implementation of TLSv1.3 resumption and renegotiation functionalities

[luayahdab]

Hello,

Could you please confirm whether the current libnetconf2/Netopeer2 server implementation supports TLS 1.3 session resumption (session tickets/PSK resumption)?

Also, can you confirm that TLS renegotiation is not supported when TLS 1.3 is used, and whether this behavior is handled entirely by OpenSSL or explicitly by libnetconf2 code?

I am interested in the actual CESNET implementation behavior rather than the TLS 1.3 specification.

Thank you.

[Roytak]

Hi,

neither TLS 1.3 resumption nor renegotiation is supported by libnetconf2.

Resumption is a libnetconf2 property: we create a new TLS context (SSL_CTX) per connection and free it with the session. So even though OpenSSL may send a NewSessionTicket, no later connection can ever resume from it. On the client side we never call anything such as SSL_set_session(), so no session is ever offered. The same holds for the MbedTLS backend.

As for renegotiation we simply never initiate it (TLS 1.2 only).

Note also that a NETCONF over TLS session is a single long lived connection carrying the whole NETCONF session, however I could see the added benefit for e.g. periodic CH connections.

[luayahdab]

Thank you for the clarification.

Just to confirm: is TLS 1.3 session resumption unsupported only because of the current implementation (new SSL_CTX per connection and no session reuse), or is there a deliberate decision not to support it in libnetconf2?

[Roytak]

As far as I know only because of the current implementation and since it was not requested to be added by any user so far.

Are you interested in supporting this?