HTTPS client POST/PUT to azure IOT hub failing at socket connect()

RE: HTTPS client POST/PUT to azure IOT hub failing at socket connect()

Bhargav Kinnal — Fri, 05 Aug 2022 09:45:59 GMT

The problem turned out to be this bug

[BUG] Changes to nrf91_sockets.c breaking native TLS when using libraries

By changing socket setup like this worked.

socket(AF_INET, SOCK_STREAM, IPPROTO_TLS_1_2); --> socket(AF_INET, SOCK_STREAM | SOCK_NATIVE_TLS, IPPROTO_TLS_1_2);

I was using ncs v1.8.0. I think this is fixed in later versions?

RE: HTTPS client POST/PUT to azure IOT hub failing at socket connect()

Håkon Alseth — Fri, 05 Aug 2022 09:22:39 GMT

Hi,

[quote user="bugs884"]Is there a sample where mbedTLS is used and the TLS is not offloaded to the modem? Looks like this is the cause for this issue[/quote]

Yes, the https_client with these options added will run TLS in the application space:

https://github.com/nrfconnect/sdk-nrf/blob/v1.8.0/samples/nrf9160/https_client/overlay-tfm_mbedtls.conf

If you still get -111 on connect(), it indicates that there's something wrong with the CA root cert (or the configuration around setup of MbedTLS). Could you try the https_client sample, as-is, with these above configurations added to see if that works on your end?

Kind regards,

Håkon

RE: HTTPS client POST/PUT to azure IOT hub failing at socket connect()

Bhargav Kinnal — Thu, 04 Aug 2022 14:28:01 GMT

Is there a sample where mbedTLS is used and the TLS is not offloaded to the modem? Looks like this is the cause for this issue

RE: HTTPS client POST/PUT to azure IOT hub failing at socket connect()

Bhargav Kinnal — Thu, 04 Aug 2022 14:22:33 GMT

UPDATE:

The connect() worked because the certificates were in the modem.

Once I remove them and use the mbedTLS only it starts to fail again. with the err: 111 Connection refused. Am I missing something in the TLS setup?

RE: HTTPS client POST/PUT to azure IOT hub failing at socket connect()

Håkon Alseth — Thu, 04 Aug 2022 13:16:27 GMT

Hi,

[quote user="bugs884"]recv() returns 0 bytes. Does this indicate the connection is closed? If so is it related to the TLS setup? [/quote]

Yes, that means that the connection was closed:

https://github.com/nrfconnect/sdk-nrf/blob/main/samples/nrf9160/https_client/src/main.c#L223

Can you share the log output on runtime?

Also, can you share your .config (build/zephyr/.config) file?

PS:

I see that I previously posted configs for ncs 2.0, sorry for that! In ncs v1.8, you should set "CONFIG_MBEDTLS_SSL_MAX_CONTENT_LEN" instead of these two:

https://github.com/nrfconnect/sdk-nrf/blob/v2.0.2/samples/nrf9160/https_client/overlay-tfm_mbedtls.conf#L13-L14

Kind regards,

Håkon

RE: HTTPS client POST/PUT to azure IOT hub failing at socket connect()

Bhargav Kinnal — Thu, 04 Aug 2022 11:57:03 GMT

[quote userid="116417" url="~/f/nordic-q-a/90614/https-client-post-put-to-azure-iot-hub-failing-at-socket-connect/380045"]But the recv() function receives no response. [/quote]

recv() returns 0 bytes. Does this indicate the connection is closed? If so is it related to the TLS setup?

RE: HTTPS client POST/PUT to azure IOT hub failing at socket connect()

Bhargav Kinnal — Thu, 04 Aug 2022 07:40:07 GMT

Hi Håkon,

I double checked the config to the overlay you shared. It looks similar to me.

The SSL and SNI renegotiation are enabled.

The connect() now works. But the recv() function receives no response.

I have attached the TLS setup I do below.

int cert_provision()
{
	err = tls_credential_add(TLS_SEC_TAG, TLS_CREDENTIAL_PRIVATE_KEY,
				 private_key, sizeof(private_key));
	if (err) {
		return err;
	}

	err = tls_credential_add(TLS_SEC_TAG, TLS_CREDENTIAL_SERVER_CERTIFICATE,
				 client_cert, sizeof(client_cert));
	if (err) {
		return err;
	}

	return tls_credential_add(TLS_SEC_TAG, TLS_CREDENTIAL_CA_CERTIFICATE,
				  cert, sizeof(cert));
}


/* Setup TLS options on a given socket */
int tls_setup(int fd, const char* hostname)
{
	int err;
	int verify;

	/* Security tag that we have provisioned the certificate with */
	const sec_tag_t tls_sec_tag[] = {
		TLS_SEC_TAG,
	};

	/* Set up TLS peer verification */
	enum {
		NONE = 0,
		OPTIONAL = 1,
		REQUIRED = 2,
	};

	verify = REQUIRED;

	err = setsockopt(fd, SOL_TLS, TLS_PEER_VERIFY, &verify, sizeof(verify));
	if (err) {
		printk("Failed to setup peer verification, err %d\n", errno);
		return err;
	}

