This is used when a service (like AWS IoT Core) uses one TLS port for multiple services (like https and mqtt), so you have to set the ALPN to 'mqtt' to be able to connect kamailio.
<!-- Kamailio Pull Request Template -->
<!-- IMPORTANT: - for detailed contributing guidelines, read: https://github.com/kamailio/kamailio/blob/master/.github/CONTRIBUTING.md - pull requests must be done to master branch, unless they are backports of fixes from master branch to a stable branch - backports to stable branches must be done with 'git cherry-pick -x ...' - code is contributed under BSD for core and main components (tm, sl, auth, tls) - code is contributed GPLv2 or a compatible license for the other components - GPL code is contributed with OpenSSL licensing exception -->
#### Pre-Submission Checklist <!-- Go over all points below, and after creating the PR, tick all the checkboxes that apply --> <!-- All points should be verified, otherwise, read the CONTRIBUTING guidelines from above--> <!-- If you're unsure about any of these, don't hesitate to ask on sr-dev mailing list --> - [x] Commit message has the format required by CONTRIBUTING guide - [x] Commits are split per component (core, individual modules, libs, utils, ...) - [x] Each component has a single commit (if not, squash them into one commit) - [x] No commits to README files for modules (changes must be done to docbook files in `doc/` subfolder, the README file is autogenerated)
#### Type Of Change - [ ] Small bug fix (non-breaking change which fixes an issue) - [x] New feature (non-breaking change which adds new functionality) - [ ] Breaking change (fix or feature that would change existing functionality)
#### Checklist: <!-- Go over all points below, and after creating the PR, tick the checkboxes that apply --> - [ ] PR should be backported to stable branches - [x] Tested changes locally - [ ] Related to issue #XXXX (replace XXXX with an open issue number)
#### Description <!-- Describe your changes in detail -->
Some services use ALPN to have one single TLS port serving multiple protocols, in order to avoid additional round-trips for negotiating TLS connections. https://en.wikipedia.org/wiki/Application-Layer_Protocol_Negotiation has the details.
One of those services using ALPN is AWS IoT Core, which allows components to send messages both via HTTP and MQTT to AWS for further processing (e.g. logging, analysis, storage to db etc). This patch enables kamailio to communicate with this service by allowing the kamailio admin to set the mqtt.so module mod-param *tls_alpn* to *mqtt*. You can view, comment on, or merge this pull request online at:
https://github.com/kamailio/kamailio/pull/3261
-- Commit Summary --
* mqtt: Add tls_alpn module option
-- File Changes --
M src/modules/mqtt/doc/mqtt_admin.xml (21) M src/modules/mqtt/mqtt_dispatch.c (13) M src/modules/mqtt/mqtt_dispatch.h (3) M src/modules/mqtt/mqtt_mod.c (5)
-- Patch Links --
https://github.com/kamailio/kamailio/pull/3261.patch https://github.com/kamailio/kamailio/pull/3261.diff
@oej commented on this pull request.
@@ -224,6 +224,17 @@ int mqtt_run_dispatcher(mqtt_dispatcher_cfg_t* cfg)
LM_ERR("mosquitto_tls_set() failed: %d %s\n",errno, strerror(errno)); return -1; } + if (cfg->tls_alpn != NULL) { +#if LIBMOSQUITTO_VERSION_NUMBER >= 1006000 + res = mosquitto_string_option(_mosquitto, MOSQ_OPT_TLS_ALPN, cfg->tls_alpn); + if (res != MOSQ_ERR_SUCCESS) { + LM_ERR("mosquitto_string_option() failedi setting tls alpn: %d %s\n",errno, strerror(errno));
"failedi" ?
@oej commented on this pull request.
@@ -224,6 +224,17 @@ int mqtt_run_dispatcher(mqtt_dispatcher_cfg_t* cfg)
LM_ERR("mosquitto_tls_set() failed: %d %s\n",errno, strerror(errno)); return -1; } + if (cfg->tls_alpn != NULL) { +#if LIBMOSQUITTO_VERSION_NUMBER >= 1006000 + res = mosquitto_string_option(_mosquitto, MOSQ_OPT_TLS_ALPN, cfg->tls_alpn); + if (res != MOSQ_ERR_SUCCESS) { + LM_ERR("mosquitto_string_option() failedi setting tls alpn: %d %s\n",errno, strerror(errno));
TLS upper case
@oej commented on this pull request.
