Subject: [core] CoAP - HTTP proxies

From: "Turner, Randy" <[email-masked]>
Date: Thu, 12 Nov 2020 15:57:13 +0000

HI All,

RFC 7252 provides a good description regarding CoAP-to-HTTP proxy (forward, reverse) operation and other documents detail some guidelines for doing this in an actual deployment.

In reading the EST-over-COAP(s) document, the text talks about a "registrar" (section 6) that performs proxy-like operations.  However, section 6 refrains from mentioning anything regarding the proxy operation described in RFC 7252.

Does this imply that if I want to deploy a generic CoAP-to-HTTP proxy between my constrained and non-constrained networks, AND I want to support an EST-over-CoAP registrar, that I actually need "2" proxies ?  Or can I use my generic CoAP to HTTP proxy to solve both generic CoAP to HTTP proxy and EST-over-CoAP(s) registrar functions ?  Understanding that if I want "1" proxy to do both, I may have to have special case code in my generic proxy to handle EST-over-COAP(s) specific behavior

Thanks,
Randy

---

From: Esko Dijk <[email-masked]>
Date: Tue, 17 Nov 2020 13:45:47 +0000

Hello Randy,

The Registrar described in Section 6 of draft-ace-coap-est is indeed doing some proxying, but it is a highly specific sort of proxy and certainly not generic:

  *   It performs some content conversions to/from Base64 encoding
  *   It performs dedicated URI path conversion as per Table 1
  *   It uses a certificate that is flagged as an ‘RA’ (Registration Authority) , both towards the HTTP EST server and towards the Coap clients.  It would be unlikely, in terms of security, that the Registrar/proxy would proxy arbitrary application requests for others using such ‘authority’ credentials.

* The TLS credentials that a generic proxy would use towards HTTP servers, might be some application/deployment specific credentials that have sufficient privileges to execute all intended proxied requests but not more than that.

  *   … there may be more.

But despite of this, generic proxy functions could be _added_ to above Registrar:

  *   A forward-proxy request with a Proxy-Uri or Proxy-Scheme Option indicating ‘http(s)’ scheme can be easily identified and processed separately from above functions.
  *   The proxy could use a different TLS (certificate) identity for performing these proxy requests, in HTTP client role.  (So not use the RA-certificate in this case but switch to another identity more suitable for the given to-be-sent HTTP request.)
  *   A reverse-proxy request could also be served from a dedicated resource.
*  e.g. a CoAP request to resource /ch/http/s.example.com/light  is translated by the reverse-proxy into a http request http://s.example.com/light .  The syntax here is borrowed from RFC 8075 which unfortunately only describes the HTTP->CoAP direction not vice versa! But the same mapping ideas can be applied. To do :)

So for “1” proxy to do both, it will always need special-case code for EST-to-CoAP and it may also need to be configured with multiple (>=2) identities for security reasons. The ‘RA’ identity would be used only on the TLS connection towards HTTP-EST-Server, not for arbitrary proxied requests.
If we would like a fully generic proxy to be used as the ‘Registrar’ in the CoAP domain , without doing the special translations, then the EST-to-CoAP draft would need some severe edits and rethinking, I guess.

Best regards
Esko

IoTconsultancy.nl  |  Email/Teams: [email-masked]

From: core <[email-masked]> On Behalf Of Turner, Randy
Sent: Thursday, November 12, 2020 16:57
To: [email-masked] WG <[email-masked]>
Subject: [core] CoAP - HTTP proxies

HI All,

In reading the EST-over-COAP(s) document, the text talks about a “registrar” (section 6) that performs proxy-like operations.  However, section 6 refrains from mentioning anything regarding the proxy operation described in RFC 7252.

Does this imply that if I want to deploy a generic CoAP-to-HTTP proxy between my constrained and non-constrained networks, AND I want to support an EST-over-CoAP registrar, that I actually need “2” proxies ?  Or can I use my generic CoAP to HTTP proxy to solve both generic CoAP to HTTP proxy and EST-over-CoAP(s) registrar functions ?  Understanding that if I want “1” proxy to do both, I may have to have special case code in my generic proxy to handle EST-over-COAP(s) specific behavior

Thanks,
Randy