@annadata/capacitor-mqtt-quic 0.1.6 → 0.1.7

package/android/install/wolfssl-android/x86_64/share/doc/wolfssl/taoCert.txt

@@ -0,0 +1,176 @@
+
+***** Create a self signed cert ************
+
+1) openssl genrsa 1024 > client-key.pem
+
+2) openssl req -new -x509 -nodes -sha1 -days 1000 -key client-key.pem > client-cert.pem
+
+3) note md5 would be -md5
+
+-- adding metadata to beginning
+
+3) openssl x509 -in client-cert.pem -text > tmp.pem
+
+4) mv tmp.pem client-cert.pem
+
+
+***** Create a CA, signing authority **********
+
+same as self signed, use ca prefix instead of client
+
+
+***** Create a cert signed by CA **************
+
+1) openssl req -newkey rsa:1024 -sha1 -days 1000 -nodes -keyout server-key.pem > server-req.pem
+
+* note if using existing key do: -new -key keyName
+
+2) copy ca-key.pem ca-cert.srl   (why ????)
+
+3) openssl x509 -req -in server-req.pem -days 1000 -sha1 -CA ca-cert.pem -CAkey ca-key.pem -set_serial 01 > server-cert.pem
+
+
+***** Adding Subject Key ID and Authentication Key ID extensions to a cert *****
+
+Create a config file for OpenSSL with the example contents:
+
+    [skidakid]
+    subjectKeyIdentifier=hash
+    authorityKeyIdentifier=keyid
+
+Add to the openssl command for creating a cert signed by a CA step 3 the
+following options:
+
+    -extfile <file.cnf> -extensions skidakid
+
+anywhere before the redirect. This will add the cert's public key hash as the
+Subject Key Identifier, and the signer's SKID as the Authentication Key ID.
+
+
+***** To create a dsa cert ********************
+
+1) openssl dsaparam 512 > dsa512.param       # creates group params
+
+2) openssl gendsa dsa512.param > dsa512.pem  # creates private key
+
+3) openssl req -new -x509 -nodes -days 1000 -key dsa512.pem > dsa-cert.pem 
+
+
+
+
+***** To convert from PEM to DER **************
+
+a) openssl x509 -in cert.pem -inform PEM -out cert.der -outform DER
+
+to convert rsa private PEM to DER :
+
+b) openssl rsa -in key.pem -outform DER -out key.der
+
+
+**** To encrypt rsa key already in pem **********
+
+a) openssl rsa <server-key.pem.bak -des >server-keyEnc.pem
+
+note location of des, pass = yassl123
+
+
+*** To make a public key from a private key ******
+
+
+openssl rsa -in 1024rsa.priv -pubout -out 1024rsa.pub
+
+
+**** To convert to pkcs8 *******
+
+openssl pkcs8 -nocrypt -topk8 -in server-key.pem -out server-keyPkcs8.pem
+
+
+**** To convert to pkcs8 encrypted *******
+
+openssl pkcs8 -topk8 -in server-key.pem -out server-keyPkcs8Enc.pem
+
+passwd: yassl123
+
+to use PKCS#5 v2 instead of v1.5 which is default add
+
+-v2 des3       # file Pkcs8Enc2
+
+to use PKCS#12 instead use -v1 which a 12 algo like
+
+-v1 PBE-SHA1-3DES   # file Pkcs8Enc12 , see man pkcs8 for more info
+-v1 PBE-SHA1-RC4-128   # no longer file Pkcs8Enc12, arc4 now off by default
+
+
+**** To convert from pkcs8 to traditional ****
+
+openssl pkcs8 -nocrypt -in server-keyPkcs8.pem -out server-key.pem
+
+
+*** DH parameters ***
+
+openssl dhparam 2048 > dh2048.param
+
+to add metadata
+
+openssl dhparam -in dh2048.param -text > dh2048.pem
+
+**** ECC ******
+
+1) make a key
+
+    to see types available do
+        openssl ecparam -list_curves
+
+    make a new key
+        openssl ecparam -genkey -text -name secp256r1 -out ecc-key.pem
+
+    convert to compressed
+        openssl ec -in ecc-key.pem -conv_form compressed -out ecc-key-comp.pem 
+
+*** CRL ***
+
+1) create a crl
+
+a) openssl ca -gencrl -crldays 120 -out crl.pem -keyfile ./ca-key.pem -cert ./ca-cert.pem
+
+Error No ./CA root/index.txt so:
+
+b) touch ./CA root/index.txt
+
+a) again
+
+Error No ./CA root/crlnumber so:
+
+c) touch ./CA root/crlnumber
+
+a) again
+
+Error unable to load CRL number
+
+d) add '01' to crlnumber file
+
+a) again
+
+2)  view crl file
+
+openssl crl -in crl.pem -text
+
+3) revoke
+
+openssl ca -revoke server-cert.pem -keyfile ./ca-key.pem -cert ./ca-cert.pem
+
+Then regenerate crl with a)
+
+4) verify
+
+openssl verify -CAfile ./ca-cert.pem  ./server-cert.pem
+
+OK
+
+Make file with both ca and crl
+
+cat ca-cert.pem crl.pem > ca-crl.pem
+
+openssl verify -CAfile ./ca-crl.pem -crl_check ./ca-cert.pem
+
+revoked

