espressif/esp-mqtt
1
0
Fork 1
mirror of https://github.com/espressif/esp-mqtt.git synced 2025-07-29 18:28:24 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'contrib/github_pr_298' into 'master'

Browse Source 
feat(mqtt): enable custom TLS cipher suites for MQTTs

Closes IDFGH-15198

See merge request espressif/esp-mqtt!241
This commit is contained in:
Rocha Euripedes
2025-05-22 17:55:41 +08:00
parent 6af4446a48 56799069af
commit 6fa1f294db
4 changed files with 18 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
include/mqtt_client.h
View File

@ -274,6 +274,8 @@ typedef struct esp_mqtt_client_config_t {
If NULL, server certificate CN must match hostname. If NULL, server certificate CN must match hostname.
This is ignored if skip_cert_common_name_check=true. This is ignored if skip_cert_common_name_check=true.
It's not copied nor freed by the client, user needs to clean up.*/ It's not copied nor freed by the client, user needs to clean up.*/
const int *ciphersuites_list; /*!< Pointer to a zero-terminated array of IANA identifiers of TLS cipher suites.
Please ensure the validity of the list, and note that it is not copied or freed by the client. */
} verification; /*!< Security verification of the broker */ } verification; /*!< Security verification of the broker */
} broker; /*!< Broker address and security verification */ } broker; /*!< Broker address and security verification */
/** /**

4
include/mqtt_supported_features.h
View File

@ -74,6 +74,10 @@
#define MQTT_SUPPORTED_FEATURE_ECDSA_PERIPHERAL #define MQTT_SUPPORTED_FEATURE_ECDSA_PERIPHERAL
#endif #endif
#if ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(5, 5, 0)
// Features supported in 5.5.0
#define MQTT_SUPPORTED_FEATURE_CIPHERSUITES_LIST
#endif
#endif /* ESP_IDF_VERSION */ #endif /* ESP_IDF_VERSION */
#endif // _MQTT_SUPPORTED_FEATURES_H_ #endif // _MQTT_SUPPORTED_FEATURES_H_

1
lib/include/mqtt_client_priv.h
View File

@ -85,6 +85,7 @@ typedef struct {
int clientkey_password_len; int clientkey_password_len;
bool use_global_ca_store; bool use_global_ca_store;
esp_err_t ((*crt_bundle_attach)(void *conf)); esp_err_t ((*crt_bundle_attach)(void *conf));
const int *ciphersuites_list;
const char *cacert_buf; const char *cacert_buf;
size_t cacert_bytes; size_t cacert_bytes;
const char *clientcert_buf; const char *clientcert_buf;

11
mqtt_client.c
View File

@ -158,6 +158,16 @@ static esp_err_t esp_mqtt_set_ssl_transport_properties(esp_transport_list_handle
goto esp_mqtt_set_transport_failed); goto esp_mqtt_set_transport_failed);
} }
if(cfg->ciphersuites_list)
{
#if defined(MQTT_SUPPORTED_FEATURE_CIPHERSUITES_LIST)
esp_transport_ssl_set_ciphersuites_list(ssl,cfg->ciphersuites_list);
#else
ESP_LOGE(TAG, "Cipher suites list feature is not available in IDF version %s", IDF_VER);
goto esp_mqtt_set_transport_failed;
#endif /* MQTT_SUPPORTED_FEATURE_CIPHERSUITES_LIST */
}
if (cfg->psk_hint_key) { if (cfg->psk_hint_key) {
#if defined(MQTT_SUPPORTED_FEATURE_PSK_AUTHENTICATION) && MQTT_ENABLE_SSL #if defined(MQTT_SUPPORTED_FEATURE_PSK_AUTHENTICATION) && MQTT_ENABLE_SSL
#ifdef CONFIG_ESP_TLS_PSK_VERIFICATION #ifdef CONFIG_ESP_TLS_PSK_VERIFICATION
@ -578,6 +588,7 @@ esp_err_t esp_mqtt_set_config(esp_mqtt_client_handle_t client, const esp_mqtt_cl
client->config->cacert_bytes = config->broker.verification.certificate_len; client->config->cacert_bytes = config->broker.verification.certificate_len;
client->config->psk_hint_key = config->broker.verification.psk_hint_key; client->config->psk_hint_key = config->broker.verification.psk_hint_key;
client->config->crt_bundle_attach = config->broker.verification.crt_bundle_attach; client->config->crt_bundle_attach = config->broker.verification.crt_bundle_attach;
client->config->ciphersuites_list = config->broker.verification.ciphersuites_list;
client->config->clientcert_buf = config->credentials.authentication.certificate; client->config->clientcert_buf = config->credentials.authentication.certificate;
client->config->clientcert_bytes = config->credentials.authentication.certificate_len; client->config->clientcert_bytes = config->credentials.authentication.certificate_len;
client->config->clientkey_buf = config->credentials.authentication.key; client->config->clientkey_buf = config->credentials.authentication.key;