	/* Associate the socket with the security tag
	 * we have provisioned the certificate with.
	 */
	err = setsockopt(fd, SOL_TLS, TLS_SEC_TAG_LIST, tls_sec_tag,
			 sizeof(tls_sec_tag));
	if (err) {
		printk("Failed to setup TLS sec tag, err %d\n", errno);
		return err;
	}

	err = setsockopt(fd, SOL_TLS, TLS_HOSTNAME, hostname, strlen(hostname));
	if (err) {
		 printk("Failed to setup TLS host name, err %d\n", errno);
		 return err;
	}

	return 0;
}

CONFIG_NRF_MODEM_LIB=y
#CONFIG_NRF_MODEM_LIB_SYS_INIT=n

CONFIG_NETWORKING=y
CONFIG_NET_SOCKETS=y
CONFIG_NET_SOCKETS_POSIX_NAMES=y
CONFIG_NET_NATIVE=n

CONFIG_HEAP_MEM_POOL_SIZE=4096
CONFIG_MAIN_STACK_SIZE=4096

CONFIG_MODEM_KEY_MGMT=y
CONFIG_LTE_LINK_CONTROL=y
CONFIG_LTE_AUTO_INIT_AND_CONNECT=n

CONFIG_NEWLIB_LIBC=y
CONFIG_CJSON_LIB=y

CONFIG_ASSERT=y
CONFIG_RING_BUFFER=y

######################


CONFIG_NET_SOCKETS_OFFLOAD_TLS=n
CONFIG_NET_SOCKETS_SOCKOPT_TLS=y

CONFIG_MBEDTLS=y
CONFIG_MBEDTLS_LIBRARY=y
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=65536
CONFIG_MBEDTLS_TLS_LIBRARY=y
CONFIG_MBEDTLS_X509_LIBRARY=y
CONFIG_MBEDTLS_PKCS1_V15=y
CONFIG_MBEDTLS_SSL_RENEGOTIATION=y
CONFIG_MBEDTLS_SSL_SERVER_NAME_INDICATION=y
CONFIG_MBEDTLS_INSTALL_PATH="DUMMY"

CONFIG_NORDIC_SECURITY_BACKEND=y
CONFIG_NRF_SECURITY_ADVANCED=y
CONFIG_NRF_SECURITY_RNG=y
CONFIG_ENTROPY_GENERATOR=y


CONFIG_OBERON_BACKEND=y

CONFIG_UART_NRFX=y
CONFIG_SERIAL=y
#CONFIG_UART_CONSOLE_ON_DEV_NAME="UART_1"
CONFIG_UART_INTERRUPT_DRIVEN=y

CONFIG_DEBUG_OPTIMIZATIONS=y

CONFIG_LOG=y
CONFIG_LTE_LINK_CONTROL_LOG_LEVEL_DBG=y

RE: HTTPS client POST/PUT to azure IOT hub failing at socket connect()

Håkon Alseth — Wed, 03 Aug 2022 14:15:12 GMT

Hi,

I do not know how you've configured and setup mbedTLS in the application space, but https_client has a configuration overlay file that shows an example of this:

https://github.com/nrfconnect/sdk-nrf/blob/v2.0.2/samples/nrf9160/https_client/overlay-tfm_mbedtls.conf

In addition, you should enable SNI and SSL renegotiation:

CONFIG_MBEDTLS_SSL_RENEGOTIATION=y

CONFIG_MBEDTLS_SSL_SERVER_NAME_INDICATION=y

Could you check your local configuration to see if these are enabled on your side?

Kind regards,

Håkon

RE: HTTPS client POST/PUT to azure IOT hub failing at socket connect()

Bhargav Kinnal — Wed, 03 Aug 2022 13:53:01 GMT

Hi,

Thanks for your suggestion.

I did try the sample for azure IOT hub. And it works completely fine.

I did load the provisioned certificates into the modem. So that is different than how I set it up.

Does the Azure IOT sample library still use the same socket library for HTTP/MQTT communication?

If so, what could I be missing? From what I see the certificates are just fine with the azure_iot_hub sample

RE: HTTPS client POST/PUT to azure IOT hub failing at socket connect()

Håkon Alseth — Wed, 03 Aug 2022 12:19:03 GMT

Hi,

[quote user="bugs884"]I am using the Baltimore CyberTrust Root CA[/quote]

That shall be the correct one for azure.

Could you try to use the azure iot hub example that we have in the sdk to see if this works? This uses the modems TLS stack by default.

https://developer.nordicsemi.com/nRF_Connect_SDK/doc/latest/nrf/samples/nrf9160/azure_iot_hub/README.html

Kind regards,

Håkon

RE: HTTPS client POST/PUT to azure IOT hub failing at socket connect()

Bhargav Kinnal — Wed, 03 Aug 2022 09:14:01 GMT

Hi,

I am using the Baltimore CyberTrust Root CA from here

www.digicert.com/.../digicert-root-certificates.html

and the domain is xxxx.azure-devices.net

Should I use a different root CA? may be the one generated during step 2 of the process here

github.com/.../CACertificateOverview.md

These are the steps I use to generate certificates (Public and private) for the azure IOT

So I use the Baltimore CA and the certificates generated from above steps to setup TLS.

Do you see any issue with this?

RE: HTTPS client POST/PUT to azure IOT hub failing at socket connect()

Håkon Alseth — Wed, 03 Aug 2022 08:50:00 GMT

Hi,

Which domain and which CA root certificate are you using?

Usually when you get -111 returned from connect(), it is due to an issue of the verifying the domain name. This can happen if you do not specify the correct CA root certificate for the domain you're connecting to.

Kind regards,

Håkon