chriz/OpenMQTT-Gateway
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity

added support for secure TLS connections (#699)

Browse Source 
* added support for secure TLS connections
on ESP32 and ESP8266 close #101

* added TLS test builds

* added documentation for TLS
fixed some some issues in the documentation

* added documentation for error code=54
This commit is contained in:
Leon Kiefer authored and GitHub committed 2020-08-02 11:29:28 -05:00
1 parent 60d173ff51
commit b5527d2e7b
14 files changed
+180 -40
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

main/User_config.h
+37 -4
View File
@@ -56,7 +56,7 @@
#define Base_Topic "home/"
/*-------------DEFINE YOUR NETWORK PARAMETERS BELOW----------------*/
/*-------------DEFINE YOUR NETWORK PARAMETERS BELOW----------------*/
//#define NetworkAdvancedSetup true //uncomment if you want to set advanced network parameters for arduino boards, not uncommented you can set the IP and mac only
#ifdef NetworkAdvancedSetup // for arduino boards advanced config
@@ -69,7 +69,7 @@ const byte subnet[] = {255, 255, 255, 0};
#endif
#if defined(ESP8266) || defined(ESP32) // for nodemcu, weemos and esp8266
//#define ESPWifiManualSetup true //uncomment you don't want to use wifimanager for your credential settings on ESP
//# define ESPWifiManualSetup true //uncomment you don't want to use wifimanager for your credential settings on ESP
#else // for arduino boards
const byte ip[] = {192, 168, 1, 99};
const byte mac[] = {0xDE, 0xED, 0xBA, 0xFE, 0x54, 0x95}; //W5100 ethernet shield mac adress
@@ -100,7 +100,7 @@ const byte mac[] = {0xDE, 0xED, 0xBA, 0xFE, 0x54, 0x95}; //W5100 ethernet shield
/*-------------DEFINE YOUR MQTT PARAMETERS BELOW----------------*/
//MQTT Parameters definition
#if defined(ESP8266) || defined(ESP32) || defined(__AVR_ATmega2560__) || defined(__AVR_ATmega1280__)
# define parameters_size 20
# define parameters_size 30
# define mqtt_topic_max_size 100
# define mqtt_max_packet_size 1024
#else
@@ -109,6 +109,16 @@ const byte mac[] = {0xDE, 0xED, 0xBA, 0xFE, 0x54, 0x95}; //W5100 ethernet shield
# define mqtt_max_packet_size 128
#endif
// activate the use of TLS for secure connection to the MQTT broker
// MQTT_SERVER must be set to the Common Name (CN) of the broker's certificate
//#define SECURE_CONNECTION
#ifdef SECURE_CONNECTION
# define MQTT_DEFAULT_PORT "8883"
#else
# define MQTT_DEFAULT_PORT "1883"
#endif
#ifndef MQTT_USER
# define MQTT_USER "your_username"
#endif
@@ -119,7 +129,30 @@ const byte mac[] = {0xDE, 0xED, 0xBA, 0xFE, 0x54, 0x95}; //W5100 ethernet shield
# define MQTT_SERVER "192.168.1.17"
#endif
#ifndef MQTT_PORT
# define MQTT_PORT "1883"
# define MQTT_PORT MQTT_DEFAULT_PORT
#endif
#ifdef SECURE_CONNECTION
# if defined(ESP8266) || defined(ESP32)
# if defined(ESP32)
# define CERT_ATTRIBUTE
# elif defined(ESP8266)
# define CERT_ATTRIBUTE PROGMEM
# endif
// The root ca certificate used for validating the MQTT broker
// The certificate must be in PEM ascii format
const char* certificate CERT_ATTRIBUTE = R"EOF("
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
")EOF";
// specify a NTP server here or else the NTP server from DHCP is used
//# define NTP_SERVER "pool.ntp.org"
# else
# error "only ESP8266 and ESP32 support SECURE_CONNECTION with TLS"
# endif
#endif
#if defined(ESP8266) || defined(ESP32)
main/main.ino
+37 -7
View File
@@ -147,12 +147,16 @@ int failure_number_mqtt = 0; // number of failure connecting to MQTT
#ifdef ESP32
# include <ArduinoOTA.h>
# include <FS.h>
# include <WiFi.h>
# include <WiFiUdp.h>
# include <SPIFFS.h>
# include <esp_wifi.h>
# include "SPIFFS.h"
# include "esp_wifi.h"
# ifdef SECURE_CONNECTION
# include <WiFiClientSecure.h>
WiFiClientSecure eClient;
# else
# include <WiFi.h>
WiFiClient eClient;
# endif
# include <Preferences.h>
# include <WiFiManager.h>
Preferences preferences;
@@ -166,7 +170,12 @@ Preferences preferences;
# include <ESP8266WiFi.h>
# include <FS.h>
# include <WiFiManager.h>
# ifdef SECURE_CONNECTION
WiFiClientSecure eClient;
X509List caCert(certificate);
# else
WiFiClient eClient;
# endif
# ifdef MDNS_SD
# include <ESP8266mDNS.h>
# endif
@@ -459,6 +468,11 @@ void connectMQTT() {
failure_number_mqtt++; // we count the failure
Log.warning(F("failure_number_mqtt: %d" CR), failure_number_mqtt);
Log.warning(F("failed, rc=%d" CR), client.state());
#if defined(SECURE_CONNECTION) && defined(ESP32)
Log.warning(F("failed, ssl error code=%d" CR), eClient.lastError(nullptr, 0));
#elif defined(SECURE_CONNECTION) && defined(ESP8266)
Log.warning(F("failed, ssl error code=%d" CR), eClient.getLastSSLError());
#endif
delay(5000);
#if defined(ESP8266) || defined(ESP32)
disconnection_handling(failure_number_mqtt);
@@ -522,7 +536,9 @@ void setup() {
Log.trace(F("OpenMQTTGateway ip: %s" CR), WiFi.localIP().toString().c_str());
setOTA();
# ifdef SECURE_CONNECTION
setupTLS();
# endif
#else // In case of arduino platform
//Launch serial for debugging purposes
@@ -546,8 +562,8 @@ void setup() {
long port;
port = strtol(mqtt_port, NULL, 10);
Log.trace(F("Port: %l" CR), port);
client.setServer(mqtt_server, port);
Log.trace(F("Mqtt server: %s" CR), mqtt_server);
client.setServer(mqtt_server, port);
#endif
setup_parameters();
@@ -733,10 +749,10 @@ void setOTA() {
# endif
});
ArduinoOTA.onEnd([]() {
Log.trace(F("\nOTA done" CR));
# if defined(ZgatewayBT) && defined(ESP32)
startProcessing();
# endif
Log.trace(F("\nOTA done" CR));
# if defined(ZboardM5STICKC) || defined(ZboardM5STACK)
M5Display("OTA done", "", "");
# endif
@@ -762,6 +778,20 @@ void setOTA() {
});
ArduinoOTA.begin();
}
# ifdef SECURE_CONNECTION
void setupTLS() {
# if defined(NTP_SERVER)
configTime(0, 0, NTP_SERVER);
# endif
# if defined(ESP32)
eClient.setCACert(certificate);
# elif defined(ESP8266)
eClient.setTrustAnchors(&caCert);
eClient.setBufferSizes(512, 512);
# endif
}
# endif
#endif
#if defined(ESPWifiManualSetup)