Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit 97a70a1

Browse files
authored
New TLS implementation (mysensors#1520)
* New TLS implementation Implement TLS to mqtt server thanks to WiFiClientSecure class * New TLS implementation Implement TLS to mqtt server thanks to WiFiClientSecure class * New TLS implementation Implement TLS to mqtt server thanks to WiFiClientSecure class * New TLS implementation Implement TLS to mqtt server thanks to WiFiClientSecure class * Update MyConfig.h Typo * Update GatewayESP8266SecureMQTTClient.ino Typo * MyGatewayTransportMQTTClient.cpp updated Move tls settings to bool gatewayTransportInit(void) * MySensors code styling applied by GIT * Try to fix Doxygen warnings * Doxygen warnings fixed hopefuly * MY_GATEWAY_ESP8266_SECURE doc added * MY_GATEWAY_ESP8266_SECURE doc completed * Avoid platform cross compiling * Replaced spaces indent by tabs * Multilines comments to /*
1 parent b49817b commit 97a70a1

File tree

6 files changed

+524
-30
lines changed

6 files changed

+524
-30
lines changed

‎.ci/arduino.groovy‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ def buildMySensorsMicro(config, sketches, String key) {
5151
for (sketch = 0; sketch < sketches.size(); sketch++) {
5252
if (sketches[sketch].path != config.library_root+'examples/GatewayESP8266/GatewayESP8266.ino' &&
5353
sketches[sketch].path != config.library_root+'examples/GatewayESP8266MQTTClient/GatewayESP8266MQTTClient.ino' &&
54+
sketches[sketch].path != config.library_root+'examples/GatewayESP8266SecureMQTTClient/GatewayESP8266SecureMQTTClient.ino' &&
5455
sketches[sketch].path != config.library_root+'examples/GatewayESP8266OTA/GatewayESP8266OTA.ino' &&
5556
sketches[sketch].path != config.library_root+'examples/GatewayGSMMQTTClient/GatewayGSMMQTTClient.ino' &&
5657
sketches[sketch].path != config.library_root+'examples/GatewayESP32/GatewayESP32.ino' &&
@@ -87,6 +88,7 @@ def buildMySensorsGw(config, sketches, String key) {
8788
if (sketches[sketch].path != config.library_root+'examples/BatteryPoweredSensor/BatteryPoweredSensor.ino' &&
8889
sketches[sketch].path != config.library_root+'examples/GatewayESP8266/GatewayESP8266.ino' &&
8990
sketches[sketch].path != config.library_root+'examples/GatewayESP8266MQTTClient/GatewayESP8266MQTTClient.ino' &&
91+
sketches[sketch].path != config.library_root+'examples/GatewayESP8266SecureMQTTClient/GatewayESP8266SecureMQTTClient.ino' &&
9092
sketches[sketch].path != config.library_root+'examples/GatewayESP8266OTA/GatewayESP8266OTA.ino' &&
9193
sketches[sketch].path != config.library_root+'examples/GatewayGSMMQTTClient/GatewayGSMMQTTClient.ino' &&
9294
sketches[sketch].path != config.library_root+'examples/GatewayESP32/GatewayESP32.ino' &&
@@ -123,6 +125,7 @@ def buildArduinoUno(config, sketches, String key) {
123125
for (sketch = 0; sketch < sketches.size(); sketch++) {
124126
if (sketches[sketch].path != config.library_root+'examples/GatewayESP8266/GatewayESP8266.ino' &&
125127
sketches[sketch].path != config.library_root+'examples/GatewayESP8266MQTTClient/GatewayESP8266MQTTClient.ino' &&
128+
sketches[sketch].path != config.library_root+'examples/GatewayESP8266SecureMQTTClient/GatewayESP8266SecureMQTTClient.ino' &&
126129
sketches[sketch].path != config.library_root+'examples/GatewayESP8266OTA/GatewayESP8266OTA.ino' &&
127130
sketches[sketch].path != config.library_root+'examples/GatewayESP32/GatewayESP32.ino' &&
128131
sketches[sketch].path != config.library_root+'examples/GatewayESP32OTA/GatewayESP32OTA.ino' &&
@@ -157,6 +160,7 @@ def buildArduinoMega(config, sketches, String key) {
157160
for (sketch = 0; sketch < sketches.size(); sketch++) {
158161
if (sketches[sketch].path != config.library_root+'examples/GatewayESP8266/GatewayESP8266.ino' &&
159162
sketches[sketch].path != config.library_root+'examples/GatewayESP8266MQTTClient/GatewayESP8266MQTTClient.ino' &&
163+
sketches[sketch].path != config.library_root+'examples/GatewayESP8266SecureMQTTClient/GatewayESP8266SecureMQTTClient.ino' &&
160164
sketches[sketch].path != config.library_root+'examples/GatewayESP8266OTA/GatewayESP8266OTA.ino' &&
161165
sketches[sketch].path != config.library_root+'examples/GatewayESP32/GatewayESP32.ino' &&
162166
sketches[sketch].path != config.library_root+'examples/GatewayESP32OTA/GatewayESP32OTA.ino' &&
@@ -191,6 +195,7 @@ def buildSTM32F1(config, sketches, String key) {
191195
for (sketch = 0; sketch < sketches.size(); sketch++) {
192196
if (sketches[sketch].path != config.library_root+'examples/GatewayESP8266/GatewayESP8266.ino' &&
193197
sketches[sketch].path != config.library_root+'examples/GatewayESP8266MQTTClient/GatewayESP8266MQTTClient.ino' &&
198+
sketches[sketch].path != config.library_root+'examples/GatewayESP8266SecureMQTTClient/GatewayESP8266SecureMQTTClient.ino' &&
194199
sketches[sketch].path != config.library_root+'examples/GatewayESP8266OTA/GatewayESP8266OTA.ino' &&
195200
sketches[sketch].path != config.library_root+'examples/GatewayESP32/GatewayESP32.ino' &&
196201
sketches[sketch].path != config.library_root+'examples/GatewayESP32OTA/GatewayESP32OTA.ino' &&
@@ -280,6 +285,7 @@ def buildESP32(config, sketches, String key) {
280285
sketches[sketch].path != config.library_root+'examples/GatewayGSMMQTTClient/GatewayGSMMQTTClient.ino' &&
281286
sketches[sketch].path != config.library_root+'examples/GatewayESP8266/GatewayESP8266.ino' &&
282287
sketches[sketch].path != config.library_root+'examples/GatewayESP8266MQTTClient/GatewayESP8266MQTTClient.ino' &&
288+
sketches[sketch].path != config.library_root+'examples/GatewayESP8266SecureMQTTClient/GatewayESP8266SecureMQTTClient.ino' &&
283289
sketches[sketch].path != config.library_root+'examples/GatewayESP8266OTA/GatewayESP8266OTA.ino' &&
284290
sketches[sketch].path != config.library_root+'examples/SensebenderGatewaySerial/SensebenderGatewaySerial.ino' &&
285291
sketches[sketch].path != config.library_root+'examples/MotionSensorRS485/MotionSensorRS485.ino' &&
@@ -316,6 +322,7 @@ def buildnRF5(config, sketches, String key) {
316322
sketches[sketch].path != config.library_root+'examples/DustSensorDSM/DustSensorDSM.ino' &&
317323
sketches[sketch].path != config.library_root+'examples/GatewayESP8266/GatewayESP8266.ino' &&
318324
sketches[sketch].path != config.library_root+'examples/GatewayESP8266MQTTClient/GatewayESP8266MQTTClient.ino' &&
325+
sketches[sketch].path != config.library_root+'examples/GatewayESP8266SecureMQTTClient/GatewayESP8266SecureMQTTClient.ino' &&
319326
sketches[sketch].path != config.library_root+'examples/GatewayGSMMQTTClient/GatewayGSMMQTTClient.ino' &&
320327
sketches[sketch].path != config.library_root+'examples/GatewayESP8266OTA/GatewayESP8266OTA.ino' &&
321328
sketches[sketch].path != config.library_root+'examples/GatewayESP32/GatewayESP32.ino' &&
@@ -396,4 +403,4 @@ def buildnRF51822(config, sketches, String key) {
396403
}
397404
}
398405

