SSL Issues with SickRage on openelec 5.0.8

mattiasb commented 8 years ago

I get a bunch of SSL errors like these when SickRage performs searches at btdigg:

2015-09-30 23:46:53 WARNING  SEARCHQUEUE-BACKLOG-75760 :: [BTDigg] :: Connection error to getURL https://api.btdigg.org/api/private-341ada3245790954/s02?q=<SHOW>&p=0&order=1 Error: error [Errno 1] _ssl.c:504: error:14077438:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert internal error
2015-09-30 23:46:53 INFO     SEARCHQUEUE-BACKLOG-75760 :: [BTDigg] :: Performing Search: <SHOW> <EPISODE>
2015-09-30 23:46:53 INFO     SEARCHQUEUE-BACKLOG-75760 :: [BTDigg] :: No data returned to be parsed!!!

I have seen similar SSL issues with TPB as well.

I'm hesitant to report this upstream since it might be an issue with OpenSSL in OpenElec or SickPotatoHead. Any idea what's going on?

mattiasb commented 8 years ago

When I paste the btdigg URL into my browser I get a JSON document back consisting of a search response (and no errors). So the URL seems correctly constructed at least.

mattiasb commented 8 years ago

Managed to catch the TPB SSL Error as well:

WARNING  SEARCHQUEUE-BACKLOG-250487 :: [ThePirateBay] :: Connection error to getURL https://thepiratebay.gd/s/ Error: error [Errno 1] _ssl.c:504: error:14077438:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert internal error

And indeed it was the same error. :)

lsellens commented 8 years ago

What architecture is this running on?

antonie-christie commented 8 years ago

I'm seeing exactly the same my side. From the little bit of searching I was able to do tonight the symptoms also seemed to correlate with some of the Sickrage threads that mention openSSL library compatibility, like this one [https://github.com/SiCKRAGETV/sickrage-issues/wiki/SSL-Errors].

Running OpenELEC 5.0.8 on Generic.x86_64 on an AMD. Running version 1.5.3 of SickPotatoHead

Will be happy to run checks/report logs if required to help diagnose :)

mattiasb commented 8 years ago

AMD x86-64

$ cat /proc/cpuinfo
processor   : 0
vendor_id   : AuthenticAMD
cpu family  : 20
model       : 2
model name  : AMD E-450 APU with Radeon(tm) HD Graphics
stepping    : 0
microcode   : 0x5000101
cpu MHz     : 1650.000
cache size  : 512 KB
physical id : 0
siblings    : 2
core id     : 0
cpu cores   : 2
apicid      : 0
initial apicid  : 0
fpu     : yes
fpu_exception   : yes
cpuid level : 6
wp      : yes
flags       : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good nopl nonstop_tsc extd_apicid aperfmperf pni monitor ssse3 cx16 popcnt lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch ibs skinit wdt arat hw_pstate npt lbrv svm_lock nrip_save pausefilter vmmcall
bugs        : fxsave_leak
bogomips    : 3301.37
TLB size    : 1024 4K pages
clflush size    : 64
cache_alignment : 64
address sizes   : 36 bits physical, 48 bits virtual
power management: ts ttp tm stc 100mhzsteps hwpstate

processor   : 1
vendor_id   : AuthenticAMD
cpu family  : 20
model       : 2
model name  : AMD E-450 APU with Radeon(tm) HD Graphics
stepping    : 0
microcode   : 0x5000101
cpu MHz     : 1650.000
cache size  : 512 KB
physical id : 0
siblings    : 2
core id     : 1
cpu cores   : 2
apicid      : 1
initial apicid  : 1
fpu     : yes
fpu_exception   : yes
cpuid level : 6
wp      : yes
flags       : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good nopl nonstop_tsc extd_apicid aperfmperf pni monitor ssse3 cx16 popcnt lahf_lm cmp_legacy svm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch ibs skinit wdt arat hw_pstate npt lbrv svm_lock nrip_save pausefilter vmmcall
bugs        : fxsave_leak
bogomips    : 3301.37
TLB size    : 1024 4K pages
clflush size    : 64
cache_alignment : 64
address sizes   : 36 bits physical, 48 bits virtual
power management: ts ttp tm stc 100mhzsteps hwpstate

lsellens commented 8 years ago

Thanks for doing the leg work antonie-christie The pyopenssl version is 0.13 but it is running openssl 1.0.0 so I'll have to cross-compile binaries for 1.0.1. I'll get this corrected soon Thanks!

