Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implemented OpenSSL providers support #1528

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from

Conversation

tomaszma1
Copy link

@tomaszma1 tomaszma1 commented Sep 30, 2024

Hi guys,

I have implemented support for OpenSSL providers. It's a new feature available from OpenSSL 3.x.x.

Added CMake compile option “-DPAHO_SSL_PROVIDERS”, which translates to “-DOPENSSL_PROVIDERS=1” C/C++ definition turning on OpenSSL providers support.
“MQTTAsync_connectOptions” and “MQTTClient_connectOptions” structures are extended by “providerName” C-string field with provider name. Empty or invalid “providerName” field indicates no provider used.

In function “SSLSocket_createContext()” provider is loaded, provider self-test is performed, key is obtained and assigned to certificate by calling SSL_CTX_use_PrivateKey() function. If any of these operations fail, function is cancelled with an error code.

Related Paho MQTT C++ PR: eclipse-paho/paho.mqtt.cpp#517


Thank you for your interest in this project managed by the Eclipse Foundation.

The guidelines for contributions can be found in the CONTRIBUTING.md file.

At a minimum, you must sign the Eclipse ECA, and sign off each commit.

To complete and submit a ECA, log into the Eclipse projects forge
You will need to create an account with the Eclipse Foundation if you have not already done so.
Be sure to use the same email address when you register for the account that you intend to use when you commit to Git.
Go to https://accounts.eclipse.org/user/eca to sign the Eclipse ECA.

Signed-off-by: Tomasz Maczkowski <[email protected]>
@tomaszma1 tomaszma1 marked this pull request as draft September 30, 2024 13:47
@tomaszma1 tomaszma1 marked this pull request as ready for review September 30, 2024 14:56
@tomaszma1
Copy link
Author

Hello, it's been 3 weeks already. Any decision to approve/reject this PR? Thanks.

@Pascal-Fremaux
Copy link

Pascal-Fremaux commented Oct 28, 2024

@tomaszma1 Interesting, but I wonder if you have a leak issue with your pkey.
OSSL_STORE_INFO_get1_PKEY() creates a duplicate and someone, someday, has to clean it with EVP_PKEY_free().
No idea how it is managed by SSL_CTX_use_PrivateKey(), but at least you would have a leak if this call fails (error line 701).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants