no tls client hello message is being sent

[vpimark]

Have MQTT working on for :1833, but when trying on :8883 looking on wireshark no tls client hello message is being sent. no error messages are being posted. I am using version 7.14,
case MG_EV_CONNECT:
if( mg_url_is_ssl(s_url) )
{
struct mg_tls_opts opts = {
.ca = mg_str(s_ca_cert)
};
mg_tls_init(c, &opts);
break;
like in example mqtt. I am a client, not a server.

#define MG_TLS MG_TLS_BUILTIN
#define MG_DEVICE MG_DEVICE_STM32H7
#define MG_ENABLE_DRIVER_STM32H 1
are there any other #define that I should be setting, or something else i am missing?

[scaprile]

Have MQTT working on for :1833, but when trying on :8883 looking on wireshark no tls client hello message is being sent. no error messages are being posted. I am using version 7.14,
case MG_EV_CONNECT:
if( mg_url_is_ssl(s_url) )

DId you see the log ? Did you see 'TLS' in the log ? Then it is not even trying
Have you seen mg_url_is_ssl(s_url) docs ? https://mongoose.ws/documentation/#mg_url_is_ssl
Did you use mqtts so it can properly guess ? Port numbers dont say anything.

[vpimark]

the url is static const char *s_url = "mqtts://10.50.63.79:8883";, mg_tls_init is being called. Do not see TLS in the wireshark log. or int print out the serial port. the only events I see after mg_tls_init is being called is MG_EV_POLL (2) and MG_EV_CLOSE(9)

static void fnMQTT(struct mg_connection *c, int ev, void *ev_data)
{
    if (ev != last_ev )
    {
        last_ev = ev;
        LOG_INFO("\r\ngot event %d\r\n", ev);
    }

    switch( ev )
    {
    case MG_EV_OPEN:
        LOG_INFO("\r\n%lu CREATED\r\n", c->id);
        break;

    case MG_EV_CONNECT:
        LOG_INFO("\r\nConnected\r\n");
        if( mg_url_is_ssl(s_url) )
        {
            LOG_INFO("TLS mode\r\n");
            struct mg_tls_opts opts = {
                    .ca = mg_str(s_ca_cert_enoch),
            };
            mg_tls_init(c, &opts);
            LOG_INFO("TLS init complete\r\n");
        }
        break;
    case MG_EV_ACCEPT:
        LOG_INFO("Connection accepted\r\n");
        break;

    case MG_EV_TLS_HS:
        LOG_INFO("TLS DONE\r\n");
        break;

    case MG_EV_ERROR:
        // On error, log error message
        LOG_ERR("%lu ERROR %s\r\n", c->id, (char *) ev_data);
        break;

    case MG_EV_MQTT_OPEN:
        // MQTT connect is successful
        #if defined(FAKE_DATA)
            LOG_INFO("%lu CONNECTED to %s\r\n", c->id, s_url);
            mqtt_subt           = mg_str(s_sub_topic);
            mqtt_pubt           = mg_str(s_pub_topic);
            mqtt_sub_opts.topic = mqtt_subt;
            mqtt_sub_opts.qos   = s_qos;
            mg_mqtt_sub(c, &mqtt_sub_opts);
            LOG_INFO("%lu SUBSCRIBED to %.*s\r\n", c->id, (int) mqtt_subt.len, mqtt_subt.buf);
        #else
            mqtt_pubt = mg_str(publishTopic);
        #endif
        memset(&mqtt_pub_opts, 0, sizeof(mqtt_pub_opts));
        mqtt_pub_opts.topic   = mqtt_pubt;
        mqtt_pub_opts.qos     = s_qos;
        mqtt_pub_opts.retain  = false;
        mqttConnected         = true;
        break;

    case MG_EV_MQTT_MSG:
        // When we get echo response, print it
        struct mg_mqtt_message *mm = (struct mg_mqtt_message *) ev_data;
        LOG_INFO("%lu %ld RECEIVED(%d) %.*s <- %.*s\r\n", c->id, (uint32_t)TIME_MS, (int) mm->data.len, (int) mm->data.len, mm->data.buf, (int) mm->topic.len, mm->topic.buf);
        break;

    case MG_EV_CLOSE:
        LOG_INFO("%lu CLOSED\r\n", c->id);
        mqttConnected = false;
        s_conn        = NULL;  // Mark that we're closed
        break;
    case MG_EV_POLL:
        break;
    default:
        LOG_INFO("MQTT_EV: %u \r\n", ev);
        break;
    }
}

