STM32/W5500/MbedTLS Skip Verification and Connect to MQTT/8883 ?

[kenYuCh]

• My goal is: STM32/W5500/MbedTLS Skip Verification and Connect to MQTT/8883.

• My question is: How do I set skip_verifcation in Mongoosews to access MQTTS 8883 without authentication? I need to test my project in this environment. I can't connect successfully using either MG_TLS_MBED or MG_TLS_BUILTIN. (This is custom PCB board).

• The result I saw:

      931    2 mongoose.c:5131:mg_tcpip_poll  Status: down, IP: 0.0.0.0, rx:0, tx:0, dr:0, er:0
      93f    1 mongoose.c:5159:mg_tcpip_poll  Network is down
      d17    2 mongoose.c:5131:mg_tcpip_poll  Status: down, IP: 0.0.0.0, rx:0, tx:0, dr:0, er:0
      d25    1 mongoose.c:4386:onstatechange  Link up
      d35    3 mongoose.c:4499:tx_dhcp_discov DHCP discover sent. Our MAC: 02:04:0e:08:0d:06
      d85    3 mongoose.c:4478:tx_dhcp_reques DHCP req sent
      de3    2 mongoose.c:4621:rx_dhcp_client Lease: 86400 sec (86403)
      ded    1 mongoose.c:4383:onstatechange  Got IP
      e03    2 mongoose.c:4379:onstatechange  READY, IP: 192.168.0.171
      e0d    2 mongoose.c:4380:onstatechange         GW: 192.168.0.1
      e17    2 mongoose.c:4381:onstatechange        MAC: 02:04:0e:08:0d:06
  
      a18f   3 mongoose.c:4054:mg_connect_svc 5 -1 mqtts://test.mosquitto.org:8883
      MQTT_Timer_Fn Trigger
      a199   2 mongoose.c:5131:mg_tcpip_poll  Status: ready, IP: 192.168.0.171, rx:42, tx:20, dr:0, er:0
      a1ad   3 mongoose.c:299:dns_cb          5 test.mosquitto.org is 5.196.78.28
      a1b4   3 mongoose.c:5326:mg_connect_res 5 192.168.0.171:33799 -> 5.196.78.28:8883
      [MQTT] MG_EV_CONNECT
      [MQTT] TLS connection detected, initializing TLS…
      a2cb   3 mongoose.c:14147:mg_tls_init   5 Setting TLS
      TLS min/max: 3.3 - 3.3
      [TLS] automode verify none
      [TLS] setup success
      [MQTT TLS] Using Mongoose TLS with maximum compatibility (no SNI)
      a3dc   1 mongoose.c:502:mg_error        5 -1 TLS handshake: -0x7780
      [MQTT] 5 MG_EV_ERROR TLS handshake: -0x7780
      [MQTT TLS DIAGNOSIS] ================================
      [MQTT TLS] Error -0x7780: MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY
      [MQTT TLS] Server closed connection during handshake
      [MQTT TLS] Common causes:
      [MQTT TLS]   - TLS version mismatch (server expects different version)
      [MQTT TLS]   - Cipher suite incompatibility
      [MQTT TLS]   - Server doesn’t accept our TLS configuration
      [MQTT TLS]   - SNI hostname verification issue
      [MQTT TLS] Solutions to try:
      [MQTT TLS]   1. Disable SNI (set name to empty)
      [MQTT TLS]   2. Try different TLS versions
      [MQTT TLS]   3. Use non-encrypted connection first to test
      [MQTT TLS DIAGNOSIS] ================================
      [MQTT] MG_EV_CLOSE 5
      [MQTT TLS] TLS resources cleaned up
      a428   3 mongoose.c:4024:mg_close_conn  5 -1 closed
  

Environment

• mongoose version: 7.18
• Compiler/IDE and SDK: STM32CubeIDE 1.16.1 / STM32F401
• Target hardware/board: Custom
• Connectivity chip/module: STM32F401/W5500
• Target RTOS/OS (if applicable): FreeRTOS
• Lib: MbedTLS(2.16), Mongoosews 7.8

Config

#define MG_ARCH MG_ARCH_NEWLIB // MG_ARCH_ARMGCC, Plain ARM GCC
#define MG_TLS MG_TLS_MBED
#define MG_ENABLE_MIP 1
#define MG_ENABLE_TCPIP 1
#define MG_HTTP_INDEX "index.html" // default page, mongoose.h 977 lines
#define MG_ENABLE_CUSTOM_MILLIS 1
#define MG_ENABLE_CUSTOM_RANDOM 1
#define MG_ENABLE_TCPIP_PRINT_DEBUG_STATS 1 // Debug
#define MG_ENABLE_PACKED_FS 1
#define MG_ENABLE_FATFS 1
#define MG_ENABLE_POSIX_FS 0
#define MG_ENABLE_LOG 1
#define MG_ENABLE_DRIVER_W5500 1

Code

#define MQTT_URL "mqtts://test.mosquitto.org:8883"

void MQTTEvent(struct mg_connection *c, int ev, void ev_data) {
switch(ev) {
case MG_EV_CONNECT: {
struct mg_tls_opts mqtt_tls_opts = {0};
mqtt_tls_opts.ca = mg_str(""); // or not use
mqtt_tls_opts.skip_verification = 1;
mg_tls_init(c, &mqtt_tls_opts);
};
break;
}
}

void MQTT_Timer_Fn(void *arg) {
struct mg_mgr *mgr = (struct mg_mgr *) arg;
struct mg_mqtt_opts mqtt_opts;
memset(&mqtt_opts, 0, sizeof(mqtt_opts));
mqtt_opts.clean = true;
mqtt_opts.keepalive = 10;
mqtt_opts.version = 4;
mqtt_opts.pass = mg_str(MQTT_PASS);
mqtt_opts.user = mg_str(MQTT_USER);
if (s_mqtt_conn == NULL) {
s_mqtt_conn = mg_mqtt_connect(mgr, MQTT_URL, &mqtt_opts, MQTTEvent, NULL);
} else {
mg_mqtt_ping(s_mqtt_conn);
};
printf("MQTT_Timer_Fn Trigger\n");
}

