[Mycanal.fr] Licence server return "challenge is missing"

[wwark]

Hi @peak3d and @glennguy

Thank you for the tips. I manage to increase the size of the response of the server in the kodi side and fix one header and now I have issue saying the challenge is missing.

I think it is inputstream.adaptive creating the challenge, am I right ?
Some information of the stream
item.property['inputstreamaddon'] = 'inputstream.adaptive'
item.property['inputstream.adaptive.manifest_type'] = 'ism'

Url of the ism manifest
https://hss-od.snl-lv3.canalplus-cdn.net/replay/cplus/ssd/cpl100032465-wildmoka.com-8183278924/wildmoka-com-8183278924.ism/manifest
url of the licence
http://secure-gen-hapi.canal-plus.com/conso/view
/5f0adef0-7bf6-11e9-9f7a-79ba78a2daad/licence?drmType=DRM%20Widevine

The response:

2019-05-21 20:19:55.729 T:140466855057152 ERROR: CCurlFile::Open failed with code 403 for http://secure-gen-hapi.canal-plus.com/conso/view/0856a1d0-7bf5-11e9-8ce9-3dc264bb61ca/licence?drmType=DRM%20Widevine:
{"status":403,"code":"MDRM-403-4","requestId":"9d6b98c4-433a-4150-9778-b668cc980109-1558462402901-593470","headers":{"XX-ECK":"cpfra-mycanal-pc","XX-DEVICE":"pc 9d6b98c4-433a-4150-9778-b668cc980109","XX-DOMAIN":"cpfra","XX-SERVICE":"mycanal","XX-OPERATOR":"pc","XX-DISTMODES":"catchup,live,svod,tvod,posttvod","Authorization":"PASS Token="00201prsK2A7AmU8kXHOoA7geT88OgmUlze6VQ2Ze_87Z1bH4-FOtQonv4Yvea66PAmj5_2yGaXVrHD__eAj3GIbvYr_FDh35NJYnBUPDuTG4bGd8nnwsySFrvEQ2XEgPKH4Cna4JNHGcQzmuq-Ohjj_Rx8mzAgfRKK9YNm4LpbQEzD__MZgWrX8dcgNuntF7fMSciwqzDNZFdBIhAHjkOcDuqX8r7QfWkGrjbp_KEEkYsdVtYEowyqwFtHFgIZ9TYCpRTsYssRoI0o0_3RB_JTZ4KhGMNIfgQluk4CyX2Nh2SxRQsERifltUiVk-lzR9Qeu32vyYVyw15Gssc_JotK-hfq398v7uQs6tWVO-CEi9Nm3Mewi3PGRpCbhtgS85_PczsnPv-9DDsRIW3p3f0Cts1o9NpBB2vhpaHmy3lVusuOsHL1ArmDlU4YXpRkomphyKuWuxPO2TmYgs31iZPUz-yZ_Na-YTXxPGNcqBGgEuQgZA6yIXUAWB_ws8UNj37Nvpg4nFbTPqJ_qtTB6E3Wfy8gzKVTo_BHRjSFG8S4fm3bU."","XX-Profile-Id":"0","XX-Request-Id":"9d6b98c4-433a-4150-9778-b668cc980109-1558462402901-593470","XX-API-VERSION":"2.1","XX-SPYRO-VERSION":"undefined"},"message":"Could not retrieve license : Le challenge est manquant."}
2019-05-21 20:19:55.730 T:140468126385920 WARNING: CActiveAE::StateMachine - signal: 22 from port: timer not handled for state: 1

Thank you for your help !

[peak3d]

@wwark how does your license_key looks like?
And how should the challenge be passed to the license server (look in browser network log for this)

[wwark]

My licence_key looks like
url_licence + '|headers|B{SSM}|'
with url_licence = 'http://secure-gen-hapi.canal-plus.com/conso/view/5f0adef0-7bf6-11e9-9f7a-79ba78a2daad/licence?drmType=DRM%20Widevine'

The challenge is base64 so I put B{SSM} and I tried also little "b" but no response from the server in this case.

Also the response is a xml response and the licence is base64 format. I don't know what to put in the response part of the license_key for the moment.

