[Tls-reg-review] [IANA #1154299] Re: [UNVERIFIED SENDER] Request to Register Value in TLS ALPN Registry

["Sabrina Tanamal via RT" <[e-mail]>]

Hi all, 

We've added the following entry to the Application-Layer Protocol Negotiation (ALPN) Protocol IDs registry:

Protocol: OASIS Message Queuing Telemetry Transport (MQTT)
Identification Sequence: 0x6d 0x71 0x74 0x74 (“mqtt”)
Reference: [http://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html]

Please see
https://www.iana.org/assignments/tls-extensiontype-values

Best regards, 

Sabrina Tanamal
Senior IANA Services Specialist

On Fri Oct 18 18:56:57 2019, [e-mail] wrote:
> Yup, even IP.
> 
> IANA: Can you please add the following registration?
> 
> Registry name: TLS Application-Layer Protocol Negotiation (ALPN)
> Protocol IDs
> Protocol field should be “OASIS Message Queuing Telemetry Transport
> (MQTT)”
> Identification sequence should be:   0x6d 0x71 0x74 0x74 (“mqtt”)
> Reference should be this document:   http://docs.oasis-
> open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html <http://docs.oasis-
> open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html>
> 
> Thanks.
> 
> Yoav
> (on behalf of the TLS registry review team)
> 
> 
> > On 18 Oct 2019, at 21:44, Salz, Rich <[e-mail]> wrote:
> >
> > I’m fine with it.
> >
> > Tunneling things through HTTPS has a long history :)
> >
> > From: Yoav Nir <[e-mail]>
> > Date: Friday, October 18, 2019 at 2:41 PM
> > To: "Thakar, Eeshan" <[e-mail]>, "[e-mail]"
> > <[e-mail]>
> > Cc: "Lee, Alexandra" <[e-mail]>, "Sharfin, Jared"
> > <[e-mail]>, "Gochenaur, Drew" <[e-mail]>
> > Subject: Re: [Tls-reg-review] [UNVERIFIED SENDER] Request to Register
> > Value in TLS ALPN Registry
> >
> > I think it’s fine.
> >
> > Rich?  Nick?  (we need at least two of us to agree)
> >
> > Yoav
> >
> >
> >> On 18 Oct 2019, at 20:30, Thakar, Eeshan <[e-mail]
> >> <mailto:[e-mail]>> wrote:
> >>
> >> Hello,
> >>
> >> Did you get a chance to review the application with the added
> >> context from my email?
> >>
> >> Thanks,
> >>
> >> Eeshan
> >>
> >> From: Thakar, Eeshan <[e-mail] <mailto:[e-mail]>>
> >> Sent: Monday, August 12, 2019 5:13 PM
> >> To: Yoav Nir <[e-mail] <mailto:[e-mail]>>
> >> Cc: [e-mail] <mailto:[e-mail]>; Lee,
> >> Alexandra <[e-mail] <mailto:[e-mail]>>; Sharfin,
> >> Jared <[e-mail] <mailto:[e-mail]>>; Gochenaur,
> >> Drew <[e-mail] <mailto:[e-mail]>>
> >> Subject: Re: [UNVERIFIED SENDER] Re: [Tls-reg-review] Request to
> >> Register Value in TLS ALPN Registry
> >>
> >> Hi Yoav,
> >>
> >> Thanks for taking a look through the request. The current
> >> implementation for the AWS IoT Gateway endpoint does support
> >> HTTP/1.1 and MQTT (3.1 and 3.1.1) on the same port (443) using ALPN
> >> (with a custom ALPN protocol id).
> >> It also supports MQTT on the IANA registered port (8883), but allows
> >> ALPN based MQTT connections on 443 to work around standard firewall
> >> configurations [1].
> >>
> >> The goal with getting the “mqtt” protocol id registered was to have
> >> a common basis for all implementers of gateways that support HTTP
> >> and MQTT (multiple cloud IoT services do so today, albeit not on the
> >> same port) to have a way to accept MQTT traffic on port 443. This is
> >> similar to how CoAP has both an ALPN registered string (“coap”) and
> >> a registered port (5684 for CoAP with TCP/TLS).
> >>
> >> Thanks,
> >>
> >> Eeshan
> >>
> >> [1]: https://aws.amazon.com/blogs/iot/mqtt-with-tls-client-
> >> authentication-on-port-443-why-it-is-useful-and-how-it-works/
> >> <https://urldefense.proofpoint.com/v2/url?u=https-
