Zulip-desktop: Add validation for custom/self-signed certificates

[penCsharpener]

Zulip 1.5.1 running on Ubuntu 16.04.2 in hyper-V
the ubuntu machine is called zulip with a self-signed certificate
the settings.py has as external_host = 'zulip'
we only use it internally without access from the outside of the LAN
in the browser https://zulip works or https://localipaddress
in the electron app however this doesn't work (nor with the IP)

[Lplenka]

@vbNETonIce Can you give a screenshot of opening this "https://zulip" server in your browser , i wanted to know if this server you want to access is accessible in your browser or not. https in localhost is quite unlikely

[penCsharpener]

yes, it is accessible. I'm on a Win10 machine and use zulip that runs on the hyper-v VM with Ubuntu. It works in all browsers and also in the legacy app but not in the electron app.

[Lplenka]

@vbNETonIce
First thing-
Make sure your server is running locally when you are tyring to access it in elctron (i.e make sure it is running in your browser at the same time when you are accessing it in electron).

Second-
Please check if this file "zulip.ogg" exists in your server root directory in the following path
root_directory_of_your_server/static/audio/zulip.ogg

[penCsharpener]

sorry. I'm not sure where to look for the file
/root/static doesn't exist
/home/zulip/deployment/current doesn't show a path static either

[Lplenka]

@vbNETonIce open your zulip(server) folder in ur VM and press Ctrl+ F , in the search bar type zulip.ogg and tell the path in which it exists.

It must exist somewhere in that server folder , I am pretty sure

[penCsharpener]

Ctrl + F doesn't seem to work (I tried Kitty and VM Connection of Hyper-V)

[penCsharpener]

ah, locate zulip.ogg did the trick
/home/zulip/deployment/date and time/prod-static/serve/audio/zulip.ogg
/home/zulip/prod-static/serve/audio/zulip.ogg

[Lplenka]

Great! @vbNETonIce
It will be easy to fix this
Hopefully you start your server in your terminal at home/zulip/deployment path , if not tell me the folder(or path) you cd to your terminal where you start your server

[penCsharpener]

I use the path from the zulip documentation
/home/zulip/deployments/current/scripts/restart-server
which points to the latest deployments/datentime/ folder which contains zulip 1.5.1 and no zulip.ogg of it's own. It seems to share the one from the former version

[Lplenka]

Okay ! Thanks for informing
will fix this and ask for a PR
@zulipbot claim

[Lplenka]

@vbNETonIce
so you have two zulip.ogg file

1-/home/zulip/deployment/date and time/prod-static/serve/audio/zulip.ogg
2-/home/zulip/prod-static/serve/audio/zulip.ogg

am i right?
Also,
In your terminal find in which you have run the server find this line
==> default: Setting up mount entries for shared folders... default: /srv/zulip => Path

Please tell me the path shown after /srv/zulip=> in your case
i need the path to handle this issue

[penCsharpener]

strangely enough I have three zulip.ogg files now

zulip@zulip:~$ locate zulip.ogg
/home/zulip/deployments/2016-09-29-16-14-21/prod-static/serve/audio/zulip.ogg
/home/zulip/deployments/2017-03-08-14-21-26/prod-static/serve/audio/zulip.ogg
/home/zulip/prod-static/audio/zulip.ogg

but I don't understand your screenshot.
/srv has these folders in it

zulip@zulip:/srv$ dir
zulip-emoji-cache  zulip-npm-cache  zulip-venv-cache

[Lplenka]

@vbNETonIce i wanted to know where your server points when you access https://zulip in your browser

Sadly I am facing some problem in installing the production server ,not able to reproduce this issue, hence asking you details

check in your browser after turning on the server if https://zulip/prod-static/audio/zulip.ogg opens or not (i.e you will hear an audio)

[timabbott]

I think you actually want to test https://zulip/static/audio/zulip.ogg since Zulip rewrites the URLs.

[penCsharpener]

that, Tim's link worked. It's the drum-like sound when a msg comes in

[Lplenka]

@vbNETonIce
https://zulip/static/audio/zulip.ogg
if this gives a drum-like sound then app should work because it's in the code

[penCsharpener]

nope, not working in version electron 0.5.8

[akashnimare]

It's not working because of self-signed certificate and we currently don't support this. It's #2, #25. This feature will be added soon....

[Lplenka]

@akashnimare Got it , I thought path of 'zulip.ogg' is creating problem.

[zulipbot]

Hello @Lplenka, you claimed this issue to work on it, but this issue hasn't been updated for a week. Are you still working on this issue?

If so, please update this issue by leaving a comment on this issue to let me know that you're still working on this issue within 3 days, or else I'll automatically remove your assignment from this issue.

If you've decided to stop working on this issue, simply comment @zulipbot abandon to abandon this issue so someone else can claim it and continue from where you left off.

