Subject: [core] constrained resources at root for debugging connectivity

From: Michael Richardson <[email-masked]>
Date: Tue, 20 Jul 2021 09:39:09 -0400

It was said in a private exchange:
    > There is no CoAP resource at the root /  hence the 4.04.  (Only the
    > MASA has a test HTTP resource at / )

I thought, what we need is a CoAP Ping/echo.
And I remembered:
  https://www.ietf.org/archive/id/draft-ietf-core-echo-request-tag-13.html#section-2.2

but, this is for the server to validate that the client is really there.

Should we recommend that Registrar put something at / that produces a 2.00?
(lowercase recommend)

--
Michael Richardson <[email-masked]>   . o O ( IPv6 IøT consulting )
           Sandelman Software Works Inc, Ottawa and Worldwide

---

From: Esko Dijk <[email-masked]>
Date: Wed, 21 Jul 2021 07:48:24 +0000

Hi,

There is already a "CoAP ping" described in RFC 7252 that can be used. It does not access any resource, just the CoAP server endpoint at CoAP message layer. As a side effect of this ping your DTLS stack will set up the connection which is handy.

So I don't think we need a resource at / that produces 2.05 , this is for the maintainer of the server to decide how to allocate that resource space.
Besides we have already defined some well-known resources accessible with GET ( in core/est/brski) that the client could make use of to test connectivity.

Even a non-existing resource in the /.well-known/X space could be used just to get a 4.04 which confirms the server is working properly. This is even better that trying to GET a resource of who knows how large size.

Esko

---

From: Michael Richardson <[email-masked]>
Date: Wed, 21 Jul 2021 15:36:18 -0400

Esko Dijk <[email-masked]> wrote:
    > There is already a "CoAP ping" described in RFC 7252 that can be
    > used. It does not access any resource, just the CoAP server endpoint at
    > CoAP message layer. As a side effect of this ping your DTLS stack will
    > set up the connection which is handy.

I recalled that later in the day that CoAP "ping" is not connected to CoAP
"echo" :-)
I think that there is also potentially a need for a way to debug possible MTU
issues.
Is there a way to use Olaf's "coap-client" to do the ping?
I don't see an option, and it also doesn't seem to be commonly built with DTLS.
We also have the issue of CCM8 vs OpenSSL that I thought got solved, but it
appears that it has not been, so one needs a tool built with mbedtls or wolfSSL.

    > So I don't think we need a resource at / that produces 2.05 , this is
    > for the maintainer of the server to decide how to allocate that
    > resource space.

    > Besides we have already defined some well-known resources accessible
    > with GET ( in core/est/brski) that the client could make use of to test
    > connectivity.

    > Even a non-existing resource in the /.well-known/X space could be used
    > just to get a 4.04 which confirms the server is working properly. This
    > is even better that trying to GET a resource of who knows how large
    > size.

BTW, I've changed my /version.json so that it now looks for and returns the
client certificate that it saw:

curl
        --cert spec/files/product/00-D0-E5-02-00-2E/device.crt
        --key  spec/files/product/00-D0-E5-02-00-2E/key.pem
        https://masa.honeydukes.sandelman.ca/version.json

->

{"version":"1.1.0","revision":"582044cfc536fd295e8bdcd3b90f30453d7784d3","Hostname":"masa.honeydukes.sandelman.ca","client_certificate":"-----BEGIN CERTIFICATE-----\nMIICBjCCAYugAwIBAgIEXKnlyDAKBggqhkjOPQQDAjBNMRIwEAYKCZImiZPyLGQB\nGRYCY2ExGTAXBgoJkiaJk/IsZAEZFglzYW5kZWxtYW4xHDAaBgNVBAMME1Vuc3Ry\ndW5nIEhpZ2h3YXkgQ0EwIBcNMTkwNDI0MDIxNjU4WhgPMjk5OTEyMzEwMDAwMDBa\nMBwxGjAYBgNVBAUMETAwLWQwLWU1LTAyLTAwLTJlMFkwEwYHKoZIzj0CAQYIKoZI\nzj0DAQcDQgAEey+I0TtIhm8ivRJY36vF5ZRHs/IwhQWRc2Ql70rN+aYLZPOIXYc6\nZzlO62kDYBo3IPrcjkiPVnhoCosUBpTzbqOBhzCBhDAdBgNVHQ4EFgQU/g+KaX9o\nDEKY2K3NGe7Vr/9geDAwCQYDVR0TBAIwADArBgNVHREEJDAioCAGCSsGAQQBgu5S\nAaATDBEwMC1EMC1FNS0wMi0wMC0yRTArBgkrBgEEAYLuUgIEHgwcbWFzYS5ob25l\neWR1a2VzLnNhbmRlbG1hbi5jYTAKBggqhkjOPQQDAgNpADBmAjEAuEwTKPMzS/Xm\nAhR4tFtDo3YHoPoBsaw/6UUYDHot4EoKy2L8AlriFzti/iNmH67/AjEAnRjH2R0T\n98DZjBIhz7W8LM52AeymMdCtsJyuDRjtVuncGEfMO/OWuFFx5qwYR63I\n-----END CERTIFICATE-----\n"}

