search

eclipse / amlen

Message Broker for IoT/Mobile/Web. Mainly uses MQTT v3.x and v5. Aims to be easy to use, scalable and reliable
Eclipse Public License 2.0
46 stars 11 forks source link

Amlen imaserver adding ssl key aes25 does not work - imaserver crashes #189

Open gfvh opened 2 weeks ago

gfvh commented 2 weeks ago

Hi

Steps reproduce

openssl genpkey -aes256 -algorithm RSA -out server.key -pkeyopt rsa_keygen_bits:2048 openssl req -new -out client.csr -key server.key openssl req -x509 -new -nodes -key server.key -sha256 -days 7304 -out clieent.crt

Then add in imawebui under Certificate Profiles cert and key. Result is imaserver crashes. Tried on two separate docker servers.

openssl ciphers -V |grep AES256

      0xC0,0x2C - ECDHE-ECDSA-AES256-GCM-SHA384  TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESGCM(256)            Mac=AEAD
      0xC0,0x30 - ECDHE-RSA-AES256-GCM-SHA384    TLSv1.2 Kx=ECDH     Au=RSA   Enc=AESGCM(256)            Mac=AEAD
      0xC0,0xAD - ECDHE-ECDSA-AES256-CCM         TLSv1.2 Kx=ECDH     Au=ECDSA Enc=AESCCM(256)            Mac=AEAD
      0xC0,0x0A - ECDHE-ECDSA-AES256-SHA         TLSv1   Kx=ECDH     Au=ECDSA Enc=AES(256)               Mac=SHA1
      0xC0,0x14 - ECDHE-RSA-AES256-SHA           TLSv1   Kx=ECDH     Au=RSA   Enc=AES(256)               Mac=SHA1
      0x00,0x9D - AES256-GCM-SHA384              TLSv1.2 Kx=RSA      Au=RSA   Enc=AESGCM(256)            Mac=AEAD
      0xC0,0x9D - AES256-CCM                     TLSv1.2 Kx=RSA      Au=RSA   Enc=AESCCM(256)            Mac=AEAD
      0x00,0x3D - AES256-SHA256                  TLSv1.2 Kx=RSA      Au=RSA   Enc=AES(256)               Mac=SHA256
      0x00,0x35 - AES256-SHA                     SSLv3   Kx=RSA      Au=RSA   Enc=AES(256)               Mac=SHA1
      0x00,0x9F - DHE-RSA-AES256-GCM-SHA384      TLSv1.2 Kx=DH       Au=RSA   Enc=AESGCM(256)            Mac=AEAD
      0xC0,0x9F - DHE-RSA-AES256-CCM             TLSv1.2 Kx=DH       Au=RSA   Enc=AESCCM(256)            Mac=AEAD
      0x00,0x6B - DHE-RSA-AES256-SHA256          TLSv1.2 Kx=DH       Au=RSA   Enc=AES(256)               Mac=SHA256
      0x00,0x39 - DHE-RSA-AES256-SHA             SSLv3   Kx=DH       Au=RSA   Enc=AES(256)               Mac=SHA1
      0x00,0xA9 - PSK-AES256-GCM-SHA384          TLSv1.2 Kx=PSK      Au=PSK   Enc=AESGCM(256)            Mac=AEAD
      0xC0,0xA5 - PSK-AES256-CCM                 TLSv1.2 Kx=PSK      Au=PSK   Enc=AESCCM(256)            Mac=AEAD
      0x00,0x8D - PSK-AES256-CBC-SHA             SSLv3   Kx=PSK      Au=PSK   Enc=AES(256)               Mac=SHA1
      0x00,0xAB - DHE-PSK-AES256-GCM-SHA384      TLSv1.2 Kx=DHEPSK   Au=PSK   Enc=AESGCM(256)            Mac=AEAD
      0xC0,0xA7 - DHE-PSK-AES256-CCM             TLSv1.2 Kx=DHEPSK   Au=PSK   Enc=AESCCM(256)            Mac=AEAD
      0x00,0x91 - DHE-PSK-AES256-CBC-SHA         SSLv3   Kx=DHEPSK   Au=PSK   Enc=AES(256)               Mac=SHA1
      0xC0,0x36 - ECDHE-PSK-AES256-CBC-SHA       TLSv1   Kx=ECDHEPSK Au=PSK   Enc=AES(256)               Mac=SHA1
      0x00,0xAD - RSA-PSK-AES256-GCM-SHA384      TLSv1.2 Kx=RSAPSK   Au=RSA   Enc=AESGCM(256)            Mac=AEAD
      0x00,0x95 - RSA-PSK-AES256-CBC-SHA         SSLv3   Kx=RSAPSK   Au=RSA   Enc=AES(256)               Mac=SHA1`

I have noticed adding without password rsa key works. Without aes256 cipher. On command line openssl password verify works.

What can do get aes256 as well working and with password for imaserver or is this bug?

env:

Almalinux 9 Selinux off Imaserver: 1.0.0.2 20240124-1010_eclipse 2024-01-24 10:43

matslindh commented 1 week ago

This is caused by the current version of openssl in the new distributions used by the docker images (or by the base OS) not accepting -passin pass: with an empty password as signifying an empty password, but as querying the user for a password.

The amlen server gets stuck in an interactive prompt from openssl asking for the private key password. This can be seen if running the amlen server in the foregrounds (either in docker or by itself).

As far as I've been able to discern there is no option to just provide an empty password to verify whether the key is protected or not, but you can provide an invalid password to get the same behavior as earlier (i.e. use __DUMMY_PASSWORD_DO_NOT_USE__ or something similar as a placeholder (or if you want to make it more robust, call openssl twice with different dummy passwords, just to cover the case of someone using __DUMMY_PASSWORD_DO_NOT_USE__ as their actual password.

One of these locations is here:

https://github.com/eclipse/amlen/blob/main/server_main/scripts/certApply.sh#L323

I have a small patch that uses a dummy password in those three locations I've found so far (in certApply.sh - there is also a two instances of the same pattern in imacertutils.sh, but I haven't tested any changes there).