Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Request Failed validation during key exchange #421

Closed
7 tasks
grant-cpt opened this issue Jan 6, 2020 · 127 comments
Closed
7 tasks

Request Failed validation during key exchange #421

grant-cpt opened this issue Jan 6, 2020 · 127 comments

Comments

@grant-cpt
Copy link

grant-cpt commented Jan 6, 2020 •
edited

Bug report

Your Environment

  • Netflix add-on version: 0.16.1
  • Operating system version/name: Android 9, Kodi 18.5
  • Device model: Hauwei P30 Lite

Used Operating system:

  • [ x] Android
  • iOS
  • Linux
  • OSX
  • Raspberry-Pi
  • Windows

Describe the bug

Getting Error Message: "Request Failed validation during key exchange"

Netflix login details are correct and login is accepted.

Expected behavior

TV Series or Movie to play

Actual behavior

Error message pops up

Steps to reproduce the behavior

  1. Open Kodi
  2. Open Netflix
  3. Select Series/Movie
  4. Error Message

Possible fix

Debug log

The debug log can be found from this link: https://docs.google.com/document/d/17NCjCyn9SqmIgZT8Ckf7fkS8QL_BPhC9ZdYePyZwkJE/edit?usp=sharing

Additional context or screenshots (if appropriate)

Installation

  • I'm using other Netflix Repo
  • I'm using a different source

Netflix addon installed from CastagnaIT repo

Other information

Screenshots
@CastagnaIT
Copy link
Owner

this is not the first time this device has had difficulties to work
can you write here the esn provided by the original netflix app?

@grant-cpt
Copy link
Author

grant-cpt commented Jan 7, 2020 •
edited by CastagnaIT

Hi @CastagnaIT

So just to add, I've got Kodi install on a Skyworth TV with Android TV OS. And I get the same error on there as on my phone.

The Netflix app from the Playstore on my mobile device is working perfectly. I just tested it on my phone (Kodi + Addon) to check if the error was the same, which they are.

The ESN from the Netflix App:
image

Best,
Grant

@CastagnaIT
Copy link
Owner

i need another thing

Install "Material Terminal" app
Open it, a back terminal is show on screen
so type getprop and press "enter"
if you have do in right way, a long list is displayed

now go to the app options, and select "send by email"
send to: gottardo.stefano.83@gmail.com

@grant-cpt
Copy link
Author

grant-cpt commented Jan 7, 2020 via email

@CastagnaIT
Copy link
Owner

the esn generated is right, but i do not know if netflix has limited this device
you can try to enter this esn manually in expert settings:
NFANDROID1-PRV-P-L3-HUAWEMAR-LX2

let me know what happen

@grant-cpt
Copy link
Author

grant-cpt commented Jan 7, 2020 via email

@bompelbob
Copy link

I have the same problem on a Sony Bravia with Android TV.

@CastagnaIT
Copy link
Owner

Hi, Still the same issue. I also see the same error popup just before the Netflix background service notifications pop ups as well. Do you think it's worth it to try a completely different Netflix Account? Thanks Grant Sent from Mailspring (https://link.getmailspring.com/link/2D6C31EC-E8D3-4D63-9541-40D26C12745A@getmailspring.com/0?redirect=https%3A%2F%2Fgetmailspring.com%2F&recipient=cmVwbHkrQU9GSTVMQVpMVUVBNFlGNUtNU0VVRjU0RUlFVkJFVkJOSEhDQkNUVVJNQHJlcGx5LmdpdGh1Yi5jb20%3D), the best free email app for work
…
On Jan 7 2020, at 9:06 pm, Stefano Gottardo @.> wrote: the esn generated is right, but i do not know if netflix has limited this device you can try to enter this esn manually in expert settings: NFANDROID1-PRV-P-L3-HUAWEMAR-LX2 let me know what happen — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub @./1?redirect=https%3A%2F%2Fgithub.com%2FCastagnaIT%2Fplugin.video.netflix%2Fissues%2F421%3Femail_source%3Dnotifications%26email_token%3DAOFI5LDQQR4LDUFP4C37XDTQ4THFBA5CNFSM4KDLBP32YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEIJ5TXY%23issuecomment-571726303&recipient=cmVwbHkrQU9GSTVMQVpMVUVBNFlGNUtNU0VVRjU0RUlFVkJFVkJOSEhDQkNUVVJNQHJlcGx5LmdpdGh1Yi5jb20%3D), or unsubscribe @.***/2?redirect=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAOFI5LDHUEYZ5WEOSKPSGWLQ4THFBANCNFSM4KDLBP3Q&recipient=cmVwbHkrQU9GSTVMQVpMVUVBNFlGNUtNU0VVRjU0RUlFVkJFVkJOSEhDQkNUVVJNQHJlcGx5LmdpdGh1Yi5jb20%3D).