@@ -324,6 +324,27 @@ modparam("mqtt", "ca_path", "/etc/ssl/certs")
<programlisting format="linespecific"> ... modparam("mqtt", "tls_method", "tlsv1.3") +... + </programlisting> + </example> + </section> + <section id="mqtt.p.tls_alpn"> + <title><varname>tls_alpn</varname> (str)</title> + <para> + Used to set the TLS ALPN option for cases where one TLS port is used to share multiple services. Prominent + example is AWS IoT, where you have to set the <varname>tls_alpn</varname> to "mqtt" to be able to connect + via MQTT. + </para> + <para> + <emphasis> + Default value is NULL, where no ALPN is set on the TLS connection.
You can't set NULL in a mod-param. I would say that "Default value is empty string, which means that no TLS ALPN is used.
@agranig commented on this pull request.
@@ -324,6 +324,27 @@ modparam("mqtt", "ca_path", "/etc/ssl/certs")
<programlisting format="linespecific"> ... modparam("mqtt", "tls_method", "tlsv1.3") +... + </programlisting> + </example> + </section> + <section id="mqtt.p.tls_alpn"> + <title><varname>tls_alpn</varname> (str)</title> + <para> + Used to set the TLS ALPN option for cases where one TLS port is used to share multiple services. Prominent + example is AWS IoT, where you have to set the <varname>tls_alpn</varname> to "mqtt" to be able to connect + via MQTT. + </para> + <para> + <emphasis> + Default value is NULL, where no ALPN is set on the TLS connection.
Ok. The wording is taken from other params in this module (see https://www.kamailio.org/docs/modules/devel/modules/mqtt.html#mqtt.p.id). So we could say "The default is that his modparam is not set, which means that no TLS ALPN is used"?
@oej commented on this pull request.
@@ -324,6 +324,27 @@ modparam("mqtt", "ca_path", "/etc/ssl/certs")
<programlisting format="linespecific"> ... modparam("mqtt", "tls_method", "tlsv1.3") +... + </programlisting> + </example> + </section> + <section id="mqtt.p.tls_alpn"> + <title><varname>tls_alpn</varname> (str)</title> + <para> + Used to set the TLS ALPN option for cases where one TLS port is used to share multiple services. Prominent + example is AWS IoT, where you have to set the <varname>tls_alpn</varname> to "mqtt" to be able to connect + via MQTT. + </para> + <para> + <emphasis> + Default value is NULL, where no ALPN is set on the TLS connection.
Yes, I think we have to change the others. NULL is in the code, not in the configuration.
@agranig pushed 1 commit.
bf5cf64f1daf8f0c8062e32d116c5da357fe516d mqtt: Add tls_alpn module option
@agranig commented on this pull request.
@@ -324,6 +324,27 @@ modparam("mqtt", "ca_path", "/etc/ssl/certs")
<programlisting format="linespecific"> ... modparam("mqtt", "tls_method", "tlsv1.3") +... + </programlisting> + </example> + </section> + <section id="mqtt.p.tls_alpn"> + <title><varname>tls_alpn</varname> (str)</title> + <para> + Used to set the TLS ALPN option for cases where one TLS port is used to share multiple services. Prominent + example is AWS IoT, where you have to set the <varname>tls_alpn</varname> to "mqtt" to be able to connect + via MQTT. + </para> + <para> + <emphasis> + Default value is NULL, where no ALPN is set on the TLS connection.
I'd propose to do this in a second step to not mix commits. So I'm going to amend the current one, and in a second pull request change the wording of all mod params regarding NULL
@henningw commented on this pull request.
@@ -324,6 +324,27 @@ modparam("mqtt", "ca_path", "/etc/ssl/certs")
<programlisting format="linespecific"> ... modparam("mqtt", "tls_method", "tlsv1.3") +... + </programlisting> + </example> + </section> + <section id="mqtt.p.tls_alpn"> + <title><varname>tls_alpn</varname> (str)</title> + <para> + Used to set the TLS ALPN option for cases where one TLS port is used to share multiple services. Prominent + example is AWS IoT, where you have to set the <varname>tls_alpn</varname> to "mqtt" to be able to connect + via MQTT. + </para> + <para> + <emphasis> + Default value is NULL, where no ALPN is set on the TLS connection.
Yes, lets not mix this PR with other enhancements.
@oej commented on this pull request.
@@ -324,6 +324,27 @@ modparam("mqtt", "ca_path", "/etc/ssl/certs")
<programlisting format="linespecific"> ... modparam("mqtt", "tls_method", "tlsv1.3") +... + </programlisting> + </example> + </section> + <section id="mqtt.p.tls_alpn"> + <title><varname>tls_alpn</varname> (str)</title> + <para> + Used to set the TLS ALPN option for cases where one TLS port is used to share multiple services. Prominent + example is AWS IoT, where you have to set the <varname>tls_alpn</varname> to "mqtt" to be able to connect + via MQTT. + </para> + <para> + <emphasis> + Default value is NULL, where no ALPN is set on the TLS connection.
