connection lost when trying to connect with aws iot mqtt broker

Question

this is my code

try {
            if (AWSIotKeystoreHelper.isKeystorePresent(keystorePath, keystoreName)) {
                if (AWSIotKeystoreHelper.keystoreContainsAlias(certificateId, keystorePath,
                        keystoreName, keystorePassword)) {
                    Log.i(LOG_TAG, "Certificate " + certificateId
                            + " found in keystore - using for MQTT.");
                    // load keystore from file into memory to pass on connection
                    clientKeyStore = AWSIotKeystoreHelper.getIotKeystore(certificateId,
                            keystorePath, keystoreName, keystorePassword);
                    btnConnect.setEnabled(true);
                    mqttManager.setAutoReconnect(false);
                } else {
                    Log.i(LOG_TAG, "Key/cert " + certificateId + " not found in keystore.");
                }
            } else {
                Log.i(LOG_TAG, "Keystore " + keystorePath + "/" + keystoreName + " not found.");
            }
        } catch (Exception e) {
            Log.e(LOG_TAG, "An error occurred retrieving cert/key from keystore.", e);
        }

        if (clientKeyStore == null) {
            Log.i(LOG_TAG, "Cert/key was not found in keystore - creating new key and certificate.");

            new Thread(new Runnable() {
                @Override
                public void run() {
                    try {
                        // Create a new private key and certificate. This call
                        // creates both on the server and returns them to the
                        // device.
                        CreateKeysAndCertificateRequest createKeysAndCertificateRequest =
                                new CreateKeysAndCertificateRequest();
                        createKeysAndCertificateRequest.setSetAsActive(true);
                        final CreateKeysAndCertificateResult createKeysAndCertificateResult;
                        createKeysAndCertificateResult =
                                mIotAndroidClient.createKeysAndCertificate(createKeysAndCertificateRequest);
                        Log.i(LOG_TAG,
                                "Cert ID: " +
                                        createKeysAndCertificateResult.getCertificateId() +
                                        " created.");

                        // store in keystore for use in MQTT client
                        // saved as alias "default" so a new certificate isn't
                        // generated each run of this application
                        AWSIotKeystoreHelper.saveCertificateAndPrivateKey(certificateId,
                                createKeysAndCertificateResult.getCertificatePem(),
                                createKeysAndCertificateResult.getKeyPair().getPrivateKey(),
                                keystorePath, keystoreName, keystorePassword);


                        // load keystore from file into memory to pass on
                        // connection
                        clientKeyStore = AWSIotKeystoreHelper.getIotKeystore(certificateId,
                                keystorePath, keystoreName, keystorePassword);


                        // Attach a policy to the newly created certificate.
                        // This flow assumes the policy was already created in
                        // AWS IoT and we are now just attaching it to the
                        // certificate.
                        AttachPrincipalPolicyRequest policyAttachRequest =
                                new AttachPrincipalPolicyRequest();
                        policyAttachRequest.setPolicyName(AWS_IOT_POLICY_NAME);
                        policyAttachRequest.setPrincipal(createKeysAndCertificateResult
                                .getCertificateArn());
                        mIotAndroidClient.attachPrincipalPolicy(policyAttachRequest);

                        runOnUiThread(new Runnable() {
                            @Override
                            public void run() {
                                btnConnect.setEnabled(true);
                            }
                        });
                    } catch (Exception e) {
                        Log.e(LOG_TAG,
                                "Exception occurred when generating new private key and certificate.",
                                e);
                    }
                }
            }).start();
        }
    }

    View.OnClickListener connectClick = new View.OnClickListener() {
        @Override
        public void onClick(View v) {

            Log.d(LOG_TAG, "clientId = " + clientId);

            try {
                mqttManager.connect(clientKeyStore, new AWSIotMqttClientStatusCallback() {
                    @Override
                    public void onStatusChanged(final AWSIotMqttClientStatus status,
                            final Throwable throwable) {
                        Log.d(LOG_TAG, "Status = " + String.valueOf(status));

