MQTT TCP Service and Traefik v2.5.0

tam481 · August 19, 2021, 9:24pm

Hi all,
I have a TCP service listening on port 8883 and passing traffic to an MQTT container running on 1883 so Traefik is doing the TLS offloading.

Since upgrading to 2.5.0 I started seeing the following:

2021-08-19 21:53:32	
time="2021-08-19T21:53:31+01:00" level=error msg="Error during connection: readfrom tcp 172.22.0.7:37118->172.22.0.8:1883: tls: client requested unsupported application protocols ([mqtt])"
2021-08-19 21:53:26	
time="2021-08-19T21:53:26+01:00" level=error msg="Error during connection: readfrom tcp 172.22.0.7:37114->172.22.0.8:1883: tls: client requested unsupported application protocols ([mqtt])"
2021-08-19 21:53:25	
time="2021-08-19T21:53:25+01:00" level=error msg="Error during connection: readfrom tcp 172.22.0.7:37112->172.22.0.8:1883: tls: client requested unsupported application protocols ([mqtt])"
2021-08-19 21:53:11	
time="2021-08-19T21:53:11+01:00" level=error msg="Error during connection: readfrom tcp 172.22.0.7:37106->172.22.0.8:1883: tls: client requested unsupported application protocols ([mqtt])"
2021-08-19 21:53:03	
time="2021-08-19T21:53:03+01:00" level=error msg="Error during connection: readfrom tcp 172.22.0.7:37102->172.22.0.8:1883: tls: client requested unsupported application protocols ([mqtt])"

Reverting to version 2.4.14 fixes the issue. Is this a bug in 2.5.0?

Thank you in advance

ldez · August 19, 2021, 10:41pm

github.com/traefik/traefik

Go 1.17 strict TLS APLN breaks TLS on TCP routers for non-HTTP protocols

opened 03:37PM - 19 Aug 21 UTC

andatche

status/0-needs-triage

### Welcome! - [x] Yes, I've searched similar issues on [GitHub](https://github….com/traefik/traefik/issues) and didn't find any. - [X] Yes, I've searched similar issues on the [Traefik community forum](https://community.containo.us) and didn't find any. ### What did you do? The 2.5.0-rc6 release switched to go 1.17, which enforces strict TLS APLN checking by default. This breaks TLS on TCP routers in traefik where the upper-layer protocol is not HTTP because `config.NextProtos` of the TLS context only includes `h2`, `http/1.1` and the ACME TLS protocol. https://github.com/traefik/traefik/blob/f15d05b22ffb752c5d9feeaed81346896cb2f29a/pkg/tls/tlsmanager.go#L236 I guess ideally `NextProtos` should be configurable on a per-router basis, or alternatively strict APLN checking should be disabled for TCP routers. ### What did you see instead? TLS negotiation attempts fail with APLN error: ``` tls: client requested unsupported application protocols ``` ### What version of Traefik are you using? 2.5.0 ### What is your environment & configuration? ```yaml tcp: routers: mosquitto_route: entryPoints: - "mqtt-mosquitto" service: mosquitto_service rule: "HostSNI(`*`)" tls: options: "mqtt@file" certResolver: le-2048 domains: - main: "mqtt.<redacted>" services: mosquitto_service: loadBalancer: servers: - address: "mosquitto:1883" ``` ### If applicable, please paste the log output in DEBUG level time="2021-08-19T15:02:56Z" level=error msg="Error during connection: readfrom tcp 10.88.26.86:40794->10.88.26.76:1883: tls: client requested unsupported application protocols ([mqtt])" time="2021-08-19T15:02:56Z" level=error msg="Error during connection: readfrom tcp 10.88.26.86:40796->10.88.26.76:1883: tls: client requested unsupported application protocols ([mqtt])" time="2021-08-19T15:02:56Z" level=error msg="Error during connection: readfrom tcp 10.88.26.86:40798->10.88.26.76:1883: tls: client requested unsupported application protocols ([mqtt])" time="2021-08-19T15:02:57Z" level=error msg="Error during connection: readfrom tcp 10.88.26.86:40800->10.88.26.76:1883: tls: client requested unsupported application protocols ([mqtt])" time="2021-08-19T15:02:57Z" level=error msg="Error during connection: readfrom tcp 10.88.26.86:40802->10.88.26.76:1883: tls: client requested unsupported application protocols ([mqtt])" time="2021-08-19T15:02:57Z" level=error msg="Error during connection: readfrom tcp 10.88.26.86:40804->10.88.26.76:1883: tls: client requested unsupported application protocols ([mqtt])" time="2021-08-19T15:02:57Z" level=error msg="Error during connection: readfrom tcp 10.88.26.86:40806->10.88.26.76:1883: tls: client requested unsupported application protocols ([mqtt])"

system · August 22, 2021, 10:42pm

This topic was automatically closed 3 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
MQTT TCP Service and ALPNProtocols Traefik v2 docker , tcp	0	536	August 27, 2021
Cant get the HTTP out of træfik Traefik v2 docker , tcp	8	2463	April 13, 2020
TCP Service for Mosquitto not connecting to pod Traefik v2 docker , tcp	0	1094	April 26, 2021
Bad record MAC from Traefik to service Traefik v2 docker , tcp	0	2164	December 30, 2020
HTTPS and TLS from one container Traefik v2 docker , tcp	1	1208	May 11, 2020

MQTT TCP Service and Traefik v2.5.0

Related topics