ihc binding and java 8 #2322

tktreload · 2015-03-18T20:28:34Z

hello all, i am running openhab 1.7.0 snapshot but have seen the same problem in 1.5 and 1.6.

When using java 7 i have no problems connecting to my ihc/elko system after adding the certificate to the store, but repeating the same process for java 8 only yields an authentication error.

paulianttila · 2015-03-20T15:59:14Z

When I implemented IHC binding, I tried to implement certificate manager which trust all certificates, so that certificate isn't need to add certificate store at all. I had many problems, which I could not resolve on that time. But some time ago I got tired to play those certificates, so I tried to solve those problems and in-fact I did.

Here you can find test version, which does not need any certificates on the certificate store. Could you tried it and give feedback? Maybe it solve your problems on java 8. If not, enable debugs for IHC binding and send full log.

tktreload · 2015-03-20T19:19:41Z

Yes thank you for the quick feedback. I will give it a try while the
girlfriend watches xfactor.

On Fri, 20 Mar 2015 16:59 pali notifications@github.com wrote:

When I implemented IHC binding, I tried to implement certificate manager
which trust all certificates, so that certificate isn't need to add
certificate store at all. I had many problems, which I could not resolve on
that time. But some time ago I got tired to play those certificates, so I
tried to solve those problems and in-fact I did.

Here
https://dl.dropboxusercontent.com/u/1481715/org.openhab.binding.ihc-1.6.0-SNAPSHOT.jar
you can find test version, which does not need any certificates on the
certificate store. Could you tried it and give feedback? Maybe it solve
your problems on java 8. If not, enable debugs for IHC binding and send
full log.

—
Reply to this email directly or view it on GitHub
#2322 (comment).

tktreload · 2015-03-20T20:04:34Z

When i start 1.7.0 snapshot with the new binding and java 7 with the certificate added to the keystore everything is fine.
Then after uninstalling java7 and installing java8 I get the following errors:

19:53:53.164 INFO  o.o.b.ihc.internal.IhcBinding[:154]- Connecting to IHC / ELKO LS controller [IP='10.0.0.50' Username='admin' Password='******'].
19:53:53.300 WARN  o.o.b.ihc.internal.IhcBinding[:204]- Can't open connection to controller
org.openhab.binding.ihc.ws.IhcExecption: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at org.openhab.binding.ihc.ws.IhcHttpsClient.sendQuery(IhcHttpsClient.java:118)
    at org.openhab.binding.ihc.ws.IhcAuthenticationService.authenticate(IhcAuthenticationService.java:57)
    at org.openhab.binding.ihc.ws.IhcClient.openConnection(IhcClient.java:242)
    at org.openhab.binding.ihc.internal.IhcBinding.connect(IhcBinding.java:162)
    at org.openhab.binding.ihc.internal.IhcBinding.execute(IhcBinding.java:200)
    at org.openhab.core.binding.AbstractActiveBinding$BindingActiveService.execute(AbstractActiveBinding.java:156)
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
    at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1917)
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:301)
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:295)
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1369)
    at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:156)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)
    at sun.security.validator.Validator.validate(Validator.java:260)
    at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:145)
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:131)
    at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382)
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)
    at sun.security.validator.Validator.validate(Validator.java:260)

is this enough information, if not please tell me how to enable debugging output for the binding.

paulianttila · 2015-03-20T20:58:01Z

Could you download binding again from the link and try one more time. Debug can be enabled by starting start_debug script rather than start script.

tktreload · 2015-03-21T19:13:32Z

I downloaded the binding again. What i have found is:

with java7 i get good connect to the controller but no traffic of updates or anything going on.

with java8 and the debug option I get the following output (after only sorting out the lines with "ihc" in them).