399-
return this
406+
return this

‎MyConfig.h‎

Lines changed: 66 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1426,6 +1426,8 @@
14261426
* @brief Define this for Ethernet GW based on the ENC28J60 module.
14271427
* @def MY_GATEWAY_ESP8266
14281428
* @brief Define this for Ethernet GW based on the ESP8266.
1429+
* @def MY_GATEWAY_ESP8266_SECURE
1430+
* @brief Define this for Ethernet GW based on the ESP8266 with TLS.
14291431
* @def MY_GATEWAY_ESP32
14301432
* @brief Define this for Ethernet GW based on the ESP32.
14311433
* @def MY_GATEWAY_LINUX
@@ -1441,6 +1443,7 @@
14411443
//#define MY_GATEWAY_W5100
14421444
//#define MY_GATEWAY_ENC28J60
14431445
//#define MY_GATEWAY_ESP8266
1446+
//#define MY_GATEWAY_ESP8266_SECURE
14441447
//#define MY_GATEWAY_ESP32
14451448
//#define MY_GATEWAY_LINUX
14461449
//#define MY_GATEWAY_TINYGSM
@@ -1548,29 +1551,79 @@
15481551
//#define MY_MQTT_SUBSCRIBE_TOPIC_PREFIX "mygateway1-in"
15491552