                        runOnUiThread(new Runnable() {
                            @Override
                            public void run() {
                                if (status == AWSIotMqttClientStatus.Connecting) {
                                    tvStatus.setText("Connecting...");

                                } else if (status == AWSIotMqttClientStatus.Connected) {
                                    tvStatus.setText("Connected");

                                } else if (status == AWSIotMqttClientStatus.Reconnecting) {
                                    if (throwable != null) {
                                        Log.e(LOG_TAG, "Connection error.", throwable);
                                    }
                                    tvStatus.setText("Reconnecting");
                                } else if (status == AWSIotMqttClientStatus.ConnectionLost) {
                                    if (throwable != null) {
                                        Log.e(LOG_TAG, "Connection error.", throwable);
                                    }
                                    tvStatus.setText("Disconnected");
                                } else {
                                    tvStatus.setText("Disconnected");

                                }
                            }
                        });
                    }
                });
            } catch (final Exception e) {
                Log.e(LOG_TAG, "Connection error.", e);
                tvStatus.setText("Error! " + e.getMessage());
            }
        }
    };

when i'm trying to connect with aws iot mqtt broker using android phone i got error as under:

E/com.amazonaws.demo.androidpubsub.PubSubActivity: Connection error. Connection lost (32109) - java.io.EOFException at org.eclipse.paho.client.mqttv3.internal.CommsReceiver.run(CommsReceiver.java:146) at java.lang.Thread.run(Thread.java:818) Caused by: java.io.EOFException at java.io.DataInputStream.readByte(DataInputStream.java:77) at org.eclipse.paho.client.mqttv3.internal.wire.MqttInputStream.readMqttWireMessage(MqttInputStream.java:65) at org.eclipse.paho.client.mqttv3.internal.CommsReceiver.run(CommsReceiver.java:107) at java.lang.Thread.run(Thread.java:818)

user_8104378 · Answer

The above exception can be due to variety of reasons such as loss of network connectivity, policy restrictions to connect or subscribe etc. Unfortunately, Mqtt paho client does not always propagate the connectivity exceptions perfectly and so it might be difficult to root cause the issue just from this exception. It seems you are following this sample app. I was able to get the app working with the README instructions. Following are some of the points that I suspect might cause this issue:

Ensure that the following IAM Policy is attached to the unauthenticated role created as part of the Identity Pool creation

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iot:AttachPrincipalPolicy", "iot:CreateKeysAndCertificate" ], "Resource": [ "*" ] } ] }
Ensure that the following IoT Policy is attached to the device certificate

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iot:Connect", "Resource": "" }, { "Effect": "Allow", "Action": [ "iot:Publish", "iot:Subscribe", "iot:Receive" ], "Resource": "" } ] }

Hope it helps!

user_10738573 · Answer

As already suggested, the problem is almost certainly due to not having an appropriate policy attached, but this is further complicated by poor error handling in the AWS sample code. The code above first looks in the device keystore for a saved certificate and, if found, tries to connect using it. If it cannot find a certificate under the expected keystore name, it then creates a new certificate, saves it in the keystore, and then tries to attach the principle policy to it. If anything goes wrong getting the policy from AWS, then you are left with an incorrectly configured entry in the keystore and the code as supplied by AWS can never recover from that. I had spent many hours experimenting with policies without success until I actually traced through the code and realised that it made no difference what policy I specified - the code was ignoring it and using the incorrectly configured policy in the keystore!

In the catch block in the code above, add the following

AWSIotKeystoreHelper.deleteKeystoreAlias(certificateId,
                            keystorePath, keystoreName, keystorePassword);

That will ensure that there is no incorrectly configured certificate hanging around to trip you up.

As far as the initial error is concerned, the problem is probably the name and context of the policy that you specified. I created policies in IAM and they were not recognised - you actually need to create the IoT policy as described above by Roshan within the context of IoT Core Security and specify the name that you give it within the PubSub sample code.

connection lost when trying to connect with aws iot mqtt broker

2 Answers