- Add `MOSQ_OPT_TLS_USE_OS_CERTS` option, to instruct the client to load and trust OS provided CA certificates for use with TLS connections.
- All clients now load OS provided CA certificates if used with `-L
mqtts://...`, or if port is set to 8883 and no other CA certificates are
used. Closes#1824.
- Add the `--tls-use-os-certs` option to all clients.
Closes#1824. Thanks to Jens Reimann.
Fixeseclipse/mosquitto#1904
If the broker rejects the connection, as opposed to the broker being
down, then there is no hope to establish a connection. This adds a
status flag so we can signal to the loop that we should just exit.
Signed-off-by: Dan White <dan.white@valpo.edu>
Fixeseclipse/mosquitto#1899
In stdin line mode, mosquitto_pub will continue running and accepting
input even if/when/after publishing fails. This condition is reached
when it first successfully establishes a connection and the server later
is unreachable.
Exiting with a non-zero exit code allows for much easier health
monitoring when used in a long-running pipe.
Signed-off-by: Dan White <dan.white@valpo.edu>
Main loop has two different logics inside: one for stdin input,
second for all other cases. Exit loop condition is also different
for both variants. This commit splits these two variants into
two separate loops.
Signed-off-by: Marek Wodzinski <majek@w7i.pl>
the `memset(&cfg, 0, sizeof(struct mosq_config));` already exsits in
`client_config_load()`'s `init_config()` function call.
So calling it in main function is totally unnecessary.
Signed-off-by: YangHau <vulxj0j8j8@gmail.com>
* Fix Will message for a persistent client incorrectly being sent when the client reconnects after a clean disconnect.
* Fix Will message for a persistent client not being sent on disconnect.
* Fix mosquitto_pub not using the `-c` option.
Thanks to Yannic Schröder.
Closes#1273.
Some OpenSSL engines (selectable via tls_engine option) may require a
password to make use of private keys created with them in the first place.
The TPM engine for example, will require a password to access the underlying
TPM's Storage Root Key (SRK), which is the root key of a hierarchy of keys
associated with a TPM; it is generated within a TPM and is a non-migratable
key. Each owned TPM contains a SRK, generated by the TPM at the request
of the Owner. [1]
By default, the engine will prompt the user to introduce the SRK password
before any private keys created with the engine can be used. This could
be inconvenient when running on an unattended system.
Here's where the new tls_engine_kpass_sha option comes in handy. The user
can specify a SHA1 hash of its engine private key password via command
line or config file and it will be passed on to the engine directly.
This commit adds support for both clients (libmosquitto) and broker.
[1] https://goo.gl/qQoXBY
Signed-off-by: Nicolás Pernas Maradei <nicopernas@gmail.com>
- Clients can now offload crypto tasks to an external crypto device through
the OpenSSL ENGINE API.
- The keyfiles can now be treated as PEM or ENGINE keys.
- Two new functions were added to libmosquitto to set up the previously
mentioned features.
- Both mosquitto_sub and mosquitto_pub include support to turn on the mentioned
features through command line options.
Signed-off-by: Nicolás Pernas Maradei <nicopernas@gmail.com>
This comes in the form of:
* Per listener maximum_qos option, which can be in the range 0-2.
* Changes to mosquitto_publish*() to return MOSQ_ERR_QOS_NOT_SUPPORTED
if attempting to publish with a higher QoS than supported.
* Bridges will downgrade messages to match the maximum QoS.
More tests on the broker side (specifically bridges) are required. This
needs bridge support for MQTT 5 first.