you can try but don't think that change the situations, the problem is in the netflix server,
that not accept the esn used,
I don't know why he won't accept it, as I said before, it's possible it's a limitation imposed by netflix

For the Skyworth TV i need the log

@CWftw
Copy link

CWftw commented Jan 7, 2020 •
edited

I also have multiple devices with this issue. Using a different ESN does not help, maybe they are checking at the widevine layer? I'm wondering if the new appboot endpoint ( https://android-appboot.netflix.com/appboot) is required. I know that iOS requires a specific endpoint for key exchange. The problem is the android appboot endpoint takes an encrypted payload and I'm not sure how this is encrypted before the key exchange. iOS for example, uses a preshared MGK.

@grant-cpt
Copy link
Author

Hi, Still the same issue. I also see the same error popup just before the Netflix background service notifications pop ups as well. Do you think it's worth it to try a completely different Netflix Account? Thanks Grant Sent from Mailspring (https://link.getmailspring.com/link/2D6C31EC-E8D3-4D63-9541-40D26C12745A@getmailspring.com/0?redirect=https%3A%2F%2Fgetmailspring.com%2F&recipient=cmVwbHkrQU9GSTVMQVpMVUVBNFlGNUtNU0VVRjU0RUlFVkJFVkJOSEhDQkNUVVJNQHJlcGx5LmdpdGh1Yi5jb20%3D), the best free email app for work
…
On Jan 7 2020, at 9:06 pm, Stefano Gottardo @.> wrote: the esn generated is right, but i do not know if netflix has limited this device you can try to enter this esn manually in expert settings: NFANDROID1-PRV-P-L3-HUAWEMAR-LX2 let me know what happen — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub _@**._/1?redirect=https%3A%2F%2Fgithub.com%2FCastagnaIT%2Fplugin.video.netflix%2Fissues%2F421%3Femail_source%3Dnotifications%26email_token%3DAOFI5LDQQR4LDUFP4C37XDTQ4THFBA5CNFSM4KDLBP32YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEIJ5TXY%23issuecomment-571726303&recipient=cmVwbHkrQU9GSTVMQVpMVUVBNFlGNUtNU0VVRjU0RUlFVkJFVkJOSEhDQkNUVVJNQHJlcGx5LmdpdGh1Yi5jb20%3D), or unsubscribe _@_.*/2?redirect=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAOFI5LDHUEYZ5WEOSKPSGWLQ4THFBANCNFSM4KDLBP3Q&recipient=cmVwbHkrQU9GSTVMQVpMVUVBNFlGNUtNU0VVRjU0RUlFVkJFVkJOSEhDQkNUVVJNQHJlcGx5LmdpdGh1Yi5jb20%3D).

you can try but don't think that change the situations, the problem is in the netflix server,
that not accept the esn used,
I don't know why he won't accept it, as I said before, it's possible it's a limitation imposed by netflix

For the Skyworth TV i need the log

I'll try to get the log for the Skyworth TV, it's a bit of a ballache to get the actual .log file. But should have it to you within 24 hours +-

@CastagnaIT
Copy link
Owner

multiple devices with this issue

At least make the list of these "multiple devices":
device name / device model / operative system version

maybe they are checking at the widevine layer?

widevine is not used for establish a communication with netflix server

I'm wondering if the new appboot endpoint ( https://android-appboot.netflix.com/appboot) is required

what is this link? and where did it come from? I can't find references...