18:46:20.853 DEBUG o.o.b.ihc.internal.IhcBinding[:291]- allBindingsChanged
18:46:20.908 WARN  o.o.m.i.i.GenericItemProvider[:108]- Attempted to register a second BindingConfigReader of type 'ihc'. The primaraly reader will remain active!
18:46:21.408 DEBUG o.o.b.ihc.internal.IhcBinding[:340]- Configuration updated, config true
18:46:21.424 INFO  o.o.b.ihc.internal.IhcBinding[:154]- Connecting to IHC / ELKO LS controller [IP='10.0.0.50' Username='admin' Password='******'].
18:46:21.458 DEBUG o.o.binding.ihc.ws.IhcClient[:214]- Open connection
18:46:22.257 WARN  o.o.b.ihc.internal.IhcBinding[:204]- Can't open connection to controller
org.openhab.binding.ihc.ws.IhcExecption: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at org.openhab.binding.ihc.ws.IhcHttpsClient.sendQuery(IhcHttpsClient.java:118)
    at org.openhab.binding.ihc.ws.IhcAuthenticationService.authenticate(IhcAuthenticationService.java:57)
    at org.openhab.binding.ihc.ws.IhcClient.openConnection(IhcClient.java:242)
    at org.openhab.binding.ihc.internal.IhcBinding.connect(IhcBinding.java:162)
    at org.openhab.binding.ihc.internal.IhcBinding.execute(IhcBinding.java:200)
    at org.openhab.binding.ihc.ws.IhcHttpsClient.sendQuery(IhcHttpsClient.java:102)
18:46:23.290 DEBUG o.o.binding.ihc.ws.IhcClient[:194]- Close connection

paulianttila · 2015-03-21T21:28:14Z

Download ihc binding ones again from the link (be sure that only one ihc binding exists on your addons folder) and add following line to start_debug script

-Djavax.net.debug=ssl:handshake

It will cause lot of ssl debug data. Hopefully that give a hint where the problem is.

paulianttila · 2015-03-21T21:35:50Z

Damn, I forgotten to inform that you need to add following line on openhab.cfg

ihc:trustAllCerts=true

tktreload · 2015-03-22T14:03:06Z

I will have a go tomorrow evening.

On Sat, 21 Mar 2015 22:36 pali notifications@github.com wrote:

Damn, I forgotten to inform that you need to add following line on
openhab.cfg

ihc:trustAllCerts=true

—
Reply to this email directly or view it on GitHub
#2322 (comment).

smerschjohann · 2015-03-24T12:39:10Z

I'm currently looking to get it working as well. I have implemented a few other clients for the IHC, so I know that it has a very shaky TLS/SSL-implementation.

The implementation on the IHC is based on "Rogatkin's JWS based on Acme.Serve $Revision: 1.39 $" and GCJ.

The only non java way (before 1.8), I have found was using an stunnel with the following configuration:

client = yes

[ihc]
sslVersion=SSLv3
accept=127.0.0.1:31337
connect=10.0.0.3:443
options=ALL

The current JAVA 1.8 implementation has enforced some TLS protocol specification and disables SSLv3. Disabling TLS1.2 and TLS1.1 (-Djdk.tls.client.protocols="TLSv1") at least helps getting through with downloading segments and getting the first event data. But after a few seconds the following shows up:

