Skip to content

Commit efdb3c6

Browse files
lxsaahclaudetest
authored
Embassy MQTT client: TLS support (#175)
* docs(design): add 044 — Embassy MQTT client TLS Resolves 042 §8.1 option 1: embedded-tls 1.3 over the Embassy TCP socket with rustpki certificate verification, injected TRNG entropy, an SNTP time source, DNS resolution, and broker authentication — plus the gamma wiring and the open questions (CA distribution, record-size negotiation). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(mqtt-connector): TLS, auth, and SNTP time source for the Embassy client Implements design 044: mqtts:// broker support behind a new embassy-tls feature. - embedded-tls 1.3 session over the Embassy TCP socket; rustpki (pure Rust, rsa+p384) certificate verification against an app-embedded root CA; SNI + hostname verification from the broker URL (IP-literal mqtts URLs are rejected at build()). - Entropy injected via TlsOptions (&'static mut dyn CryptoRngCore) — the app owns the TRNG; buffers are app-provided statics (D3, D10). - Connector-internal SNTPv4 task (UDP + DNS) backs the TlsClock; the first handshake waits for time sync so validity is always checked (D4, D5). The wire codec is feature-independent and host-tested. - The TLS manager loop is a connector-local port of mountain-mqtt-embassy's run() (which hard-codes a plain TcpSocket); the session speaks a custom Connection impl tracking decrypted plaintext + socket readiness, and re-subscribes inbound routes per session. The plain path is untouched (D6). - with_credentials() feeds MQTT CONNECT on both transports; the fork submodule gains upstream 0.4's ConnectionSettings::with_auth/ authenticated (aimdb-dev/mountain-mqtt@89a7129) (D8). - make check gains the embassy-runtime,embassy-tls,defmt clippy leg. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(audit): update advisories to ignore known vulnerabilities in dependencies * refactor: remove design references from mqtt-connector doc comments * chore: remove unused dependencies from Cargo.lock and deny.toml * Implement TLS support in the Embassy MQTT connector - Added `embassy_tls` feature to enable TLS connections using `embedded-tls`. - Introduced `TlsOptions` for configuring TLS parameters, including read and write buffers. - Updated the MQTT connection logic to handle both plain and TLS connections based on the feature flag. - Implemented SNTP for time synchronization to ensure certificate validity during TLS handshakes. - Enhanced error handling for IP literals in broker URLs, rejecting IPv6 literals and warning for IPv4 literals. - Updated documentation and examples to reflect the new TLS capabilities and usage instructions. * feat: update heap size for MQTT demo and adjust binary path in flash script * docs(changelog): record Embassy MQTT TLS support (design 044, WP7) Adds Unreleased entries in the root and aimdb-mqtt-connector changelogs for the embassy-tls feature, with_tls/with_credentials, and the SNTP time source landed in the preceding commits. * refactor(mqtt-connector): reuse upstream session loop; fix plain-path resubscribe The Embassy connector no longer copies mountain-mqtt-embassy's session loop (`State`/`ChannelEventHandler`/`try_action`/`handle_messages`, ~195 lines). It now calls the newly-public upstream `handle_messages`, so the plain and TLS paths share one keep-alive/action-dispatch/event implementation and can't drift. The plain `mqtt://` path switches to `run_with_subscriptions`, which re-subscribes the inbound topics on every connection. Previously it queued subscribe actions once at startup, so subscriptions were silently lost after a reconnect. Bumps the mountain-mqtt submodule to the matching upstream change. Net: -215/+30 in the connector; behaviour on the TLS path is unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(embassy): re-pin submodule to aimdb-dev/embassy main (217dbc9e1) Moves the `_external/embassy` pin from `20f6d85e8` (the standalone #6390 poll-methods commit) to the fork's main `217dbc9e1`, which merges that commit onto current upstream. No code change — 217dbc9e1's tree contains the same poll-method additions; this just points the pin at the fork's main line so the branch tracks main instead of a feature commit. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * chore(embassy): refresh fork main to upstream + keep #6390 carry Re-pins `_external/embassy` to d60764b5 — the aimdb-dev/embassy fork main merged up to current embassy-rs upstream (124 commits) with the #6390 public poll_next_message / poll_changed carry retained. Verified compiling on thumbv7em-none-eabihf: embassy-adapter, mqtt-connector (embassy-tls), demo binary. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: test <test@test.local>
1 parent b5658b4 commit efdb3c6

21 files changed

Lines changed: 1896 additions & 81 deletions

File tree

‎.cargo/audit.toml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,11 @@
22
# See: https://github.com/rustsec/rustsec/blob/main/cargo-audit/audit.toml.example
33

