MSP432E401Y: TLS Server Name Indication

Robert Macklin

Part Number: MSP432E401Y

Tool/software:

I am trying to connect to AWS IoT using MQTT. AWS requires the SNI extension to TLS. This means the name of the server is sent with the Client Hello message during negotiation of the connection. I can see that the SNI extension is enabled in the mbed TLS library. The problem is that I don't have access to the context needed to make the call directly to the mbed tls library because of the SlNet wrapper. I found a security attribute called SLNETSOCK_SEC_ATTRIB_DOMAIN_NAME and set that to the server name, but it does not generate the SNI extension to the Client Hello message. Is there an SlNet function that I can use to set the SNI in the mbed TLS library?

7 months ago

0 Charles Tsai 7 months ago

TI__Guru**** 191846 points

Hi,

Doing some search on SNI, I found in section 7.5.6 Set Domain Name for Verification and SNI of this user's guide talking about how to use it. Not sure if this will be helpful as it is a user's guide for a different product but I think the underlying SimpleLink stack should be common. http://www.ti.com/lit/ug/swru455c/swru455c.pdf

0 Robert Macklin 7 months ago in reply to Charles Tsai

Intellectual 505 points

That's exactly what I need, but I don't see it documented in Resource Explorer, and I don't see any of the defines in the header files. Is there a way to do this with the SimpleLink version for the MSP432E401Y?

0 Charles Tsai 7 months ago in reply to Robert Macklin

TI__Guru**** 191846 points

Hi,

The document that I show is for a different TI processor. I don't know for sure if you can make the same call in SL for MSP432E. Searching for SNI has almost no hit in the forum archive for MSP432E. But if you have already tried it, please let me know the result.

0 Robert Macklin 7 months ago in reply to Charles Tsai

Intellectual 505 points

I'm trying to add some code to build the SNI. I need to modify ssl_tls.c in the mbed library. I copied the file into my local folder and rebuilt my application with no changes to ssl_tls.c. Now when the code runs I get memory allocation errors and see that all the HeapMem has been used up. When I "Exclude from Build" the ssl_tls.c file (forcing it to go back to the library routine) I don't get the memory errors any more. Why does this behave differently when one file or the other is used? What other way can I modify ssl_tls.c? Do I need to rebuild the whole TLS library? How would that be done?

0 Charles Tsai 7 months ago in reply to Robert Macklin

TI__Guru**** 191846 points

Hi,

I find these posts that talk about rebuilding mbedtls and NDK libraries.

https://e2e.ti.com/support/microcontrollers/arm-based-microcontrollers-group/arm-based-microcontrollers/f/arm-based-microcontrollers-forum/1116894/msp432e401y-msp432-entropy-source-mbedtls

https://e2e.ti.com/support/microcontrollers/arm-based-microcontrollers-group/arm-based-microcontrollers/f/arm-based-microcontrollers-forum/1274945/simplelink-msp432-sdk-rebuild-mbedtls-using-gcc-compiler

https://e2e.ti.com/support/microcontrollers/msp-low-power-microcontrollers-group/msp430/f/msp-low-power-microcontroller-forum/867347/msp432e401y-rebuilt-a-library-within-the-ndk-howto

0 Robert Macklin 7 months ago in reply to Charles Tsai

Intellectual 505 points

I've made some progress. I found that the SLNETSOCK_SEC_ATTRIB_DOMAIN_NAME attribute actually does set the SNI. I used the SlNetSock_secAttribSet function to set the value before making the connection. I stepped through this and watched it load the value properly. Then I made the call to connect the socket and in the SlNetIfNDK_sockStartSec, where the domain name should be loaded, the attribute is no longer set. I hacked in the pointer to my domain name string for a test and found that the SNI was properly generated during the connect process. Can you explain why the attribute that is set with SlNetSock_secAttribSet is not present when SlNetIfNDK_sockStartSec gets called?

0 Robert Macklin 7 months ago in reply to Robert Macklin

Intellectual 505 points

Problem solved. After digging through enough of the source code I found the MQTT library handles setting the SNI automatically, but it is disabled in the MQTT example code I used as a base for my code. The only thing that needs to be done is to change the MQTTClient_ConnParams to NOT include the MQTTCLIENT_NETCON_SKIP_DOMAIN_NAME_VERIFICATION flag in the netconnFlags field. Then the MQTT client will automatically load the serverAddr field into the SNI when the socket connects.

Arm-based microcontrollers

Arm-based microcontrollers forum

MSP432E401Y: TLS Server Name Indication