13:16:40.043 [ERROR] [enhab.binding.ihc.ws.IhcClient:625  ] - New controller state change notification wait failed...
org.openhab.binding.ihc.ws.IhcExecption: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
        at org.openhab.binding.ihc.ws.IhcHttpsClient.sendQuery(IhcHttpsClient.java:183) ~[na:na]
        at org.openhab.binding.ihc.ws.IhcControllerService.waitStateChangeNotifications(IhcControllerService.java:183) ~[na:na]
        at org.openhab.binding.ihc.ws.IhcClient.waitStateChangeNotifications(IhcClient.java:363) ~[na:na]
        at org.openhab.binding.ihc.ws.IhcClient.access$4(IhcClient.java:357) ~[na:na]
        at org.openhab.binding.ihc.ws.IhcClient$IhcControllerStateListener.run(IhcClient.java:592) ~[na:na]
Caused by: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
        at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:980) ~[na:1.8.0_40]
        at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1363) ~[na:1.8.0_40]
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1391) ~[na:1.8.0_40]
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1375) ~[na:1.8.0_40]
        at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:563) ~[na:1.8.0_40]
        at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185) ~[na:1.8.0_40]
        at sun.net.www.protocol.http.HttpURLConnection.getOutputStream0(HttpURLConnection.java:1282) ~[na:1.8.0_40]
        at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1257) ~[na:1.8.0_40]
        at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:250) ~[na:1.8.0_40]
        at org.openhab.binding.ihc.ws.IhcHttpsClient.sendQuery(IhcHttpsClient.java:167) ~[na:na]
        ... 4 common frames omitted
Caused by: java.io.EOFException: SSL peer shut down incorrectly
        at sun.security.ssl.InputRecord.read(InputRecord.java:505) ~[na:1.8.0_40]
        at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:961) ~[na:1.8.0_40]
        ... 13 common frames omitted

The same happens if enabling SSLv3 and setting the protocol to SSLv3, so I guess something equal to "enable all workarounds" is needed for the java implementation as well.

If no one has any ideas, I will patch the IHC-binding to allow HTTP connections as well and use my stunnel approach for now. (Better than punching a whole into the enforced java tls security after all).

It might be possible to change the SSL contexts in java as well. Any one an idea which settings could help here?

paulianttila · 2015-03-24T16:11:14Z

Just tested ihc binding (which trust all certs) with java 8 u40 and it works fine on my environment when -Djdk.tls.client.protocols="TLSv1" system property is introduced. I changed ihc binding code to force TLSv1 and now it seems to work without system property as well.

So could you both test the latest test version from Here

If you don't want to add controller certificate to trusted store anymore, don't forgot to add following line on openhab.cfg

ihc:trustAllCerts=true

smerschjohann · 2015-03-24T16:42:06Z

hm nice, it really is working. I might have introduced a bug in my IHC snapshot or because of the testings the controller had blocked resources, whatever...

Can you release the sourcecode for that version? I'm currently extending the IHC-binding with a custom output feature (allowing "custom" rollershutter programs) ( ihc=">[DOWN:IHC_ID:1000],>[UP:IHC_ID:1000]" ). Would be nice to merge them in. I will add a pull request the next days..

smerschjohann · 2015-03-24T17:09:29Z

I see that you override the default SSLContext. I think that's not the best idea, as in my understanding this would not only change the context for the ihc-binding. But for the whole java process.

As TLSv1 is always the right choice for the IHC, it would be okay to set it with the connection:

conn.setSSLSocketFactory(socketFactory); // where socketFactory is the new factory (setting it to TLSv1 (and optionally enabling "trust all")

paulianttila · 2015-03-29T09:30:45Z

I see that you override the default SSLContext. I think that's not the best idea, as in my understanding > this would not only change the context for the ihc-binding. But for the whole java process.

I agree. I never had time to test it, but hoped that default context is limited to one OSGi bundle. I quickly tested with http binding, and my hope wasn't come true. Whole java process is using then all trusting trust manager and that's definitely not acceptable. The same, of course, also takes place with default cookie manager and host name verifier. This actually is pretty danger feature, because someone could use it in another binding to ruin the whole OH security.

I quickly tried to do it via socket factory (and also changed cookie manager and host name verifier) without success. But anyhow, because it's works with default SSL context, global cookie manager and host name verifier, there is still hope to get it to work.

smerschjohann · 2015-03-30T16:32:15Z

Yes, I tried that as well and it did not work. I don't know what we are missing here.

