Large device twins with Azure - Causes disconnect when response to get twin request exceeds ~2k.

[JVantol]

We're using the Azure iot hub implementation in a custom product that works with Azure.

One of the things we've noted is that if the total size of the device twin exceeds about 2k, then when the device twin is fetched initially, the connection is terminated. I've not run this down completely, but I'm pretty sure that what's happening is that the response exceeds the ~2k+ TLS size that Nordic supports, and that's what causes the disconnect. Reducing the size of the twin fixes this issue, so I'm pretty confident this is the issue.

We can work around this issue for the time being, but it would be nice to have a way to fix this.

Some possible ideas:

• Configuration change on the Azure end to force fragmenting packets to a small enough size.
• A mechanism to fetch only selected parts of the device twin.
• Increase the size of the TLS packet that the Nordic stack can handle.

Can Nordic provide any information on which of these ideas (or other ideas) might be worth pursuing? This is not an urgent issue for us, but we will eventually need a solution.

[Didrik Rokhaug]

Hi,

 

Increase the size of the TLS packet that the Nordic stack can handle.

 It is not possible to increase the segment size in the TLS stack in the modem.

However, it is possible to run the TLS stack on the application core, where you can set the TLS segment size however you want.

This will of course come at a RAM and flash cost on the application core. To see how it can be done, you can take a look at the Serial LTE Modem, where it can be enabled by a Kconfig option and an overlay configuration file.

When it comes to the two first ideas, I am not familiar enough with Azure to give an answer now. But, I have asked the developers of the azure_iot_hub library for their input, and will come back to you when I get an answer.

Best regards,

Didrik

[JVantol]

Didrik,

Did you ever find out anything more with this? It seems that Azure has a feature in preview which is part of RFC6066 that allows the TLS fragment size to be negotiated.

https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-tls-support#tls-maximum-fragment-length-negotiation-preview

https://datatracker.ietf.org/doc/html/rfc6066#section-4

Is this something we can make use of to mitigate this problem?

[Øyvind]

Hello, 

I will provide an answer to this as Didrik is currently on vacation.

I've asked internally about this feature and it has not been implemented.  Please contact you local RSM for more roadmap information.

Kind regards,
Øyvind