Re: [Tls-reg-review] [UNVERIFIED SENDER] Request to Register Value in TLS ALPN Registry

Yoav Nir <ynir.ietf@gmail.com> Fri, 18 October 2019 18:56 UTC

Return-Path: <ynir.ietf@gmail.com>
X-Original-To: tls-reg-review@ietfa.amsl.com
Delivered-To: tls-reg-review@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4109112013F for <tls-reg-review@ietfa.amsl.com>; Fri, 18 Oct 2019 11:56:22 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.897
X-Spam-Level:
X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, HTTPS_HTTP_MISMATCH=0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YM9c8cxOyUtG for <tls-reg-review@ietfa.amsl.com>; Fri, 18 Oct 2019 11:56:19 -0700 (PDT)
Received: from mail-wm1-x342.google.com (mail-wm1-x342.google.com [IPv6:2a00:1450:4864:20::342]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A68F31200DE for <tls-reg-review@ietf.org>; Fri, 18 Oct 2019 11:56:18 -0700 (PDT)
Received: by mail-wm1-x342.google.com with SMTP id q70so20789wme.1 for <tls-reg-review@ietf.org>; Fri, 18 Oct 2019 11:56:18 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=ZuiLX1ou1FQlqn+wB/wc9HpBHzGe5o5PRDa3f8MiJcM=; b=cPXCKoxOuhmXwrFWr4ePkuFEd6VjFATWyhhwXY71AXwmxKKs8OwnCh6i2wwUDVfNIO 9O04HkY5TI6HwqCy8HlLBBhjFFkfgUhZRO+SxX1U+VnqZ0Xb3y/ry6mHchqXF0efazfh odr/I8Gd2dJ+vtjqrU+Vor38PVNCieMnvi5wq8Chuf9J5qdAocyT7F6REalD369p2K0j /81uJjnzKK9Yz1CvIqEf86JSPfqTZK3zUxQYq/UGPnTpBHgEaT7bS4HpxTiHk2SoNkp2 dNXIzmDtxyW4A73ZcguJffVawo1Kfp1+LQFzd+vr5XL1IKiS9eHyvcEusWmhWIhGEDgo 4PJQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=ZuiLX1ou1FQlqn+wB/wc9HpBHzGe5o5PRDa3f8MiJcM=; b=SQTWZrUJO4PxvQ8nj0c8fqQlDk76P/OkU8qOouQ10dbXBPkdLE88O0BbpppDeqpn1u AULRK2oYV6HuUaAjlH6uaFDvFG4bvFCg9rcb1aMhYjtzRdHeOMDbYQyKqrD3mzKWUe+T AIHopzA2GjamIh+xTGgMMdaggUpR+CHjFNF+OwTyhWOFNK0tWlyhTyi4daT8bXvoLVJI fKh5Q0p/Xs44BYDboCsaaoHP/PXptrrVA45ZQ9hP2n63DTFOrqLu3qmvaaRcN3H3Q8wb Cp+Ey1642ZEUlG7h0SvfEdf6HKaZ8hew9WfCKIR5eQi/V9F0HL0DEPTi7QP0lJBxEexv zxMQ==
X-Gm-Message-State: APjAAAWU0zbSoex98tfUYkx+FDtcnp8Di/LBZUb/a2eqnfISSb4NfO1Q JdsG0pH2TvF1cWULRjuR2x4=
X-Google-Smtp-Source: APXvYqx5z0iYQy7ZWBLd6KR7uySs5EmhU+lwaCI/ZA0eghhXv8Nk6vwZ4f8jXHHF3hIWpQWI3eolUw==
X-Received: by 2002:a05:600c:34b:: with SMTP id u11mr8516447wmd.172.1571424977153; Fri, 18 Oct 2019 11:56:17 -0700 (PDT)
Received: from [192.168.1.12] ([46.120.57.147]) by smtp.gmail.com with ESMTPSA id t11sm5969634wmi.25.2019.10.18.11.56.15 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 18 Oct 2019 11:56:16 -0700 (PDT)
From: Yoav Nir <ynir.ietf@gmail.com>
Message-Id: <50281700-558A-48AF-BA75-4A36E48EE334@gmail.com>
Content-Type: multipart/alternative; boundary="Apple-Mail=_1BC6FF24-7B2E-4986-AB01-6218629B43AA"
Mime-Version: 1.0 (Mac OS X Mail 13.0 \(3594.4.19\))
Date: Fri, 18 Oct 2019 21:56:13 +0300
In-Reply-To: <D8E8C333-79BA-4854-92F9-7D55C56F4CD4@akamai.com>
Cc: Rich Salz <rsalz@akamai.com>, "Thakar, Eeshan" <thakar@amazon.com>, "tls-reg-review@ietf.org" <tls-reg-review@ietf.org>, "Lee, Alexandra" <alexanl@amazon.com>, "Sharfin, Jared" <sharfinj@amazon.com>, "Gochenaur, Drew" <gochenau@amazon.com>
To: iana-prot-param@iana.org
References: <237DADD1-883D-47C3-88D4-3B39D9843CBC@amazon.com> <73904165-C904-455B-B681-488F7EE676C2@gmail.com> <50D9DBC7-2A06-4479-90D5-D3CEA2BD857F@amazon.com> <B8780BD9-84F3-41ED-9EDD-C94F122BB3DE@gmail.com> <D8E8C333-79BA-4854-92F9-7D55C56F4CD4@akamai.com>
X-Mailer: Apple Mail (2.3594.4.19)
Archived-At: <https://mailarchive.ietf.org/arch/msg/tls-reg-review/payOv1GZYOIA8IcHk73BXuZ45N0>
Subject: Re: [Tls-reg-review] [UNVERIFIED SENDER] Request to Register Value in TLS ALPN Registry
X-BeenThere: tls-reg-review@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: TLS REVIEW <tls-reg-review.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/tls-reg-review>, <mailto:tls-reg-review-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/tls-reg-review/>
List-Post: <mailto:tls-reg-review@ietf.org>
List-Help: <mailto:tls-reg-review-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls-reg-review>, <mailto:tls-reg-review-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 18 Oct 2019 18:56:22 -0000