<licenseresponse deviceid="v3Egl27IcUq3DXL+COEn8w==" xmlns="http://www.canal-plus.com/DRM/V1">\<license contentid="1710168517">CAISlgIKKgoQTSdnu46EhnmKo3qc/ep03RIQowvsuWp9Hk2Jbg7mvT9F9RoAIAEoABIUCAEQARgAKICangEwgJqeAUgAUAAaZhIQdWaI5N9DYBtTBKRALGqKrxpQ3e4AMWE7blRprUGVFJPsKSvhbBj//Ey3VNpFKDwQFaknE6FTj4uOVdXP4uLzoPcLp00+ZXsnHcZa2nQ9lMfupCcg90qecUyuz2PQDw7WnPggARpOChAIDuWgADJCxpYKbSJBH++/EhDlKx0zBLLfQcLJsPm3UmmdGiAMxRbuXSJnx7ezkxWjq49GpGYcGfettNIrCDZbourvmiACKAFiAlNEIMP/kOcFMhC/cSCXbshxSrcNcv4I4SfzOABQABoghZvLdiHxXzL9RFhkNtlEFb9fJmcFAX76sRmXPA788bgigAJ+yYhZCy2LRR1f2/5Nhd1xVOTCFDGHeynjHlNcF2LL12gBSVn1422Mc1x+gQiyLm5SistVVIG9NRtIxj2zYbjpeI2IxXtDCWxZk4G1eVUstDg18Ryl+Pzm1dWTcrWefdvm6ozsu0feHWd31Bpde/cIVh7NboQM/l9LLh+4KDG7SZjx89rQNBiTwj5fsJRr1Vh/QUF87WHe3LBVAM/4GadF2+0CbXNXLNUf/STXEUnL5YDjjB8L7e4vuL/n5mjbD7N...............</license></clientresponse></licenseresponse>

[peak3d]

@wwark could it be that the browser b64 decodes the challenge for display?
In chrome browser you can switch between text and raw to verify this.

But even you get the 200 OK response, you are currently out of luck parsing the xml response.
There are 3 options: 1.) write an license proxy (either plugin call or TCP server in a service addon), do the license request by yourself and route the result in a known format, or 2.) add the xml parser into wvdecrypter and make a PR, or wait until I provide a solution for it.

Nevertheless you should first figure out why you dont get 200 OK, use libCURL debugging and compare kodi vs browser, I'm sure you'll get a license if you do things correct.

[wwark]

@peak3d Thank you for these information's.
My previous message there is an error in the case of 'b{SSM}' I don't have the json on the response (like 401) but i don't check the http return. With this configuration the server return HTTP 200 so it is good 👍

The response can't be interpreted by inputstream.adaptive so I will try to propose a solution (2).

I will let open this ticket regarding the issue about to interpret the response of the server.

Last question, what is the difference between {SSM} and {SID}? In which case I need to use {SID}. It is not clear for me.

Good day !

[peak3d]

@wwark SID is the DRM session Id, there are a few (I remember 1) addons which need to pass the DRM SessionId in the license request. I bet you can forget this one for your addon.

Regarding option 2.) Pls. refer how license is parsed from json, pls. try to follow the way, you can use expat which is already in inputstream.adaptive dependencies and already used in DASHStream parser

[wwark]

ok thank you I will look into it !

[wwark]

Hi @peak3d,

I start to work to implement option (2). (https://github.com/wwark/inputstream.adaptive)
but I have this issue after downloading the manifest. Any idea about this issue ?

2019-06-07 00:06:42.259 T:140701132101376 DEBUG: AddOnLog: InputStream Adaptive: Download https://hss-od.snl-lv3.canalplus-cdn.net/replay/cplus/ssd/cpl100032465-wildmoka.com-8183278924/wildmoka-com-8183278924.ism/manifest finished
2019-06-07 00:06:42.261 T:140701132101376 INFO: AddOnLog: InputStream Adaptive: Successfully parsed .mpd file. #Streams: 2 Type: VOD, Download speed: 1994320.6709 Bytes/s
2019-06-07 00:06:42.261 T:140701132101376 DEBUG: CAddonSettings[inputstream.adaptive]: loading setting definitions
2019-06-07 00:06:42.262 T:140701132101376 DEBUG: CAddonSettings[inputstream.adaptive]: loading setting values
2019-06-07 00:06:42.263 T:140701132101376 DEBUG: CAddonSettings[inputstream.adaptive]: loading setting definitions
2019-06-07 00:06:42.263 T:140701132101376 DEBUG: CAddonSettings[inputstream.adaptive]: loading setting values
2019-06-07 00:06:42.263 T:140701132101376 DEBUG: AddOnLog: InputStream Adaptive: Entering encryption section
2019-06-07 00:06:42.264 T:140701132101376 DEBUG: AddOnLog: InputStream Adaptive: CDM version: 1.4.9.1088
2019-06-07 00:06:42.266 T:140701132101376 DEBUG: AddOnLog: InputStream Adaptive: Initializing stream with KID: 080EE5A00036352D77696C646D6F6B61
2019-06-07 00:06:42.266 T:140701132101376 ERROR: AddOnLog: InputStream Adaptive: Initialize failed (SingleSampleDecrypter)

I tried with my test version of inputstream and with this version of inputstream https://launchpad.net/~team-xbmc/+archive/ubuntu/ppa/+files/kodi-inputstream-adaptive-dbg_2.3.19-1~bionic_amd64.deb

Thanks,

[peak3d]

For Smoothstream with PlayReady content protection you'll have to tell inputstream.adaptive how to create the pssh binary data for initializing widevine library. What you can do now is install EME logger extension in your Chrome browser, activate logging and search inside the log for initialization. If you have found it, pls. post this section here

Edit: No, its some other issue, will have to debug

[wwark]

Ok. Do not hesitate if you need me to do some tests.
Thanks,
Wwark

[wwark]

Hi,
The issue reported the 7th of June is not present anymore.
I tried to implement XML Response for the licence wwark@b73a8f0 but without success. Can you please take a look ?

