Retrieving TLS Information After/On Connect

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|

Retrieving TLS Information After/On Connect

Ryan Auger
Hello,

I am using PSKs to connect to my VMQTT/EMQTT instance, and need to modify the source code or write a plugin to set my clientid or username = psk-identity, thus creating a “TLS-PSK based authentication”. To be clear, my connection using PSKs works, and I can connect and send encrypted messages using an incredibly basic user_lookup_fun like so:

user_lookup(psk, _Username, UserState) ->
        {ok, UserState}.

The problem here is that I have no reference to the calling process, and can’t modify the ClientID or username, so I cannot authenticate users without sending an additional username and password. If someone gained access to my private key, they would be able to publish and subscribe to any topic because the psk_identity is not currently used in authentication.

The way I see it, there are two options:
1) Set the ClientID in user lookup -> this is impossible because I have no reference to the calling process
2) Find where the ClientID is set, use a function to get the psk-identity from the listening process, and then set the ClientID = psk-identity


For option 2, my first goal is to just get the psk_identity from somewhere in the code. I tried to use the erlang library function ssl_connection:connection_information(Client#mqtt_client.client_pid)]) on the client.connected hook,
But this process hangs and does not return any value.


Can anyone point me in the right direction for getting the TLS information from within the code? 
Otherwise, is there any way that I could go about option 1) without knowing anything about the calling process?


Thank you in advance!


_______________________________________________
erlang-questions mailing list
[hidden email]
http://erlang.org/mailman/listinfo/erlang-questions
Reply | Threaded
Open this post in threaded view
|

Re: Retrieving TLS Information After/On Connect

Andreas Schultz
Hi,

----- On Aug 8, 2017, at 9:18 PM, Ryan Auger <[hidden email]> wrote:
Hello,

I am using PSKs to connect to my VMQTT/EMQTT instance, and need to modify the source code or write a plugin to set my clientid or username = psk-identity, thus creating a “TLS-PSK based authentication”. To be clear, my connection using PSKs works, and I can connect and send encrypted messages using an incredibly basic user_lookup_fun like so:

user_lookup(psk, _Username, UserState) ->
        {ok, UserState}.
I think you are misunderstanding the user_lookup/3 function. The UserName argument will contain the PSK client identity from the TLS handshake, the returned value should be `{ok, ShareSecret}`. The UserState argument can be used to point the user_lookup function to the place where the share secret is stored. It could be a map, a ets TID or the pid of a process knowing about the secret.

Your sample is working, because the simplest implementation just stores the shared secret in UserState and simply returns that. For a real world use case that is obviously not going to be very useful.

The real problem is after your TLS connection has been established, how to extract the PSK identity (or SRP username for that matter) from the TLS connection. A interface similar to ssl:peercert/1 to the SSL connection is currently missing.

Adding such a API to ssl.erl is not very difficult, the real question is should it be

    peer_identity(#sslsocket{}) ->{ok, binary()} | {error, reason()}.

or a more generic version like

    peer_identity(#sslsocket{}, Type :: 'certificate' | 'psk_identity' | 'srp_username' | 'whatever') ->{ok, Identity} | {error, reason()}.

Regards
Andreas

The problem here is that I have no reference to the calling process, and can’t modify the ClientID or username, so I cannot authenticate users without sending an additional username and password. If someone gained access to my private key, they would be able to publish and subscribe to any topic because the psk_identity is not currently used in authentication.

The way I see it, there are two options:
1) Set the ClientID in user lookup -> this is impossible because I have no reference to the calling process
2) Find where the ClientID is set, use a function to get the psk-identity from the listening process, and then set the ClientID = psk-identity


For option 2, my first goal is to just get the psk_identity from somewhere in the code. I tried to use the erlang library function ssl_connection:connection_information(Client#mqtt_client.client_pid)]) on the client.connected hook,
But this process hangs and does not return any value.


Can anyone point me in the right direction for getting the TLS information from within the code? 
Otherwise, is there any way that I could go about option 1) without knowing anything about the calling process?


Thank you in advance!


_______________________________________________
erlang-questions mailing list
[hidden email]
http://erlang.org/mailman/listinfo/erlang-questions

_______________________________________________
erlang-questions mailing list
[hidden email]
http://erlang.org/mailman/listinfo/erlang-questions