Subject: [Anima] Registrar to MASA connections: SNI required

From: Michael Richardson <[email-masked]>
Date: Tue, 06 Jul 2021 13:15:12 -0400

In section 5.1 of RFC8995, we say:

>   Use of TLS 1.3 (or newer) is encouraged.  TLS 1.2 or newer is
>   REQUIRED on the Pledge side.  TLS 1.3 (or newer) SHOULD be available
>   on the Registrar server interface, and the Registrar client
>   interface, but TLS 1.2 MAY be used.  TLS 1.3 (or newer) SHOULD be
>   available on the MASA server interface, but TLS 1.2 MAY be used.

and in section 5.4:

>   Use of TLS 1.3 (or newer) is encouraged.  TLS 1.2 or newer is
>   REQUIRED.  TLS 1.3 (or newer) SHOULD be available.

In TLS 1.3, the "SNI" is mandatory.
In TLS 1.2, SNI is defined at: https://datatracker.ietf.org/doc/html/rfc6066#section-3
and it's not mandatory, but it's highly recommended, and all browsers
implement it today, and so one can depend upon it being present at the server
side.

Without SNI, each HTTPS tenant needs it's own IP address.
In IPv6, this isn't a big deal.  In IPv4, it is.
TLS has been a justification to ask for multiple IPv4 in the past, but this
is not flying as often anymore.

I guess that I regret we did not write:

>   Use of TLS 1.3 (or newer) is encouraged.  TLS 1.2 or newer (with RFC6066
>   SNI support) is REQUIRED.  TLS 1.3 (or newer) SHOULD be available.

I don't know if is worth an errata.

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 7 Jul 2021 08:52:01 +1200

below..

> I don't know if is worth an errata.

RFC8995 refers to TLS 1.2 but gives no reference for it. Even for TLS 1.3, it doesn't cite RFC8446 in the above extracts, where I think it should. So I think what you really want to say is more like:

  Use of TLS 1.3 [RFC8446] (or newer) is RECOMMENDED.  TLS 1.2 [RFC5246] with 
  SNI support [RFC6066] is REQUIRED.

Or should that last bit be:
 
  TLS 1.2 [RFC5246] with SNI support [RFC6066] is REQUIRED if TLS 1.3 is
  not available.

I'd say, yes, submit an erratum, even if it ends up as "Held for Document Update".

   Brian

---

From: Michael Richardson <[email-masked]>
Date: Wed, 14 Jul 2021 13:39:55 -0400

Peter,

Can you tell us what the critical mbedtls operation was that made the SNI
communication with my MASA work in the end?  Just for the benefit of the
archives.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-

---

From: Peter van der Stok <[email-masked]>
Date: Mon, 19 Jul 2021 09:12:25 +0200

Sorry,

took some time to see this one.

attached the code; the order in which certificates are parsed into 
cacert is important.

This is extract of setting up; All statements are needed.

if( ( ret = mbedtls_ssl_config_defaults( &conf,
MBEDTLS_SSL_IS_CLIENT,
MBEDTLS_SSL_TRANSPORT_STREAM,
MBEDTLS_SSL_PRESET_DEFAULT ) ) != 0 )
{
coap_log( LOG_ERR, " failed\n ! mbedtls_ssl_config_defaults returned 
%d\n\n", ret);
goto exit;
}
mbedtls_ssl_conf_authmode( &conf, MBEDTLS_SSL_VERIFY_OPTIONAL );
mbedtls_ssl_conf_ca_chain( &conf, &cacert, NULL );
mbedtls_ssl_conf_verify(&conf,
cert_verify_callback_mbedtls, &entry);
if( ( ret = mbedtls_ssl_conf_own_cert( &conf, &cacert, &pkey ) ) != 0 )
{
coap_log(LOG_ERR, " failed\n ! mbedtls_ssl_conf_own_cert returned 
%d\n\n",
ret );
goto exit;
}
mbedtls_ssl_conf_rng( &conf, mbedtls_ctr_drbg_random, &ctr_drbg );

mbedtls_ssl_conf_sni( &conf, sni_callback, &entry );

if( ( ret = mbedtls_ssl_setup( &ssl, &conf ) ) != 0 )
{
coap_log( LOG_ERR, " failed\n ! mbedtls_ssl_setup returned %d\n\n", ret 
);
goto exit;
}

if( ( ret = mbedtls_ssl_set_hostname( &ssl, CN_NAME ) ) != 0 )
{
coap_log( LOG_ERR, " failed\n ! mbedtls_ssl_set_hostname returned 
%d\n\n", ret );
goto exit;
}

mbedtls_ssl_set_bio( &ssl, &server_fd, mbedtls_net_send, 
mbedtls_net_recv, NULL );

_________________________________________________

greetings,

peter
Michael Richardson schreef op 2021-07-14 19:39:

> _______________________________________________
> Anima mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/anima