---

From: Peter van der Stok <[email-masked]>
Date: Thu, 22 Jul 2021 08:55:55 +0200

Is there a way to use Olaf's "coap-client" to do the ping?
I don't see an option, and it also doesn't seem to be commonly built 
with DTLS.

No, I have a three lines of code for doing a ping, from pledge; not from 
coap_client

Peter
Michael Richardson schreef op 2021-07-21 21:36:

> {"version":"1.1.0","revision":"582044cfc536fd295e8bdcd3b90f30453d7784d3","Hostname":"masa.honeydukes.sandelman.ca","client_certificate":"-----BEGIN 
> CERTIFICATE-----\nMIICBjCCAYugAwIBAgIEXKnlyDAKBggqhkjOPQQDAjBNMRIwEAYKCZImiZPyLGQB\nGRYCY2ExGTAXBgoJkiaJk/IsZAEZFglzYW5kZWxtYW4xHDAaBgNVBAMME1Vuc3Ry\ndW5nIEhpZ2h3YXkgQ0EwIBcNMTkwNDI0MDIxNjU4WhgPMjk5OTEyMzEwMDAwMDBa\nMBwxGjAYBgNVBAUMETAwLWQwLWU1LTAyLTAwLTJlMFkwEwYHKoZIzj0CAQYIKoZI\nzj0DAQcDQgAEey+I0TtIhm8ivRJY36vF5ZRHs/IwhQWRc2Ql70rN+aYLZPOIXYc6\nZzlO62kDYBo3IPrcjkiPVnhoCosUBpTzbqOBhzCBhDAdBgNVHQ4EFgQU/g+KaX9o\nDEKY2K3NGe7Vr/9geDAwCQYDVR0TBAIwADArBgNVHREEJDAioCAGCSsGAQQBgu5S\nAaATDBEwMC1EMC1FNS0wMi0wMC0yRTArBgkrBgEEAYLuUgIEHgwcbWFzYS5ob25l\neWR1a2VzLnNhbmRlbG1hbi5jYTAKBggqhkjOPQQDAgNpADBmAjEAuEwTKPMzS/Xm\nAhR4tFtDo3YHoPoBsaw/6UUYDHot4EoKy2L8AlriFzti/iNmH67/AjEAnRjH2R0T\n98DZjBIhz7W8LM52AeymMdCtsJyuDRjtVuncGEfMO/OWuFFx5qwYR63I\n-----END 
> CERTIFICATE-----\n"}
> 
> --
> _______________________________________________
> Anima mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/anima

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 22 Jul 2021 09:45:50 +0200

Time for me to update the coaping gem…

Well, yeah, the warning message.