Thanks in advane

[wwark]

Hi @peak3d,
Do you have time to check this request ?
Thanks again for your help !

[wwark]

Hi @peak3d,
Could you please take time for this issue?

The format is of the response is "<licenseresponse deviceid="Poet+NDDxUKhcuBSJSNCug==" xmlns="http://www.canal-plus.com/DRM/V1\"><clientresponse statuscode="200"><license contentid="1710379614">.........QWpHFRBtCFW+/iAKSs3WMCxIQkYLbEX1fK0GwT/L1DWmRgBoAIAEoABIUCAEQA..........</license></clientresponse></licenseresponse>

Thanks for your help !

[glennguy]

@wwark is this issue still current?

[glennguy]

@wwark closing, please reopen though if it's still current

[Arias800]

Hello,
Can you reopen this issue, please @glennguy .
The problem is still there on MyCanal.
Exemple of manifest : replay-dsh.p-cdnvod-edge020604.scy.canalplus-cdn.net/ora02-880b13d5db2ae6d88ea44a0b0880545a-94d8/mkpc/canalplus/canalplus/ANT_1258662_22/2036393/ANT_1258662_22.mpd

[glennguy]

@Arias800 please provide a full debug log showing the issue. I can't access the manifest from my country btw.

[Arias800]

I completely forgot that the manifest are geo-blocked on this website.

Debug log : https://github.com/Arias800/Fichier-divers/blob/master/mycanal/debuglog.txt
Manifest : https://github.com/Arias800/Fichier-divers/blob/master/mycanal/manifest.mpd

[glennguy]

The reason we ask for full debug log is to be able to see what device you have, what version of kodi is running, whether there are banned add-ons in use etc. - could you please provide the whole log?

[Arias800]

Sorry for the mistake, I will remember next time.
I have updated the debuglog.txt with the full debug log.

[glennguy]

Ok. The issue seen is different to the original topic. Don't open a new issue yet though, the problem would appear to be on the add-on's side.

The license server is accepting the challenge and returning a response, just that there are no decryption keys coming with it.
This can happen when you contact the wrong license server, ask for the wrong keyid, or send some other parameters that are wrong perhaps. From the log we're asking for the same key id that's in the mpd, however I wonder if the GUID in the license URL is also meant to reflect the KID - http://secure-gen-hapi.canal-plus.com/conso/view/d3002520-b7d2-11ec-8002-5bce9dc0f19c/licence?drmConfig=mkpl::false

You should check on the add-on's github/forum to see if there are other users having the same issue, if not then open a new issue there. Most likely there has been a change on Mycanal.fr side and someone will need to confirm if this is the case by looking in the browser/official app to compare.

[Arias800]

I have just discovered something.
There is another license key that can be used: http://secure-gen-hapi.canal-plus.com/conso/view/6e455f70-b899-11ec-9dc6-950475e96da6/licence?drmId=1711119637, but this one isn't used on the browser.
Both license are returning an XML.

Is it possible to see what the license server returns in Kodi?
It might be useful to know the content and if it's the same as expected.
In this case, the response need to be similar to this one :
#267 (comment)

[glennguy]

Is it possible to see what the license server returns in Kodi?

Yes, in the cdm folder:

6e455f70-b899-11ec-9dc6-950475e96da6

Is this guid related back to anything in the manifest? (kid perhaps?)

[Arias800]

I don't have any response file in the cdm folder.

So you're right, there is something wrong with the requests itself.

The guid seem to be an internal id use by the service, because he doesn't appear in the manifest.

I will try to fix the requests.

[glennguy]

my bad, the files would be there in kodi 19 but this is turned off by default in 20. Need to uncomment this https://github.com/xbmc/inputstream.adaptive/blob/Nexus/wvdecrypter/wvdecrypter.cpp#L30 and recompile to get these files

[Arias800]

It would be nice to have an option to enable or disable these files in Kodi 20.
Because they are useful for debugging.

So, I'm back to Kodi 19 and the license response is as expected.