package/android/src/main/cpp/CMakeLists.txt

@@ -11,29 +11,23 @@ if(NOT ANDROID_PLATFORM)
     set(ANDROID_PLATFORM android-21)
 endif()
 
-# Default OpenSSL path (can be overridden via -DOPENSSL_ROOT_DIR=...)
-if(NOT OPENSSL_ROOT_DIR)
-    set(OPENSSL_ROOT_DIR "${CMAKE_CURRENT_SOURCE_DIR}/../../install/openssl-android" CACHE PATH "Path to OpenSSL for Android")
-    # ABI-aware layout: allow installs under .../openssl-android/<abi>
-    if(EXISTS "${OPENSSL_ROOT_DIR}/${ANDROID_ABI}")
-        set(OPENSSL_ROOT_DIR "${OPENSSL_ROOT_DIR}/${ANDROID_ABI}" CACHE PATH "Path to OpenSSL for Android (ABI)" FORCE)
+# WolfSSL path (same layout as iOS: TLS backend for ngtcp2). Override via -DWOLFSSL_ROOT_DIR=...
+if(NOT WOLFSSL_ROOT_DIR)
+    set(WOLFSSL_ROOT_DIR "${CMAKE_CURRENT_SOURCE_DIR}/../../install/wolfssl-android" CACHE PATH "Path to WolfSSL for Android")
+    if(EXISTS "${WOLFSSL_ROOT_DIR}/${ANDROID_ABI}")
+        set(WOLFSSL_ROOT_DIR "${WOLFSSL_ROOT_DIR}/${ANDROID_ABI}" CACHE PATH "Path to WolfSSL for Android (ABI)" FORCE)
     endif()
 endif()
-
-# Help FindOpenSSL by pointing at explicit locations when present
-if(NOT OPENSSL_INCLUDE_DIR AND EXISTS "${OPENSSL_ROOT_DIR}/include")
-    set(OPENSSL_INCLUDE_DIR "${OPENSSL_ROOT_DIR}/include")
+if(NOT WOLFSSL_INCLUDE_DIR AND EXISTS "${WOLFSSL_ROOT_DIR}/include")
+    set(WOLFSSL_INCLUDE_DIR "${WOLFSSL_ROOT_DIR}/include")
 endif()
-if(NOT OPENSSL_CRYPTO_LIBRARY AND EXISTS "${OPENSSL_ROOT_DIR}/lib/libcrypto.a")
-    set(OPENSSL_CRYPTO_LIBRARY "${OPENSSL_ROOT_DIR}/lib/libcrypto.a")
+if(NOT WOLFSSL_LIBRARY AND EXISTS "${WOLFSSL_ROOT_DIR}/lib/libwolfssl.a")
+    set(WOLFSSL_LIBRARY "${WOLFSSL_ROOT_DIR}/lib/libwolfssl.a")
 endif()
-if(NOT OPENSSL_SSL_LIBRARY AND EXISTS "${OPENSSL_ROOT_DIR}/lib/libssl.a")
-    set(OPENSSL_SSL_LIBRARY "${OPENSSL_ROOT_DIR}/lib/libssl.a")
+if(NOT WOLFSSL_LIBRARY OR NOT WOLFSSL_INCLUDE_DIR)
+    message(FATAL_ERROR "WolfSSL not found. Build it first: cd android && ./build-wolfssl.sh --abi ${ANDROID_ABI}. Then run ./build-ngtcp2.sh (default uses WolfSSL).")
 endif()
 
