Re: Extensions when negotiating TLS

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--===============6971824016408374279==
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="MEedkodfEOGGalsGHwix8Oidp8I6nsg6t"

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--MEedkodfEOGGalsGHwix8Oidp8I6nsg6t
Content-Type: multipart/mixed; boundary="2nOdiUs87jkLpVvBfllJg8LWndAvS1iUb";
 protected-headers="v1"
From: Christopher Schultz <[email protected]>
To: [email protected]
Message-ID: <[email protected]>
Subject: Re: [stunnel-users] Extensions when negotiating TLS
References: <c92c5a6e51824325b83c1bc0f2098847@SN1F00803MB0045.008f.mgd2.msft.net>
In-Reply-To: <c92c5a6e51824325b83c1bc0f2098847@SN1F00803MB0045.008f.mgd2.msft.net>

--2nOdiUs87jkLpVvBfllJg8LWndAvS1iUb
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable

Tom,

On 11/4/19 16:05, Tom (AST) Watson wrote:
> Well, I thought it would be "easy", but maybe not.  I have an=20
> application (#1) that uses http2, and isn't encrypted.  No problem=20
> here.  Now I have another application (#2) that insists on using=20
> https to talk to application #1.  So I gleefully setup stunnel to=20
> connect the two.  Well, application #2 starts talking to stunnel with
> a "Client Hello" packet, and it includes an extension "Application
> Layer Protocol Extension" of "h2".

This is called ALPN, and is a requirement for h2s.

> While not versed in the minutia, I take this that the client=20
> (application #2) wants to talk "http2" to the server (application=20
> #1).

Yep, pretty much.

> OK, that is what I want.  The problem is that stunnel doesn't
> respond with ANY "Application Layer Protocol Extension" indicating
> acceptance of this request in its "server hello".  This means that
> application #2 fails in its negotiation.  No joy!
>
> Now I know that application #1 will nicely talk http2, but how do I=20
> get stunnel to communicate this to application #2 (as encrypted=20
> http2).  Am I missing something in my (pretty simple) configuration=20
> file?

I can't find any references to stunnel supporting ALPN.
You may be (temporarily) out of luck, at least with stunnel.

You mentioned that app #2 insists on encryption (great, usually). Is
there a requirement that it use h2? Or can it be configured to use HTTP/1=
=2E1?

-chris


--2nOdiUs87jkLpVvBfllJg8LWndAvS1iUb--

--MEedkodfEOGGalsGHwix8Oidp8I6nsg6t
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/

iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAl3AnxMACgkQHPApP6U8
pFgjshAAuwCXhJGE4Nzuk5Ras9m2ulpr/qWsS9mkaiAb1D1oqXNJhQzEo6dHTgFy
UZDa+VQsvd4Ybjh9EEtVzdwJCOhAaa1jCg69IVbnhqziO0QjboW643PHN70j8RdU
JUV4xFxpcxYQQ2HMPmG9qlqE+ukZ9Chl0EVN0lj0SaDeyqdW17/7mbp2P6780NZQ
ZoDYjjTlcR2gWeFp6YU578H/GNOAhb+Q3t8swgU+B/uJ3bKgqVtKyUro4PqkwHFr
QYqhs5q5cvz42ro5uMyariTTkcUymJMSMggVZfSuznypXqLVA29HXFWxT8JKeKxa
UkxHSCj1iPU1CCCooSE/DIN4tfqTRxnzKVZR2wJ6+Jiz5rdDAFRbH0BewJFj5IAV
VKooJ4H57QeoEvu5TWvF+U6SBJthWXOf1RDljI+x5jhLCFibdLL+Y8w3+/4ws4aQ
gdqNXHRgDsRmhHcZtgoXE9g3Jjxp/JYN1c++h72C2lzaSrDMYZwC8y39EiwYxRVd
86vEctKlaNNPrBwbI/bq0GaKW4TGiR1yG24beMyUTc5HdG/jbJOTkDGia69c1nkk
6cQbDhRwuaXzj3dA5Rm2d2nrVrG/5Wk9MtT9ARHxpAhG6k4/gQvYJs/MrP+k5WCN
EACgnsncrgt3wgRN+36hgTEIIH9xNuUs9NfxBNS89IglPvTp06M=
=RGdw
-----END PGP SIGNATURE-----

--MEedkodfEOGGalsGHwix8Oidp8I6nsg6t--

--===============6971824016408374279==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
stunnel-users mailing list
[email protected]
https://www.stunnel.org/cgi-bin/mailman/listinfo/stunnel-users

--===============6971824016408374279==--