GithubStar/neuron
1
0
Fork 0
mirror of https://github.com/emqx/neuron.git synced 2026-10-18 13:41:22 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(mqtt): require CA for TLS and verify broker certificates

Browse Source
This commit is contained in:
hxy7yx
2026-06-22 02:33:28 -07:00
parent a1e4d2c89b
commit d6aefea13a
8 changed files with 37 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plugins/monitor/monitor.json
+1 -1
View File
@@ -111,7 +111,7 @@
"name_zh": "CA 证书",
"description": "CA certificate which signs the server certificate",
"description_zh": "签发服务器证书的 CA 证书",
"attribute": "optional",
"attribute": "required",
"type": "file",
"condition": {
"field": "ssl",
plugins/monitor/monitor_config.c
+4 -4
View File
@@ -84,11 +84,11 @@ static inline int parse_ssl_params(neu_plugin_t *plugin, const char *setting,
return 0;
}
// ca, optional
// ca, required when ssl enabled
ret = neu_parse_param(setting, NULL, 1, ca);
if (0 != ret) {
plog_notice(plugin, "setting no ca");
return 0;
plog_error(plugin, "setting no ca, required when ssl enabled");
return -1;
}
if (0 != decode_b64_param(plugin, ca)) {
@@ -106,7 +106,7 @@ static inline int parse_ssl_params(neu_plugin_t *plugin, const char *setting,
return -1;
}
// key, required if cert enable
// key, required if cert is set
ret = parse_b64_param(plugin, setting, key);
if (0 != ret) {
return -1;
plugins/mqtt/aws-iot.json
+1 -1
View File
@@ -206,7 +206,7 @@
"name_zh": "根 CA 证书",
"description": "AWS IoT data endpoint root CA certificate",
"description_zh": "AWS IoT 设备数据终端节点根 CA 证书",
"attribute": "optional",
"attribute": "required",
"type": "file",
"condition": {
"field": "ssl",
plugins/mqtt/azure-iot.json
-4
View File
@@ -106,10 +106,6 @@
"description_zh": "签发服务器证书的 CA 证书",
"attribute": "required",
"type": "file",
"condition": {
"field": "auth",
"value": 1
},
"valid": {
"length": 81960
}
plugins/mqtt/azure_iot_plugin.c
+13 -15
View File
@@ -29,22 +29,10 @@
#define AUTH_CERT 1
static int parse_ssl_params(neu_plugin_t *plugin, const char *setting,
neu_json_elem_t *ca, neu_json_elem_t *cert,
neu_json_elem_t *key)
neu_json_elem_t *cert, neu_json_elem_t *key)
{
// ca, required
int ret = neu_parse_param(setting, NULL, 1, ca);
if (0 != ret) {
plog_notice(plugin, "setting no ca");
return -1;
}
if (0 != decode_b64_param(plugin, ca)) {
return -1;
}
// cert, required
ret = neu_parse_param(setting, NULL, 1, cert);
int ret = neu_parse_param(setting, NULL, 1, cert);
if (0 != ret) {
plog_notice(plugin, "setting no cert");
return -1;
@@ -137,8 +125,18 @@ static int azure_parse_config(neu_plugin_t *plugin, const char *setting,
password.v.val_str = strdup("");
}
// ca, required for TLS (SSL is always enabled)
ret = neu_parse_param(setting, NULL, 1, &ca);
if (0 != ret) {
plog_error(plugin, "setting no ca");
goto error;
}
if (0 != decode_b64_param(plugin, &ca)) {
goto error;
}
if (AUTH_CERT == auth.v.val_int) {
ret = parse_ssl_params(plugin, setting, &ca, &cert, &key);
ret = parse_ssl_params(plugin, setting, &cert, &key);
if (0 != ret) {
plog_error(plugin, "setting certificates fail");
goto error;
plugins/mqtt/mqtt.json
+1 -1
View File
@@ -306,7 +306,7 @@
"name_zh": "CA 证书",
"description": "CA certificate which signs the server certificate",
"description_zh": "签发服务器证书的 CA 证书",
"attribute": "optional",
"attribute": "required",
"type": "file",
"condition": {
"field": "ssl",
plugins/mqtt/mqtt_config.c
+4 -4
View File
@@ -81,11 +81,11 @@ static int parse_ssl_params(neu_plugin_t *plugin, const char *setting,
return 0;
}
// ca, optional
// ca, required when ssl enabled
ret = neu_parse_param(setting, NULL, 1, ca);
if (0 != ret) {
plog_notice(plugin, "setting no ca");
return 0;
plog_error(plugin, "setting no ca, required when ssl enabled");
return -1;
}
if (0 != decode_b64_param(plugin, ca)) {
@@ -103,7 +103,7 @@ static int parse_ssl_params(neu_plugin_t *plugin, const char *setting,
return -1;
}
// key, required if cert enable
// key, required if cert is set
ret = parse_b64_param(plugin, setting, key);
if (0 != ret) {
return -1;
src/connection/mqtt_client.c
+13 -14
View File
@@ -1258,20 +1258,19 @@ int neu_mqtt_client_set_tls(neu_mqtt_client_t *client, bool enabled,
goto end;
}
if (ca && (rv = nng_tls_config_ca_chain(cfg, ca, NULL)) != 0) {
if (NULL == ca || '\0' == ca[0]) {
log(error, "tls enabled but no ca");
rv = -1;
goto end;
}
if ((rv = nng_tls_config_ca_chain(cfg, ca, NULL)) != 0) {
log(error, "nng_tls_config_ca_chain fail: %s", nng_strerror(rv));
rv = -1;
goto end;
}
if (cert != NULL && key != NULL) {
if ((rv = nng_tls_config_auth_mode(cfg, NNG_TLS_AUTH_MODE_REQUIRED)) !=
0) {
log(error, "nng_tls_config_auth_mode fail: %s", nng_strerror(rv));
rv = -1;
goto end;
}
if (keypass) {
pass[0] = write_string_to_random_file(((char **) keypass)[0]);
pass[1] = write_string_to_random_file(((char **) keypass)[1]);
@@ -1283,12 +1282,12 @@ int neu_mqtt_client_set_tls(neu_mqtt_client_t *client, bool enabled,
rv = -1;
goto end;
}
} else {
if ((rv = nng_tls_config_auth_mode(cfg, NNG_TLS_AUTH_MODE_NONE)) != 0) {
log(error, "nng_tls_config_auth_mode fail: %s", nng_strerror(rv));
rv = -1;
goto end;
}
}
if ((rv = nng_tls_config_auth_mode(cfg, NNG_TLS_AUTH_MODE_REQUIRED)) != 0) {
log(error, "nng_tls_config_auth_mode fail: %s", nng_strerror(rv));
rv = -1;
goto end;
}
end: