I just developed an Application in Qt that uses a WebSocket Server (QWebSocketServer). I did this under Linux and everything worked great, but when I ran the code on Mac OS I was unable to connect to the server from a webpage on Chrome.
The connection took ages, and I got WebSocket opening handshake timed out from Chrome after a few minutes.
In the end I went back to basics and tried Qt's example:
http://doc.qt.io/qt-5/qtwebsockets-sslechoserver-example.html
Exactly the same.
edit:
After removing SSL and using non-secure websockets it works, even on the same port.
Chrome on the Mac can access a secure Qt WebSocket server on a remote (non-Mac) computer, but Chrome on a remote computer times out while connecting to the Mac (securely) - so it would appear to be something wrong with the Qt QWebSocketServer example. It works fine on both Linux and Windows.
There is a connection being made (because the web browser fails instantly if the application isn't running or is closed), but for whatever reason it isn't completing.
Any idea what this might be, or how I can go about trying to track it down?
thanks!
As qt document(http://doc.qt.io/qt-5/qsslsocket.html) says:
Note: Secure Transport SSL backend on macOS may update the default keychain (the default is probably your login keychain) by importing your local certificates and keys. This can also result in system dialogs showing up and asking for permission when your application is using these private keys. If such behavior is undesired, set the QT_SSL_USE_TEMPORARY_KEYCHAIN environment variable to a non-zero value; this will prompt QSslSocket to use its own temporary keychain.
The issue here seems to be some interaction with MacOS's permissions system.
The first time you run the application and connect, the app will pop up a window asking for permissions to access your keychain (I guess to install the certificate).
If you close the dialog at that point, it won't come back, and it seems no QtWebSocketServer based programs will function from then on, until your reboot!
Related
I'm using a Microsoft add-in for Powerpoint called 'Web Viewer' (it's just an iframe, you insert a URL, it displays it in the slide).
I inserted a webpage that uses Socket.IO, and I'm seeing it is not able to connect to the server (even the long polling it's falling back on is not working).
Clearly this is not an issue with the add-in: Any ideas what is going on here?
I tested on Mac 10.13.4 (latest) / Powerpoint (16.12, Office 365 Home) (latest).
The same webpage works in an iframe in the latest Chrome, Firefox, Safari, IE11, so I'm thinking something wonky is going on with the embedded (Webkit) browser that Powerpoint is using on Mac.
The general request flow is:
Browser -> AWS ALB (with stickiness enabled) -> Nginx -> Node
UPDATE
Looked into this further, and having tested other pages that use Socket.IO, I think the only difference in their setups and here is the ALB.
Even with stickiness enabled, the load balancer is clearly seen (in the logs) passing traffic between all EC2s. This leads me to believe the cookie they use is either not being set or not being passed with the requests.
First of all, based on this github issue it should be possible to open a websocket.
There might be a problem with using the unsecure ws://. I know that officejs rejects all requests to http:// and forces you to use https:// with a secure certificate. So they might do the same with WebSockets and force you to use wss:// with a valid certificate.
You can test this more easily in Power Point Online with Chrome. The addin is the same but you get much better error logging in the Devtools Console (hit F12). If it's asecurity issue there should be an error message indicating it.
I had the same issue and S.Freederle is correct. Now I'm able to use socket.io via ngrok to create a secure tunnel (HttpS) to connect to my server and emit the data to my client side in office add-in.
I am relatively new to Qt and have no experience in network programming. I am trying to write a minimal TCP-client-server connection with TLS encryption in Qt using the QSslSocket class. So far I established a connection between server and client both running on localhost without encryption. For TLS encryption I found this example on gitHub: https://github.com/GuiTeK/Qt-SslServer
and followed carefully the given instructions (including the OpenSSL installation). Nevertheless I can not establish a connection between client and server (even if I set timeout to -1). The error messages for the server and client are depicted below.
Can anybody help me with that ? If someone has complete code examples in Qt for client and server which exchange data via TCP using encryption SSL encryption I would highly appreciate. I am working with QtCreator running Qt 5.5.0 MSVC2013 64 bit.
Launch Qt Creator. On Welcome screen hit "Examples" button. Then at search box write "ssl". You will see several fully working Qt examples for ssl clients and servers. This is the good place for start. Also read this link.
I started with a problem connecting to a webservice on a remote server [internal] from a custom made program.