15501553
/**
1551-
* @def MY_MQTT_CA_CERT
1552-
* @brief Set a specific CA certificate needed to validate MQTT server against. Use the certificate as a trust anchor, accepting remote certificates signed by it.
1554+
* @def MY_MQTT_CA_CERT1
1555+
* @brief Up to three root Certificates Authorities could be defined to validate the mqtt server' certificate. The most secure.
1556+
*
1557+
* This define is mandatory when you need connect MQTT over SSL/TLS. Certificate Authorities.
1558+
* The best method to validate server certificates.
1559+
* Advised to retrieve root Certificate Authorities as they expire less often than server certificates.
1560+
* With let's encrypt you may need up to three Certificate Authorities
15531561
*
1554-
* This define is mandatory when you need connect MQTT over SSL/TLS.
15551562
* Example: @code
15561563
*
1557-
* const char mqtt_ca_cert[] PROGMEM = R"EOF(
1564+
* const char cert_isrgrootx1_Authority[] PROGMEM = R"EOF(
15581565
* ----- BEGIN THE CERTIFICATE -----
15591566
* XXX ... XXX
15601567
* ----- FINISH CERTIFICATE -----
15611568
* )EOF";
15621569
*
1563-
* #define MY_MQTT_CA_CERT mqtt_ca_cert
1570+
* const char cert_isrgrootx2_Authority[] PROGMEM = R"EOF(
1571+
* ----- BEGIN THE CERTIFICATE -----
1572+
* XXX ... XXX
1573+
* ----- FINISH CERTIFICATE -----
1574+
* )EOF";
1575+
*
1576+
* const char cert_letsEncryptR3_Authority[] PROGMEM = R"EOF(
1577+
* ----- BEGIN THE CERTIFICATE -----
1578+
* XXX ... XXX
1579+
* ----- FINISH CERTIFICATE -----
1580+
* )EOF";
1581+
*
1582+
* #define MY_MQTT_CA_CERT1 cert_isrgrootx1_Authority
1583+
* #define MY_MQTT_CA_CERT2 cert_isrgrootx2_Authority
1584+
* #define MY_MQTT_CA_CERT3 cert_letsEncryptR3_Authority
1585+
*
1586+
* @endcode
1587+
*/
1588+
//#define MY_MQTT_CA_CERT1
1589+
1590+
/**
1591+
* @def MY_MQTT_CA_CERT2
1592+
* @brief Up to three root Certificates Authorities could be defined to validate the mqtt serv.
1593+
*/
1594+
//#define MY_MQTT_CA_CERT2
1595+
1596+
/**
1597+
* @def MY_MQTT_CA_CERT3
1598+
* @brief Up to three root Certificates Authorities could be defined to validate the mqtt serv.
1599+
*/
1600+
//#define MY_MQTT_CA_CERT3
1601+
1602+
1603+
/**
1604+
* @def MY_MQTT_FINGERPRINT
1605+
* @brief Server certificate validation with its fingerprint
1606+
*
1607+
* The finger print to validate the mqtt server certificate. This is less secure and less convenient
1608+
* than using certificate authorities.
1609+
* Command (3 lines...) to obtain the certificate finger print:
1610+
* @code
1611+
* $>openssl s_client -connect <hostname>:<host port> < /dev/null 2>/dev/null | \
1612+
* openssl x509 -fingerprint -noout -in /dev/stdin \
1613+
* awk -F= '{print 2ドル}'
1614+
* @endcode
15641615
*
1616+
* Example: @code
1617+
* const char mqtt_fingerprint [] PROGMEM = "CA:CE:2B:MD:D3:32:A3:F1:8C:73:9E:1B:B7:D5:75:4A:10:61:E4:05";
15651618
* @endcode
15661619
*/
1567-
//#define MY_MQTT_CA_CERT
1620+
//#define MY_MQTT_FINGERPRINT
15681621

15691622
/**
15701623
* @def MY_MQTT_CLIENT_CERT
15711624
* @brief Set a client certificate to send to a MQTT server that requests one over TLS connection.
15721625
*
1573-
* This define is mandatory when you need connect MQTT over SSL/TLS.
1626+
* This define is mandatory when you need connect MQTT over SSL/TLS and client certificate is requested.
15741627
* Example: @code
15751628
*
15761629
* const char mqtt_client_cert[] PROGMEM = R"EOF(
@@ -1587,9 +1640,9 @@
15871640

15881641
/**
15891642
* @def MY_MQTT_CLIENT_KEY
1590-
* @brief Set a client private key to send to a MQTT server that requests one over TLS connection.
1643+
* @brief Set the client private key generated with the MY_MQTT_CLIENT_CERT.
15911644
*
1592-
* This define is mandatory when you need connect MQTT over SSL/TLS.
1645+
* This define is mandatory when you need connect MQTT over SSL/TLS and client certificate is requested.
15931646
* Example: @code
15941647
*
15951648
* const char mqtt_client_key[] PROGMEM = R"EOF(
@@ -2373,7 +2426,10 @@
23732426
#define MY_MQTT_CLIENT_ID
23742427
#define MY_MQTT_PUBLISH_TOPIC_PREFIX
23752428
#define MY_MQTT_SUBSCRIBE_TOPIC_PREFIX
2376-
#define MY_MQTT_CA_CERT
2429+
#define MY_MQTT_CA_CERT1
2430+
#define MY_MQTT_CA_CERT2
2431+
#define MY_MQTT_CA_CERT3
2432+
#define MY_MQTT_FINGERPRINT
23772433
#define MY_MQTT_CLIENT_CERT
23782434
#define MY_MQTT_CLIENT_KEY
23792435
#define MY_SIGNAL_REPORT_ENABLED

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /