Elk M1G SSL Error after updating M1XEP to v 2.0.46 about elkm1 HOT 7 CLOSED

Looking now. Assuming the fix is as easy as changing the one line it should be done today or tomorrow.

from elkm1.

Switching from ssl.PROTOCOL_TLSv1 to ssl.PROTOCOL_TLS does not work. Here are a couple of things I tied. I'm using the 2.0.34 version of the firmware on the Ethernet board which support TLS 1.1.

This did not work:

        ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS)
        ssl_context.options |= ssl.OP_NO_SSLv2 | ssl.OP_NO_SSLv3 | ssl.OP_NO_TLSv1_2 | ssl.OP_NO_TLSv1_3

This also did not work:

        ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS)
        ssl_context.options = ssl.PROTOCOL_TLSv1_1

@bdraco do you have any thoughts? I'll poke around a bit more during the weekend to see if I can learn something new.

from elkm1.

I'm guessing, but know little about TLS negotiation, is that ElkM1 does not support negotiation, so you need to specify the version of TLS specific to the version of the Ethernet firmware. If that is the case then a parameter is needed, which would have to be specified in HA and passed through to the library. If this is true then here is what I propose: elks:// is TLSv1, elksv1 is TLSv1, and elksv1_2 is TLSv1_2. Might as well add elksv1_3 while I'm changing the lib, even those no ElkM1 supports it yet.

The code for TLSv1 (other versions would be similar) would be something such as:

        ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS)
        ssl_context.minimum_version = ssl.TLSVersion.TLSv1
        ssl_context.maximum_version = ssl.TLSVersion.TLSv1

To learn about negotiation, I tried this: openssl s_client -connect 192.168.1.12:2601 -prexit which failed.

I then tried this: openssl s_client -connect 192.168.1.12:2601 -prexit -no_tls1_1 -no_tls1_2 which worked.

I will go ahead with changes once there's some responses on this thread. If we go ahead as proposed it would be great if someone could change the HA code, I don't have a dev environment setup.

from elkm1.

That sounds right. I haven't upgraded my firmware yet and I'm traveling so I can't test. Pretty lame that it can't do negotiation.

from elkm1.

from elkm1.

FYI, fallback until this fix makes its way through is to use elk://, the non-secure connection.

from elkm1.

I've push a new version of the ElkM1 library which adds support for TLS 1.2.

To use the HA config GUI changes are required to use the new protocol. If you are using the YAML config then I believe it should work (but have not checked) by changing from elks:// to elksv1_2://

I won't have time this week to look at the HA changes... life has thrown a few curve balls. I'm going to close this issue. I recommend to get the HA changes in open a bug against that project. That will help with tracking, and perhaps someone else can pick it up.

Check this project's README for details on the change, or "use the code Luke" - they are pretty simple.

And BTW, I bumped the version of this lib to 1.0.0! Woo hoo! Its out of beta!

from elkm1.