Can't connect via TLS #55

hillelt · 2019-01-14T14:28:17Z

I installed spark from npm (v0.2.2) and I can connect locally. However, when starting the server with spark-wallet -i 0.0.0.0 and browsing to https://<internal_ip>:9737 my web browser times out trying to establish connection. The client machine is a different box on my home network and I tried connecting with Firefox, Chrome and Brave, all timing out in the same fashion.

Note that I can telnet to the internal ip and the server machine is responsive. It seems like something in the TLS handshake might be broken.

On the server:

>> spark-wallet -i 0.0.0.0
...
HTTPS server running on https://0.0.0.0:9737

On the client (browsers timing out, telnet is working):

>> telnet <internal_ip> 9737
Trying x.x.x.x...
Connected to ubuntu-server.
Escape character is '^]'.

The text was updated successfully, but these errors were encountered:

hillelt · 2019-01-18T10:59:39Z

Also, if I start spark with spark-wallet -i 0.0.0.0 --no-tls then I can connect from remote machines -- the problem is definitely with TLS.

shesek · 2019-01-20T01:58:10Z

Can you try making a request from a remote machine using curl --verbose https://<internal_ip>:9737 and report the output here?

hillelt · 2019-01-20T06:16:35Z

Yes. When I run it it gets stuck for a couple of minutes in the following state:

>> curl --verbose https://<internal_ip>:9737
* Rebuilt URL to: https://<internal_ip>:9737/
*   Trying <internal_ip>...
* TCP_NODELAY set
* Connected to <internal_ip> (internal_ip) port 9737 (#0)
* ALPN, offering http/1.1
* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH
* successfully set certificate verify locations:
*   CAfile: /home/<my_user>/anaconda3/ssl/cacert.pem
  CApath: none
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):

and then prints the error below and exits:

* OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to <private_ip>:9737 
* Closing connection 0
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to <private_ip>:9737

shesek · 2019-01-20T07:55:57Z

Are you able to access it from the same host running the server using curl -v https://localhost/?

hillelt · 2019-01-20T13:44:33Z

No, I can't. It fails with essentially the same output as before (changing the issue title to reflect).

ghost · 2019-01-28T14:40:34Z

I have the same problem and can't use Spark wallet except with --no-tls.

shesek · 2019-01-28T23:57:53Z

@hillelt @sumBTC which OS and nodejs version are you using?

Btw, another alternative that you could consider is using --onion. This will start a hidden service that you could connect to from everywhere, without worrying about NATs and router configuration. You also get strong encryption with a key that is pinned to the .onion hostname (so you don't need CAs). This doesn't require pre-installing Tor on your system, should (hopefully) Just Work ™. :)

ghost · 2019-01-29T11:27:52Z

Ubuntu 16.04, spark-wallet 0.2.2 and nodejs 11.8.0

hillelt · 2019-01-29T17:46:54Z

Ubuntu 18.04 spark-wallet 0.2.2 nodejs v11.6.0

Got an error trying to start with --onion (opened #60)

astupidmoose · 2019-02-01T22:23:36Z

Can confirm, also cannot open without the --no-tls flag. Simply goes to connection refused

k3tan172 · 2019-02-22T09:46:25Z

can also confirm, cannot open without the --no-tls flag.

hillelt · 2019-02-23T06:28:13Z

By the way, I just found out that my router (Bezeq Be) comes with a "secure surfing" protection that randomly blocks me from establishing secure connections with certain web-sites (e.g. Tor). Not sure yet but I have a feeling the problems might be related.

pseudozach · 2019-03-06T12:51:59Z

Having the same issue on debian. port allowed on firewall but https fails. --no-tls works.
no luck with my certificates or lets-encrypt either.

scottshapiro · 2019-03-11T04:21:14Z

Same issue on Ubuntu 16. Can't access remotely.

hillelt · 2019-03-17T05:15:53Z

@shesek see also https://github.com/mimblewimble/grin/issues/2523 (maybe an opportunity for cross pollination: solutions like i2pd might be relevant for spark or maybe some of the work on spark-wallet could be relevant to grin).

alko89 · 2019-03-21T08:49:23Z

I am unable to open even with --no-tls flag. Keeps redirecting to https.

pseudozach · 2019-03-26T08:30:50Z

As a workaround I managed to get https working with ngrok
Run spark regularly on localhost and start ngrok to tunnel the port to remote https domain.
Tested and works with both spark and KwH.

ghost · 2019-12-24T15:38:35Z

@shesek After trying to tweak tls/ssl for Ubuntu for days and not being able to connect via openssl s_client -connect IP:9737 (local or external IP), I decided to look at tls.js. I managed to get spark-wallet working over tls (so without --no-tls) in a browser. The App still can't connect but maybe my solution gives you enough information to get the App working as well.

In tls.js I had to change

socket.resume();

into

process.nextTick(() => socket.resume());

and that made spark-wallet finally work in a browser (including the camera permission) without --no-tls.

See the comment (As of NodeJS 10.x ...) in your own hint.

I don't understand why the App still refuses to connect. I have added the TLS certificate (cert.pem) as a user trusted certificate. I don't see anything in the server logs when the App tries to connect, while I do see text lines appear when spark-wallet (successfully) connects in a browser.

Now, I would be more than happy to use spark-wallet in a browser but there the camera has permission but when I try to scan a QR-code (for example via coinpanic.com) a red line starts scanning but the QR-code isn't read, whatever I try. While with the App (with --no-tls) the QR-code is read immediately.

