cloud_connect() stuck in 22nd connection attempts (using AWS_IOT backend)

RE: cloud_connect() stuck in 22nd connection attempts (using AWS_IOT backend)

Tjaz — Tue, 08 Sep 2020 07:18:57 GMT

Thank you for your help.

I have found it easiest to just comment out lines 72-79 in the file you have linked: https://github.com/nrfconnect/sdk-zephyr/blob/master/subsys/net/lib/mqtt/mqtt_transport_socket_tls.c#L73

I have then verified this fix to be correct over the weekend.

For anyone who might need it, I am attaching a git patch file that does this for you. It can then easily be reverted after the fix is introduced in mfw v1.2.1.
devzone.nordicsemi.com/.../mqtt_5F00_tsl_5F00_hostname_5F00_verification_5F00_disable.patch
To apply the patch, cd to your zephyr folder and use:

git apply mqtt_tsl_hostname_verification_disable.patch

# to revert
git apply -R mqtt_tsl_hostname_verification_disable.patch

Best regards,
Tjaž Vračko

RE: cloud_connect() stuck in 22nd connection attempts (using AWS_IOT backend)

Martin Lesund — Thu, 03 Sep 2020 11:17:25 GMT

You are correct, my mistake sorry.
You can instead change it directly in the function instead. (set it directly to avoid the TLS Hostname Verification)

RE: cloud_connect() stuck in 22nd connection attempts (using AWS_IOT backend)

Tjaz — Thu, 03 Sep 2020 08:40:18 GMT

Thank you for the quick reply, but CONFIG_TLS_HOSTNAME does not seem to exist.
I get this when building:

/workdir/ncs/firmware/prj.conf:83: warning: attempt to assign the value '0' to the undefined symbol TLS_HOSTNAME

error: Aborting due to Kconfig warnings

I also can not find it in the Kconfig reference/documentation:

https://developer.nordicsemi.com/nRF_Connect_SDK/doc/1.3.0/kconfig/search.html?q=CONFIG_TLS_HOSTNAME&check_keywords=yes&area=default#

RE: cloud_connect() stuck in 22nd connection attempts (using AWS_IOT backend)

Martin Lesund — Thu, 03 Sep 2020 08:20:27 GMT

Hi Tjaž,

Correct, It will be a minor release so there is possible to do a modem FOTA.

Easiest way to disable TLS host verification is to set
CONFIG_TLS_HOSTNAME=0 in prj.conf.

Here is the function https://github.com/nrfconnect/sdk-zephyr/blob/master/subsys/net/lib/mqtt/mqtt_transport_socket_tls.c#L73

also, I recommend that you disable the AT host library if you do not need it when testing:

CONFIG_AT_HOST_LIBRARY=n

(should be used just when testing, not recommended for the final application)

Best regards,
Martin L.

RE: cloud_connect() stuck in 22nd connection attempts (using AWS_IOT backend)

Tjaz — Thu, 03 Sep 2020 07:57:27 GMT

Simply setting CONFIG_MQTT_LIB_TLS=n in prj.conf does not work, since it is selected by AWS_IOT.

warning: MQTT_LIB_TLS (defined at subsys/net/lib/mqtt/Kconfig:28) was assigned the value 'n' but got
the value 'y'. See http://docs.zephyrproject.org/latest/reference/kconfig/CONFIG_MQTT_LIB_TLS.html
and/or look up MQTT_LIB_TLS in the menuconfig/guiconfig interface. The Application Development
Primer, Setting Configuration Values, and Kconfig - Tips and Best Practices sections of the manual
might be helpful too.

as seen in the docs here: https://developer.nordicsemi.com/nRF_Connect_SDK/doc/1.3.0/kconfig/CONFIG_MQTT_LIB_TLS.html

How can I then disable this?

BR,
Tjaž

RE: cloud_connect() stuck in 22nd connection attempts (using AWS_IOT backend)

Tjaz — Wed, 02 Sep 2020 14:37:19 GMT

Will this be a minor (v1.2.1) release or a major release?
This is important since it is only possible to FOTA upgrade minor releases.

The workaround is thus to disable TLS hostname verification. How might we go about doing that?

Regards,
Tjaž

RE: cloud_connect() stuck in 22nd connection attempts (using AWS_IOT backend)

Martin Lesund — Wed, 02 Sep 2020 14:03:38 GMT

Hi Tjaz,

The next modem firmware should have this fixed (releases in the near future), but you can try to use the workaround mentioned here.

For more information about release schedule please contact your RSM. If you do not know who that is please send me a direct message on Devzone and I will provide the information.

BR,
Martin L.