Fully agree, my intention was to change the others separately.
@agranig commented on this pull request.
@@ -324,6 +324,27 @@ modparam("mqtt", "ca_path", "/etc/ssl/certs")
<programlisting format="linespecific"> ... modparam("mqtt", "tls_method", "tlsv1.3") +... + </programlisting> + </example> + </section> + <section id="mqtt.p.tls_alpn"> + <title><varname>tls_alpn</varname> (str)</title> + <para> + Used to set the TLS ALPN option for cases where one TLS port is used to share multiple services. Prominent + example is AWS IoT, where you have to set the <varname>tls_alpn</varname> to "mqtt" to be able to connect + via MQTT. + </para> + <para> + <emphasis> + Default value is NULL, where no ALPN is set on the TLS connection.
Is there actually good practice on how to document a param which has no default value (aka is NULL)? I'm finding quite some old modules having it documented like this, see https://www.kamailio.org/docs/modules/devel/modules/auth_db.html#auth_db.p.l... for example.
@agranig commented on this pull request.
@@ -324,6 +324,27 @@ modparam("mqtt", "ca_path", "/etc/ssl/certs")
<programlisting format="linespecific"> ... modparam("mqtt", "tls_method", "tlsv1.3") +... + </programlisting> + </example> + </section> + <section id="mqtt.p.tls_alpn"> + <title><varname>tls_alpn</varname> (str)</title> + <para> + Used to set the TLS ALPN option for cases where one TLS port is used to share multiple services. Prominent + example is AWS IoT, where you have to set the <varname>tls_alpn</varname> to "mqtt" to be able to connect + via MQTT. + </para> + <para> + <emphasis> + Default value is NULL, where no ALPN is set on the TLS connection.
It's a bit of a rabbit hole. https://www.kamailio.org/docs/modules/devel/modules/dispatcher.html#dispatch... is one of the most famous ones I guess. Any good example how to properly document a non-set behavior, so it's consistent?
@oej commented on this pull request.
@@ -324,6 +324,27 @@ modparam("mqtt", "ca_path", "/etc/ssl/certs")
<programlisting format="linespecific"> ... modparam("mqtt", "tls_method", "tlsv1.3") +... + </programlisting> + </example> + </section> + <section id="mqtt.p.tls_alpn"> + <title><varname>tls_alpn</varname> (str)</title> + <para> + Used to set the TLS ALPN option for cases where one TLS port is used to share multiple services. Prominent + example is AWS IoT, where you have to set the <varname>tls_alpn</varname> to "mqtt" to be able to connect + via MQTT. + </para> + <para> + <emphasis> + Default value is NULL, where no ALPN is set on the TLS connection.
That's a bad one with "NULL" in quotes like it's a settable value. Let's focus now on make this new option better, and then we'll work on improving the existing docs to something non-developers may understand :-)
@agranig commented on this pull request.
@@ -324,6 +324,27 @@ modparam("mqtt", "ca_path", "/etc/ssl/certs")
<programlisting format="linespecific"> ... modparam("mqtt", "tls_method", "tlsv1.3") +... + </programlisting> + </example> + </section> + <section id="mqtt.p.tls_alpn"> + <title><varname>tls_alpn</varname> (str)</title> + <para> + Used to set the TLS ALPN option for cases where one TLS port is used to share multiple services. Prominent + example is AWS IoT, where you have to set the <varname>tls_alpn</varname> to "mqtt" to be able to connect + via MQTT. + </para> + <para> + <emphasis> + Default value is NULL, where no ALPN is set on the TLS connection.
Alright. So, I will keep the docs for this commit as-is with the NULL, so it's consistent with the documentation of the other params in this module. In parallel, I've prepared another PR on top of this one, which changes the docs of all module parameters at once, changing the wording from NULL to `Default value is that option is not set ([description of implication this has, e.g. random id or no auth or whatever])`. Agreed?
@oej commented on this pull request.
@@ -324,6 +324,27 @@ modparam("mqtt", "ca_path", "/etc/ssl/certs")
<programlisting format="linespecific"> ... modparam("mqtt", "tls_method", "tlsv1.3") +... + </programlisting> + </example> + </section> + <section id="mqtt.p.tls_alpn"> + <title><varname>tls_alpn</varname> (str)</title> + <para> + Used to set the TLS ALPN option for cases where one TLS port is used to share multiple services. Prominent + example is AWS IoT, where you have to set the <varname>tls_alpn</varname> to "mqtt" to be able to connect + via MQTT. + </para> + <para> + <emphasis> + Default value is NULL, where no ALPN is set on the TLS connection.
Thank you for doing that. Agreed!
Merged #3261 into master.
-
Andreas Granig -
Henning Westerholt
-
Olle E. Johansson