Quiver connection failure on Android

[bemasc]

On some servers, I'm seeing repeated timeouts leading to total connection failure, on Android. After some investigation, I've traced it to a specific error: "SSL handshake not completed", resultCode -148, when calling chrome.sockets.tcp.secure (provided by a CCA cordova plugin).

EDIT: After removing a lot of breakpoints, it looks like the deeper problem is actually that chrome.sockets.tcp.connect never calls its success or failure callback when connecting to the problematic domain.

[bemasc]

I've traced this into a reduced testcase in our Cordova plugin dependency: MobileChromeApps/cordova-plugin-chrome-apps-sockets-tcp#17

[bemasc]

Using the reduced testcase, I've established that the CCA plugin for chrome.sockets.tcp doesn't support TLS-SNI. It appears that half of our front domains require SNI, while the other half do not. The domains that don't work all have similar DNS entries, suggesting that some common Cloudfront configuration (maybe the default) requires SNI.

The sockets plugin uses Java's SSLEngine API to implement SSL. This API has recently gained supported for SNI, but only starting in API 24 (Android N). Supporting SNI on earlier Android versions would be difficult. If supporting SNI on pre-N devices is necessary, our best option would seem to be writing a new Cordova plugin that provides the same sockets API but wraps a bundled native-code SSL library.

However, we can also rescue domain-fronting functionality by simply restricting the set of domains to ones that do not require SNI, and possibly along with some retry logic that changes the front domain.

[bemasc]

This should be fixed by UWNetworksLab/freedom-social-quiver#25