Re: [Tls-reg-review] [UNVERIFIED SENDER] Request to Register Value in TLS ALPN Registry

[Yoav Nir <[e-mail]>]

I think it’s fine. 

Rich?  Nick?  (we need at least two of us to agree)

Yoav

> On 18 Oct 2019, at 20:30, Thakar, Eeshan <[e-mail]> wrote:
> 
> Hello,
>  
> Did you get a chance to review the application with the added context from my email?
>  
> Thanks,
>  
> Eeshan
>  
> From: Thakar, Eeshan <[e-mail] <mailto:[e-mail]>> 
> Sent: Monday, August 12, 2019 5:13 PM
> To: Yoav Nir <[e-mail] <mailto:[e-mail]>>
> Cc: [e-mail] <mailto:[e-mail]>; Lee, Alexandra <[e-mail] <mailto:[e-mail]>>; Sharfin, Jared <[e-mail] <mailto:[e-mail]>>; Gochenaur, Drew <[e-mail] <mailto:[e-mail]>>
> Subject: Re: [UNVERIFIED SENDER] Re: [Tls-reg-review] Request to Register Value in TLS ALPN Registry
>  
> Hi Yoav,
>  
> Thanks for taking a look through the request. The current implementation for the AWS IoT Gateway endpoint does support HTTP/1.1 and MQTT (3.1 and 3.1.1) on the same port (443) using ALPN (with a custom ALPN protocol id).
> It also supports MQTT on the IANA registered port (8883), but allows ALPN based MQTT connections on 443 to work around standard firewall configurations [1].
>  
> The goal with getting the “mqtt” protocol id registered was to have a common basis for all implementers of gateways that support HTTP and MQTT (multiple cloud IoT services do so today, albeit not on the same port) to have a way to accept MQTT traffic on port 443. This is similar to how CoAP has both an ALPN registered string (“coap”) and a registered port (5684 for CoAP with TCP/TLS).
>  
> Thanks,
>  
> Eeshan
>  
> [1]: https://aws.amazon.com/blogs/iot/mqtt-with-tls-client-authentication-on-port-443-why-it-is-useful-and-how-it-works/ <https://aws.amazon.com/blogs/iot/mqtt-with-tls-client-authentication-on-port-443-why-it-is-useful-and-how-it-works/>
>  
> From: Yoav Nir <[e-mail]>
> Date: Saturday, August 10, 2019 at 2:08 AM
> To: "Thakar, Eeshan" <[e-mail]>
> Cc: "[e-mail]" <[e-mail]>, "Lee, Alexandra" <[e-mail]>, "Sharfin, Jared" <[e-mail]>, "Gochenaur, Drew" <[e-mail]>
> Subject: [UNVERIFIED SENDER] Re: [Tls-reg-review] Request to Register Value in TLS ALPN Registry
>  
> On 9 Aug 2019, at 23:45, Thakar, Eeshan <thakar=[e-mail] <mailto:thakar=[e-mail]>> wrote:
>  
>> Type of Assignment:
>> Registration of “mqtt” token
>>  
>> Registry:
>> Application Layer Protocol Negotiation (ALPN) Protocol ID
>>  
>> Description:
>> The mqtt protocol has the protocol version written into the first message on a connection. The mqtt server implementations typically understand the protocol version based on the fixed header on the first message (connect).
>>  
>> Adding this protocol id to the registry will help the community since clients wanting to request mqtt as the protocol would have an appropriate specification reference to use.
>>  
>> Additional Info:
>> [1] MQTT 3.1 Specification: http://public.dhe.ibm.com/software/dw/webservices/ws-mqtt/mqtt-v3r1.html <http://public.dhe.ibm.com/software/dw/webservices/ws-mqtt/mqtt-v3r1.html>
>> [2] MQTT 3.1.1 Specification: http://docs.oasis-open.org/mqtt/mqtt/v3.1.1/csprd02/mqtt-v3.1.1-csprd02.html <http://docs.oasis-open.org/mqtt/mqtt/v3.1.1/csprd02/mqtt-v3.1.1-csprd02.html>
>> [3] MQTT 5.0 Specification: http://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html <http://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html>
>>  
>  
> Hi, Eeshan.
>  
> I’ve looked through the linked specifications, especially the third one because it says it replaces the others.
>  
> It says that TCP port 8883 is registered with IANA for MQTT over TLS, and the IANA registry confirms it.  If you have your own port, why do you need ALPN?
>  
> ALPN is used to negotiate a particular service (such as HTTP) over a single port, typically 443.  
>  
> So if you were using a server listening on port 443 and serving both MQTT and HTTP/2 you would need that to distinguish clients that need MQTT from web browsers that need HTTP/2.
>  
> The linked document does not make any mention of such a server.  Is this described elsewhere?
>  
> Thanks
>  
> Yoav