches[sketch].path != config.library_root+'examples/GatewayESP8266SecureMQTTClient/GatewayESP8266SecureMQTTClient.ino' &&
194199
sketches[sketch].path != config.library_root+'examples/GatewayESP8266OTA/GatewayESP8266OTA.ino' &&
195200
sketches[sketch].path != config.library_root+'examples/GatewayESP32/GatewayESP32.ino' &&
196201
sketches[sketch].path != config.library_root+'examples/GatewayESP32OTA/GatewayESP32OTA.ino' &&
@@ -280,6 +285,7 @@ def buildESP32(config, sketches, String key) {
280285
sketches[sketch].path != config.library_root+'examples/GatewayGSMMQTTClient/GatewayGSMMQTTClient.ino' &&
281286
sketches[sketch].path != config.library_root+'examples/GatewayESP8266/GatewayESP8266.ino' &&
282287
sketches[sketch].path != config.library_root+'examples/GatewayESP8266MQTTClient/GatewayESP8266MQTTClient.ino' &&
288+
sketches[sketch].path != config.library_root+'examples/GatewayESP8266SecureMQTTClient/GatewayESP8266SecureMQTTClient.ino' &&
283289
sketches[sketch].path != config.library_root+'examples/GatewayESP8266OTA/GatewayESP8266OTA.ino' &&
284290
sketches[sketch].path != config.library_root+'examples/SensebenderGatewaySerial/SensebenderGatewaySerial.ino' &&
285291
sketches[sketch].path != config.library_root+'examples/MotionSensorRS485/MotionSensorRS485.ino' &&
@@ -316,6 +322,7 @@ def buildnRF5(config, sketches, String key) {
316322
sketches[sketch].path != config.library_root+'examples/DustSensorDSM/DustSensorDSM.ino' &&
317323
sketches[sketch].path != config.library_root+'examples/GatewayESP8266/GatewayESP8266.ino' &&
318324
sketches[sketch].path != config.library_root+'examples/GatewayESP8266MQTTClient/GatewayESP8266MQTTClient.ino' &&
325+
sketches[sketch].path != config.library_root+'examples/GatewayESP8266SecureMQTTClient/GatewayESP8266SecureMQTTClient.ino' &&
319326
sketches[sketch].path != config.library_root+'examples/GatewayGSMMQTTClient/GatewayGSMMQTTClient.ino' &&
320327
sketches[sketch].path != config.library_root+'examples/GatewayESP8266OTA/GatewayESP8266OTA.ino' &&
321328
sketches[sketch].path != config.library_root+'examples/GatewayESP32/GatewayESP32.ino' &&
@@ -396,4 +403,4 @@ def buildnRF51822(config, sketches, String key) {
396403
}
397404
}
398405

399-
return this
406+
return this

‎MyConfig.h

Lines changed: 66 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1442,6 +1442,8 @@
14421442
* @brief Define this for Ethernet GW based on the ENC28J60 module.
14431443
* @def MY_GATEWAY_ESP8266
14441444
* @brief Define this for Ethernet GW based on the ESP8266.
1445+
* @def MY_GATEWAY_ESP8266_SECURE
1446+
* @brief Define this for Ethernet GW based on the ESP8266 with TLS.
14451447
* @def MY_GATEWAY_ESP32
14461448
* @brief Define this for Ethernet GW based on the ESP32.
14471449
* @def MY_GATEWAY_LINUX
@@ -1457,6 +1459,7 @@
14571459
//#define MY_GATEWAY_W5100
14581460
//#define MY_GATEWAY_ENC28J60
14591461
//#define MY_GATEWAY_ESP8266
1462+
//#define MY_GATEWAY_ESP8266_SECURE
14601463
//#define MY_GATEWAY_ESP32
14611464
//#define MY_GATEWAY_LINUX
14621465
//#define MY_GATEWAY_TINYGSM
@@ -1564,29 +1567,79 @@
15641567
//#define MY_MQTT_SUBSCRIBE_TOPIC_PREFIX "mygateway1-in"
15651568

