From 7f569490300f433e2c9fa54467368ecc8f84e015 Mon Sep 17 00:00:00 2001
From: techdada <22725849+techdada@users.noreply.github.com>
Date: Sun, 21 Oct 2018 11:25:44 +0000
Subject: [PATCH] mqtt client ssl enabled

---
 config/config-sample.yaml |  3 +++
 src/mqtt.py               | 28 ++++++++++++++++++++++++++--
 2 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/config/config-sample.yaml b/config/config-sample.yaml
index 71b11fd..6d6affb 100644
--- a/config/config-sample.yaml
+++ b/config/config-sample.yaml
@@ -4,6 +4,9 @@ mqtt:
   username: username
   password: passw0rd
   prefix: home
+  #secure mqtt. uncomment to enable ssl:
+  #ca: "config/roots.pem"
+  #tls_version: "tlsv1.2"
   #send report as json
   json: False
 
diff --git a/src/mqtt.py b/src/mqtt.py
index 4abaded..5d0de22 100644
--- a/src/mqtt.py
+++ b/src/mqtt.py
@@ -1,5 +1,7 @@
 import paho.mqtt.client as mqtt
 import logging
+import os
+import ssl
 from queue import Queue
 from threading import Thread
 import json
@@ -15,8 +17,10 @@ class Mqtt:
     password = ""
     server = "localhost"
     port = 1883
+    ca = None
+    tlsvers = None
     prefix = "home"
-
+    
     _client = None
     _sids = None
     _queue = None
@@ -41,6 +45,10 @@ class Mqtt:
         self.server = mqttConfig.get("server", "localhost")
         self.port = mqttConfig.get("port", 1883)
         self.prefix = mqttConfig.get("prefix", "home")
+        self.ca = mqttConfig.get("ca",None)
+        self.tlsvers = self._get_tls_version(
+                mqttConfig.get("tls_version","tlsv1.2")
+        )
         self.json = mqttConfig.get("json", False)
         self._queue = Queue()
         self._threads = []
@@ -52,8 +60,16 @@ class Mqtt:
             self._client.username_pw_set(self.username, self.password)
         self._client.on_message = self._mqtt_process_message
         self._client.on_connect = self._mqtt_on_connect
-        self._client.connect(self.server, self.port, 60)
+        if (self.ca != None):
+            self._client.tls_set(
+                    ca_certs=self.ca,
+                    cert_reqs=ssl.CERT_REQUIRED,
+                    tls_version=self.tlsvers
+            )
 
+            self._client.tls_insecure_set(False)
+
+        self._client.connect(self.server, self.port, 60)
         # run message processing loop
         t1 = Thread(target=self._mqtt_loop)
         t1.start()
@@ -202,3 +218,11 @@ class Mqtt:
             bright = 255
         value = int('%02x%02x%02x%02x' % (bright, r, g, b), 16)
         return value
+
+    def _get_tls_version(self,tlsString):
+        switcher = {
+            "tlsv1": ssl.PROTOCOL_TLSv1,
+            "tlsv1.1": ssl.PROTOCOL_TLSv1_1,
+            "tlsv1.2": ssl.PROTOCOL_TLSv1_2
+        }
+        return switcher.get(tlsString,ssl.PROTOCOL_TLSv1_2)