This is necessary as of nodejs 10 and was preventing TLS from working properly (#55). Thanks to @sumBTC for figuring this out! #55 (comment) Also see the "As of NodeJS 10 ..." comment in https://stackoverflow.com/a/42019773/865693

shesek · 2019-12-25T12:38:10Z

@sumBTC Thank you! I was finally able to reproduce the issue by upgrading to nodejs 10 and was able to resolve it by resuming the socket asynchronously as you suggested. I implemented this in 3fc7e1a.

I don't understand why the App still refuses to connect. I have added the TLS certificate (cert.pem) as a user trusted certificate.

I'm not entirely sure, but I think that some Android versions/configurations may not respect user-trusted certificates for connections made by apps (and block the requests). It worked for me when I tried it awhile back (I normally use onion), but I've heard of others having issues.

the QR-code isn't read

Which browser and version are you using?

I'm wondering if this is also somehow related to the user-trusted self-signed tls certificate. Websites without tls or with invalid certs are not allowed to access the camera, perhaps this restriction is still in place for websites with user-trusted certs?

I'll try to look a bit more into how user-trusted certs affect these two issues. Would it be possible for you to point some (sub)domain at your IP address and try the letsencrypt integration, to help pinpoint if the self-signed cert is the cause?

ghost · 2019-12-25T14:58:19Z

@shesek

I was finally able to reproduce the issue

Glad to hear that because if you can't reproduce an issue it's kind of impossible to solve it.

Websites without tls or with invalid certs are not allowed to access the camera

But I am allowed to access the camera now that tls is working.

Which browser and version are you using?

I tried it with Google Chrome (79.0.3967.93) and Firefox (6.8.30) (on my android (9) phone). Both give me permission to use the camera and start scanning the QR code for Pay but are never able to read it and report back what's in the QR-code while other scanners report back immediately (including the spark-wallet App)

Am I right that Pay will not accept any QR-code but only specific QR-codes that are valid invoices? If so, I think the problem lies there. The QR-code is not seen as valid for some reason.

shesek · 2019-12-25T15:52:03Z

Alright, seems like the original issue here was (finally!) resolved. I created #134 and #135 to keep track of the other two issues raised by @sumBTC.

hillelt mentioned this issue Jan 18, 2019

UI does not load on ubports phone #54

Closed

hillelt changed the title ~~Can't connect remotely via TLS~~ Can't connect via TLS Jan 20, 2019

ghost mentioned this issue Dec 19, 2019

Android app v0.2.11 not able to make unencrypted connections #132

Closed

This was referenced Dec 25, 2019

Some QR codes not read properly in the web QR scanner #134

Closed

Android app unable to connect to self-signed TLS #135

Open

shesek closed this as completed Dec 25, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Can't connect via TLS #55

Can't connect via TLS #55

hillelt commented Jan 14, 2019 •

edited

Loading

hillelt commented Jan 18, 2019

shesek commented Jan 20, 2019

hillelt commented Jan 20, 2019

shesek commented Jan 20, 2019

hillelt commented Jan 20, 2019 •

edited

Loading

ghost commented Jan 28, 2019 •

edited by ghost

Loading

shesek commented Jan 28, 2019

ghost commented Jan 29, 2019 •

edited by ghost

Loading

hillelt commented Jan 29, 2019

astupidmoose commented Feb 1, 2019

k3tan172 commented Feb 22, 2019

hillelt commented Feb 23, 2019

pseudozach commented Mar 6, 2019

scottshapiro commented Mar 11, 2019

hillelt commented Mar 17, 2019

alko89 commented Mar 21, 2019

pseudozach commented Mar 26, 2019

ghost commented Dec 24, 2019 •

edited by ghost

Loading

shesek commented Dec 25, 2019

ghost commented Dec 25, 2019 •

edited by ghost

Loading

shesek commented Dec 25, 2019

Can't connect via TLS #55

Can't connect via TLS #55

Comments

hillelt commented Jan 14, 2019 • edited Loading

hillelt commented Jan 18, 2019

shesek commented Jan 20, 2019

hillelt commented Jan 20, 2019

shesek commented Jan 20, 2019

hillelt commented Jan 20, 2019 • edited Loading

ghost commented Jan 28, 2019 • edited by ghost Loading

shesek commented Jan 28, 2019

ghost commented Jan 29, 2019 • edited by ghost Loading

hillelt commented Jan 29, 2019

astupidmoose commented Feb 1, 2019

k3tan172 commented Feb 22, 2019

hillelt commented Feb 23, 2019

pseudozach commented Mar 6, 2019

scottshapiro commented Mar 11, 2019

hillelt commented Mar 17, 2019

alko89 commented Mar 21, 2019

pseudozach commented Mar 26, 2019

ghost commented Dec 24, 2019 • edited by ghost Loading

shesek commented Dec 25, 2019

ghost commented Dec 25, 2019 • edited by ghost Loading

shesek commented Dec 25, 2019

hillelt commented Jan 14, 2019 •

edited

Loading

hillelt commented Jan 20, 2019 •

edited

Loading

ghost commented Jan 28, 2019 •

edited by ghost

Loading

ghost commented Jan 29, 2019 •

edited by ghost

Loading

ghost commented Dec 24, 2019 •

edited by ghost

Loading

ghost commented Dec 25, 2019 •

edited by ghost

Loading