[erlang-questions] Retrieving TLS Information After/On Connect

[Andreas Schultz]

Hi, 

----- On Aug 8, 2017, at 9:18 PM, Ryan Auger <raugerfacebook@REDACTED> wrote: 

> Hello,

> I am using PSKs to connect to my VMQTT/EMQTT instance, and need to modify the
> source code or write a plugin to set my clientid or username = psk-identity,
> thus creating a “TLS-PSK based authentication”. To be clear, my connection
> using PSKs works, and I can connect and send encrypted messages using an
> incredibly basic user_lookup_fun like so:

> user_lookup(psk, _Username, UserState) ->
> {ok, UserState}.

I think you are misunderstanding the user_lookup/3 function. The UserName argument will contain the PSK client identity from the TLS handshake, the returned value should be `{ok, ShareSecret}`. The UserState argument can be used to point the user_lookup function to the place where the share secret is stored. It could be a map, a ets TID or the pid of a process knowing about the secret. 

Your sample is working, because the simplest implementation just stores the shared secret in UserState and simply returns that. For a real world use case that is obviously not going to be very useful. 

The real problem is after your TLS connection has been established, how to extract the PSK identity (or SRP username for that matter) from the TLS connection. A interface similar to ssl:peercert/1 to the SSL connection is currently missing. 

Adding such a API to ssl.erl is not very difficult, the real question is should it be 

peer_identity(#sslsocket{}) ->{ok, binary()} | {error, reason()}. 

or a more generic version like 

peer_identity(#sslsocket{}, Type :: 'certificate' | 'psk_identity' | 'srp_username' | 'whatever') ->{ok, Identity} | {error, reason()}. 

Regards 
Andreas 

> The problem here is that I have no reference to the calling process, and can’t
> modify the ClientID or username, so I cannot authenticate users without sending
> an additional username and password. If someone gained access to my private
> key, they would be able to publish and subscribe to any topic because the
> psk_identity is not currently used in authentication.

> The way I see it, there are two options:
> 1) Set the ClientID in user lookup -> this is impossible because I have no
> reference to the calling process
> 2) Find where the ClientID is set, use a function to get the psk-identity from
> the listening process, and then set the ClientID = psk-identity

> For option 2, my first goal is to just get the psk_identity from somewhere in
> the code. I tried to use the erlang library function
> ssl_connection:connection_information(Client#mqtt_client.client_pid)]) on the
> client.connected hook,
> But this process hangs and does not return any value.

> Can anyone point me in the right direction for getting the TLS information from
> within the code?
> Otherwise, is there any way that I could go about option 1) without knowing
> anything about the calling process?

> Thank you in advance!

> _______________________________________________
> erlang-questions mailing list
> erlang-questions@REDACTED
> http://erlang.org/mailman/listinfo/erlang-questions
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://erlang.org/pipermail/erlang-questions/attachments/20170809/9a263bf2/attachment.htm>