I know that iOS requires a specific endpoint for key exchange.
The problem is the android appboot endpoint takes an encrypted payload and I'm not sure how this is encrypted before the key exchange. iOS for example, uses a preshared MGK.

currently in the addon key handshake is performed in same way with all operative systems
i have no information about what you say...

@CWftw
Copy link

CWftw commented Jan 8, 2020

The devices are irrelevant to my post. I was simply giving you some background information as someone who has done a lot of work with Android implementations of Netflix. Widevine is used for the key exchange and this has been changed recently to a two step process. You can see this and the URLs in a package capture via Charles or the app of your choice. Given the way Netflix works I believe the key exchange would work if implemented in the way they expect.

@CastagnaIT
Copy link
Owner

CastagnaIT commented Jan 9, 2020 •
edited

I got confused with the other encryption used, but this error:

Request failed validation during key exchange

come from Netflix MSL
so in my opinion there's something wrong with the msl request
but this part of the encryption was developed by others, so i don't know this part of code well

i have see the link https://android-appboot.netflix.com/appboot by browse nf from android chrome browser, at moment i don't know how to get more information about it
this is used by the netflix android app that's why i can't find references in website

having a list of operating systems and device model that are not working could be useful to have a scheme, if it's irrelevant to you, it doesn't mean it's irrelevant to others

If you are more experienced than me in this area, no problem
I can leave you this task to solve, here are very few who can help me

@CastagnaIT
Copy link
Owner

CastagnaIT commented Jan 9, 2020 •
edited

@grant-cpt
plugin.video.netflix_0.16.2_20200109_t1.zip
Can you try to install this test on P30?
let me know

@nohajc
Copy link

nohajc commented Jan 9, 2020 •
edited

i have see the link https://android-appboot.netflix.com/appboot by browse nf from android chrome browser, at moment i don't know how to get more information about it
this is used by the netflix android app that's why i can't find references in website

There are two Android endpoints for key exchange depending on the supported widevine level

L1:
android-appboot.netflix.com/appboot/NFANDROID1-PRV-P-

L3:
android-appboot.netflix.com/appboot/NFANDROID1-PRV-P-L3-

Format of the initial handshake request should still be the same though.

The problem is the android appboot endpoint takes an encrypted payload and I'm not sure how this is encrypted before the key exchange.

From what I've seen, the first request is not encrypted. There is a second request whose function is unknown to me. I'd suggest we should just try to change the endpoint and see if it helps.

@CastagnaIT
Copy link
Owner

how do you visualize them? I see them both encrypted
can you post the contents?

@nohajc
Copy link

nohajc commented Jan 9, 2020

If you really see them both encrypted it means they must have changed it since the last time I checked. Or it could behave differently on different Android devices / OS versions. No idea.

I don't have any dumps at the moment. I'm just suggesting it should work with your code unchanged. Even if it's not compliant with the way Netflix app does it currently.

@CastagnaIT
Copy link
Owner

before continuing blindly, i will wait a response from grant-cpt for the test

@grant-cpt
Copy link
Author

@grant-cpt
plugin.video.netflix_0.16.2_20200109_t1.zip
Can you try to install this test on P30?
let me know

The computer says no.

I did uninstall the plugin, installed the one provided. Also tested by installing from repo and then updating to this one.

Screenshot_20200109_162737_com amazon aiv eu

@CastagnaIT
Copy link
Owner

I'd suggest we should just try to change the endpoint and see if it helps.

by changing endpoint with appboot link (with esn) to perform handshake return this error:
MSLError: Entity authentication cannot be handled during failover.

@nohajc
Copy link

nohajc commented Jan 9, 2020 •
edited

@CastagnaIT What do you mean "with esn"? You shouldn't complete it. It ends with NFANDROID1-PRV-P- verbatim. ESN is still sent as part of the payload.