[scaprile]

If you have a question, please ask a question; please do not open an issuel. This is your issue, not a Mongoose issue. Migrated.
Your config has archaic definitions, please see our documentation, and follow the guidelines in our tutorials.
If you paste code, please format it so we can read it.
Your log is huge, and it shows a lot of stuff that is not regular Mongoose log stuff, and we don't know where it comes from. Please be concise. Also, you seem to have modified our code to get what you want to get logged. You can get TLS to be verbose by setting a verbose log: mg_log_set(MG_LL_VERBOSE);
Your problem is not with a custom board nor with a W5500 nor with an STM32; your problem seems to be a TLS problem that I don't fully understand; please be specific and correctly describe what you want to do.
You want to use TLS
You connect to an MQTT broker using TLS
You seem to also be using user and password
You don't provide a CA certificate
You set skip_verification
You don't provide a hostname
This log seems to be when using MbedTLS (guessed from the log strings), MbedTLS seems to be telling you that you need to set a hostname.
You don't provide a log for our built-in TLS.

Maybe this is what you want:

  } else if (c->is_tls && ev == MG_EV_CONNECT) {
    struct mg_tls_opts opts = {.ca = mg_str_n("", 0), .name = mg_url_host(your_url), .skip_verification=1};
    mg_tls_init(c, &opts);

The skip_verification option is for our built-in TLS, it does not do anything in MbedTLS. It bypasses checks on the peer certificate, because we only support elliptic curve-based encryption algorithms.

What exactly do you want to do ? Looks like you want to connect using TLS but do not provide any means of authentication, you just want to blindly connect and just encrypt. That we don't test, not sure if we support that; even some versions of MbedTLS do not allow that. // See Mbed-TLS/mbedtls#7075
This is what we test and support:

mongoose/test/unit_test.c

Lines 1513 to 1555 in 8a62633

	#if MG_TLS
	url = "https://cesanta.com";
	opts.name = mg_url_host(url);
	#if MG_TLS == MG_TLS_BUILTIN
	// our TLS does not search for the proper CA in a bundle
	opts.ca = mg_file_read(&mg_fs_posix, "data/e5.crt");
	#endif
	c = mg_http_connect(&mgr, url, f3, &ok);
	ASSERT(c != NULL);
	mg_tls_init(c, &opts);
	for (i = 0; i < 1500 && ok <= 0; i++) mg_mgr_poll(&mgr, 1);
	MG_INFO(("OK: %d", ok));
	ASSERT(ok == 200);
	mg_mgr_poll(&mgr, 1);
	// Make host validationfail
	c = mg_http_connect(&mgr, url, f3, &ok);
	ASSERT(c != NULL);
	opts.name = mg_str("dummy"); // Set some invalid hostname value
	mg_tls_init(c, &opts);
	ok = 0;
	for (i = 0; i < 500 && ok <= 0; i++) mg_mgr_poll(&mgr, 10);
	MG_INFO(("OK: %d", ok));
	ASSERT(ok == 777);
	mg_mgr_poll(&mgr, 1);
	opts.name = mg_url_host(url);
	#if MG_TLS == MG_TLS_BUILTIN
	mg_free((void *) opts.ca.buf);
	#endif
	// Test empty CA
	// Disable mbedTLS: https://github.com/Mbed-TLS/mbedtls/issues/7075
	#if MG_TLS != MG_TLS_MBED
	opts.ca = mg_str("");
	c = mg_http_connect(&mgr, url, f3, &ok);
	mg_tls_init(c, &opts);
	ok = 0;
	for (i = 0; i < 1000 && ok <= 0; i++) mg_mgr_poll(&mgr, 10);
	MG_INFO(("OK: %d", ok));
	ASSERT(ok == 200);
	mg_mgr_poll(&mgr, 1);
	#endif
	#endif

You'll see we explicitly skip empty CA with MbedTLS, and point to the link above
If it works. fine, if it doesn't, then we don't currently support that. If you need that, please discuss your usage scenario and contract options with our Support team via mail.
The specific MbedTLS configuration options you may need, depend on your MbedTLS version and are your responsibility.

PS: Our built-in TLS is 1.3 only, you need a TLS 1.3 server to be able to connect

[hoathienvu8x]

Hello @scaprile first at all, meny thanks @scaprile and all contributes was created project and share to community, when i used MbedTLS skip verification the error same mbedtls was retur code -0x7780 when check and override code i was add after line 143 of file tls_mbed.c with code like this

if (c->is_client && opts->name.buf != NULL && opts->name.buf[0] != '\0') {
  char *host = mg_mprintf("%.*s", opts->name.len, opts->name.buf);
  mbedtls_ssl_set_hostname(&tls->ssl, host);
  MG_DEBUG(("%lu hostname verification: %s", c->id, host));
  mg_free(host);
}

I think this is not best solution but this code was Ok i hope this code will be fixed that error

[scaprile]

@hoathienvu8x Please do not add noise, and don't thread hijack, and try to use understandable English. The code you describe is already in Mongoose. If you have a problem, or a question, open your own. Thank you.