We tested the ws from Firefox and Chrome - both latest and it connects instantly. But in IE10 (latest version for windows 2012 not R2) we get a page can't be displayed error:
Make sure the web address https://remoteserver:9443 is correct.
Look for the page with your search engine.
Refresh the page in a few minutes.
Make sure TLS and SSL protocols are enabled. Go to Tools > Internet Options > Advanced > Settings > Security
I think that IE10 and our program are using the same system libraries, and thats the reason both cannot connect to the web service. If i solve the problem with IE i presume that i could connect to the ws from the program.
The url port is custom and OK as other browsers work. IE10 can open HTTPS connection to other remote servers.
I tried:
flushing DNS setting,
reinstalling the CA certificate. Certificate is valid in chrome.
enabling TLS1.0, TLS1.1, TLS1.2, SSLv3 and SSLv2
telnet to remote server on port 9443 works
Using developer tool in IE simulated IE 9, IE8, ...
ping to remote sever works
nslookup finds the remote server
What could be the cause of this issue?
A combination of hardening for PCI DSS(securing servers) and the webservice provider not announcing protocols that were enabled was causing the issue.
Moving the server out of PCIDSS policy made the webservice connection function normally.
The changes were displayed only after restarting the server, because of registry modification.
Thanks to #Steffen Ullrich for driving me in the right direction.
I'm testing a local HTTPS (in fact SSL) server with a fake test certificate and after adding an exception in Firefox 33.0 - Ubuntu (I can see the certificate is the test certificate I've created), every time I try to open the test url on my computer on port 4431, what happens is that Firefox redirects me to another url (http://www.kataweb.it).
I am completely clueless at this point, because from the logs of my application I can see Firefox forcefully closing the TCP/IP connection to localhost and then doing what it wants, even if I've got the right certificate exception.
Of course, other browsers such as Chromium, do behave as expected (those work just fine, they just display the strike-through https symbol).
What am I doing wrong? Or is Firefox wrong?
The local test server is written in C++ using openssl (Ubuntu 14.04 x64).
Cheers,
Apparently installing version 34.0 on Ubuntu fixed this problem.
At this point not sure if the cause was a poorly installed plug-in or not...
I have a web service running under IIS7 on a server with a host header set so that it receives requests made to http://myserver1.mydomain.com.
I've set Windows INtegrated Authentication to Enabled and everything else (basic, anonymous, etc) to Disabled.
I'm testing the web service using a powershell script, and it works fine when I run it from my workstation against http://myserver1.mydomain.com
However, when I run the same exact script on the IIS server itself, I get a 401-Unauthorized message.
In addition, I've tried installing the web service on a second server, myserver2.mydomain.com. Again I can call my test script fine from BOTH my workstation and from myserver1.
So it seems the only issue is when the client is on the same box as the web server itself - somehow the windows credentials are not being passed or recognized.
I tried playing with IE settings on myserver1 (checked and unchecked 'Enable Windows Integrated Authentication', and added the URL to Local Sites). That did not seem to have an effect.
When I look at the IIS logs, I see the 401 unauthorized line but very little other information.
I see basically the same behavior when testing with IE (v9) - works from my workstation but not when IE is running on the IIS server.
I found the answer after several hours:
By default, there is something called a LoopbackCheck which will reject windows authentication if the host header used for the site does not match the local host's name. This behavior will only be seen when the client is on the local host. The check is there to defeat possible reflection attacks.
More details here:
http://support.microsoft.com/kb/896861
The kb item discusses ways to disable the Loopback check, but I ended up just switching from using host headers to ports to distinguish the different sites on the IIS server.
Thanks to those who gave assistance.
Try checking the actual credential that is being passed when you are running on the server itself. Often times you will be running on some system account that doesn't have access to the resource in question.
For example, on your box your credentials are running as...
MYDOMAIN\MYNAME
and the server will be something like...
SYSTEM\SYSTEM_ACCOUNT
and so this will fail because 'SYSTEM\SYSTEM_ACCOUNT' doesn't have credentials.
If this is the case, you can fix the problem in one of two ways.
Give 'SYSTEM\SYSTEM_ACCOUNT' access to the resource in question. Most people would avoid this strategy due to security concerns (which is why the account has no access in the first place).
Impersonate, or change the credentials of the client manually to something that does have access to the resource, 'MYDOMAIN\MYNAME' for example. This is what most people would probably go with, including myself.