-# Find required packages
-find_package(OpenSSL REQUIRED)
-
 # ngtcp2 install/source directories (adjust as needed)
 if(NOT NGTCP2_INSTALL_DIR)
     set(NGTCP2_INSTALL_DIR "${CMAKE_CURRENT_SOURCE_DIR}/../../build/android-${ANDROID_ABI}/install" CACHE PATH "Path to ngtcp2 install")
@@ -52,7 +46,7 @@ if(NOT NGHTTP3_INSTALL_DIR)
 endif()
 set(NGHTTP3_SOURCE_DIR "${CMAKE_CURRENT_SOURCE_DIR}/../../../../nghttp3" CACHE PATH "Path to nghttp3 source")
 
-# Prefer installed libraries, fallback to source build
+# Prefer installed libraries (WolfSSL backend: libngtcp2_crypto_wolfssl.a), fallback to source build
 set(NGTCP2_INCLUDE_DIR "")
 set(NGTCP2_LIBRARY "")
 set(NGTCP2_CRYPTO_LIBRARY "")
@@ -63,10 +57,10 @@ if(EXISTS "${NGTCP2_INSTALL_DIR}/include/ngtcp2/ngtcp2.h")
     elseif(EXISTS "${NGTCP2_INSTALL_DIR}/lib/libngtcp2.so")
         set(NGTCP2_LIBRARY "${NGTCP2_INSTALL_DIR}/lib/libngtcp2.so")
     endif()
-    if(EXISTS "${NGTCP2_INSTALL_DIR}/lib/libngtcp2_crypto_quictls.a")
-        set(NGTCP2_CRYPTO_LIBRARY "${NGTCP2_INSTALL_DIR}/lib/libngtcp2_crypto_quictls.a")
-    elseif(EXISTS "${NGTCP2_INSTALL_DIR}/lib/libngtcp2_crypto_quictls.so")
-        set(NGTCP2_CRYPTO_LIBRARY "${NGTCP2_INSTALL_DIR}/lib/libngtcp2_crypto_quictls.so")
+    if(EXISTS "${NGTCP2_INSTALL_DIR}/lib/libngtcp2_crypto_wolfssl.a")
+        set(NGTCP2_CRYPTO_LIBRARY "${NGTCP2_INSTALL_DIR}/lib/libngtcp2_crypto_wolfssl.a")
+    elseif(EXISTS "${NGTCP2_INSTALL_DIR}/lib/libngtcp2_crypto_wolfssl.so")
+        set(NGTCP2_CRYPTO_LIBRARY "${NGTCP2_INSTALL_DIR}/lib/libngtcp2_crypto_wolfssl.so")
     endif()
 else()
     if(NOT EXISTS "${NGTCP2_SOURCE_DIR}/lib/includes/ngtcp2/ngtcp2.h" AND NOT EXISTS "${NGTCP2_SOURCE_DIR}/lib/ngtcp2.h")
@@ -114,14 +108,12 @@ target_include_directories(ngtcp2_client PRIVATE
     ${NGHTTP3_INCLUDE_DIR}
     ${NGTCP2_SOURCE_DIR}/lib/includes
     ${NGHTTP3_SOURCE_DIR}/lib/includes
-    ${OpenSSL_INCLUDE_DIR}
+    ${WOLFSSL_INCLUDE_DIR}
 )
 
-# Link libraries
+# Link libraries: WolfSSL + ngtcp2 (same TLS backend as iOS)
 target_link_libraries(ngtcp2_client
-    # OpenSSL
-    ${OpenSSL_LIBRARIES}
-    # Android log
+    ${WOLFSSL_LIBRARY}
     log
 )
 

package/android/src/main/cpp/ngtcp2_jni.cpp

@@ -10,11 +10,9 @@
 
 #include <ngtcp2/ngtcp2.h>
 #include <ngtcp2/ngtcp2_crypto.h>
-#include <ngtcp2/ngtcp2_crypto_quictls.h>
+#include <ngtcp2/ngtcp2_crypto_wolfssl.h>
 
-#include <openssl/ssl.h>
-#include <openssl/rand.h>
-#include <openssl/err.h>
+#include <wolfssl/ssl.h>
 