Grüße, Carsten

$ gem install coaping
Fetching coaping-0.0.1.gem
Successfully installed coaping-0.0.1
$ coaping coap.me
Trying 20 times with coap.me at port 5683, waiting 1.0 second max:
/Volumes/nar/Users/cabo-rescue/lib/ruby/gems/3.0.0/gems/coaping-0.0.1/bin/coaping:36: warning: Object#timeout is deprecated, use Timeout.timeout instead.
  0 28.0 ms 134.102.218.18
/Volumes/nar/Users/cabo-rescue/lib/ruby/gems/3.0.0/gems/coaping-0.0.1/bin/coaping:36: warning: Object#timeout is deprecated, use Timeout.timeout instead.
  1 23.2 ms 134.102.218.18
/Volumes/nar/Users/cabo-rescue/lib/ruby/gems/3.0.0/gems/coaping-0.0.1/bin/coaping:36: warning: Object#timeout is deprecated, use Timeout.timeout instead.
  2 22.1 ms 134.102.218.18
/Volumes/nar/Users/cabo-rescue/lib/ruby/gems/3.0.0/gems/coaping-0.0.1/bin/coaping:36: warning: Object#timeout is deprecated, use Timeout.timeout instead.
  3 22.0 ms 134.102.218.18
/Volumes/nar/Users/cabo-rescue/lib/ruby/gems/3.0.0/gems/coaping-0.0.1/bin/coaping:36: warning: Object#timeout is deprecated, use Timeout.timeout instead.
  4 22.7 ms 134.102.218.18
/Volumes/nar/Users/cabo-rescue/lib/ruby/gems/3.0.0/gems/coaping-0.0.1/bin/coaping:36: warning: Object#timeout is deprecated, use Timeout.timeout instead.
  5 28.0 ms 134.102.218.18
/Volumes/nar/Users/cabo-rescue/lib/ruby/gems/3.0.0/gems/coaping-0.0.1/bin/coaping:36: warning: Object#timeout is deprecated, use Timeout.timeout instead.
  6 33.6 ms 134.102.218.18
/Volumes/nar/Users/cabo-rescue/lib/ruby/gems/3.0.0/gems/coaping-0.0.1/bin/coaping:36: warning: Object#timeout is deprecated, use Timeout.timeout instead.
  7 23.4 ms 134.102.218.18
/Volumes/nar/Users/cabo-rescue/lib/ruby/gems/3.0.0/gems/coaping-0.0.1/bin/coaping:36: warning: Object#timeout is deprecated, use Timeout.timeout instead.
  8 35.1 ms 134.102.218.18
/Volumes/nar/Users/cabo-rescue/lib/ruby/gems/3.0.0/gems/coaping-0.0.1/bin/coaping:36: warning: Object#timeout is deprecated, use Timeout.timeout instead.
  9 39.2 ms 134.102.218.18
/Volumes/nar/Users/cabo-rescue/lib/ruby/gems/3.0.0/gems/coaping-0.0.1/bin/coaping:36: warning: Object#timeout is deprecated, use Timeout.timeout instead.
 10 28.7 ms 134.102.218.18
/Volumes/nar/Users/cabo-rescue/lib/ruby/gems/3.0.0/gems/coaping-0.0.1/bin/coaping:36: warning: Object#timeout is deprecated, use Timeout.timeout instead.
 11 29.2 ms 134.102.218.18
/Volumes/nar/Users/cabo-rescue/lib/ruby/gems/3.0.0/gems/coaping-0.0.1/bin/coaping:36: warning: Object#timeout is deprecated, use Timeout.timeout instead.
 12 32.4 ms 134.102.218.18
/Volumes/nar/Users/cabo-rescue/lib/ruby/gems/3.0.0/gems/coaping-0.0.1/bin/coaping:36: warning: Object#timeout is deprecated, use Timeout.timeout instead.
 13 24.2 ms 134.102.218.18
/Volumes/nar/Users/cabo-rescue/lib/ruby/gems/3.0.0/gems/coaping-0.0.1/bin/coaping:36: warning: Object#timeout is deprecated, use Timeout.timeout instead.
 14 25.9 ms 134.102.218.18
/Volumes/nar/Users/cabo-rescue/lib/ruby/gems/3.0.0/gems/coaping-0.0.1/bin/coaping:36: warning: Object#timeout is deprecated, use Timeout.timeout instead.
 15 23.0 ms 134.102.218.18
/Volumes/nar/Users/cabo-rescue/lib/ruby/gems/3.0.0/gems/coaping-0.0.1/bin/coaping:36: warning: Object#timeout is deprecated, use Timeout.timeout instead.
 16 36.1 ms 134.102.218.18
/Volumes/nar/Users/cabo-rescue/lib/ruby/gems/3.0.0/gems/coaping-0.0.1/bin/coaping:36: warning: Object#timeout is deprecated, use Timeout.timeout instead.
 17 24.4 ms 134.102.218.18
/Volumes/nar/Users/cabo-rescue/lib/ruby/gems/3.0.0/gems/coaping-0.0.1/bin/coaping:36: warning: Object#timeout is deprecated, use Timeout.timeout instead.
 18 27.7 ms 134.102.218.18
/Volumes/nar/Users/cabo-rescue/lib/ruby/gems/3.0.0/gems/coaping-0.0.1/bin/coaping:36: warning: Object#timeout is deprecated, use Timeout.timeout instead.
 19 27.0 ms 134.102.218.18

