<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div>Hi,</div><div><br></div><div><span id="zwchr" data-marker="__DIVIDER__">----- On Aug 8, 2017, at 9:18 PM, Ryan Auger <raugerfacebook@gmail.com> wrote:<br></span></div><div data-marker="__QUOTED_TEXT__"><blockquote style="border-left: 2px solid #1010FF; margin-left: 5px; padding-left: 5px; color: #000; font-weight: normal; font-style: normal; text-decoration: none; font-family: Helvetica,Arial,sans-serif; font-size: 12pt;" data-mce-style="border-left: 2px solid #1010FF; margin-left: 5px; padding-left: 5px; color: #000; font-weight: normal; font-style: normal; text-decoration: none; font-family: Helvetica,Arial,sans-serif; font-size: 12pt;"><span style="font-size: 14px;" class="" data-mce-style="font-size: 14px;">Hello,</span><div class=""><br class=""></div><div class=""><span style="color: #24292e; font-family: -apple-system, system-ui, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: #ffffff;" class="" data-mce-style="color: #24292e; font-family: -apple-system, system-ui, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: #ffffff;">I am using PSKs to connect to my VMQTT/EMQTT instance, and need to modify the source code or write a plugin to set my clientid or username = psk-identity, thus creating a “TLS-PSK based authentication”. To be clear, my connection using PSKs works, and I can connect and send encrypted messages using an incredibly basic user_lookup_fun like so:</span></div><div class=""><span style="font-family: -apple-system, system-ui, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; orphans: 2; white-space: pre-wrap; widows: 2; background-color: #ffffff;" class="" data-mce-style="font-family: -apple-system, system-ui, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; orphans: 2; white-space: pre-wrap; widows: 2; background-color: #ffffff;"><br class=""></span></div><div class=""><span style="font-family: -apple-system, system-ui, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; orphans: 2; white-space: pre-wrap; widows: 2; background-color: #ffffff;" class="" data-mce-style="font-family: -apple-system, system-ui, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; orphans: 2; white-space: pre-wrap; widows: 2; background-color: #ffffff;">user_lookup(psk, _Username, UserState) -></span></div><div class=""><span style="color: #24292e; font-family: -apple-system, system-ui, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: #ffffff;" class="" data-mce-style="color: #24292e; font-family: -apple-system, system-ui, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: #ffffff;"><pre style="white-space: pre-wrap; color: #000000; font-variant-ligatures: normal;" class="" data-mce-style="white-space: pre-wrap; color: #000000; font-variant-ligatures: normal;"> {ok, UserState}.</pre></span></div></blockquote><div>I think you are misunderstanding the user_lookup/3 function. The UserName argument will contain the PSK client identity from the TLS handshake, the returned value should be `{ok, ShareSecret}`. The UserState argument can be used to point the user_lookup function to the place where the share secret is stored. It could be a map, a ets TID or the pid of a process knowing about the secret.<br></div><div><br data-mce-bogus="1"></div><div>Your sample is working, because the simplest implementation just stores the shared secret in UserState and simply returns that. For a real world use case that is obviously not going to be very useful.</div><div><br data-mce-bogus="1"></div><div>The real problem is after your TLS connection has been established, how to extract the PSK identity (or SRP username for that matter) from the TLS connection. A interface similar to ssl:peercert/1 to the SSL connection is currently missing.</div><div><br data-mce-bogus="1"></div><div>Adding such a API to ssl.erl is not very difficult, the real question is should it be</div><div><br data-mce-bogus="1"></div><div> peer_identity(#sslsocket{}) ->{ok, binary()} | {error, reason()}.</div><div><br data-mce-bogus="1"></div><div> or a more generic version like</div><div><br data-mce-bogus="1"></div><div> peer_identity(#sslsocket{}, Type :: 'certificate' | 'psk_identity' | 'srp_username' | 'whatever') ->{ok, Identity} | {error, reason()}.</div><div><br data-mce-bogus="1"></div><div>Regards</div><div>Andreas</div><div><br></div><blockquote style="border-left: 2px solid #1010FF; margin-left: 5px; padding-left: 5px; color: #000; font-weight: normal; font-style: normal; text-decoration: none; font-family: Helvetica,Arial,sans-serif; font-size: 12pt;" data-mce-style="border-left: 2px solid #1010FF; margin-left: 5px; padding-left: 5px; color: #000; font-weight: normal; font-style: normal; text-decoration: none; font-family: Helvetica,Arial,sans-serif; font-size: 12pt;"><div class=""><span style="color: #24292e; font-family: -apple-system, system-ui, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: #ffffff;" class="" data-mce-style="color: #24292e; font-family: -apple-system, system-ui, 'Segoe UI', Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol'; font-size: 14px; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: #ffffff;"><div class="">The problem here is that I have no reference to the calling process, and can’t modify the ClientID or username, so I cannot authenticate users without sending an additional username and password. If someone gained access to my private key, they would be able to publish and subscribe to any topic because the psk_identity is not currently used in authentication.<br></div><div class=""><br class=""></div><div class="">The way I see it, there are two options:</div><div class="">1) Set the ClientID in user lookup -> this is impossible because I have no reference to the calling process</div><div class="">2) Find where the ClientID is set, use a function to get the psk-identity from the listening process, and then set the ClientID = psk-identity</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">For option 2, my first goal is to just get the psk_identity from somewhere in the code. I tried to use the erlang library function <b class="">ssl_connection:connection_information(Client#mqtt_client.client_pid)]) </b>on the client.connected hook,</div><div class="">But this process hangs and does not return any value.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Can anyone point me in the right direction for getting the TLS information from within the code? </div><div class="">Otherwise, is there any way that I could go about option 1) without knowing anything about the calling process?</div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Thank you in advance!</div><div class=""><br class=""></div></span></div><br>_______________________________________________<br>erlang-questions mailing list<br>erlang-questions@erlang.org<br>http://erlang.org/mailman/listinfo/erlang-questions<br></blockquote></div></div></body></html>