 #include <arpa/inet.h>
 #include <fcntl.h>
@@ -300,39 +298,35 @@ class QuicClient {
   }
 
   int init_tls(const std::string &alpn) {
-    if (ngtcp2_crypto_quictls_init() != 0) {
-      setError("ngtcp2_crypto_quictls_init failed");
-      return -1;
-    }
-    ssl_ctx_ = SSL_CTX_new(TLS_client_method());
+    ssl_ctx_ = wolfSSL_CTX_new(wolfTLS_client_method());
     if (!ssl_ctx_) {
-      setError("SSL_CTX_new failed");
+      setError("wolfSSL_CTX_new failed");
       return -1;
     }
-    if (ngtcp2_crypto_quictls_configure_client_context(ssl_ctx_) != 0) {
-      setError("ngtcp2_crypto_quictls_configure_client_context failed");
+    if (ngtcp2_crypto_wolfssl_configure_client_context(ssl_ctx_) != 0) {
+      setError("ngtcp2_crypto_wolfssl_configure_client_context failed");
       return -1;
     }
-    SSL_CTX_set_verify(ssl_ctx_, SSL_VERIFY_PEER, nullptr);
+    wolfSSL_CTX_set_verify(ssl_ctx_, WOLFSSL_VERIFY_PEER, nullptr);
 
-    ssl_ = SSL_new(ssl_ctx_);
+    ssl_ = wolfSSL_new(ssl_ctx_);
     if (!ssl_) {
-      setError("SSL_new failed");
+      setError("wolfSSL_new failed");
       return -1;
     }
-    SSL_set_app_data(ssl_, &conn_ref_);
-    SSL_set_connect_state(ssl_);
+    wolfSSL_set_app_data(ssl_, &conn_ref_);
+    wolfSSL_set_connect_state(ssl_);
 
     std::string alpn_vec;
     alpn_vec.push_back(static_cast<char>(alpn.size()));
     alpn_vec.append(alpn);
-    SSL_set_alpn_protos(ssl_,
-                        reinterpret_cast<const unsigned char *>(alpn_vec.data()),
-                        (unsigned int)alpn_vec.size());
-    SSL_set_tlsext_host_name(ssl_, host_.c_str());
+    wolfSSL_set_alpn_protos(ssl_,
+                            reinterpret_cast<const unsigned char *>(alpn_vec.data()),
+                            (unsigned int)alpn_vec.size());
+    wolfSSL_set_tlsext_host_name(ssl_, host_.c_str());
 
-    if (SSL_set1_host(ssl_, host_.c_str()) != 1) {
-      setError("SSL_set1_host failed");
+    if (wolfSSL_set1_host(ssl_, host_.c_str()) != 1) {
+      setError("wolfSSL_set1_host failed");
       return -1;
     }
 
@@ -340,14 +334,14 @@ class QuicClient {
     const char *ca_file = std::getenv("MQTT_QUIC_CA_FILE");
     const char *ca_path = std::getenv("MQTT_QUIC_CA_PATH");
     if ((ca_file && ca_file[0] != '\0') || (ca_path && ca_path[0] != '\0')) {
-      if (SSL_CTX_load_verify_locations(ssl_ctx_, ca_file, ca_path) != 1) {
+      if (wolfSSL_CTX_load_verify_locations(ssl_ctx_, ca_file, ca_path) != 1) {
         setError("Failed to load CA bundle from MQTT_QUIC_CA_FILE/CA_PATH");
         return -1;
       }
       ca_loaded = true;
     }
     if (!ca_loaded) {
-      if (SSL_CTX_set_default_verify_paths(ssl_ctx_) == 1) {
+      if (wolfSSL_CTX_set_default_verify_paths(ssl_ctx_) == 1) {
         ca_loaded = true;
       }
     }
@@ -403,13 +397,13 @@ class QuicClient {
 
     ngtcp2_cid dcid, scid;
     dcid.datalen = NGTCP2_MIN_INITIAL_DCIDLEN;
-    if (RAND_bytes(dcid.data, (int)dcid.datalen) != 1) {
-      setError("RAND_bytes failed");
+    if (wolfSSL_RAND_bytes(dcid.data, (int)dcid.datalen) != 1) {
+      setError("wolfSSL_RAND_bytes failed");
       return -1;
     }
     scid.datalen = 8;
-    if (RAND_bytes(scid.data, (int)scid.datalen) != 1) {
-      setError("RAND_bytes failed");
+    if (wolfSSL_RAND_bytes(scid.data, (int)scid.datalen) != 1) {
+      setError("wolfSSL_RAND_bytes failed");
       return -1;
     }
 
