Android: Failed to reseed on old versions #39
Reference in New Issue
Block a user
No description provided.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Opened 4 years ago
Last modified 2 years ago
#1941assigneddefect
Android: Failed to reseed on old versions
Reported by:zamzamOwned by:Meeh
Priority:
major
Milestone:
undecided
Component:
apps/android
Version:
0.9.28
Keywords:
Cc:
Parent Tickets:
Sensitive:
no
Description
When I tried to run I2P on Android 4.0.4, it cannot bootstrap (reseed) the list of peers, after few minutes it says "Tunnels ready", and then "No connection".
Subtickets
comment:17 Changed 2 years ago by zzz
Milestone:0.9.35 →
undecided
comment:16 Changed 3 years ago by zzz
Milestone:0.9.34 →
0.9.35Owner:
changed from str4d to _Meeh_Priority:blocker →
majorStatus:open →
assigned
Reassigning and marking non-blocker as per 2018-04-03 meeting
comment:15 Changed 3 years ago by str4d
Milestone:0.9.33 →
0.9.34
Bumping to .34 due to lack of time (I've already spent several entire weekends trying to figure out what is going on here).
comment:14 Changed 3 years ago by str4d
Doesn't appear to help.
comment:13 Changed 3 years ago by zzz
POSIX flush and sync added to SU3File.verifyAndMigrate() in adca7d1c74352996ec6121863557136ab9b53c1c to be 0.9.32-15
untested, please test
comment:12 Changed 3 years ago by zzz
Milestone:undecided →
0.9.33Priority:major →
blockerSummary:0 active peers and "ready tunnels" →
Android: Failed to reseed on old versions
Reworded summary and setting as blocker for 0.9.33.
Note that OP's 4.0.4 is API 15.
comment:11 Changed 3 years ago by zzz
So we successfully extracted the data from the su3, wrote the zip file, and closed it, but then on reopen in the unzipper (and in the same thread) the file isn't there? I don't get it. Something unique to Android file systems or SD cards? Or we aren't doing strict POSIX?
If it's POSIX, see the line if (SHOULD_SYNC) in DataHelper?.storeProps. Adding the flush and sync to the SU3File.verifyAndMigrate() finally block would fix it if that's the problem. It's expensive…
comment:10 Changed 3 years ago by str4d
Here's a debug trace for one of the reseeds:
comment:9 Changed 3 years ago by str4d
After hacking i2p.jar to have
FileUtil.extractZip()throw errors, this is what I get on API 16:Inspecting the emulator, it seems that the temporary folder has been created, but there are no reseed files in it.
comment:8 Changed 3 years ago by str4d
Not a blocker, no - just a bit annoying to get the pieces in place. But I'll figure something out.
comment:7 Changed 3 years ago by zzz
@str4d
re: my comment 5: Rereading comments 1-3, it appears that 'java 8 only' means 'TLS 1.2 only' ? It's not in Java 6, it is in Java 7, not enabled by default, but we do enable it in I2PSSLSocketFactory.
As we are at Java 7 minimum for desktop, the current isSNISupported() {return java7 android} returns true for all platforms.
re: my comment 6: I see you entered ticket #2099 for this. I assume it's not a blocker for this ticket, as you can check the system log in your 'virtual devices', and/or make a temporary code change, to see what's happening, correct?
Let's get to the bottom of this quickly so we have time to make any changes necessary.
comment:6 Changed 3 years ago by zzz
Check wherever the system log is, FileUtil?.extractZip() logs there.
comment:5 Changed 3 years ago by zzz
@str4d good work. Most of the reseeds have moved to needing SNI. The reseed maintainer notes that, and for some also notes them as 'Java 8+ only' but I'm not sure what that means or its implications for old Android.
In the reseeder code, we assume all Android supports SNI, but that looks to be wrong.
Based on your test results, could you update the code in Reseeder.java to exclude the ones that don't work? See isSNISupported() and comments. You could add a test with SystemVersion?.getAndroidVersion(). If there's others that don't support SNI, add them at Reseeder.java line 555
You may wish to discuss this with backup.
Don't know what the unzip issue is.
comment:4 Changed 3 years ago by str4d
Here's what I see on various APIs:
API 10
All eleven reseeds fail hostname verification.
API 15
Four of the reseeds pass hostname verification now, but fail on unzip:
API 16
Two more reseeds pass hostname verification:
All six of those still fail unzip.
API 17
Reseeding works without any issues, and the router successfully builds tunnels.
comment:3 Changed 3 years ago by str4d
I don't have with me devices old enough to test this, so I will play with some virtual devices to try and replicate.
Relatedly, in July Google finally removed support for API 13 and below from its support library, making the oldest supported version 4.0. If we are having the above issues in 4.0.4, then we are very likely also having them on Gingerbread devices (2.3, API 10), and should consider just dropping support for them. But if we can fix this for 4.0.4 and retain API 10 support, I'm more ambivalent about leaving it in.
comment:2 Changed 4 years ago by zzz
according to backup, only download.xxlspeed.com doesn't support TLS 1.0, but it failed SNI. Additionally, us.reseed.i2p2.no was shut down in mid-December. 3 (host not named) reseeds failed for 'bad zip file', don't know why. netdb.i2p2.no failed for SNI. Most of our reseeds require SNI. It's not clear from a quick google search if SNI is supported in Android 4.0.4, but it's based on Java 6 which doesn't have good support.
Of all that, the 'bad zip file' is most worrisome because that means the SSL/TLS and su3 part worked, but then it couldn't unzip the file. We don't have looging for the details above, although there may be something in the wrapper log. If the Golang reseed app is making bad zip files, or somehow incompatible with our unzipper, that's a problem.
I don't believe I have any Android device that old that's not broken. str4d can you reproduce?
In any case my initial thought that all the reseeds require TLS 1.2 is completely wrong.
comment:1 Changed 4 years ago by zzz
Status:new →
open
I'm not completely sure (the reseeds are managed by somebody else), but I think that the last of our insecure reseeds (the ones that didn't require TLS 1.2) were shut down in mid-December 2016.
It appears from a quick search that TLS v1.2 isn't available until 4.1 Jelly Bean API 16 (2012) https://developer.android.com/reference/javax/net/ssl/SSLSocket.html - We do enable it if supported but disabled.
We currently claim support for Android 2.3 (API 0) or higher on https://geti2p.net/en/download but if
we really don't have any reseeds left, we'll have to change that, or come up with a workaround. For further research.