Yup, even IP.

IANA: Can you please add the following registration?

Registry name: TLS Application-Layer Protocol Negotiation (ALPN) Protocol IDs
Protocol field should be “OASIS Message Queuing Telemetry Transport (MQTT)”
Identification sequence should be:   0x6d 0x71 0x74 0x74 (“mqtt”)
Reference should be this document:   http://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html <http://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html>

Thanks.

Yoav
(on behalf of the TLS registry review team)


> On 18 Oct 2019, at 21:44, Salz, Rich <rsalz@akamai.com> wrote:
> 
> I’m fine with it.
>  
> Tunneling things through HTTPS has a long history :)
>  
> From: Yoav Nir <ynir.ietf@gmail.com>
> Date: Friday, October 18, 2019 at 2:41 PM
> To: "Thakar, Eeshan" <thakar@amazon.com>om>, "tls-reg-review@ietf.org" <tls-reg-review@ietf.org>
> Cc: "Lee, Alexandra" <alexanl@amazon.com>om>, "Sharfin, Jared" <sharfinj@amazon.com>om>, "Gochenaur, Drew" <gochenau@amazon.com>
> Subject: Re: [Tls-reg-review] [UNVERIFIED SENDER] Request to Register Value in TLS ALPN Registry
>  
> I think it’s fine.  
>  
> Rich?  Nick?  (we need at least two of us to agree)
>  
> Yoav
> 
> 
>> On 18 Oct 2019, at 20:30, Thakar, Eeshan <thakar@amazon.com <mailto:thakar@amazon.com>> wrote:
>>  
>> Hello,
>>  
>> Did you get a chance to review the application with the added context from my email?
>>  
>> Thanks,
>>  
>> Eeshan
>>  
>> From: Thakar, Eeshan <thakar@amazon.com <mailto:thakar@amazon.com>> 
>> Sent: Monday, August 12, 2019 5:13 PM
>> To: Yoav Nir <ynir.ietf@gmail.com <mailto:ynir.ietf@gmail.com>>
>> Cc: tls-reg-review@ietf.org <mailto:tls-reg-review@ietf.org>; Lee, Alexandra <alexanl@amazon.com <mailto:alexanl@amazon.com>>; Sharfin, Jared <sharfinj@amazon.com <mailto:sharfinj@amazon.com>>; Gochenaur, Drew <gochenau@amazon.com <mailto:gochenau@amazon.com>>
>> Subject: Re: [UNVERIFIED SENDER] Re: [Tls-reg-review] Request to Register Value in TLS ALPN Registry
>>  
>> Hi Yoav,
>>  
>> Thanks for taking a look through the request. The current implementation for the AWS IoT Gateway endpoint does support HTTP/1.1 and MQTT (3.1 and 3.1.1) on the same port (443) using ALPN (with a custom ALPN protocol id).
>> It also supports MQTT on the IANA registered port (8883), but allows ALPN based MQTT connections on 443 to work around standard firewall configurations [1].
>>  
>> The goal with getting the “mqtt” protocol id registered was to have a common basis for all implementers of gateways that support HTTP and MQTT (multiple cloud IoT services do so today, albeit not on the same port) to have a way to accept MQTT traffic on port 443. This is similar to how CoAP has both an ALPN registered string (“coap”) and a registered port (5684 for CoAP with TCP/TLS).
>>  
>> Thanks,
>>  
>> Eeshan
>>  
>> [1]: https://aws.amazon.com/blogs/iot/mqtt-with-tls-client-authentication-on-port-443-why-it-is-useful-and-how-it-works/ <https://urldefense.proofpoint.com/v2/url?u=https-3A__aws.amazon.com_blogs_iot_mqtt-2Dwith-2Dtls-2Dclient-2Dauthentication-2Don-2Dport-2D443-2Dwhy-2Dit-2Dis-2Duseful-2Dand-2Dhow-2Dit-2Dworks_&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=3E_UAQbU2i5rQj4oofQmA2Zn6VVJWCevYQrKZ79iWEM&s=gS3wQv9j7fykgWX5rYj3Juwi-bASrckP4DIA5dBf2Ec&e=>