lsellens commented 8 years ago

try this when you have time and let me know if it fixes it(I'm not at home so can't test myself)

ssh into your htpc and run these commands cd /storage/.kodi/addons/script.module.audo-dependencies/lib/multiarch/ mv libssl.so.1.0.0.x86_64 /libssl.so.1.0.0.x86_64.bak mv libcrypto.so.1.0.0.x86_64 libcrypto.so.1.0.0.x86_64.bak wget http://lsellens.openelec.tv/addons/libssl.so.1.0.0.x86_64 wget http://lsellens.openelec.tv/addons/libcrypto.so.1.0.0.x86_64 rm ../../arch.x86_64

then reboot and let me know if the issue still persists.

lsellens commented 8 years ago

also just curious, under general settings in sickrage is "Verify SSL Certs" checked or unchecked?

lsellens commented 8 years ago

Well, I feel dumb. Just realized you're not running audo but sickpotatohead... I know exactly what is wrong. I'll get this fixed.

antonie-christie commented 8 years ago

My absolute pleasure, although I don't feel like I even did much, just a bit of googling.

Thanks so much for your fantastic add-on and swift action on keeping it up to date. If you ever need people to test stuff don't hesitate to ask

mattiasb commented 8 years ago

It looks like the 1.5.4 package you released with the fix above is broken though. I can't install it from within kodi/openelec and when unzipping manually I get this:

MediaBox:~/.kodi/addons/packages # unzip service.downloadmanager.SickPotatoHead-1.5.4.zip 
Archive:  service.downloadmanager.SickPotatoHead-1.5.4.zip
error [service.downloadmanager.SickPotatoHead-1.5.4.zip]:  missing 1379 bytes in zipfile
  (attempting to process anyway)
error [service.downloadmanager.SickPotatoHead-1.5.4.zip]:  start of central directory not found;
  zipfile corrupt.
  (please check that you have transferred or created the zipfile in the
  appropriate BINARY mode and that you have compiled UnZip properly)

lsellens commented 8 years ago

My internet connection was acting squirrelly last night. I just reuploaded it. Try it again.

lsellens commented 8 years ago

Actually hold on it still uploaded corrupted

lsellens commented 8 years ago

ok, some how my ftp client was in ascii mode. Should be all good now

mattiasb commented 8 years ago

Hm, I'm still getting these SSL errors even after upgrading to 1.5.4. :(

lsellens commented 8 years ago

Did you reboot after the install?

lsellens commented 8 years ago

could you try this when you get a chance? http://lsellens.openelec.tv/addons/repo/service.downloadmanager.SickPotatoHead/service.downloadmanager.SickPotatoHead-1.5.5~beta1.zip sorry, I'm on the road right now so I can't test myself.

mattiasb commented 8 years ago

Oh no problems! I know what it means to maintain open source projects in your spare time :) I'll test it later. (And I did reboot :))

antonie-christie commented 8 years ago

Hi, was away this weekend so could only try this on my side this morning. Excuse my noob question but I can't seem to get the beta to run on my side. I thought I could just override the contents of .kodi/addon/service.downloadmanager.SickPotatoHead/ with the contents of the 1.5.5-beta zip file. I don't seem to have the add-on running after doing that though. What are the correct steps to update to 1.5.5 manually.

On Sat, Oct 3, 2015 at 2:51 PM, Mattias Bengtsson notifications@github.com wrote:

Oh no problems! I know what it means to maintain open source projects in your spare time :) I'll test it later. (And I did reboot :))

— Reply to this email directly or view it on GitHub https://github.com/lsellens/service.downloadmanager.SickPotatoHead/issues/4#issuecomment-145245969 .

lsellens commented 8 years ago

Easy way would just be to place the zip in a folder on your htpc, and go to the add-on manager and select install from zip. Thanks for doing this for me.

mattiasb commented 8 years ago

I get "Addon does not have the correct structure" inside Kodi. :(

lsellens commented 8 years ago

Was worried about that. Tried adding a module extension but I don't think kodi allows this. I'm going to have to setup a test box to get this fixed. Give me a few days and I'll have it working.

mattiasb commented 8 years ago

:heart:

lsellens commented 8 years ago

stupid me... I just noticed what the real problem was. Had some bad paths. Try this one http://lsellens.openelec.tv/addons/repo/service.downloadmanager.SickPotatoHead/service.downloadmanager.SickPotatoHead-1.5.5~beta2.zip should install this time. Will probably have to reboot after install.

lsellens commented 8 years ago

Actually wait on that lol

mattiasb commented 8 years ago

:D

lsellens commented 8 years ago

Was driving down the road and realized I made a mistake. Just corrected it and reuploaded. go ahead and try the file I posted above. Thanks!

mattiasb commented 8 years ago

Still the same unfortunately.

I see that you're trying to fiddle with the resource paths a bunch. (Or I can't actually see your last commit). But I think the solution (based on that link from antoine above) is to just upgrade OpenSSL to 1.0.1 from the current bundled 1.0.0.

EDIT: Or maybe I'm missing something? :)

lsellens commented 8 years ago

the files are named the same for backwards compatibility but that isnt 1.0.0

mattiasb commented 8 years ago

Ah, so they actually are 1.0.1?

lsellens commented 8 years ago

yes

lsellens commented 8 years ago

if you have time could you send me an kodi debug log?

lsellens commented 8 years ago

Finally had more then 5 seconds to sit down and look at this. version 1.5.5 is up on the repo. Should be working now.

mattiasb commented 8 years ago

Weee! It's working! Thanks a lot!

Am I correct that I can delete /storage/.kodi/addons/service.downloadmanager.SickPotatoHeadresources? I'm guessing that dir was created by the typo fixed in https://github.com/lsellens/service.downloadmanager.SickPotatoHead/commit/e76d2a0a7d040ec11124f9fd73e469455abeb2f7 right?

lsellens commented 8 years ago

Absolutely. Thanks for testing for me.

mattiasb commented 8 years ago

Np! :)

antonie-christie commented 8 years ago

Hey, only got round to testing on my side tonight. I am on 1.5.6. I'm afraid that I still need to disable SSL cert verification from general settings otherwise SSL verifcation still fails. Disabling SSL verification allows the getURLs to succeed again. Sorry :)

Any tests I can do for you?

Same log as before BTW:

2015-10-08 21:03:32 SEARCHQUEUE-MANUAL-80379 :: [KickAssTorrents] :: Connection error to getURL https://kat.cr/usearch/ Error: error hostname ' kat.cr' doesn't match either of '*.kickass.so', 'kickass.so' 2015-10-08 21:03:32 SEARCHQUEUE-MANUAL-80379 :: [ThePirateBay] :: Connection error to getURL https://thepiratebay.gd/s/ Error: error [Errno 1] _ssl.c:504: error:14077438:SSL routines:SSL23_GET_SERVER_HELLO:tlsv1 alert internal error

On Wed, Oct 7, 2015 at 1:30 AM, Mattias Bengtsson notifications@github.com wrote:

Np! :)

— Reply to this email directly or view it on GitHub https://github.com/lsellens/service.downloadmanager.SickPotatoHead/issues/4#issuecomment-146033606 .

mattiasb commented 8 years ago

This is awkward, but the same old errors have returned. There were some fixes for kat.cr and tpb commited to SickRage master an hour ago so I upgraded to that, but it didn't help. :(

lsellens / service.downloadmanager.SickPotatoHead

SSL Issues with SickRage on openelec 5.0.8 #4