TLS Milestone 1: host OpenSSL transport + opt-in plumbing - #15
Merged
Conversation
New src/host/transport_openssl.c/.h implements mqtt_transport over host OpenSSL: verification on by default (system trust store, SNI + hostname check), -S/insecure opt-out, SO_RCVTIMEO poll ticks and WANT_READ/ WANT_WRITE mapped to the vtable's would-block contract, and SSL_get_verify_result() read before SSL_free() on handshake failure. TLS is strictly opt-in (never default-on): new -s/-S getopt flags and TLS/S,TLSINSECURE/S ReadArgs switches populate tool_opts.tls/ tls_insecure; both parsers now resolve the default port after parsing (8883 with TLS, otherwise exactly 1883 as before). The Amiga side only plumbs the flags for now - the AmiSSL transport lands in Milestone 2/3. tests/broker/tls-smoke.sh (make broker-tls-smoke, plus a CI job on the existing broker filter) proves verify-on against a provisioned CA, skip-verify against an untrusted cert, and that verify-on rejects an untrusted cert. userdocs/CLI-Reference.md documents the host flags. Part of #3. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QWq1CRLCQy9AaD9UtLRSM9
sidick
force-pushed
the
tls/milestone-1-host-openssl
branch
from
August 29, 2026 20:18
400cda6 to
df0a45e
Compare
ci / test-host and ci / build run make test-host/make build inside the shared amiga-dev CI image via a reusable workflow this repo can't add an apt-get step to, and that image has no OpenSSL headers - so linking -lssl -lcrypto unconditionally into mqtt_pub-host/mqtt_sub-host broke CI. Probe for openssl/ssl.h at Makefile-configure time instead: when present, build transport_openssl.c in as before; when absent, the host tools still build cleanly and reject -s/-S at runtime with a clear "not supported in this build" message rather than failing to link. broker-tls-smoke's own job (a stock ubuntu-latest runner, not the amiga-dev container) still gets full TLS support either way. Same idiom the TLS plan already designs for Milestone 2's AmiSSL SDK, pulled forward to the host build; mirrors amiauth's own precedent of keeping an optional host OpenSSL dependency out of its core build/test verbs. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QWq1CRLCQy9AaD9UtLRSM9
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Milestone 1 of the TLS plan for #3 (plan posted as a comment there): prove the transport-vtable seam and opt-in flag threading entirely on the host, before any AmiSSL/Amiga-side work.
What this delivers
src/host/transport_openssl.c/.h— a newmqtt_transportover host OpenSSL (1.1+/3.x), structurally mirroringtransport_bsd.c. Certificate and hostname verification on by default (system trust store viaSSL_CTX_set_default_verify_paths(), SNI +SSL_set1_host); explicit insecure-skip-verify mode; same 1sSO_RCVTIMEOpoll trick as the plaintext transport;WANT_READ/WANT_WRITE(and theSO_RCVTIMEOEAGAINtick) map to the vtable's "0 = would-block, not an error" contract;SSL_get_verify_result()is read beforeSSL_free()on handshake failure; no leaks on any error path; no global state. Zero changes tosrc/core.-s(TLS, verify on) /-S(TLS, skip verify); the Amiga ReadArgs templates gainTLS/S/TLSINSECURE/S(plumbed intotool_optsonly — nothing consumes them on the Amiga side until Milestone 3's AmiSSL wiring).tests/broker/tls-smoke.sh/make broker-tls-smoke— mirrorssmoke.sh: scratch Mosquitto with a TLS listener and an on-the-fly self-signed cert. Proves (1) verify-on round-trip with the cert as trust anchor viaSSL_CERT_FILE, (2) skip-verify round-trip against the untrusted cert, (3) verify-on with no trust anchor is rejected. New CI job on the existingbrokerpath filter; the two container jobs' apt-get lines gainlibssl-dev pkg-configsincemake clinow links OpenSSL.userdocs/CLI-Reference.mdgains a "Host development builds" section for-s/-S, noting TLS is opt-in and host-only for now.Verification (all run locally)
make test-host: 249 passed, 0 failed;make cliandmake m68kbuild warning-free;make lintcleanmake broker-smokeandmake broker-tls-smoke: all checks pass-s→ still connects plaintext on port 1883 by default (checked against a real broker on 1883)Deliberately left for later milestones
MIDGE_TLSbuild flag, SDK fetch, on-target TLS smoke (needs the hardware-timing spike first)opts.tlsthrough the Amiga CLIs andmqtt.library(mco_UseTLS,MQTTERR_NOTLS), full Amiga flag docs🤖 Generated with Claude Code
https://claude.ai/code/session_01QWq1CRLCQy9AaD9UtLRSM9