Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Openssl engine support - revisited #915

Closed
wants to merge 3 commits into from
Closed

Openssl engine support - revisited #915

wants to merge 3 commits into from

Commits on Aug 11, 2018

  1. Add TLS engine and keyform support to libmosquitto 

    - Clients can now offload crypto tasks to an external crypto device through
  the OpenSSL ENGINE API.
- The keyfiles can now be treated as PEM or ENGINE keys.
- Two new functions were added to libmosquitto to set up the previously
  mentioned features.
- Both mosquitto_sub and mosquitto_pub include support to turn on the mentioned
  features through command line options.

Signed-off-by: Nicolás Pernas Maradei <[email protected]>
    @nicopernas
    nicopernas committed Aug 11, 2018
    Configuration menu
    Copy the full SHA
    ea85fff View commit details
    Browse the repository at this point in the history

  2. Add TLS engine and keyform support to mosquitto 

    Add same OpenSSL engine support to mosquitto (server side) previously added to
client side only.

Signed-off-by: Nicolás Pernas Maradei <[email protected]>
    @nicopernas
    nicopernas committed Aug 11, 2018
    Configuration menu
    Copy the full SHA
    c311757 View commit details
    Browse the repository at this point in the history

  3. Add engine private key password support 

    Some OpenSSL engines (selectable via tls_engine option) may require a
password to make use of private keys created with them in the first place.

The TPM engine for example, will require a password to access the underlying
TPM's Storage Root Key (SRK), which is the root key of a hierarchy of keys
associated with a TPM; it is generated within a TPM and is a non-migratable
key. Each owned TPM contains a SRK, generated by the TPM at the request
of the Owner. [1]

By default, the engine will prompt the user to introduce the SRK password
before any private keys created with the engine can be used. This could
be inconvenient when running on an unattended system.

Here's where the new tls_engine_kpass_sha option comes in handy. The user
can specify a SHA1 hash of its engine private key password via command
line or config file and it will be passed on to the engine directly.

This commit adds support for both clients (libmosquitto) and broker.

[1] https://goo.gl/qQoXBY

Signed-off-by: Nicolás Pernas Maradei <[email protected]>
    @nicopernas
    nicopernas committed Aug 11, 2018
    Configuration menu
    Copy the full SHA
    f26b197 View commit details
    Browse the repository at this point in the history