Re: [mosquitto-dev] Mosquitto remote_password for bridge with space char

[Mikkel Kirkgaard Nielsen <miki@xxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi Sebastian.

On 2016-04-28 15:55, Sebastian Koch wrote:
> does anyone know how the password is parsed from the config file
> by mosquitto, is the space the problem here?

The space will give you trouble as the code of src/conf.c line 1536
(http://git.eclipse.org/c/mosquitto/org.eclipse.mosquitto.git/tree/src/conf.c?h=v1.4.7#n1536)
will parse only until the first space after "remote_password", so that
is a no-go.

- ---
token = strtok_r(NULL, " ", &saveptr);
- ---

HTML-encoding would make mosquitto use the full string, but maybe the
other end (the Azure stuff) won't try to decode it. Their docs may say
something about that.

Any quotation marks or escaping attempts will become part of the
password string, so that won't work unless agreed upon with the other
end. And it won't make a difference to the space parsing either.

As far as I can see the MQTT v3.1.1 standard doesn't limit the
contents of the PASSWORD field beyond "binary"
(http://docs.oasis-open.org/mqtt/mqtt/v3.1.1/os/mqtt-v3.1.1-os.html#_Toc385349246).
So I guess the inability to use a password containing a space is a
flaw of the current Mosquitto implementation.

- -- 
    Mikkel
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBAgAGBQJXIkQLAAoJEJ2luFWzaTSaLfoIAI6fNOjeXQrjKokKI9gBWljS
KH3u722SVNdiHdtsX4L/aqX4+vmDhnzUckKuTPe/DS1KKTZK0GmblzOXvnhPQTAb
Nc/gwOeiMUv1DiGwBPGi/9Z/FGjDgYlm3/B6qoJUlwJO9qP57JZxciuosGt3tT/7
ts9H3v9Pa7SlPB1u0YDQU3XiknvOea4rRPdGbGgL/fQDdiLCSZb1EMhA9zqfwFKw
NDELtQZgWGQQnLlcbbDC3XHWNDK0nlKLxW1QCSP5kdQW6+6Bi+qT2ovaKb5woxKL
CVE54YjZuBhWLw60wYzzeHW8mV1N7hiJfqpV6Jtf77iJoI18ygjJw4KqIQHRwS8=
=/TvW
-----END PGP SIGNATURE-----