TLS for the MQTT connection (iteration 2, step 5)
ca_file or the system's CAs (MOSQ_OPT_TLS_USE_OS_CERTS), client certificate, broker certificate and host name verified, settings errors reported before connecting. The client thread blocks SIGPIPE: with TLS, a write to a connection the broker closed killed the process. The reason of a failed handshake (libmosquitto's log) is appended to the error. tst_mqtt covers TLS with test certificates in tests/data (D44). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Claude Opus 5.5
+144
-1
@@ -1,6 +1,7 @@
|
||||
// MosquittoClient against a real broker (docs/DESIGN.md, D30 level 2): a
|
||||
// local mosquitto on a free port. Connect, messages, retained messages,
|
||||
// reconnect, last will, login. Skips when mosquitto isn't installed.
|
||||
// reconnect, last will, login, TLS (certificates in tests/data/, D44). Skips
|
||||
// when mosquitto isn't installed.
|
||||
//
|
||||
// The binary is also its own helper process for the last-will test:
|
||||
// `tst_mqtt --will-helper <port> <topic>` connects with a will and waits to be
|
||||
@@ -24,6 +25,33 @@ namespace {
|
||||
|
||||
constexpr int kTimeoutMs = 10000;
|
||||
|
||||
QString data(const char* file) {
|
||||
return QStringLiteral(TEST_DATA_DIR "/") + QLatin1String(file);
|
||||
}
|
||||
|
||||
// Broker configuration for a TLS listener with the test CA's server
|
||||
// certificate.
|
||||
QString tlsListener(bool requireClientCertificate = false) {
|
||||
return QStringLiteral(
|
||||
"allow_anonymous true\ncafile %1\ncertfile %2\nkeyfile %3\n"
|
||||
"require_certificate %4\n")
|
||||
.arg(data("ca.crt"), data("server.crt"), data("server.key"),
|
||||
requireClientCertificate ? QStringLiteral("true")
|
||||
: QStringLiteral("false"));
|
||||
}
|
||||
|
||||
MosquittoClient::Settings tlsSettings(int port, const char* caFile) {
|
||||
MosquittoClient::Settings s;
|
||||
s.broker.host = QStringLiteral("127.0.0.1");
|
||||
s.broker.port = port;
|
||||
s.broker.tls.enabled = true;
|
||||
if (caFile) s.broker.tls.caFile = data(caFile);
|
||||
s.clientId = QStringLiteral("tls");
|
||||
s.reconnectMinMs = 100;
|
||||
s.reconnectMaxMs = 500;
|
||||
return s;
|
||||
}
|
||||
|
||||
QString findTool(const QString& name) {
|
||||
QString path = QStandardPaths::findExecutable(name);
|
||||
if (path.isEmpty())
|
||||
@@ -350,6 +378,121 @@ class TestMqtt : public QObject {
|
||||
}
|
||||
}
|
||||
|
||||
void tlsConnects() {
|
||||
Broker broker(m_dir.path());
|
||||
QVERIFY(broker.start(tlsListener()));
|
||||
MosquittoClient a(tlsSettings(broker.port(), "ca.crt"));
|
||||
Recorder ra(&a);
|
||||
QVERIFY(connectClient(a, ra, QStringLiteral("test/#")));
|
||||
QVERIFY(a.publish(QStringLiteral("test/x"), "secret", false));
|
||||
QTRY_COMPARE_WITH_TIMEOUT(ra.messages.size(), 1, kTimeoutMs);
|
||||
QVERIFY(ra.errors.isEmpty());
|
||||
}
|
||||
|
||||
// The broker's certificate isn't from the given CA: no connection, and
|
||||
// the reason says why.
|
||||
void tlsWrongCaRejected() {
|
||||
Broker broker(m_dir.path());
|
||||
QVERIFY(broker.start(tlsListener()));
|
||||
MosquittoClient a(tlsSettings(broker.port(), "other-ca.crt"));
|
||||
Recorder ra(&a);
|
||||
a.connectToBroker();
|
||||
QTRY_VERIFY_WITH_TIMEOUT(!ra.errors.isEmpty(), kTimeoutMs);
|
||||
QVERIFY2(ra.errors.first().contains(QStringLiteral("verify failed")),
|
||||
qPrintable(ra.errors.first()));
|
||||
QTest::qWait(300);
|
||||
QVERIFY(!ra.states.contains(MqttClient::State::Connected));
|
||||
}
|
||||
|
||||
// Without ca_file the system's CAs are used (they don't know the test
|
||||
// CA). Fails the same way, which shows that TLS is on.