<licenseresponse deviceid="MTY0OTU5ODM1OTY2OC1kZTQyN2Q1MGM3MDRORFk0TldJME9UazNZakkzTW1Oak5tRmtORFV5TUdaalltWmlNRE5qTUdFPQ==" xmlns="http://www.canal-plus.com/DRM/V1"><clientresponse statuscode="200"><license contentid="1711143937">CAIStgIKNwoQE7fTNEX2d1DTB1QYeyYy6RIQG7Um5wGSSEyw3tVvlzi55BoAIAEoADgAQIj1igFIm7/LkgYSGQgBEAEYACCI9YoBKIj1igEwiPWKAUgAUAAaZhIQ5a09u58Ltc8lFHUzXQqUlhpQ0xyIFU/wmcW6ma4I2/NdVKBjOMgeKO+UOyqH/mJwI7X5rF3733NLDzyS1dgn9ZFQPkBD6YmBo3W+14UAbCvmLhimRIPfyA4LXZq5O83vRdMgARpqChAN+jZC7YtBnLNDQlDWKUZSEhDRhtazn8QU4tHWSFWxypK4GiBpX5RsaO8LlGdT3fM8hhMjpYx7Yr7knFLVuu89ziTf2CACKAEyBggAGAAgAEISChBrYzE2ACK6iFi1LWiAAAAIYgJTRCCbv8uSBjjj3JWbBlAAGiC9CQGYyRkUkP57KUFv9y7KxG8AIHOlSASntiFAU/K18yKAAUlWqT92VpV5oKqWAYWF7V1PyvNpJN86oHdk982WcJ9xCPPIWt6zDUkbDd9lIu0vURxlX6iSMSNscbulclVJjSw5kvMVXCKYYsteLBTjlLkSaX7VHcgdGNnS7bTMDjIoHw2GpT8YwWTFfnuALWMBQGqs0cpPaY458LT+uQQ9pL0yOjMKMTE2LjUuMCBCdWlsdCBvbiBEZWMgMTUgMjAyMSAxMDoyNzoxNyAoMTYzOTU5MjgxNSlAAUqwAQAAAAIAAACwAAUAEFi1LWilElT5AAAAWAAAABAAAABqAAAAUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAEAAAAAAAAAAAAAAAAAAAAAACK6iAAAAAAAIrqIAAAAAAAAAAAAAAABAAAAwAAAABAAAADSAAAAEAAAAOQAAAAQAAAAAAAAAAAAAAEUAAAAEF18SpSiyxmFPyiVnx/TvsYOIRVWL7yUOUD9VqtR4GNXWAE=</license></clientresponse></licenseresponse>

So the problem isn't in the addon side, I think.
IA doesn't seem to handle this type of response.

[glennguy]

Ah ok.

[glennguy]

Have reopened issue and we'll add xml license parsing as a feature to be implemented.

[glennguy]

If you want a solution right now, you could probably implement a proxy server in the add-on which would parse the xml and return just the base64 license. I can't give any indication to when this would be done, there's a lot of other competing features and only so much time between the active developers.

[Arias800]

Take your time, it's not urgent.

I didn't know that we can retrieve the license with a proxy server.
I have implemented this workaround.

[CastagnaIT]

@Arias800 can you check on webbrowser network flow, from the license response, what is the "Content-Type" header value?

[Arias800]

Hello,
The "Content-Type" is text/plain.

[CastagnaIT]

So the problem isn't in the addon side, I think.
IA doesn't seem to handle this type of response.

i made some search and yes ISA dont handle this type of response,
your type of license data is called "wrapped license" that are customizations of each video provider

from very old ISA versions, some license wrapper support was implemented
that however some of them works to specific video providers only
a similar example is json use case, limited to am@zon case, where a small json change will make this support unusable,
means that if the json scheme its different/change will not work anymore,
and similar thing is for your xml license case

on an ideal world (as said some comment above) would be the addon with his proxy server implementation
that solve the wrapped license and provide to ISA the binary data directly
(such as wiki example https://github.com/xbmc/inputstream.adaptive/wiki/How-to-provide-custom-manifest-and-license)

But anyway being that we have from older versions already some wrapper implementations
we could improve the wrapper support by adding xml case
and possibly allowing to provide the xml path where to read the xml value in the data,
this would prevent addons from to be forced implementing a proxy server that require additionals system resources

i have planned future ISA improvements on this topic
where i think to add also the xml wrapper support since its similar to json case

i cannot provide you an ETA, my hope is try include it in to Kodi 21,
but this change is part of other big improvements,
then if for some reason a long delay happen will be for Kodi 22

meantime proxy server implementation its the only possible solution

[Arias800]

We've set up a proxy as advised before, and it works very well.
So, if it's something complex to implement in AI, it might not be worth doing, and we can leave it to the proxy.

[CastagnaIT]

good, i will let you know here for future updates