>>  
>> From: Yoav Nir <ynir.ietf@gmail.com <mailto:ynir.ietf@gmail.com>>
>> Date: Saturday, August 10, 2019 at 2:08 AM
>> To: "Thakar, Eeshan" <thakar@amazon.com <mailto:thakar@amazon.com>>
>> Cc: "tls-reg-review@ietf.org <mailto:tls-reg-review@ietf.org>" <tls-reg-review@ietf.org <mailto:tls-reg-review@ietf.org>>, "Lee, Alexandra" <alexanl@amazon.com <mailto:alexanl@amazon.com>>, "Sharfin, Jared" <sharfinj@amazon.com <mailto:sharfinj@amazon.com>>, "Gochenaur, Drew" <gochenau@amazon.com <mailto:gochenau@amazon.com>>
>> Subject: [UNVERIFIED SENDER] Re: [Tls-reg-review] Request to Register Value in TLS ALPN Registry
>>  
>> On 9 Aug 2019, at 23:45, Thakar, Eeshan <thakar=40amazon.com@dmarc.ietf.org <mailto:thakar=40amazon.com@dmarc.ietf.org>> wrote:
>>  
>>> Type of Assignment:
>>> Registration of “mqtt” token
>>>  
>>> Registry:
>>> Application Layer Protocol Negotiation (ALPN) Protocol ID
>>>  
>>> Description:
>>> The mqtt protocol has the protocol version written into the first message on a connection. The mqtt server implementations typically understand the protocol version based on the fixed header on the first message (connect).
>>>  
>>> Adding this protocol id to the registry will help the community since clients wanting to request mqtt as the protocol would have an appropriate specification reference to use.
>>>  
>>> Additional Info:
>>> [1] MQTT 3.1 Specification: http://public.dhe.ibm.com/software/dw/webservices/ws-mqtt/mqtt-v3r1.html <https://urldefense.proofpoint.com/v2/url?u=http-3A__public.dhe.ibm.com_software_dw_webservices_ws-2Dmqtt_mqtt-2Dv3r1.html&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=3E_UAQbU2i5rQj4oofQmA2Zn6VVJWCevYQrKZ79iWEM&s=cCCKZ-lqltftwi8iSb9xnH41GIG7pDOo77inFY0LShI&e=>
>>> [2] MQTT 3.1.1 Specification: http://docs.oasis-open.org/mqtt/mqtt/v3.1.1/csprd02/mqtt-v3.1.1-csprd02.html <https://urldefense.proofpoint.com/v2/url?u=http-3A__docs.oasis-2Dopen.org_mqtt_mqtt_v3.1.1_csprd02_mqtt-2Dv3.1.1-2Dcsprd02.html&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=3E_UAQbU2i5rQj4oofQmA2Zn6VVJWCevYQrKZ79iWEM&s=PmP61TQmKHzpZMhM8TNDzpcZBqp1fZ8RM7xE05_c9T8&e=>
>>> [3] MQTT 5.0 Specification: http://docs.oasis-open.org/mqtt/mqtt/v5.0/mqtt-v5.0.html <https://urldefense.proofpoint.com/v2/url?u=http-3A__docs.oasis-2Dopen.org_mqtt_mqtt_v5.0_mqtt-2Dv5.0.html&d=DwMFaQ&c=96ZbZZcaMF4w0F4jpN6LZg&r=4LM0GbR0h9Fvx86FtsKI-w&m=3E_UAQbU2i5rQj4oofQmA2Zn6VVJWCevYQrKZ79iWEM&s=BEoHGVZzaCG6fp19ig2vfDpkz4rJkQhdUEVOG8EtQD0&e=>
>>>  
>>  
>> Hi, Eeshan.
>>  
>> I’ve looked through the linked specifications, especially the third one because it says it replaces the others.
>>  
>> It says that TCP port 8883 is registered with IANA for MQTT over TLS, and the IANA registry confirms it.  If you have your own port, why do you need ALPN?
>>  
>> ALPN is used to negotiate a particular service (such as HTTP) over a single port, typically 443.  
>>  
>> So if you were using a server listening on port 443 and serving both MQTT and HTTP/2 you would need that to distinguish clients that need MQTT from web browsers that need HTTP/2.
>>  
>> The linked document does not make any mention of such a server.  Is this described elsewhere?
>>  
>> Thanks
>>  
>> Yoav