44
[advisories]
5-
# Advisories to ignore (transitive dependencies we can't fix)
6-
ignore = []
5+
# Advisories to ignore (transitive dependencies we can't fix in the current
6+
# embedded and CLI dependency graph). These are tracked upstream and have no
7+
# viable replacement in the workspace today.
8+
ignore = [
9+
"RUSTSEC-2023-0071", # rsa timing sidechannel via embedded-tls; no fixed upgrade available
10+
"RUSTSEC-2026-0110", # bare-metal deprecated via cortex-m (embedded-only transitive)
11+
"RUSTSEC-2026-0173", # proc-macro-error2 unmaintained (transitive via defmt/tabled_derive)
12+
]

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,7 @@ multi-step migration round-trip suite and a trybuild compile-fail harness.
105105

106106
### Added
107107

108+
- **Embassy MQTT client TLS — `mqtts://` for embedded, WP7 ([design 044](docs/design/044-embassy-mqtt-tls.md)).** The Embassy MQTT connector can now dial a broker over TLS 1.3 (`embedded-tls`, pure-Rust `rustpki` certificate verification with `rsa`/`p384` so public CA chains verify out of the box), with SNI/hostname verification, DNS resolution, and a connector-internal SNTP time source that gates the first handshake so certificate validity is always checked against real time. Behind the new `embassy-tls` feature; `MqttConnectorBuilder::new` picks the transport from the URL scheme (`mqtt://` plain, `mqtts://` TLS) and gains `with_tls(TlsOptions)` (entropy, record buffers, SNTP server) and `with_credentials(username, password)` (MQTT CONNECT auth, both transports). The plain `mqtt://` path is untouched. The `embassy-mqtt-connector-demo` example gains a `tls` feature demonstrating the full flow against the repo's `dev/mosquitto` bench broker. ([aimdb-mqtt-connector](aimdb-mqtt-connector/CHANGELOG.md))
108109
- **Design 034 Phase 3 — sans-io KNX/IP tunneling engine shared by both transports (Issue #135, [review doc §3.7](docs/design/034-technical-debt-review.md)).** The entire tunneling lifecycle — CONNECT_REQUEST/RESPONSE handshake, TUNNELING_REQUEST/ACK sequence + pending-ACK bookkeeping, keepalive (CONNECTIONSTATE_REQUEST) scheduling, ACK-timeout sweeps, and reconnect-with-backoff — now lives **once**, in the new runtime-neutral `aimdb_knx_connector::tunnel` module (`no_std + alloc`, no tokio/embassy imports), driven as a poll-based state machine (events in, `Action`s out, `next_deadline()` for timer arming). `tokio_client.rs` (988 → ~530 lines incl. a new fake-gateway integration test) and `embassy_client.rs` (1,055 → ~450 lines) are reduced to socket shims; the previously untestable handshake/ACK/keepalive/reconnect paths now have 15 host-run unit tests plus a scripted localhost-UDP roundtrip test. Behavioral unifications: Embassy gains the 5 s CONNECT_RESPONSE timeout (previously waited forever), both shims reconnect on fatal socket errors, and the dead tokio-only per-publish ACK oneshot is dropped (it was always `None`); the CONNECT_REQUEST HPAI stays per-transport (`LocalEndpoint`: tokio = real bound address, Embassy = NAT mode). ([aimdb-knx-connector](aimdb-knx-connector/CHANGELOG.md))
109110

110111
- **Design 034 Phase 2 — dyn-safe `RuntimeOps` capability trait (Issue #130, [review doc](docs/design/034-technical-debt-review.md)).** New object-safe trait in `aimdb-executor` (`name` / `now_nanos` / `unix_time` / boxed `sleep` / `log(LogLevel, …)`) so a runtime adapter can travel as `Arc<dyn RuntimeOps>` instead of a generic parameter — the groundwork for removing `R` from the record object graph (#131). Implemented by `TokioAdapter`, `EmbassyAdapter`, and `WasmAdapter`, each covered by a shared behavioral contract test. `BoxFuture`'s canonical definition moves to `aimdb-executor` (re-exported unchanged from `aimdb-core`). ([aimdb-executor](aimdb-executor/CHANGELOG.md), [aimdb-tokio-adapter](aimdb-tokio-adapter/CHANGELOG.md), [aimdb-embassy-adapter](aimdb-embassy-adapter/CHANGELOG.md), [aimdb-wasm-adapter](aimdb-wasm-adapter/CHANGELOG.md))

0 commit comments

Comments
 (0)