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 22 Jul 2021 09:50:26 +0200

> Time for me to update the coaping gem…

Done:

VERSIONS:
	• 0.0.2 - July 22, 2021 (5 KB)
	• 0.0.1 - November 19, 2012 (4.5 KB)

Grüße, Carsten

---

From: Christer Holmberg <[email-masked]>
Date: Thu, 22 Jul 2021 08:04:56 +0000

Hi,

Maybe not exactly what people are looking for, but below is a link to the thin-ICE presentation from the T2TRG 2019 session in Singapore.

https://github.com/t2trg/2019-11-singapore/blob/master/slides/44-thin-ICE-151119-Singapore.pdf

Regards,

Christer

-----Original Message-----
From: core <[email-masked]> On Behalf Of Carsten Bormann
Sent: torstai 22. heinäkuuta 2021 10.50
To: [email-masked]
Cc: [email-masked]; [email-masked]
Subject: Re: [core] [Anima] constrained resources at root for debugging connectivity

Done:

VERSIONS:

Grüße, Carsten

_______________________________________________
core mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/core

---

From: Carsten Bormann <[email-masked]>
Date: Thu, 22 Jul 2021 10:43:32 +0200

> On 2021-07-21, at 21:36, Michael Richardson <[email-masked]> wrote:
> 
> Signed PGP part
> 

The Echo option is not an echo in the sense of an ICMP echo.
(Maybe we should fix the name to “cookie”.)

> I think that there is also potentially a need for a way to debug possible MTU

Good point, CoAP Ping (empty CON messages) cannot do that.

Actually, the fact that it was possible to set up DTLS should give one considerable confidence; the CoAP Ping is not needed to verify pure presence.  Verifying that that server actually speaks a specific protocol would need to be part of that protocol though.

Also, cough, cough, https://datatracker.ietf.org/doc/html/rfc6520 gives you a nice way to ping a DTLS server with different MTU sizes.
(Ignoring the fact that an incorrect implementation led to the biggest TLS, er, “event” we ever had.)

Grüße, Carsten

---

From: Olaf Bergmann <[email-masked]>
Date: Thu, 22 Jul 2021 11:53:07 +0200

Michael,

> Is there a way to use Olaf's "coap-client" to do the ping?

-K does that, see man coap-client (https://libcoap.net/doc/reference/develop/man_coap-client.html):

      -K interval
           Send a ping after interval seconds of inactivity. If
           not specified (or 0), keep-alive is disabled (default).

It would be not difficult to create a dedicated coap-ping, though.

> I don't see an option, and it also doesn't seem to be commonly built

It is automatically built with DTLS if you have either GnuTLS, OpenSSL,
Mbed TLS with headers installed (--enable-dtls is default).

Grüße
Olaf

---

From: Michael Richardson <[email-masked]>
Date: Sun, 25 Jul 2021 12:46:12 -0400

Christer Holmberg <christer.holmberg=[email-masked]> wrote:
    > Maybe not exactly what people are looking for, but below is a link to
    > the thin-ICE presentation from the T2TRG 2019 session in Singapore.

No, not what we want.
We just want to prove connectivity as part of debugging what's going on.

---

From: Michael Richardson <[email-masked]>
Date: Sun, 25 Jul 2021 12:47:34 -0400

> • 0.0.2 - July 22, 2021 (5 KB)

Yes, but DTLS?
I'll see about adding it in my copy, but my DTLS additions to coap gem
are rough.  I guess my changes to OpenSSL are only required by the server side.