Wget error trying to update he.net

[aboaboit]

Longtime user, most recently I had 15.05 before installing 18.06.2 and reconfiguring.

I installed the following additional packages: 6in4, libustream-wolfssl, curl, luci-app-ddns, ca-bundle, ca-certificates. Duckdns, for example, can successfully be updated with a https URL.

My he.net tunnel shows 0 received packages because the endpoint is not being updated. I modified 6in4.sh to show the actual URL used:
https://username:updatekey@ipv4.tunnelbroker.net/nic/update?hostname=tunnelid
(credentials redacted)

Running the command on the router I get

Connecting to 64.62.200.2:443
Connection error: Connection failed

If I run the same command on my destkop it works just fine, the endpoint is updated and the tunnel comes online. What am I doing wrong?

Please note: I omitted the tunnel config here since it works, it's just wget giving me trouble.

Thanks, Andrea.

[lleachii]

Wow...I didn't know HE updated on HTTPS (maybe I just always had issues OpenWrt)...when I have a opportunity to configure a test device I'll let you know.

@aboaboit

libustream-wolfssl

Any reason you preferred that over mbed TLS?

[aboaboit]

@lleachii AFAIK it updated on HTTPS even on my older 15.05 setup but I am going from memory...
Regarding wolfssl, a friend works there so I had the name in mind
Anyhow, I quickly removed it and installed your suggestion: now it works, thanks for the tip!
(of course, I'm going to let him know...)

[danielinux]

Hey, wolfSSL contributor here. We're happy to help fixing this, if you can provide more information about the problem. It could be useful that wolfSSL packages are updated to the latest version (4.0.0 at the moment of writing this), and if you could let us know more details on the nature of this issue.

If security is important to you, I'd always suggest to use wolfSSL over mbedTLS, because reported vulnerabilities are fixed much quicker, and all the latest standards are properly supported.

WolfSSL has been supporting TLS 1.3 since way before it was even accepted as standard, while mbedTLS has not yet communicated any plans to implement it, and it's been now an RFC for several months already. This alone might be a major security risk, seeing the vulnerabilities on TLS up to v.1.2 that have been disclosed lately.

I've also notice that mbedTLS stopped communicating about security disclosures more than a year ago, so I am not sure if any effort has been invested on their security-related research and development lately.

[aboaboit]

Thanks, Daniele. I'll keep you posted.

@lleachii should I file a bug for this problem? How do we get the devs involved?

[lleachii]

...sure you can.

bugs.openwrt.org or the dev list.

[aboaboit]

Done, thanks.
FS#2238 - 6in4 endpoint does not update with libustream-wolfssl