Thank you for your understanding and your valuable contributions to Zulip!

[Lplenka]

I am working on it 😄

[Lplenka]

Will come back to this after completely solving another issue.
@zulipbot abandon

[Lplenka]

@akashnimare I just removed the part of the code in domain.js that checked the presence of zulip.ogg in static folder.

else {
             const domain = 'https://' + newDomain;
            // const checkDomain = domain + '/static/audio/zulip.ogg';
            // 
            // request(checkDomain, (error, response) => {
            //  if (!error && response.statusCode !== 404) {
            //      document.getElementById('main').innerHTML = 'Connect';
                    db.push('/domain', domain);
                    ipcRenderer.send('new-domain', domain);
            //  } else {
            //      document.getElementById('main').innerHTML = 'Connect';
            //      document.getElementById('server-status').innerHTML = 'Not a valid Zulip Server.';
            //  }
            // });
        }

And our app opened the https://localhost production server.

Can you please try to replicate this in your system?

[Lplenka]

Can you please try to replicate this in your system?

@akashnimare Incase you missed this. I couldn't find any certificate error. "Not a zulip server" error only occurred because zulip.ogg file was not found. So please check this once in your system.

[akashnimare]

Do you see zulip.ogg file at https://localhost/static/audio/zulip.ogg ?

[Lplenka]

Now I checked if I can access the zulip.ogg file in the browser or not.
It is accessible.

[Lplenka]

Got it, The request we send to check the presence of zulip.ogg fails because of certificate error.
If we don't check the presence of zulip.ogg the app loads the server somehow and everything works well after that but also throws a certificate error in the terminal :thinking: .

[timabbott]

I think we should just make the logic conditional on the nature of the failure. If zulip.ogg 404s, or DNS doesn't resolve, that means it's clearly not a Zulip server. If we get some other form of issue, such as a certificate error, we presumably want to present the certificate error to the user, so they can decide if they still want to connect.

[Lplenka]

I think we should just make the logic conditional on the nature of the failure. If zulip.ogg 404s, or DNS doesn't resolve, that means it's clearly not a Zulip server. If we get some other form of issue, such as a certificate error, we presumably want to present the certificate error to the user, so they can decide if they still want to connect.

Seems like the best solution, Will work on this

[akashnimare]

I have pushed a fix. @Lplenka can you test it? As of now, I don't have access to Linux machine so I can't verify this.

[Lplenka]

@akashnimare will verify as soon as I get time amidst exams :sweat_smile: , tonight most probably.

[Lplenka]

Currently, I am getting this error in my Ubuntu 16.04.2 VM :confused: which was not there earlier.

I am not getting this error in my Linux Mint though.

[akashnimare]

@Lplenka please see #139

[Lplenka]

@Lplenka please see #139

Thanks! It worked.

I have pushed a fix. @Lplenka can you test it? As of now, I don't have access to Linux machine so I can't verify this.

This fix doesn't work because in domain.js zulip.ogg check fails because of certificate error. The URL is not sent to Main process from domain.js until zulip.ogg check is successful. So we have to deal with the error there too.

I will work on this issue :smile: . Have some ideas that can successfully solve this.
@zulipbot claim

[akashnimare]

Self-signed/custom certificate support has been added in https://github.com/zulip/zulip-electron/commit/3dade768a750a9d0c08763ec6d9f347040f6807f + PR #141 . If possible could you guys verify if it works? Just pull the latest master :smile:
cc @vbNETonIce, @timapril, @steele, @mgrabow1

Note - Support for selecting appropriate certificate from keychain will be added soon (just like chrome).

[penCsharpener]

I can confirm that it does. Thanks a lot for your work! Thanks to Lplenka for guiding me through.

[akashnimare]

The current logic simply ignores the certs error and load it without validating the certs. Ideal solution would be -

• When a user enters a server which has self-signed cert we should check it against all the installed certs from user's keychain.

[timabbott]

@akashnimare can you explain in a bit more detail what exactly we're doing now? I think the flow we want is:

• If the server has a valid cert checkable via the user's keychain (including public keychains), accept
• If the server doesn't, prompt the user for whether they want to ignore the fact that the certificate isn't properly signed; I'd copy language from Chrome or Firefox for how to explain the situation, with maybe some specificity to Zulip. E.g. "Unless your IT administrator has told you specifically that you'll need to accept this self-signed certificate, you probably want to say no".

[akashnimare]

If the server has a valid cert checkable via the user's keychain (including public keychains), accept

^^ We're not doing this. The current logic works on the basis of certificate error, not on the validity of the server certificate. So when user enters a server which has custom certs we take this as a certs error and just ask this -

Ideally, we should validate the certs first and then prompt the user for whether they want to ignore
it or not. The flow you have mentioned is what we need to implement here.