15661569
/**
1567-
* @def MY_MQTT_CA_CERT
1568-
* @brief Set a specific CA certificate needed to validate MQTT server against. Use the certificate as a trust anchor, accepting remote certificates signed by it.
1570+
* @def MY_MQTT_CA_CERT1
1571+
* @brief Up to three root Certificates Authorities could be defined to validate the mqtt server' certificate. The most secure.
1572+
*
1573+
* This define is mandatory when you need connect MQTT over SSL/TLS. Certificate Authorities.
1574+
* The best method to validate server certificates.
1575+
* Advised to retrieve root Certificate Authorities as they expire less often than server certificates.
1576+
* With let's encrypt you may need up to three Certificate Authorities
15691577
*
1570-
* This define is mandatory when you need connect MQTT over SSL/TLS.
15711578
* Example: @code
15721579
*
1573-
* const char mqtt_ca_cert[] PROGMEM = R"EOF(
1580+
* const char cert_isrgrootx1_Authority[] PROGMEM = R"EOF(
15741581
* ----- BEGIN THE CERTIFICATE -----
15751582
* XXX ... XXX
15761583
* ----- FINISH CERTIFICATE -----
15771584
* )EOF";
15781585
*
1579-
* #define MY_MQTT_CA_CERT mqtt_ca_cert
1586+
* const char cert_isrgrootx2_Authority[] PROGMEM = R"EOF(
1587+
* ----- BEGIN THE CERTIFICATE -----
1588+
* XXX ... XXX
1589+
* ----- FINISH CERTIFICATE -----
1590+
* )EOF";
1591+
*
1592+
* const char cert_letsEncryptR3_Authority[] PROGMEM = R"EOF(
1593+
* ----- BEGIN THE CERTIFICATE -----
1594+
* XXX ... XXX
1595+
* ----- FINISH CERTIFICATE -----
1596+
* )EOF";
1597+
*
1598+
* #define MY_MQTT_CA_CERT1 cert_isrgrootx1_Authority
1599+
* #define MY_MQTT_CA_CERT2 cert_isrgrootx2_Authority
1600+
* #define MY_MQTT_CA_CERT3 cert_letsEncryptR3_Authority
1601+
*
1602+
* @endcode
1603+
*/
1604+
//#define MY_MQTT_CA_CERT1
1605+
1606+
/**
1607+
* @def MY_MQTT_CA_CERT2
1608+
* @brief Up to three root Certificates Authorities could be defined to validate the mqtt serv.
1609+
*/
1610+
//#define MY_MQTT_CA_CERT2
1611+
1612+
/**
1613+
* @def MY_MQTT_CA_CERT3
1614+
* @brief Up to three root Certificates Authorities could be defined to validate the mqtt serv.
1615+
*/
1616+
//#define MY_MQTT_CA_CERT3
1617+
1618+
1619+
/**
1620+
* @def MY_MQTT_FINGERPRINT
1621+
* @brief Server certificate validation with its fingerprint
1622+
*
1623+
* The finger print to validate the mqtt server certificate. This is less secure and less convenient
1624+
* than using certificate authorities.
1625+
* Command (3 lines...) to obtain the certificate finger print:
1626+
* @code
1627+
* $>openssl s_client -connect <hostname>:<host port> < /dev/null 2>/dev/null | \
1628+
* openssl x509 -fingerprint -noout -in /dev/stdin \
1629+
* awk -F= '{print $2}'
1630+
* @endcode
15801631
*
1632+
* Example: @code
1633+
* const char mqtt_fingerprint [] PROGMEM = "CA:CE:2B:MD:D3:32:A3:F1:8C:73:9E:1B:B7:D5:75:4A:10:61:E4:05";
15811634
* @endcode
15821635
*/
1583-
//#define MY_MQTT_CA_CERT
1636+
//#define MY_MQTT_FINGERPRINT
15841637

15851638
/**
15861639
* @def MY_MQTT_CLIENT_CERT
15871640
* @brief Set a client certificate to send to a MQTT server that requests one over TLS connection.
15881641
*
1589-
* This define is mandatory when you need connect MQTT over SSL/TLS.
1642+
* This define is mandatory when you need connect MQTT over SSL/TLS and client certificate is requested.
15901643
* Example: @code
15911644
*
15921645
* const char mqtt_client_cert[] PROGMEM = R"EOF(
@@ -1603,9 +1656,9 @@
16031656

16041657
/**
16051658
* @def MY_MQTT_CLIENT_KEY
1606-
* @brief Set a client private key to send to a MQTT server that requests one over TLS connection.
1659+
* @brief Set the client private key generated with the MY_MQTT_CLIENT_CERT.
16071660
*
1608-
* This define is mandatory when you need connect MQTT over SSL/TLS.
1661+
* This define is mandatory when you need connect MQTT over SSL/TLS and client certificate is requested.
16091662
* Example: @code
16101663
*
16111664
* const char mqtt_client_key[] PROGMEM = R"EOF(
@@ -2391,7 +2444,10 @@
23912444
#define MY_MQTT_CLIENT_ID
23922445
#define MY_MQTT_PUBLISH_TOPIC_PREFIX
23932446
#define MY_MQTT_SUBSCRIBE_TOPIC_PREFIX
2394-
#define MY_MQTT_CA_CERT
2447+
#define MY_MQTT_CA_CERT1
2448+
#define MY_MQTT_CA_CERT2
2449+
#define MY_MQTT_CA_CERT3
2450+
#define MY_MQTT_FINGERPRINT
23952451
#define MY_MQTT_CLIENT_CERT
23962452
#define MY_MQTT_CLIENT_KEY
23972453
#define MY_SIGNAL_REPORT_ENABLED

0 commit comments

Comments
 (0)