Here is printout from serial port Hardware:0002 Software: 0001

ro 1 mongoose.c:1363:mg_error 1 -1 net down
1 ERROR net down
32 1 mongoose.c:1363:mg_error 1 -1 net down
1 ERROR net down
33 1 mongoose.c:1363:mg_error 1 -1 net down
1 ERROR net down
34 1 mongoose.c:5824:mg_tcpip_poll Network is down

got event 2

got event 9
1 CLOSED
36TIME TIMEYYMMDDhhmmss
VER Software and Hardware Version
SB Start sampling
SE Stop sampling
SPS SPSn n=2.5,5,10,16.6,20,50,60,100,400,1200,2400,4800,7200,1440,19200,38400
SC Set ADC Clock 1..100000
SDE Erase Data files from SDCard
SDF Show files on SD Card
SDI Start SDCard
DT Disk Timing Test
SWA Simulate SwitchA Press
SWB Simulate SwitchB Press
HELP Display commands i.e. this menu
Unable to read settings, using default17 2 mongoose.c:5914:mg_tcpip_init MAC not set. Generated random: 02:d1:80:ff:cd:42
1a 2 mongoose.c:17142:mg_phy_init PHY ID: 0x07 0xc131 (LAN87x)
1e 2 mongoose.c:4902:mg_mgr_init Driver: stm32h, MAC: 02:d1:80:ff:cd:42
MQTT Init done
timer_fnMQTT 32
20 3 mongoose.c:4804:mg_connect 1 -1 mqtts://10.50.63.79:8883

got event 1

1 CREATED
22 3 mongoose.c:5962:mg_connect_res 1 0.0.0.0:47823 -> 10.50.63.79:8883

got event 3
MQTT_EV: 3
24 1 mongoose.c:1363:mg_error 1 -1 net down

got event 0
1 ERROR net down
25 1 mongoose.c:1363:mg_error 1 -1 net down
1 ERROR net down
26 1 mongoose.c:1363:mg_error 1 -1 net down
1 ERROR net down
28 1 mongoose.c:1363:mg_error 1 -1 net down
1 ERROR net down
29 1 mongoose.c:1363:mg_error 1 -1 net down
1 ERROR net down
2a 1 mongoose.c:1363:mg_error 1 -1 net down
1 ERROR net down
2b 1 mongoose.c:1363:mg_error 1 -1 net down
1 ERROR net down
2d 1 mongoose.c:1363:mg_error 1 -1 net down
1 ERROR net down
2e 1 mongoose.c:1363:mg_error 1 -1 net down
1 ERROR net down
2f 1 mongoose.c:1363:mg_error 1 -1 net down
1 ERROR net down
30 1 mongoose.c:1363:mg_error 1 -1 net down
1 ERROR net down
32 1 mongoose.c:1363:mg_error 1 -1 net down
1 ERROR net down
33 1 mongoose.c:1363:mg_error 1 -1 net down
1 ERROR net down
34 1 mongoose.c:5824:mg_tcpip_poll Network is down

got event 2

got event 9
1 CLOSED
36 406 1 mongoose.c:5824:mg_tcpip_poll Network is down
7ee 3 mongoose.c:18117:mg_tcpip_driv Link is 100M full-duplex
7ef 1 mongoose.c:5122:onstatechange Link up
7f1 3 mongoose.c:5228:tx_dhcp_discov DHCP discover sent. Our MAC: 02:d1:80:ff:cd:42
bd7 3 mongoose.c:5228:tx_dhcp_discov DHCP discover sent. Our MAC: 02:d1:80:ff:cd:42
timer_fnMQTT 3032
bd9 3 mongoose.c:4804:mg_connect 2 -1 mqtts://10.50.63.79:8883