@CastagnaIT
Copy link
Owner

That's not the problem, you can enter whatever you want, but it always results in the same error

@nohajc
Copy link

nohajc commented Jan 9, 2020

That's odd. I haven't seen that error before.

@nohajc
Copy link

nohajc commented Jan 9, 2020

https://github.com/Netflix/msl/blob/master/examples/proxy/src/main/java/com/netflix/msl/ProxyMslError.java#L29

This line suggests it's only a transient error...

@Paco8
Copy link

Paco8 commented Jan 9, 2020

Since today I have the same problem on a nvidia shield (updated to the latest firmware).

@CastagnaIT
Copy link
Owner

CastagnaIT commented Jan 9, 2020 •
edited

it's useless to randomly test
CWftw was mentioned that link, but there is no certainty, no confirmation with data at hand,
can also be a wrong way
there is something wrong, but the problem only happens with a few device not all devices
it could be a gradual change that will block everyone, we don't know...

to understand how that endpoint works we must know at least the data of the first call that is sent by android app

I can no longer decompile apk to analyze the code, last year i could read some source code, but now nothing comes out, if someone can do it, explain how to do it, you might try to read some information

@CastagnaIT
Copy link
Owner

CastagnaIT commented Jan 9, 2020 •
edited

@grant-cpt you've already attempted to manually write the entire ESN (of nf app)? same results?

@grant-cpt
Copy link
Author

grant-cpt commented Jan 9, 2020 via email

@peak3d
Copy link

peak3d commented Jan 9, 2020

The appboot endpont is used in the native android app, the first one is in general not encrypted (its the one which establishes the widevine key handshake for subsequent requests). You may have to delete all your app data to get the first unencrypted request, keys have some time validity.

Unfortunately the appboot has lot of differences, I got this working in the past, you'll have to authenticate with SecureNetflixId (provided by some http boot command) You also need to provide the userId instead passing the creds on every request (its handled currently this way and we make MSL request always with the default / main user what is even not correct, but worked)

@CastagnaIT I can try to help solving this issue, but there will be major changes to get it working with appboot. You will most probably make SecureNetflixId and UserGUID public from netflixSession to MSL session. Credentials (email / password) are not really needed for MSL comunication.

@CastagnaIT
Copy link
Owner

Hi peak3d welcome back! :)
yes now msl and nfsession are in two different sessions
but they should be joined not separated sessions

one of my goals before this problem arose, was to find a way to use get/post (of msl and nfsession) with same requests.session

today i tried to get as you say the first call in clear (so i have deleted nf app data and also uninstall the app) but nothing... i dont know, tomorrow i try again i'm at a dead end.

of your guidelines more o less i understand but it's not all clear there are things i still don't know,
if you want to help me, it's fine, you are in advantage if you've already tried this way
let me know if you will take this task and if i'm gonna do something

@CastagnaIT
Copy link
Owner

volunteers to see if this resolve the problem: plugin.video.netflix_0.16.3_20200126_test1.zip

after having installed, go to addon Expert settings, and do Reset ESN

let me know thanks

@timfehr
Copy link

timfehr commented Jan 26, 2020

Tried it, it works!

Installed the update -> resetes ESN -> restarted Kodi -> played a video without error.

Just out of curiosity, what did you do the get it working?

@CastagnaIT
Copy link
Owner

with what device model?

@timfehr
Copy link

timfehr commented Jan 26, 2020

with what device model?

Nvidia Shield TV 2017

@tjamieg
Copy link

tjamieg commented Jan 26, 2020

volunteers to see if this resolve the problem: plugin.video.netflix_0.16.3_20200126_test1.zip

after having installed, go to addon Expert settings, and do Reset ESN

let me know thanks

Confirmed working on Amazon Fire TV Stick 4K

@CastagnaIT CastagnaIT mentioned this issue Jan 26, 2020
Merged
9 tasks
@geaddict
Copy link

plugin.video.netflix_0.16.3_20200126_test1.zip works perfectly! Thank you so much!!! I love using this in Kodi.

The original Netflix app is junk. I have to reboot after each use once I exit the app. I cannot disable autoplay (even though it is set online NOT to autoplay). The interface is awful for searches.

