diff --git a/ChangeLog.txt b/ChangeLog.txt index c4becdf8..3980e2e8 100644 --- a/ChangeLog.txt +++ b/ChangeLog.txt @@ -20,6 +20,7 @@ Broker features: - Disallow writing to $ topics where appropriate. - Fix mosquitto_passwd crashing on corrupt password file. Closes #1207. - Add support for OCSP stapling. +- Add support for ALPN on bridge TLS connections. Closes #924. Client library features: - Add mosquitto_subscribe_multiple() for sending subscriptions to multiple @@ -28,6 +29,7 @@ Client library features: - Add explicit support for TLS v1.3. - Drop support for TLS v1.0. - Add support for OCSP stapling to bridges. +- Add support for ALPN on TLS connections. Closes #924. Client features: - Add mosquitto_rr client, which can be used for "request-response" messaging, @@ -39,6 +41,7 @@ Client features: messages on a broker. - -V now accepts `5, `311`, `31`, as well as `mqttv5` etc. - Add TLS Engine support. +- Add support for ALPN on TLS connections. Closes #924. - Add explicit support for TLS v1.3. - Drop support for TLS v1.0. diff --git a/client/client_shared.c b/client/client_shared.c index f903497c..1dea07ec 100644 --- a/client/client_shared.c +++ b/client/client_shared.c @@ -159,6 +159,7 @@ void client_config_cleanup(struct mosq_config *cfg) free(cfg->certfile); free(cfg->keyfile); free(cfg->ciphers); + free(cfg->tls_alpn); free(cfg->tls_version); free(cfg->tls_engine); free(cfg->tls_engine_kpass_sha1); @@ -870,6 +871,14 @@ int client_config_line_proc(struct mosq_config *cfg, int pub_or_sub, int argc, c } i++; #ifdef WITH_TLS + }else if(!strcmp(argv[i], "--tls-alpn")){ + if(i==argc-1){ + fprintf(stderr, "Error: --tls-alpn argument given but no protocol specified.\n\n"); + return 1; + }else{ + cfg->tls_alpn = strdup(argv[i+1]); + } + i++; }else if(!strcmp(argv[i], "--tls-engine")){ if(i==argc-1){ fprintf(stderr, "Error: --tls-engine argument given but no engine_id specified.\n\n"); @@ -1068,6 +1077,11 @@ int client_opts_set(struct mosquitto *mosq, struct mosq_config *cfg) mosquitto_lib_cleanup(); return 1; } + if(cfg->tls_alpn && mosquitto_string_option(mosq, MOSQ_OPT_TLS_ALPN, cfg->tls_alpn)){ + if(!cfg->quiet) fprintf(stderr, "Error: Problem setting TLS ALPN protocol.\n"); + mosquitto_lib_cleanup(); + return 1; + } # ifdef FINAL_WITH_TLS_PSK if(cfg->psk && mosquitto_tls_psk_set(mosq, cfg->psk, cfg->psk_identity, NULL)){ if(!cfg->quiet) fprintf(stderr, "Error: Problem setting TLS-PSK options.\n"); diff --git a/client/client_shared.h b/client/client_shared.h index 7356acbe..46592a23 100644 --- a/client/client_shared.h +++ b/client/client_shared.h @@ -67,6 +67,7 @@ struct mosq_config { char *keyfile; char *ciphers; bool insecure; + char *tls_alpn; char *tls_version; char *tls_engine; char *tls_engine_kpass_sha1; diff --git a/client/pub_client.c b/client/pub_client.c index b7709744..e1ee2cbe 100644 --- a/client/pub_client.c +++ b/client/pub_client.c @@ -265,8 +265,9 @@ void print_usage(void) printf(" [--will-topic [--will-payload payload] [--will-qos qos] [--will-retain]]\n"); #ifdef WITH_TLS printf(" [{--cafile file | --capath dir} [--cert file] [--key file]\n"); - printf(" [--ciphers ciphers] [--insecure]\n"); - printf(" [--tls-engine engine] [--keyform keyform] [--tls-engine-kpass-sha1]]\n"); + printf(" [--ciphers ciphers] [--insecure]\n"); + printf(" [--tls-alpn protocol]\n"); + printf(" [--tls-engine engine] [--keyform keyform] [--tls-engine-kpass-sha1]]\n"); #ifdef FINAL_WITH_TLS_PSK printf(" [--psk hex-key --psk-identity identity [--ciphers ciphers]]\n"); #endif diff --git a/client/rr_client.c b/client/rr_client.c index 6161a41b..5ecd3093 100644 --- a/client/rr_client.c +++ b/client/rr_client.c @@ -174,9 +174,11 @@ void print_usage(void) printf(" [--will-topic [--will-payload payload] [--will-qos qos] [--will-retain]]\n"); #ifdef WITH_TLS printf(" [{--cafile file | --capath dir} [--cert file] [--key file]\n"); - printf(" [--ciphers ciphers] [--insecure]]\n"); -#ifdef WITH_TLS_PSK - printf(" [--psk hex-key --psk-identity identity [--ciphers ciphers]]\n"); + printf(" [--ciphers ciphers] [--insecure]\n"); + printf(" [--tls-alpn protocol]\n"); + printf(" [--tls-engine engine] [--keyform keyform] [--tls-engine-kpass-sha1]]\n"); +#ifdef FINAL_WITH_TLS_PSK + printf(" [--psk hex-key --psk-identity identity [--ciphers ciphers]]\n"); #endif #endif #ifdef WITH_SOCKS diff --git a/client/sub_client.c b/client/sub_client.c index 28a71b87..c970537c 100644 --- a/client/sub_client.c +++ b/client/sub_client.c @@ -185,8 +185,9 @@ void print_usage(void) printf(" [--will-topic [--will-payload payload] [--will-qos qos] [--will-retain]]\n"); #ifdef WITH_TLS printf(" [{--cafile file | --capath dir} [--cert file] [--key file]\n"); - printf(" [--ciphers ciphers] [--insecure] [--tls-engine engine]\n"); - printf(" [--keyform keyform] [--tls-engine-kpass-sha1]]\n"); + printf(" [--ciphers ciphers] [--insecure]\n"); + printf(" [--tls-alpn protocol]\n"); + printf(" [--tls-engine engine] [--keyform keyform] [--tls-engine-kpass-sha1]]\n"); #ifdef FINAL_WITH_TLS_PSK printf(" [--psk hex-key --psk-identity identity [--ciphers ciphers]]\n"); #endif diff --git a/lib/mosquitto.h b/lib/mosquitto.h index 3aa55787..79ca8d86 100644 --- a/lib/mosquitto.h +++ b/lib/mosquitto.h @@ -2070,6 +2070,10 @@ libmosq_EXPORT void mosquitto_log_callback_set(struct mosquitto *mosq, void (*on * accessed, this option allows a hex encoded SHA1 hash of the * private key password to be passed to the engine directly. * Must be set before . + * MOSQ_OPT_TLS_ALPN + * If the broker being connected to has multiple services available + * on a single TLS port, such as both MQTT and WebSockets, use this + * option to configure the ALPN option for the connection. */ libmosq_EXPORT int mosquitto_string_option(struct mosquitto *mosq, enum mosq_opt_t option, const char *value); diff --git a/man/mosquitto.conf.5.xml b/man/mosquitto.conf.5.xml index 5f3e2619..4c66fadc 100644 --- a/man/mosquitto.conf.5.xml +++ b/man/mosquitto.conf.5.xml @@ -1704,6 +1704,14 @@ topic clients/total in 0 test/mosquitto/org $SYS/broker/ The following options are available for all bridges to configure SSL/TLS support. + + alpn + + Configure the application layer protocol negotiation + option for the TLS session. Useful for brokers that support + both websockets and MQTT on the same port. + + file path @@ -1811,14 +1819,6 @@ topic clients/total in 0 test/mosquitto/org $SYS/broker/ connection to succeed. - - alpn - - Configure the application layer protocol negotiation - option for the TLS session. Useful for brokers that support - both websockets and MQTT on the same port. - - diff --git a/man/mosquitto_pub.1.xml b/man/mosquitto_pub.1.xml index f92a1442..0e2fdf1d 100644 --- a/man/mosquitto_pub.1.xml +++ b/man/mosquitto_pub.1.xml @@ -63,6 +63,7 @@ file ciphers version + protocol engine @@ -455,6 +456,14 @@ The MQTT topic on which to publish the message. See mqtt7 for more information on MQTT topics. + + + + Provide a protocol to use when connecting to a broker + that has multiple protocols available on a single port, + e.g. MQTT and WebSockets. + + diff --git a/man/mosquitto_rr.1.xml b/man/mosquitto_rr.1.xml index c8ece437..f6a01396 100644 --- a/man/mosquitto_rr.1.xml +++ b/man/mosquitto_rr.1.xml @@ -70,6 +70,7 @@ file file version + protocol @@ -472,6 +473,13 @@ + + + Provide a protocol to use when connecting to a broker + that has multiple protocols available on a single port, + e.g. MQTT and WebSockets. + + Choose which TLS protocol version to use when diff --git a/man/mosquitto_sub.1.xml b/man/mosquitto_sub.1.xml index f934ce48..0547288f 100644 --- a/man/mosquitto_sub.1.xml +++ b/man/mosquitto_sub.1.xml @@ -72,6 +72,7 @@ file file version + protocol engine @@ -565,6 +566,14 @@ mosquitto_sub -t 'bbc/#' -T bbc/bbc1 --remove-retained topics or topic trees. + + + + Provide a protocol to use when connecting to a broker + that has multiple protocols available on a single port, + e.g. MQTT and WebSockets. + + diff --git a/mosquitto.conf b/mosquitto.conf index 8b354475..76b15466 100644 --- a/mosquitto.conf +++ b/mosquitto.conf @@ -939,6 +939,11 @@ # point using encryption. #bridge_insecure false +# If the remote broker has more than one protocol available on its port, e.g. +# MQTT and WebSockets, then use bridge_alpn to configure which protocol is +# requested. Note that WebSockets support for bridges is not yet available. +#bridge_alpn + # ----------------------------------------------------------------- # PSK based SSL/TLS support # -----------------------------------------------------------------