got event 1

2 CREATED
bda 3 mongoose.c:5962:mg_connect_res 2 0.0.0.0:47824 -> 10.50.63.79:8883

got event 3
MQTT_EV: 3
bdc 1 mongoose.c:1363:mg_error 2 -1 net down

got event 0
2 ERROR net down
bde 1 mongoose.c:1363:mg_error 2 -1 net down
2 ERROR net down
bdf 1 mongoose.c:1363:mg_error 2 -1 net down
2 ERROR net down
be0 1 mongoose.c:1363:mg_error 2 -1 net down
2 ERROR net down
be2 1 mongoose.c:1363:mg_error 2 -1 net down
2 ERROR net down
be3 1 mongoose.c:1363:mg_error 2 -1 net down
2 ERROR net down
be4 1 mongoose.c:1363:mg_error 2 -1 net down
2 ERROR net down
be5 1 mongoose.c:1363:mg_error 2 -1 net down
2 ERROR net down
be7 1 mongoose.c:1363:mg_error 2 -1 net down
2 ERROR net down
be8 1 mongoose.c:1363:mg_error 2 -1 net down
2 ERROR net down
be9 1 mongoose.c:1363:mg_error 2 -1 net down
2 ERROR net down
bea 1 mongoose.c:1363:mg_error 2 -1 net down
2 ERROR net down
bec 1 mongoose.c:1363:mg_error 2 -1 net down
2 ERROR net down
bee 3 mongoose.c:5207:tx_dhcp_reques DHCP req sent

got event 2

got event 9
2 CLOSED
bef 3 mongoose.c:4778:mg_close_conn 2 -1 closed
bf0 2 mongoose.c:5341:rx_dhcp_client Lease: 86400 sec (86403)
bf2 2 mongoose.c:5117:onstatechange READY, IP: 10.50.62.105
bf3 2 mongoose.c:5118:onstatechange GW: 10.50.0.1
bf4 2 mongoose.c:5119:onstatechange MAC: 02:d1:80:ff:cd:42
timer_fnMQTT 6032
1790 3 mongoose.c:4804:mg_connect 3 -1 mqtts://10.50.63.79:8883

got event 1

3 CREATED
1792 3 mongoose.c:5962:mg_connect_res 3 10.50.62.105:47825 -> 10.50.63.79:8883

got event 3
MQTT_EV: 3
1794 3 mongoose.c:5970:mg_connect_res 3 ARP lookup...

got event 2
1796 3 mongoose.c:5275:rx_arp 3 ARP resolved 10.50.63.79 -> 38:14:28:f0:da:33

got event 4

Connected
TLS mode
TLS init complete

got event 2
1fdf 3 mongoose.c:5262:rx_arp ARP: tell 10.50.0.1 we're 02:d1:80:ff:cd:42
timer_fnMQTT 9032
timer_fnMQTT 12032
timer_fnMQTT 15032
timer_fnMQTT 18032
timer_fnMQTT 21032
timer_fnMQTT 24032
timer_fnMQTT 27032
timer_fnMQTT 30032
timer_fnMQTT 33032
timer_fnMQTT 36032
timer_fnMQTT 39032
a075 3 mongoose.c:5262:rx_arp ARP: tell 10.50.63.79 we're 02:d1:80:ff:cd:42
timer_fnMQTT 42032
timer_fnMQTT 45032
timer_fnMQTT 48032
timer_fnMQTT 51032
timer_fnMQTT 54032
timer_fnMQTT 57032
timer_fnMQTT 60032
timer_fnMQTT 63032
timer_fnMQTT 66032
timer_fnMQTT 69032
11619 3 mongoose.c:5262:rx_arp ARP: tell 10.50.63.79 we're 02:d1:80:ff:cd:42
timer_fnMQTT 72032
timer_fnMQTT 75032
timer_fnMQTT 78032
timer_fnMQTT 81032
timer_fnMQTT 84032
timer_fnMQTT 87032
timer_fnMQTT 90032
timer_fnMQTT 93032
timer_fnMQTT 96032
timer_fnMQTT 99032

got event 9
3 CLOSED
18562 3 mongoose.c:4778:mg_close_conn 3 -1 closed
18bb0 3 mongoose.c:5262:rx_arp ARP: tell 10.50.63.79 we're 02:d1:80:ff:cd:42
timer_fnMQTT 102032
18e90 3 mongoose.c:4804:mg_connect 4 -1 mqtts://10.50.63.79:8883

got event 1

4 CREATED
18e92 3 mongoose.c:5962:mg_connect_res 4 10.50.62.105:47826 -> 10.50.63.79:8883

got event 3
MQTT_EV: 3
18e94 3 mongoose.c:5970:mg_connect_res 4 ARP lookup...

