no-ip: invalid base64 encoding of passwords with special characters

[hancockks]

cat /usr/local/etc/inadyn.conf

period = 432000
provider default@no-ip.com {
username = myusername
password = password#hash
hostname = { "test.com" }
}
inadyn[5411]: Sending alias table update to DDNS server: GET /nic/update?hostname=test.com&myip=XX.XX.XX.XX HTTP/1.0
Host: dynupdate.no-ip.com
Authorization: Basic bXl1c2VybmFtZTpwYXNzd29yZA==
User-Agent: inadyn/2.2 https://github.com/troglobit/inadyn/issues

inadyn[5411]: Successfully sent DDNS update using HTTPS!
inadyn[5411]: DDNS server response:

Note two errors here:

1. base64 decode of the Authorization: Basic decodes to "myusername:password" -- it's missing everything hash and later.
2. The DDNS server response isn't being shown. It's returning a 401 error

Additionally, I cannot verify whether the username:password@ is being correctly encoded in the URL. Any special characters in the password would have to be html escaped, in the above case http://myusername:password%23hash@dynupdate.no-ip.com

[troglobit]

Try putting the password in double quotes, like this:

password = "password#hash"

The # character is a comment character in the .conf file, so everything after it is likely interpreted as a comment. Enclosing the password in quotes should escape that.

I recently commented out the encoded debug message you need. But if you run an earlier version it should be logged if you run inadyn with -l debug, otherwise you'll have to uncomment https://github.com/troglobit/inadyn/blob/master/src/ddns.c#L722

[dakaix]

I'm seeing the same behaviour, no DDNS response and there's no change actioned on No-Ip's side. However unlike hancockks I'm using a password with no special characters, plain alpha numeric (tried with and without double quotes).

This had been working fine for the last few months, is there an API change on No-IP's side perhaps?

[troglobit]

@dakaix Have you tried running inadyn in the foreground with -l debug? You should also check your account at No-IP, some providers block accounts/hostnames that update too often.

The API is defined here, https://www.noip.com/integrate/request and it looks to me that it's the same as before. Exact same as Dyn et al. The code is in plugins/dyndns.c and plugins/common.c.

[dakaix]

@troglobit Indeed, nothing hugely interesting in there (sanitised output below). My account on No-IP looks OK, there's no obvious message stating any rate-limiting is occurring. Although interestingly if I manually perform an API request with a new IP it returns stating there's no change required... and yet the My Account page (and a DNS query) shows the old IP remains.

root@nas:~ # /usr/local/sbin/inadyn -n -l debug
inadyn[14045]: In-a-dyn version 2.2 -- Dynamic DNS update client.
inadyn[14045]: Resolving hostname {No-IP URL} => IP# {Old IP}
inadyn[14045]: Base64 encode {Username:Auth Hash} for default@no-ip.com ...
inadyn[14045]: Base64 encoded string: {Auth Hash}
inadyn[14045]: Get address for default@no-ip.com
inadyn[14045]: Checking for IP# change, connecting to ip1.dynupdate.no-ip.com(52.203.8.5:80)
inadyn[14045]: Querying DDNS checkip server for my public IP#: GET / HTTP/1.0
Host: ip1.dynupdate.no-ip.com
User-Agent: inadyn/2.2 https://github.com/troglobit/inadyn/issues

inadyn[14045]: Checked my IP, return code: 0
inadyn[14045]: IP server response:
inadyn[14045]: HTTP/1.0 200 OK
Server: xipha
Date: Tue, 27 Aug 2018 22:35:42 GMT
Content-Type: text/html
Connection: close

{New IP}
inadyn[14045]: Checking IPv4 address {New IP} ...
inadyn[14045]: IPv4 address {New IP} is valid.
inadyn[14045]: Current IP# {New IP} at default@no-ip.com
inadyn[14045]: Update forced for alias .ddns.net, new IP# {New IP}
inadyn[14045]: Sending IP# update to DDNS server, initiating HTTPS ...
inadyn[14045]: Sending IP# update to DDNS server, connecting to dynupdate.no-ip.com(8.23.224.120:443)
inadyn[14045]: Certificate OK
inadyn[14045]: SSL server cert subject: CN=*.no-ip.com
inadyn[14045]: SSL server cert issuer: C=US,O=GeoTrust Inc.,CN=RapidSSL SHA256 CA
inadyn[14045]: Sending alias table update to DDNS server: GET /nic/update?hostname={No-IP URL}&myip={New IP} HTTP/1.0
Host: dynupdate.no-ip.com
Authorization: Basic
User-Agent: inadyn/2.2 https://github.com/troglobit/inadyn/issues

inadyn[14045]: Successfully sent DDNS update using HTTPS!
inadyn[14045]: DDNS server response:

[hancockks]

@dakaix I had the same results after changing my password to work around the issue (before the quotes suggestion was posted). I'm not sure if it's a latency issue between the back end and the UI...

[troglobit]

@dakaix I think I'm starting to understand what's going on here. I'm assuming you're using the OpenSSL backend and not GnuTLS? OpenSSL is the only code path that seems plausible, because ...

... The transaction with the server is in two phases: 1) send the HTTP GET string, and 2) wait for and receive reply.

After 1) there is the debug message "Successfully sent ...", this is printed on success. But in 2) there no such message, which by looking at the code (openssl.c) there should be, which in turn seems to indicate there was an error.

Unfortunately Inadyn doesn't print the OpenSSL error, that code path is still TODO. Either way, the front-end should check the reply from the back-end only attempt to show the reply on success.

[troglobit]

I've pushed some changes related to this. Would be great if someone could test it.

See https://github.com/troglobit/inadyn/#building-from-git for details on building from Git.

[troglobit]

You can almost hear the crickets ... last call, if anyone can test the fixes I've pushed I'd be really grateful! A new release, including these fixes, will be out in a couple of days now, and this issue will be closed due to inactivity unless someone pipes up.

[troglobit]

Closing due to lack of feedback to fixes.