buglwIP - A Lightweight TCP/IP stack - Bugs: bug #54601, altcp_tls_create_config_client...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #54601: altcp_tls_create_config_client does not support sending of device certificate and private key

Submitter:  Richmond Umagat <richmond_umagat>
Submitted:  Fri 31 Aug 2018 03:01:04 AM UTC
   
 
Category:  TCP Severity:  3 - Normal
Item Group:  Feature Request Status:  Fixed
Privacy:  Public Assigned to:  goldsimon
Open/Closed:  Closed Planned Release:  None
lwIP version:  git head

Fri 07 Sep 2018 07:00:15 PM UTC, comment #3: 

Fixed, though slightly different. Thanks for the fix.

Simon Goldschmidt <goldsimon>
Group administrator
Mon 03 Sep 2018 10:16:18 AM UTC, comment #2: 

Attached are the updated modifications to address your comments.

- A new function called altcp_tls_create_config_client_2wayauth() is introduced to support two-way authentication (server can authenticate client using the client certificate and private key; client can authenticate server using the ca/server certificate)
- 'ca' member in altcp_tls_config structure is necessary. Like 'cert' and 'pkey' members, the memory must persist until connection is freed in altcp_tls_free_config().

The modifications have been tested working with Amazon AWS IoT cloud.

(file #44924, file #44925)

Richmond Umagat <richmond_umagat>
Fri 31 Aug 2018 08:01:23 PM UTC, comment #1: 

OK, so now at least we know it fails because you need a client certificate for your mqtt server.

Some comments before pushing this:
- please provide a new function (e.g. altcp_tls_create_config_client_privkey or something like that) to differ between client authentication connections and "standard" https connections
- remove those FT32_PORT ifdefs
- why do you need the 'ca' member in struct altcp_tls_config? I fail to find it in the manual diff...

Anyway, 2.1.0 is about to be released really soon, so if you want this to go in, you should be fast ;-)

Simon Goldschmidt <goldsimon>
Group administrator
Fri 31 Aug 2018 03:01:04 AM UTC, original submission:  

Secure MQTT brokers such as AWS IoT cloud requires MQTT clients to send device certificate and private key, in addition to the CA certificate (which is optional).

But the current implementation of altcp_tls_create_config_client() only allows user to include CA certificate. As such, it is impossible to connect to AWS cloud with such limitation.

To fix this issue, the following function has been modified:
OLD:
struct altcp_tls_config *altcp_tls_create_config_client(const u8_t *cert, size_t cert_len);
NEW:
altcp_tls_create_config_client(const u8_t *ca, size_t ca_len, const u8_t *cert, size_t cert_len, const u8_t *pkey, size_t pkey_len)

I have attached my proposed modifications in altcp_tls_mbedtls.c and altcp_tls.h. This has been tested to work with MQTT protocol to connect to AWS IoT cloud and AWS Greengrass.

Richmond Umagat <richmond_umagat>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #44924:  altcp_tls_mbedtls.c added by richmond_umagat (36KiB - text/plain - Proposed changes (updated as suggested))
file #44925:  altcp_tls.h added by richmond_umagat (4KiB - text/plain - Proposed changes (updated as suggested))
file #44901:  altcp_tls.h added by richmond_umagat (4KiB - text/plain - Proposed changes)
file #44902:  altcp_tls_mbedtls.c added by richmond_umagat (37KiB - text/plain - Proposed changes)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by goldsimon (Posted a comment)
  • -email is unavailable- added by richmond_umagat (Submitted the item)
  • -email is unavailable- added by richmond_umagat (Submit LWIP ALTCP_TLS feature request with proposed solution)
  • -email is unavailable- added by richmond_umagat (Submit LWIP ALTCP_TLS feature request with proposed solution)
  • -email is unavailable- added by richmond_umagat (Submit LWIP ALTCP_TLS feature request with proposed solution)
  • -email is unavailable- added by richmond_umagat (Submit LWIP ALTCP_TLS feature request with proposed solution)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 11 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-09-07 goldsimon StatusNone Fixed
        Assigned toNone goldsimon
        Open/ClosedOpen Closed
    2018-09-03 richmond_umagat Attached File- Added altcp_tls_mbedtls.c, #44924
        Attached File- Added altcp_tls.h, #44925
    2018-08-31 richmond_umagat Attached File- Added altcp_tls.h, #44901
        Attached File- Added altcp_tls_mbedtls.c, #44902
        Carbon-Copy- Added -email is unavailable-
        Carbon-Copy- Added -email is unavailable-
        Carbon-Copy- Added -email is unavailable-
        Carbon-Copy- Added -email is unavailable-

    Back to the top

    Powered by Savane 3.13-3230.
    Corresponding source code