got event 2
18e96 3 mongoose.c:5275:rx_arp 4 ARP resolved 10.50.63.79 -> 38:14:28:f0:da:33

got event 4

Connected
TLS mode
TLS init complete

got event 2
timer_fnMQTT 105032
timer_fnMQTT 108032
timer_fnMQTT 111032
timer_fnMQTT 114032
timer_fnMQTT 117032
timer_fnMQTT 120032
timer_fnMQTT 123032
timer_fnMQTT 126032
timer_fnMQTT 129032
timer_fnMQTT 132032
timer_fnMQTT 135032
216e6 3 mongoose.c:5262:rx_arp ARP: tell 10.50.63.79 we're 02:d1:80:ff:cd:42
timer_fnMQTT 138032
timer_fnMQTT 141032
timer_fnMQTT 144032
timer_fnMQTT 147032
timer_fnMQTT 150032
timer_fnMQTT 153032
timer_fnMQTT 156032
timer_fnMQTT 159032
timer_fnMQTT 162032
timer_fnMQTT 165032
28c7a 3 mongoose.c:5262:rx_arp ARP: tell 10.50.63.79 we're 02:d1:80:ff:cd:42
timer_fnMQTT 168032
timer_fnMQTT 171032
timer_fnMQTT 174032
timer_fnMQTT 177032
timer_fnMQTT 180032
timer_fnMQTT 183032
timer_fnMQTT 186032
timer_fnMQTT 189032

[vpimark]

Also on document page for mg_url_is_ssl https://mongoose.ws/documentation/#mg_url_is_ssl
if (mg_url_is_ssl("https://example.org") == 0) {
// scheme is encrypted
}
on tutorial page https://mongoose.ws/documentation/tutorials/mqtt/mqtt-client/
} else if (ev == MG_EV_CONNECT) {
// If target URL is SSL/TLS, command client connection to use TLS
if (mg_url_is_ssl(s_url)) {
struct mg_tls_opts opts = {.ca = "ca.pem"};
mg_tls_init(c, &opts);
}

Which one is correct?

[scaprile]

Oh, thanks for pointing that out, that doc is outdated, this function returns true if it is TLS

Well, I don't see anything else. Are you running 7.14 release or git HEAD ?
If you can't make it, let me know and we'll turn this into an issue and investigate further next week

[vpimark]

I am using 7.14 from https://github.com/cesanta/mongoose/tree/master

[vpimark]

I will continue to try to get this to work over the weekend and let you if I get it to work.

[scaprile]

That is git HEAD.

[vpimark]

I've tried with head, 7.14, 7.13 still no tls client hello message being sent. If I modify mg_tcpip_poll and add

if(c->is_tls && c->is_client && c->is_tls_hs )
mg_tls_handshake(c);

at line 6018 in mongoose.c (after the MG_VERBOSE but before if( c->is_tls && mg_tls_pending(c) )
atleast I get the hello sent, but now I get ERROR expected server certificate but got msg 0x0d
so I do not think this is the correct. I also get c x25519, hs secret, hello hash, s key, s iv, s finished, c hs traffic, c key, c iv, c finished as mg_tls_hexdump. then next printout is -1 expected server certificate but got msg 0x0d .

[scaprile]

OK, I'll change our unit-tests to try to trap something the likes of this.

[scaprile]

Fixed in HEADER, tested with MQTT.
E.g.: https://github.com/cesanta/mongoose/tree/master/tutorials/tcpip/pcap-driver

[vpimark]

I have another question, since the server I am connecting to does not support ECC, if building for MBEDTLS do I need to download the code or is it ok to use the MBEDTLS from STM32CubeMX

[scaprile]

You can use whatever version you want, the point is we've only tested the one we use in our examples. As long as you set MG_TLS properly, Mongoose will call the TLS library functions it knows, so you have to provide them at linkage, thing that CubeIDE will surely do for MbedTLS.

[scaprile]

You can disable ChaCha in the source, what cypher do you need ?