LWM2M + DTLS + NBIoT proper implementation

[fastfox]

Hi,

I am trying to implement energy efficient(batt powered) application for nrf9160, using UDP/DTLS/LWM2M as comm stack. Got "hello world" working, but now I am really confused about many details. Hope you can help me.

Question 1: Operator NAT/firewall rules and NRF9160 DTLS implementation

It looks like operator networks loose UDP port rules about after 1 minute of silence. This essentially means that UDP port number changes between consecutive packets sent from device to server if communications happens for example in every 10 minutes. This again means that DTLS connection would need to be resumed for it to work. It looks like resumption does not work in NRF or is not implemented at all? Effect is dramatic, you have to either ping server in <60s intervals or go through connection failure+re-register cycle every time you send anything.

Am I missing something here or how do people in general make things work? This ruins the whole idea of power save modes and LWM2M benefits. Is the only workaround to use MBED TLS stack instead?

Question 2: It looks like DTLS connection(to LWM2M bootstrap server) always ends to TLS ALERT sent by nrf91. Any idea why? Is this a feature? Other clients do not do that.

Question 3: Zephyr does not support QUEUE mode. If I understood the LWM2M spec correctly, QUEUE mode is exactly what low power NB-IoT application needs, but zephyr LWM2M stack does not support it. Do you have any idea how Nordic users tend to solve this? Implement queues as server side application on top of LWM2M? Use different LWM2M client?

Probably not the easiest questions and not all directly in Nordics domain, but I hope that you have some ideas how to make actual production quality app using NRF91. Thanks.

[jp]

Yes, I think it needs to be a configurable timeout, as it is network dependent, and using the worst case of 20 seconds would cut short the access window from the server, if your network keeps the session for 2 minutes for example.

[Didrik Rokhaug]

Hi, both of you.

These are good questions, but I am not familiar enough with the fine details to give an answer myself.

I have forwarded them to our developers and will get back to you when I have an answer.

Best regards,

Didrik

[Didrik Rokhaug]

DO you see a different behavior if you set the TLS_SESSION_CACHE socket option explicitly?

https://github.com/nrfconnect/sdk-zephyr/blob/master/include/net/socket.h#L126

Edit: Note that the option must be set using setsockopt(), not the non-offloaded nrf_setsockopt().

Or, you can use nrf_setsockopt() and NRF_SO_SEC_SESSION_CACHE.

[fastfox]

I did try to set cache before like this:

nrf_sec_session_cache_t session_cache = 1;
if (nrf_setsockopt(client_ctx->sock_fd, NRF_SOL_SECURE, NRF_SO_SEC_SESSION_CACHE, &session_cache, sizeof(session_cache)) < 0) {
	LOG_ERR("setsockopt NRF_SO_SEC_SESSION_CACHE: %d", errno);
}

Right after this setsockopt https://github.com/zephyrproject-rtos/zephyr/blob/358dcc1bde6a79abb3167e994fe7aec66968adaf/subsys/net/lib/lwm2m/lwm2m_engine.c#L4241

But that had no effect, and I just retried and confirmed that

I can see TLS_SESSION_CACHE was just added to master, so I can't use that in 1.2. Does it make any difference in which way the opt is set? Should I try it on master?(I assume that the problem lies in modem side)

[Jan Tore Guggedal]

Hi,

I had a look at ip_port_changes_90s.pcapng, and it seems like (D)TLS caching is already enabled. The session ID is at least provided in the client hello message, but it seems like the server side has closed that session, possibly because of the preceeding alert message. You can check which nrfxlib revision you are using by executing "west status" which should print the revision of all repositories west has imported for you. That will show if you have the revision where TLS caching is enabled by default or not.

The alert messages from the device are curious, and looks likely to be the source of trouble here. Could you try to enable  CONFIG_LWM2M_LOG_LEVEL_DBG=y and see if that yields any useful information, in particular related to the alert message?

Best regards,

Jan Tore