Respect user certificates #1215
Conversation
If one wants to run one’s own global discovery inside of a private network in a secure manner, the simplest solution is to use a self signed CA that is already trusted by all network devices. Unfortunately the app currently ignores user certificates from android and doesn’t provide a way to set one’s own, forcing users to use public domain names as a workaround. This is unfortunate. Given the strong warnings android gives before installing custom CAs, it is likely that anyone with custom certificates installed "knows what they are doing" and out of those, people who would rather trust their CAs are a lot more common. As such I propose enabling trusting of user CAs. If you think it would be straightforward, I'd be willing to attempt adding a toggle somewhere in the settings for this, if you think it's really necessary.
|
Thanks for the PR 🙂. Did you test this if it works on your phone? Where can I get the debug APK? |
|
Hi! Not exactly; I was about to to write, so thanks for the prompt. Im not an android dev but i experienced this problem (of apps not respecting certificates) in other apps, eg termux, and upon investigation this (my PR) was the established solution in sites like SO. In termux specifically there’s a workaround of setting the certificates inside the app. Here I was not able to find a workaround aside from setting up a letsencrypt. I was about to open an issue but then thought “it’s a one line change, just do the pr”. I did, then decided to try and build this but I got stuck(before even patching). build breaks in the step where syncthing is to be built using go. both for head commit and latest release tag. (building on an ubuntu:latest amd64 container). If I run the failing command manually, i get an error message about cgo, and if i enable cgo as instructed by google, eventually something tries to execute some nonexistent version of llvm in the ndk directory and fails. If all that doesn’t make sense ill post the actual errors once im by the computer. One thing that might have tripped it might have been the python version. I just went with whatever was available in apt repo. Ill also test with correct version before posting the errors. |
|
It's maybe the ndk home or where it is installed when cgo is failing!? I am not sure the native can profit from your android xml change. I only know from another ticket that env vars may be respected by the compiled native process. |
|
Here is the initial error with python 3.9.6. I followed the instructions in the readme and failed to build. As far as I understand, the script downloads the NDK itself, so I see no reason for it to be of an incorrect version. On an ubuntu 24.4.01 container: This then complains about the lack of java 17 - I install Attempting to run the failing command directly, I get the following: OK. I install clang-14 via apt and symlink the executable to the expected location. We go a bit further: OK, sounds like I should have install a cross compiler instead. I don't recall one being available via apt, so let's try to link clan-18 from the same directory to clang-14 instead; Unfortunately it's the same error. Perhaps not a cross-compiler issue. Just to test I tried with CGO_ENABLED=0 and got In light of this, perhaps we could revisit the build instructions? Would you like me to submit an issue? Are you building on a specific kind of machine/OS? I noticed that the windows instructions has some extra steps. Are you building on Windows? I can try doing that. |
I'm not sure I follow. Are you saying that the location where I made the changes is incorrect? I've very little experience with android so I'll happily change to a more suitable location. As far as I understand it, it is the lack of the Or are you saying this kind of change is wrong in general and will not acheive desired effect? If so, would you propose a different mechanism? Thanks! |
|
Small update - I suddenly noticed that there are docker build instructions. Attempting to build with docker fails with a similar error. I see there have been some changes since v1.28.0.0, but, attempting to build the image fails on the prebuild step: I guess I'll try to build on windows unless you have any advice here. |
|
Update; I get the same results on windows 11 with python 3.9.6 and go 1.2.3 (though i think the build script installs a local go). the python script to install android studio from the readme doesn’t work (ill post the error later). If I ignore it and instead just run the gradle commmand or the cmd script, i get stuck at the same place, same error as before. |
|
Hi, Openjdk 17 is fine. Where did you get the 11 from? I updated this some days ago... Docker: currently not functional, as I have no knowledge about the github CI yet and tried porting from upstream. It seems, one go package is affected - maybe there is sth wrong with your go build cache? Fdroid build succeeded last night, so I think there is no general problem. The script tries to fetch ndk&go for you if it can't find it, yes. I don't know if your change will have the desired effect. Some config comes from the android app sandbox and some is its own world as a linux native is running ("syncthing binary"). Android treats them differently, that's also the back story of sdcard access why apps can write to sdcard via android SAF but SyncthingNative can't. It may be similar in this case if certificates aren't handled by the sandbox thus ignoring your xml change. Your change may only affect the wrapper. |
The readme :) I suspected some of it may not be up to date and especially noticed that there were some changes in the dependencies and build scripts recently.
I barely read any go code ever, not really familiar with the go ecosystem. afaiu cgo is some layer of compatibility with c? Anyway, i didn’t disable it. For some reason it seems to not be enabled by default, unless i add the environment variable that forces it on. Just tried both ways to make sure. Possibly you have some private go config that is not in the repo such as eg a .env file?
I understand. The way i see it docker /is/ the official linux instructions bound in code against a specific distro.
What script is executed by fdroid builder?
I understand. Kinda. I don’t know if my change is “correct”, however ST does check some specific store for root certificates. Either it takes these from android, in which case it should probably listen to the config, or some other embedded store like eg termux, which if the case, i would propose adding a small ui to add your own certificate to (in termux you just do it the normal linux way inside) |
Description
If one wants to run one’s own global discovery inside of a private network in a secure manner, the simplest solution is to use a self signed CA that is already trusted by all network devices. Unfortunately the app currently ignores user certificates from android and doesn’t provide a way to set one’s own, forcing users to use public domain names as a workaround. This is unfortunate.
Given the strong warnings android gives before installing custom CAs, it is likely that anyone with custom certificates installed "knows what they are doing" and out of those, people who would rather trust their CAs are a lot more common.
As such I propose enabling trusting of user CAs. If you think it would be straightforward, I'd be willing to attempt adding a toggle somewhere in the settings for this, if you think it's really necessary.
Changes