> >> 3A__aws.amazon.com_blogs_iot_mqtt-2Dwith-2Dtls-2Dclient-
> >> 2Dauthentication-2Don-2Dport-2D443-2Dwhy-2Dit-2Dis-2Duseful-2Dand-
> >> 2Dhow-2Dit-
> >> 2Dworks_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-
> >> w&m=3E_UAQbU2i5rQj4oofQmA2Zn6VVJWCevYQrKZ79iWEM&s=gS3wQv9j7fykgWX5rYj3Juwi-
> >> bASrckP4DIA5dBf2Ec&e=>
> >>
> >> From: Yoav Nir <[e-mail] <mailto:[e-mail]>>
> >> Date: Saturday, August 10, 2019 at 2:08 AM
> >> To: "Thakar, Eeshan" <[e-mail] <mailto:[e-mail]>>
> >> Cc: "[e-mail] <mailto:[e-mail]>" <tls-
> >> [e-mail] <mailto:[e-mail]>>, "Lee,
> >> Alexandra" <[e-mail] <mailto:[e-mail]>>,
> >> "Sharfin, Jared" <[e-mail] <mailto:[e-mail]>>,
> >> "Gochenaur, Drew" <[e-mail] <mailto:[e-mail]>>
> >> Subject: [UNVERIFIED SENDER] Re: [Tls-reg-review] Request to
> >> Register Value in TLS ALPN Registry
> >>
> >> On 9 Aug 2019, at 23:45, Thakar, Eeshan
> >> <thakar=[e-mail]
> >> <mailto:thakar=[e-mail]>> wrote:
> >>
> >>> Type of Assignment:
> >>> Registration of “mqtt” token
> >>>
> >>> Registry:
> >>> Application Layer Protocol Negotiation (ALPN) Protocol ID
> >>>
> >>> Description:
> >>> The mqtt protocol has the protocol version written into the first
> >>> message on a connection. The mqtt server implementations typically
> >>> understand the protocol version based on the fixed header on the
> >>> first message (connect).
> >>>
> >>> Adding this protocol id to the registry will help the community
> >>> since clients wanting to request mqtt as the protocol would have an
> >>> appropriate specification reference to use.
> >>>
> >>> Additional Info:
> >>> [1] MQTT 3.1 Specification:
> >>> http://public.dhe.ibm.com/software/dw/webservices/ws-mqtt/mqtt-
> >>> v3r1.html <https://urldefense.proofpoint.com/v2/url?u=http-
> >>> 3A__public.dhe.ibm.com_software_dw_webservices_ws-2Dmqtt_mqtt-
> >>> 2Dv3r1.html&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-
> >>> w&m=3E_UAQbU2i5rQj4oofQmA2Zn6VVJWCevYQrKZ79iWEM&s=cCCKZ-
> >>> lqltftwi8iSb9xnH41GIG7pDOo77inFY0LShI&e=>
> >>> [2] MQTT 3.1.1 Specification: http://docs.oasis-
> >>> open.org/mqtt/mqtt/v3.1.1/csprd02/mqtt-v3.1.1-csprd02.html
> >>> <https://urldefense.proofpoint.com/v2/url?u=http-3A__docs.oasis-
> >>> 2Dopen.org_mqtt_mqtt_v3.1.1_csprd02_mqtt-2Dv3.1.1-
> >>> 2Dcsprd02.html&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-
> >>> w&m=3E_UAQbU2i5rQj4oofQmA2Zn6VVJWCevYQrKZ79iWEM&s=PmP61TQmKHzpZMhM8TNDzpcZBqp1fZ8RM7xE05_c9T8&e=>
> >>> [3] MQTT 5.0 Specification: http://docs.oasis-
> >>> open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html
> >>> <https://urldefense.proofpoint.com/v2/url?u=http-3A__docs.oasis-
> >>> 2Dopen.org_mqtt_mqtt_v5.0_mqtt-
> >>> 2Dv5.0.html&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-
> >>> w&m=3E_UAQbU2i5rQj4oofQmA2Zn6VVJWCevYQrKZ79iWEM&s=BEoHGVZzaCG6fp19ig2vfDpkz4rJkQhdUEVOG8EtQD0&e=>
> >>>
> >>
> >> Hi, Eeshan.
> >>
> >> I’ve looked through the linked specifications, especially the third
> >> one because it says it replaces the others.
> >>
> >> It says that TCP port 8883 is registered with IANA for MQTT over
> >> TLS, and the IANA registry confirms it.  If you have your own port,
> >> why do you need ALPN?
> >>
> >> ALPN is used to negotiate a particular service (such as HTTP) over a
> >> single port, typically 443.
> >>
> >> So if you were using a server listening on port 443 and serving both
> >> MQTT and HTTP/2 you would need that to distinguish clients that need
> >> MQTT from web browsers that need HTTP/2.
> >>
> >> The linked document does not make any mention of such a server.  Is
> >> this described elsewhere?
> >>
> >> Thanks
> >>
> >> Yoav