Nevertheless I wrote Schneider about the problem and they told me that they are currently working on a new firmware which should fix that issue and are about to release it in two weeks. So my hopes are high that this version will really fix it. Let's hope for the best 👍

paulianttila · 2015-03-30T16:36:45Z

That's great news. Btw, do you own ihc or elko branded controller?

smerschjohann · 2015-03-30T16:39:12Z

It is Schneider/ELSO IHC branded

paulianttila · 2015-04-05T12:29:29Z

I spend some time again and tried to get HttpsURLConnection and socket factory to work without success. I give up and changed HttpsURLConnection to Apache HTTP client and that seems to work fine. I didn't test binding very well yet, but @smerschjohann if you have time please take a look my repo.

smerschjohann · 2015-04-07T21:44:43Z

I will check it tomorrow.

smerschjohann · 2015-04-08T15:51:46Z

Okay, I just checked it out and everything works as it should. Seems good 👍

I will now run it 24/7 and check if it keeps that way.

paulianttila · 2015-04-17T17:08:03Z

@smerschjohann: have you had any problems with the binding? 1.7 code freeze date is pretty soon, so before I make PR, I like to have some feedback.

smerschjohann · 2015-04-20T20:11:14Z

Sorry, that I did not respond anymore. Yes, it runs for around 2 weeks now without any (big) issues.

The only issue I see is while initializing. The socket timeout seems to be too short. Sometimes on the initialization I get a timeout and an exception gets thrown. But this is not an issue as the connection gets reestablished and the initialization proceeds.
I run it on a raspberry pi 2 which does not have that much horse power, I guess this is the reason for that behavior. So if you could increase the timeout a little bit, this little problem should go away for good.

teichsta · 2015-05-17T21:05:10Z

#2598 has been merged successfully …

paulianttila mentioned this issue May 15, 2015

IHC binding: Support for java 8 and simplified controller certificate… #2598

Merged

teichsta closed this as completed May 17, 2015

teichsta added this to the 1.7.0 milestone May 17, 2015

teichsta added bug enhancement and removed bug labels May 17, 2015

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ihc binding and java 8 #2322

ihc binding and java 8 #2322

tktreload commented Mar 18, 2015

paulianttila commented Mar 20, 2015

tktreload commented Mar 20, 2015

tktreload commented Mar 20, 2015

paulianttila commented Mar 20, 2015

tktreload commented Mar 21, 2015

paulianttila commented Mar 21, 2015

paulianttila commented Mar 21, 2015

tktreload commented Mar 22, 2015

smerschjohann commented Mar 24, 2015

paulianttila commented Mar 24, 2015

smerschjohann commented Mar 24, 2015

smerschjohann commented Mar 24, 2015

paulianttila commented Mar 29, 2015

smerschjohann commented Mar 30, 2015

paulianttila commented Mar 30, 2015

smerschjohann commented Mar 30, 2015

paulianttila commented Apr 5, 2015

smerschjohann commented Apr 7, 2015

smerschjohann commented Apr 8, 2015

paulianttila commented Apr 17, 2015

smerschjohann commented Apr 20, 2015

teichsta commented May 17, 2015

ihc binding and java 8 #2322

ihc binding and java 8 #2322

Comments

tktreload commented Mar 18, 2015

paulianttila commented Mar 20, 2015

tktreload commented Mar 20, 2015

tktreload commented Mar 20, 2015

paulianttila commented Mar 20, 2015

tktreload commented Mar 21, 2015

paulianttila commented Mar 21, 2015

paulianttila commented Mar 21, 2015

tktreload commented Mar 22, 2015

smerschjohann commented Mar 24, 2015

paulianttila commented Mar 24, 2015

smerschjohann commented Mar 24, 2015

smerschjohann commented Mar 24, 2015

paulianttila commented Mar 29, 2015

smerschjohann commented Mar 30, 2015

paulianttila commented Mar 30, 2015

smerschjohann commented Mar 30, 2015

paulianttila commented Apr 5, 2015

smerschjohann commented Apr 7, 2015

smerschjohann commented Apr 8, 2015

paulianttila commented Apr 17, 2015

smerschjohann commented Apr 20, 2015

teichsta commented May 17, 2015