buglwIP - A Lightweight TCP/IP stack - Bugs: bug #60078, MQTTS : Support SNI extension...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #60078: MQTTS : Support SNI extension needed for some cloud

Submitter:  Jonathan D <jona>
Submitted:  Thu 18 Feb 2021 09:00:46 PM UTC
   
 
Category:  apps Severity:  3 - Normal
Item Group:  Feature Request Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open Planned Release:  None
lwIP version:  git head

Fri 08 Sep 2023 06:53:26 PM UTC, comment #2: 

Sorry about the formatting. Should have checked preview. Hope this is better:

Time,Source,Destination,Protocol,Length,Info

0,10.0.0.11,54.156.47.148,TLSv1.2,336,Client Hello

0.016360719,54.156.47.148,10.0.0.11,TLSv1.2,150,Server Hello

0.001577507,54.156.47.148,10.0.0.11,TLSv1.2,685,Certificate

0.00001705,54.156.47.148,10.0.0.11,TLSv1.2,438,"Server Key Exchange, Certificate Request, Server Hello Done"

2.518046294,10.0.0.11,54.156.47.148,TLSv1.2,1329,"Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message"

0.015707564,54.156.47.148,10.0.0.11,TLSv1.2,60,Change Cipher Spec

0.000007277,54.156.47.148,10.0.0.11,TLSv1.2,99,Encrypted Handshake Message

0.001473909,10.0.0.11,54.156.47.148,TLSv1.2,193,Application Data

0.022366332,54.156.47.148,10.0.0.11,TLSv1.2,85,Encrypted Alert


Roger Sala <rsala>
Fri 08 Sep 2023 06:47:58 PM UTC, comment #1: 

I am developing a AWS IoT MQTT client on STM32H723 using FreeRTOS 10.3.1, LwIP 2.1.2 and MbedTLS 2.28.4. Through debugging and looking at Wireshark captures, it appears that this client is successfully completing the TLS handshake:

Time,Source,Destination,Protocol,Length,Info 0,10.0.0.11,54.156.47.148,TLSv1.2,336,Client Hello 0.016360719,54.156.47.148,10.0.0.11,TLSv1.2,150,Server Hello 0.001577507,54.156.47.148,10.0.0.11,TLSv1.2,685,Certificate 0.00001705,54.156.47.148,10.0.0.11,TLSv1.2,438,"Server Key Exchange, Certificate Request, Server Hello Done" 2.518046294,10.0.0.11,54.156.47.148,TLSv1.2,1329,"Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message" 0.015707564,54.156.47.148,10.0.0.11,TLSv1.2,60,Change Cipher Spec 0.000007277,54.156.47.148,10.0.0.11,TLSv1.2,99,Encrypted Handshake Message

... and then when it attempts to connect ...

0.001473909,10.0.0.11,54.156.47.148,TLSv1.2,193,Application Data 0.022366332,54.156.47.148,10.0.0.11,TLSv1.2,85,Encrypted Alert

... the IoT broker issues an encrypted alert which I believe to be a TLS close_notify, because it is followed by a TCP FIN shortly afterwards. I've confirmed in the debugger that the penultimate "Application Data" packet is in fact the MQTT connect.

I've been through all the AWS troubleshooting guides and my certificates are all good and I have my policy sent to --

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "iot:", "Resource": "" } ] }

-- such that I can connect and publish to it with mosquitto_pub using any random client ID and topic. Furthermore this client can connect to a local mosquitto broker that I have set up and the decrypted disection of the Wireshark capture of the success MQTT connect looks to be in order.

Failures that take place before a MQTT connect are not included in the AWS logs so I'm at a loss. Is the reason I'm not able to connect due to the fact that I'm not including the SNI?

Roger Sala <rsala>
Thu 18 Feb 2021 09:00:46 PM UTC, original submission:  

To be able to connect to a cloud with MQTT, some providers required to provide the SNI extension in TLS as mentionned here :
https://docs.aws.amazon.com/iot/latest/developerguide/transport-security.html

I attached a patch as a discussion basis.

I succeed to connect to AWS with modifications similar to the patch attached except that instead of modifying the prototypes, I duplicate the functions with different arguments.

Hope this helps

Jonathan D <jona>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rsala (Posted a comment)
  • -email is unavailable- added by jona (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-02-18 jona Attached File- Added 0001-Discussion-basis-to-write-the-SNI-for-MQTTS.patch, #50881

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code