HTTPS using SSLv3 #174

Activity

1. koush commented on Jun 16, 2014

   

   koush

   on Jun 16, 2014

   Owner

   More actions

   Hm, let me look
2. koush commented on Jun 16, 2014

   

   koush

   on Jun 16, 2014

   Owner

   More actions

   Looking around line 157, can you let me know what SSLEngine gets instantiated? Default or TLS?

       static {
           // following is the "trust the system" certs setup
           try {
               // critical extension 2.5.29.15 is implemented improperly prior to 4.0.3.
               // https://code.google.com/p/android/issues/detail?id=9307
               // https://groups.google.com/forum/?fromgroups=#!topic/netty/UCfqPPk5O4s
               // certs that use this extension will throw in Cipher.java.
               // fallback is to use a custom SSLContext, and hack around the x509 extension.
               if (Build.VERSION.SDK_INT <= 15)
                   throw new Exception();
               sslContext = SSLContext.getInstance("Default");
           }
           catch (Exception ex) {
               try {
                   sslContext = SSLContext.getInstance("TLS");
                   TrustManager[] trustAllCerts = new TrustManager[] { new X509TrustManager() {
                       public java.security.cert.X509Certificate[] getAcceptedIssuers() {
                           return new X509Certificate[0];
                       }
   
                       public void checkClientTrusted(java.security.cert.X509Certificate[] certs, String authType) {
                       }
   
                       public void checkServerTrusted(java.security.cert.X509Certificate[] certs, String authType) {
                           for (X509Certificate cert : certs) {
                               if (cert != null && cert.getCriticalExtensionOIDs() != null)
                                   cert.getCriticalExtensionOIDs().remove("2.5.29.15");
                           }
                       }
                   } };
                   sslContext.init(null, trustAllCerts, null);
               }
               catch (Exception ex2) {
                   ex.printStackTrace();
                   ex2.printStackTrace();
               }
           }
       }
3. luisgabriel commented on Jun 16, 2014

   

   luisgabriel

   on Jun 16, 2014

   ContributorAuthor

   More actions

   The first one ( sslContext = SSLContext.getInstance("Default") ) gets instantiated.
4. koush commented on Jun 16, 2014

   

   koush

   on Jun 16, 2014

   Owner

   More actions

   What device is this? Custom ROM or no?

   It's actually kind of worrisome that you need to force SSLv3. That's been deprecated in favor of TLS.
5. koush commented on Jun 16, 2014

   

   koush

   on Jun 16, 2014

   Owner

   More actions

   Server issue maybe? Can you screenshot me the cert as shown in the browser? I want to see how a browser connects to it. Protocols etc.
6. luisgabriel commented on Jun 16, 2014

   

   luisgabriel

   on Jun 16, 2014

   ContributorAuthor

   More actions

   I have tested on a Nexus 4 (with Android 4.4.3) and on a Galaxy S3 (with Android 4.3), both using official ROMs.

   The cert info:
   
   

   I'm not sure if it's a sever issue (I don't have access to the server), but I was suspecting that it's an issue on the Android platform. For some reason when there is other protocols besides SSLv3 enabled the SSL engine is not able to decode the messages.
7. koush commented on Jun 17, 2014

   

   koush

   on Jun 17, 2014

   Owner

   More actions

   Yikes, even the browser is using SSLv3. TLS should be backwards compatible, but it is not, for some unknown reason. May be an Android bug:

   http://stackoverflow.com/a/11194217/704837

   Same issue w/ the normal HttpClient.

   Ideally, the fix is that the server uses TLS and not SSLv3. If the server is not in your control, your workaround seems to be what others use. I'll merge your patch.
8. koush

   closed this as completedon Jun 17, 2014
9. fy2462 commented on Dec 2, 2014

   

   fy2462

   on Dec 2, 2014

   More actions

   Hi, koush,
   I want to develop on the android platform with your androidasync. But when I send message by invoking the socket.io API, server received a message with http head. why it is ? that only 0.9.x version can do socket.io? where is the 0.9.x download link or the git commit version ?
10. blazecake commented on Mar 10, 2015

    

    blazecake

    on Mar 10, 2015

    More actions

    SocketIOClient.connect(AsyncHttpClient.getDefaultInstance(), "http://192.168.1.2:3000", new ConnectCallback() {
    @OverRide
    public void onConnectCompleted(Exception ex, SocketIOClient client) {
    if (ex != null) {
    ex.printStackTrace();
    return;
    }
    client.setStringCallback(new StringCallback() {
    @OverRide
    public void onString(String string) {
    System.out.println(string);
    }
    });
    client.on("someEvent", new EventCallback() {
    @OverRide
    public void onEvent(JSONArray argument, Acknowledge acknowledge) {
    System.out.println("args: " + arguments.toString());
    }
    });
    client.setJSONCallback(new JSONCallback() {
    @OverRide
    public void onJSON(JSONObject json) {
    System.out.println("json: " + json.toString());
    }
    });
    }
    });

    Hi, koush,
    I use this "connect" method to receive msg, The method "client.on("someEvent", new EventCallback())" is perform on Android 4.1, But don't perform on Android 5.0.1, It's very weird.
11. YaYaGo commented on Oct 16, 2015

    

    YaYaGo

    on Oct 16, 2015

    More actions

    how to pause the executing task

    👍React with 👍1Reacted by taran20009
12. MikeRzDev commented on Jul 7, 2016

    

    MikeRzDev

    on Jul 7, 2016

    More actions

    is not very clear how to fix this, because im using the latest version (2.1.8) and it doesnt work on android 4.4 and 4.3 :S.