implementation of TLSv1.3 resumption and renegotiation functionalities

[luayahdab]

Hello,

Could you please confirm whether the current libnetconf2/Netopeer2 server implementation supports TLS 1.3 session resumption (session tickets/PSK resumption)?

Also, can you confirm that TLS renegotiation is not supported when TLS 1.3 is used, and whether this behavior is handled entirely by OpenSSL or explicitly by libnetconf2 code?

I am interested in the actual CESNET implementation behavior rather than the TLS 1.3 specification.

Thank you.

[Roytak]

Hi,

neither TLS 1.3 resumption nor renegotiation is supported by libnetconf2.

Resumption is a libnetconf2 property: we create a new TLS context (SSL_CTX) per connection and free it with the session. So even though OpenSSL may send a NewSessionTicket, no later connection can ever resume from it. On the client side we never call anything such as SSL_set_session(), so no session is ever offered. The same holds for the MbedTLS backend.

As for renegotiation we simply never initiate it (TLS 1.2 only).

Note also that a NETCONF over TLS session is a single long lived connection carrying the whole NETCONF session, however I could see the added benefit for e.g. periodic CH connections.

[luayahdab]

Thank you for the clarification.

Just to confirm: is TLS 1.3 session resumption unsupported only because of the current implementation (new SSL_CTX per connection and no session reuse), or is there a deliberate decision not to support it in libnetconf2?

[Roytak]

As far as I know only because of the current implementation and since it was not requested to be added by any user so far.

Are you interested in supporting this?

[Roytak]

So I looked at it more closely and for renegotiation, it's not part of TLS 1.3 and enabling it for TLS 1.2 would be just a security regression with no real benefit.

For session resumption:
like i said, a classic NETCONF session is a single long lived connection, so there is nothing to gain there. The only real benefit would be for periodically reconnecting Call Home clients.

The main problem is authentication. RFC 7589 requires the server to verify the client's identity before the session starts, but on a resumed handshake there is no Certificate message, so our verify callback never runs. Meaning no cert-to-name, no username, and no user verify callback. We would have to derive the identity again post-handshake against the current configuration, since a ticket can easily outlive a config change that revoked the client or changed the CTN mapping. This would have to be done for both the OpenSSL and MbedTLS backends.

So with respect to the benefit/effort ratio I don't think this makes sense for us to implement right now. If you are interested, a PR is welcome. Just note the above + 0-RTT early data must stay disabled (replayable RPCs) and it would need to be opt-in per endpoint, off by default (new augment in libnetconf2-netconf-server.yang).