SNI missing after upgrade to 0.97-alpha2

We started using NetCipher to improve TLS support (e.g. enable TLS 1.2 on all platforms it's available on), see 2c88703588a6192cbf3ffd7ccb8d01b65c693ed3.

@eighthave could this be caused by that change?

@badfish99 if you have time, try reverting that commit, building a debug apk and see if that solves your issue. Bonus points if you build without the revert to confirm that the commit is to blame for this :)

@mvdan Built from git repository: fails as described above. Reverted patch for NetCipher (and nothing else): works OK. So yes, it's that change that has caused the problem. I can work round it as I control my own server, but it might cause problems for other people.

@badfish99 thanks for confirming the source of the issue.

Luckily, this was made after the 0.96 release. If we find a way to fix it, we'll keep netcipher enabled - if not, the safest route is to temporarily revert.

Assigning to Hans, he probably has an idea of what's going on.

Reassigned to @eighthave

It looks to me like, once it has gone wrong, uninstalling the app and installing a "working" version does not cure the problem; the "working" app will continue to give the same symptom until I power-cycle android. I would guess that there is a global pool of https connections that are shared between the apps and are being re-used somehow. If I'm right this might cause all sorts of confusion. For what it's worth, I'm testing with kitkat from android-x86.org, on a real device, not an emulator.

Milestone changed to 0.97

Added regression label

Regression - netcipher can be reverted for a stable unless fixed.

Reping @eighthave before I revert netcipher.

Status changed to closed by commit 6c8e726aadbe6714d6295882c5be87a7bf81a9f0

mentioned in issue #370 (closed)

I don't think this is a regression. This is probably caused by NetCipher enforcing good TLS practice on all Android versions. A TLS connection with a certificate that has a hostname "server.localdomain" should fail.

Status changed to reopened

@badfish99 can you provide more details on your setup? I.e. the SNI stuff, etc. Even better, can we use your URL for testing?

It looks like this is still broken in 0.97-alpha7.

There is a dummy repository at https://www.john-williams.org/fdroid

If you try to download index.jar with "wget" it works OK. But fdroid (on kitkat) appears not to send the SNI extension in the SSL connection, and so the (apache) server sends it the certificate for www.pond-weed.com which is on the same IP address.

The SNI extension is sent in the clear, so is readily visible with wireshark.

@badfish99 0.97-alpha7 does not have netcipher, so most probably it's not the cause.

Correction - it's alpha8 that doesn't have it. You tried the version from last week.

After some more experimentation, I've concluded that this is what is happening:

When you add a repository, it calls "new DefaultHttpClient()" in ManageReposActivity.checkForRepository() and this fails because it does not support SNI. But adding the repository works anyway.
The call to DefaultHttpClient somehow poisons an internal cache of SSL connections; subsequent attempts to use the repository use the defective SSL connection and fail.
If I reboot my phone, this clears the SSL cache, and the repository starts to work OK (once I have disabled and re-enabled it).

I hacked checkForRepository() to always return false (!) and the problem went away. So I would suggest that this method is redundant and should be removed.

Maybe netcipher was a red herring? I'll leave my test repository in place, in case you want to experiment with re-adding netcipher.

6c8e726aadb should have closed this issue, but for some reason gitlab didn't.

Status changed to closed

Status changed to reopened

Oh, it was indeed closed by that commit, then reopened.

Milestone removed

NetCipher really should not have been removed without really confirming this issue. Even if it was the cause, the SNI stuff is pretty specific, and not in use by f-droid.org. NetCipher is important for making sure that the client running on older versions of Android is not using extremely crappy default TLS settings.

@badfish99 if you want me to test/support the SNI stuff, you'll need to reenable your test repo. It currently requires a username/password.

I vaguely remember I had this issue with my repo as well: https://grobox.de/fdroid/ However, I think the issue was resolved by subsequent updates.

@grote thanks for that, it is a problem related to NetCipher but it is different than the original report. But its something that I can work with.