|
||||
void tlsWithSystemCertificates() {
|
||||
Broker broker(m_dir.path());
|
||||
QVERIFY(broker.start(tlsListener()));
|
||||
MosquittoClient a(tlsSettings(broker.port(), nullptr));
|
||||
Recorder ra(&a);
|
||||
a.connectToBroker();
|
||||
QTRY_VERIFY_WITH_TIMEOUT(!ra.errors.isEmpty(), kTimeoutMs);
|
||||
QVERIFY2(ra.errors.first().contains(QStringLiteral("verify failed")),
|
||||
qPrintable(ra.errors.first()));
|
||||
}
|
||||
|
||||
// A TLS error ends libmosquitto's own loop for good (D45); ours retries.
|
||||
// First a plain listener on the port (handshake fails), then TLS.
|
||||
void retriesAfterTlsError() {
|
||||
Broker broker(m_dir.path());
|
||||
QVERIFY(broker.start());
|
||||
MosquittoClient a(tlsSettings(broker.port(), "ca.crt"));
|
||||
Recorder ra(&a);
|
||||
a.connectToBroker();
|
||||
QTRY_VERIFY_WITH_TIMEOUT(!ra.errors.isEmpty(), kTimeoutMs);
|
||||
broker.stop();
|
||||
QVERIFY(broker.start(tlsListener()));
|
||||
QTRY_COMPARE_WITH_TIMEOUT(a.state(), MqttClient::State::Connected,
|
||||
kTimeoutMs);
|
||||
}
|
||||
|
||||
void tlsClientCertificate_data() {
|
||||
QTest::addColumn<bool>("withCertificate");
|
||||
QTest::newRow("with") << true;
|
||||
QTest::newRow("without") << false;
|
||||
}
|
||||
|
||||
void tlsClientCertificate() {
|
||||
QFETCH(bool, withCertificate);
|
||||
Broker broker(m_dir.path());
|
||||
QVERIFY(broker.start(tlsListener(true)));
|
||||
MosquittoClient::Settings s = tlsSettings(broker.port(), "ca.crt");
|
||||
if (withCertificate) {
|
||||
s.broker.tls.certFile = data("client.crt");
|
||||
s.broker.tls.keyFile = data("client.key");
|
||||
}
|
||||
MosquittoClient a(s);
|
||||
Recorder ra(&a);
|
||||
a.connectToBroker();
|
||||
if (withCertificate) {
|
||||
QTRY_COMPARE_WITH_TIMEOUT(a.state(), MqttClient::State::Connected,
|
||||
kTimeoutMs);
|
||||
} else {
|
||||
QTRY_VERIFY_WITH_TIMEOUT(!ra.errors.isEmpty(), kTimeoutMs);
|
||||
QVERIFY(!ra.states.contains(MqttClient::State::Connected));
|
||||
}
|
||||
}
|
||||
|
||||
// Settings errors show up at once, without a connection attempt.
|
||||
void tlsSettingsErrors_data() {
|
||||
QTest::addColumn<QString>("caFile");
|
||||
QTest::addColumn<QString>("certFile");
|
||||
QTest::addColumn<QString>("keyFile");
|
||||
QTest::addColumn<QString>("error");
|
||||
QTest::newRow("missing CA file")
|
||||
<< QStringLiteral("/no/such/ca.crt") << QString() << QString()
|
||||
<< QStringLiteral("TLS: cannot read /no/such/ca.crt");
|
||||
QTest::newRow("certificate without key")
|
||||
<< data("ca.crt") << data("client.crt") << QString()
|
||||
<< QStringLiteral("TLS: cert_file and key_file go together");
|
||||
QTest::newRow("client certificate without CA file")
|
||||
<< QString() << data("client.crt") << data("client.key")
|
||||
<< QStringLiteral("TLS: a client certificate needs ca_file");
|
||||
}
|
||||
|
||||
void tlsSettingsErrors() {
|
||||
QFETCH(QString, caFile);
|
||||
QFETCH(QString, certFile);
|
||||
QFETCH(QString, keyFile);
|
||||
QFETCH(QString, error);
|
||||
MosquittoClient::Settings s = tlsSettings(freePort(), nullptr);
|
||||
s.broker.tls.caFile = caFile;
|
||||
s.broker.tls.certFile = certFile;
|
||||
s.broker.tls.keyFile = keyFile;
|
||||
MosquittoClient a(s);
|
||||
Recorder ra(&a);
|
||||
a.connectToBroker();
|
||||
QTRY_COMPARE_WITH_TIMEOUT(ra.errors.size(), 1, kTimeoutMs);
|
||||
QCOMPARE(ra.errors.first(), error);
|
||||
QCOMPARE(a.state(), MqttClient::State::Disconnected);
|
||||
}
|
||||
|
||||
private:
|
||||
QTemporaryDir m_dir;
|
||||
};
|
||||
|
||||
Reference in New Issue
Block a user