@@ -658,11 +652,11 @@ class QuicClient {
       conn_ = nullptr;
     }
     if (ssl_) {
-      SSL_free(ssl_);
+      wolfSSL_free(ssl_);
       ssl_ = nullptr;
     }
     if (ssl_ctx_) {
-      SSL_CTX_free(ssl_ctx_);
+      wolfSSL_CTX_free(ssl_ctx_);
       ssl_ctx_ = nullptr;
     }
     if (fd_ != -1) {
@@ -693,7 +687,7 @@ class QuicClient {
   static void rand_cb(uint8_t *dest, size_t destlen,
                       const ngtcp2_rand_ctx *rand_ctx) {
     (void)rand_ctx;
-    if (RAND_bytes(dest, (int)destlen) != 1) {
+    if (wolfSSL_RAND_bytes(dest, (int)destlen) != 1) {
       abort();
     }
   }
@@ -703,11 +697,11 @@ class QuicClient {
                                       void *user_data) {
     (void)conn;
     (void)user_data;
-    if (RAND_bytes(cid->data, (int)cidlen) != 1) {
+    if (wolfSSL_RAND_bytes(cid->data, (int)cidlen) != 1) {
       return NGTCP2_ERR_CALLBACK_FAILURE;
     }
     cid->datalen = cidlen;
-    if (RAND_bytes(token, NGTCP2_STATELESS_RESET_TOKENLEN) != 1) {
+    if (wolfSSL_RAND_bytes(token, NGTCP2_STATELESS_RESET_TOKENLEN) != 1) {
       return NGTCP2_ERR_CALLBACK_FAILURE;
     }
     return 0;
@@ -777,8 +771,8 @@ class QuicClient {
   struct sockaddr_storage local_addr_;
   socklen_t local_addrlen_;
 
-  SSL_CTX *ssl_ctx_;
-  SSL *ssl_;
+  WOLFSSL_CTX *ssl_ctx_;
+  WOLFSSL *ssl_;
   ngtcp2_conn *conn_;
   ngtcp2_crypto_conn_ref conn_ref_;
   ngtcp2_ccerr last_error_;

package/android/src/main/kotlin/ai/annadata/mqttquic/MqttQuicPlugin.kt

@@ -7,7 +7,10 @@ import com.getcapacitor.Plugin
 import com.getcapacitor.PluginCall
 import com.getcapacitor.PluginMethod
 import com.getcapacitor.annotation.CapacitorPlugin
+import android.os.Handler
+import android.os.Looper
 import android.system.Os
+import android.util.Base64
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.launch
@@ -85,6 +88,18 @@ class MqttQuicPlugin : Plugin() {
                     client.disconnect()
                 }
                 client = MQTTClient(protocolVersion)
+                // Forward every incoming PUBLISH to JS so addListener('message', ...) receives topic + payload
+                client.onPublish = { topic, payload ->
+                    val payloadStr = try {
+                        String(payload, StandardCharsets.UTF_8)
+                    } catch (_: Exception) {
+                        Base64.encodeToString(payload, Base64.NO_WRAP)
+                    }
+                    val data = JSObject().put("topic", topic).put("payload", payloadStr)
+                    Handler(Looper.getMainLooper()).post {
+                        notifyListeners("message", data)
+                    }
+                }
                 client.connect(host, port, clientId, username, password, cleanSession, keepalive, sessionExpiryInterval)
                 call.resolve(JSObject().put("connected", true))
                 notifyListeners("connected", JSObject().put("connected", true))

package/android/src/main/kotlin/ai/annadata/mqttquic/client/MQTTClient.kt

@@ -57,6 +57,9 @@ class MQTTClient {
     private var keepaliveJob: kotlinx.coroutines.Job? = null
     private var nextPacketId = 1
     private val subscribedTopics = mutableMapOf<String, (ByteArray) -> Unit>()
+    /** Optional global callback for every incoming PUBLISH (topic, payload). Used by plugin to forward to JS. */
+    @Volatile
+    var onPublish: ((String, ByteArray) -> Unit)? = null
     /** Per-connection Topic Alias map (alias -> topic name) for MQTT 5.0 incoming PUBLISH. */
     private val topicAliasMap = mutableMapOf<Int, String>()
     private val lock = Mutex()
@@ -430,9 +433,10 @@ class MQTTClient {
                                 }
                             }
 
-                            val (cb, _) = lock.withLock {
-                                subscribedTopics[topic] to activeProtocolVersion
+                            val (cb, globalCb) = lock.withLock {
+                                subscribedTopics[topic] to onPublish
                             }
+                            globalCb?.invoke(topic, payload)
                             cb?.invoke(payload)
 
                             if (qos >= 1 && packetId != null) {