@grote hmm, perhaps its not related to NetCipher. Did you have that box setup with a cacert.org certificate at one point? It seems it is sometimes still active. It shows up when doing openssl s_client -debug -connect grobox.de:443:

Certificate chain
 0 s:/CN=*.bas3.de
   i:/O=CAcert Inc./OU=http://www.CAcert.org/CN=CAcert Class 3 Root
 1 s:/O=CAcert Inc./OU=http://www.CAcert.org/CN=CAcert Class 3 Root
   i:/O=Root CA/OU=http://www.cacert.org/CN=CA Cert Signing Authority/emailAddress=support@cacert.org

@eighthave Yes, there's many domains on that box and the main one is still running with a CAcert cert. grobox.de however should be served with a cert from Let's Encrypt if you use SNI.

Arg, SNI is a pain. It is also not supported on android-8 and older, which F-Droid still supports.

I'm sorry for using SNI, but I just can't afford enough physical servers or IPV4 addresses ;)

if you put your fdroid repo on the main domain on that IP, then no SNI is needed.

Sure, but I am sharing this box with other people and prefer to have the repo under my own domain.

@grote does your grobox repo work for you? Even without the NetCipher stuff, I can't get it to work in FDroid. I get this error, which makes me think that something else is wrong with your alias setup:

      DownloaderFactory  I  Downloader create https://grobox.de/fdroid/index.jar?client_version=0.99-alpha1 /data/data/org.fdroid.fdroid/cache/index-1274035975-downloaded
         HttpDownloader  I  setupConnection https://grobox.de/fdroid/index.jar?client_version=0.99-alpha1
                         D  Downloading from https://grobox.de/fdroid/index.jar?client_version=0.99-alpha1
             Downloader  D  Downloading from stream
          UpdateService  E  Error updating repository https://grobox.de/fdroid
                         E  org.fdroid.fdroid.RepoUpdater$UpdateException: Error getting index file
                         E      at org.fdroid.fdroid.RepoUpdater.downloadIndex(RepoUpdater.java:117)
                         E      at org.fdroid.fdroid.RepoUpdater.update(RepoUpdater.java:131)
                         E      at org.fdroid.fdroid.UpdateService.onHandleIntent(UpdateService.java:383)
                         E      at android.app.IntentService$ServiceHandler.handleMessage(IntentService.java:65)
                         E      at android.os.Handler.dispatchMessage(Handler.java:102)
                         E      at android.os.Looper.loop(Looper.java:149)
                         E      at android.os.HandlerThread.run(HandlerThread.java:61)
                         E  Caused by: java.io.FileNotFoundException: https://grobox.de/fdroid/index.jar?client_version=0.99-alpha1
                         E      at com.android.okhttp.internal.http.HttpURLConnectionImpl.getInputStream(HttpURLConnectionImpl.java:186)
                         E      at com.android.okhttp.internal.http.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:246)
                         E      at org.fdroid.fdroid.net.HttpDownloader.getDownloadersInputStream(HttpDownloader.java:67)
                         E      at org.fdroid.fdroid.net.Downloader.getInputStream(Downloader.java:52)
                         E      at org.fdroid.fdroid.net.Downloader.downloadFromStream(Downloader.java:111)
                         E      at org.fdroid.fdroid.net.HttpDownloader.doDownload(HttpDownloader.java:155)
                         E      at org.fdroid.fdroid.net.HttpDownloader.download(HttpDownloader.java:80)
                         E      at org.fdroid.fdroid.net.Downloader.downloadUninterrupted(Downloader.java:99)
                         E      at org.fdroid.fdroid.RepoUpdater.downloadIndex(RepoUpdater.java:102)
                         E      ... 6 more

@eighthave is it possible that you did not add the repo properly like described on the webpage https://grobox.de/fdroid/ ?

Milestone changed to 0.99

Added ~16415 label

doh, yup, sorry for the noise. A bit too tired. In any case, !216 (merged) should address this in a decent way. But until NetCipher gets SNI support, TLSv1.2 is not guaranteed on all supported Android devices, so a repo that is TLSv1.2 only will not work on all devices.

Status changed to closed by commit 38e4b38602d54591185bcf2e1dd73e90364606bb

SNI missing after upgrade to 0.97-alpha2

Designs

Child items 0

Activity

Admin message

Admin message

SNI missing after upgrade to 0.97-alpha2

Activity