Minix Neo U9-H, Android 6.01.

@venom7107
Copy link

plugin.video.netflix_0.16.3_20200126_test1.zip works perfectly! Thank you so much!!! I love using this in Kodi.

The original Netflix app is junk. I have to reboot after each use once I exit the app. I cannot disable autoplay (even though it is set online NOT to autoplay). The interface is awful for searches.

Minix Neo U9-H, Android 6.01.

Did you get it working at 1080p? Max res I get is 960x540.

@geaddict
Copy link

960x540 for me as well. It is still better than the crappy original netflix app though! If we can get to 1080p that would be a bonus but I am not complaining as is :-)

@venom7107
Copy link

960x540 for me as well. It is still better than the crappy original netflix app though! If we can get to 1080p that would be a bonus but I am not complaining as is :-)

Yes honestly the fact that the app is even working on the U9 is enough itself. Hopefully we see some progress on 1080p sometime in the future.

@Jibbonator
Copy link

I´ve tested it too. Nvidia Shield 2017. newest Updates.It did not work with just installing the Test over the normal one. Had to delete the original Addon and then install this Test version.
Works like a charm in 4K HDR (Chilling Adventures of Sabrina)

@CastagnaIT
Copy link
Owner

CastagnaIT commented Jan 27, 2020 •
edited

To all (that have 4k tv) that have installed this fixed test version
can you check if Kodi's skin shows 4K info-label? see yellow rectangle in screenshot
image

@timfehr
Copy link

timfehr commented Jan 27, 2020

To all (that have 4k tv) that have installed this fixed test version
can you check if Kodi's skin shows 4K info-label? see yellow rectangle in screenshot
image

Unfortunately I don't have a working 4K environment, so I can't test it

@Jibbonator
Copy link

on my 4k TV it is 1080p,like Ur Screenshot. but the Stream is 4k HDR. tested with the Button "O" and the "HDR enabled" Message from my TV.

@CastagnaIT
Copy link
Owner

thanks, this confirm that my experiment not work

@M2k80
Copy link

M2k80 commented Jan 27, 2020 •
edited

@Jibbonator did u used this plugin.video.netflix_0.16.3_20200127_test3.zip version for your 4k flag test? or the older one, if you used the older one, take a look here #448

@Jibbonator
Copy link

i have tested with test1. now i have deinstalled 1 and installed test3. now the 4k HDR with the Logo in the Corner works. ist says(chilling adventures of Sabrina) 5.1 DOLBY 4K.

@CastagnaIT
Copy link
Owner

the new release is out,
for the 4k flags will be fixed in the future version

@CastagnaIT
Copy link
Owner

CastagnaIT commented Jan 29, 2020 •
edited

could someone that using NVIDIA Shield on a TV that is NOT 4K, attach a screenshot of the DRM Info app?

thanks!

DONE

@M2k80
Copy link

M2k80 commented Jan 29, 2020

sure i can do, i will send it to your email

@M2k80
Copy link

M2k80 commented Jan 29, 2020

drm info has now a tv version, it looks complete different to the mobile version....would you pls tell me which informations you need?

@CastagnaIT
Copy link
Owner

i have to see the widevine CDM part

@M2k80
Copy link

M2k80 commented Jan 29, 2020

email is out

@M2k80
Copy link

M2k80 commented Jan 29, 2020

tell me pls if thats enough, if not, i have to search for another version of this tool

@CastagnaIT
Copy link
Owner

is perfect thanks very much

@M2k80
Copy link

M2k80 commented Jan 29, 2020

just installed an older version...this would be only 1 screenshot for all information instead 5 😆

@beo59-cmd
Copy link

Hi Folks,
just installed the test version on a x92_S912_3GB_32GB abdroid 7.12 and it is not working.
Keep getting error message about the stupid "key exchange"

@CastagnaIT
Copy link
Owner

for every user who will read this Issue in the future, do not install the Test versions attached here

Repository owner locked as resolved and limited conversation to collaborators Feb 25, 2020
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests