iCloud SSL issue again

[dk8pn (Willibald Konrath)]

Hello all,
works out for me and sounds sensible.

Best regards,

Willi

[Hawkeye (Erwin)]

@maihacke

Automatically downloading and thereby accepting the TLS certificate is not a good idea. As you already this setup is vulnerable to MITM attacks.
I saw that the binding includes the server certificate but not Apples CA certificate. So when Apple issues a new certificate things broke. If it is true that Apple does not change his CA certificate often it would be enough to include this in the binding.
To test this a created a new jar where I replaced the former server certificate with Apple current CA certificate:

drive.google.com

org.openhab.binding.icloud-2.5.2-SNAPSHOT-CA.jar

Google Drive file.

First tests look good. Fell free to test it.

Thanks for your input! I agree with the security hole that was in the previous snapshots, I removed these from google drive. I updated the code today to verify the certificate against the certificate chain, up to the root CA certificate (there’s an Apple Server CA that expires years before the root CA certificate).

Did you use the server CA or the root CA?

My latest snapshot (including certificate verification) can be found here: https://drive.google.com/file/d/10227PoeE4Dh4ZF2PCTH9MyMDeH_FKsyS/view?usp=sharing

Works for me locally

[domparisi (Domenic Parisi)]

I’ve installed this snapshot on openhab 2.4.0 and am getting the following message:

bundle org.eclipse.smarthome.io.net:0.10.0.oh240 (118)[org.eclipse.smarthome.io.net.http.internal.ExtensibleTrustManager(122)] : The addTlsCertificateProvider method has thrown an exception
java.lang.NoClassDefFoundError: org/eclipse/smarthome/io/net/http/TrustAllTrustMananger

Caused by: java.lang.ClassNotFoundException: org.eclipse.smarthome.io.net.http.TrustAllTrustMananger cannot be found by org.openhab.binding.icloud_2.5.2.202001301255

Looks like I’m missing a dependency but not sure how to install it. Appreciate any advice.

[Hawkeye (Erwin)]

Is that when using my snapshot or @maihacke his snapshot?

[domparisi (Domenic Parisi)]

I get the error when using maihacke’s snapshot. If I use yours nothing happens in openhab. I get no error messages and none of my apple devices work. The jar is in the ‘addons’ folder and when I do a 'bundle:list: in the console the jar is listed however the state is ‘waiting’ I’ve rebooted the system and left it alone for around 20 minutes and the binding is still waiting.

[Hawkeye (Erwin)]

org.openhab.binding.icloud-2.5.2-SNAPSHOT.jar

Can you please try this snapshot? It turns out that we can simply get this binding more stable by using the root certificate (thanks for the pointer @maihacke!!!) , instead of the server certificate. I’ve tried this snapshot, and it works locally. It’s a much simpler change actually (see https://github.com/openhab/openhab-addons/pull/6948 for the new pull request)

[domparisi (Domenic Parisi)]

Thanks Hawkeye! It worked!

[Hawkeye (Erwin)]

Would be good if more people could check this latest snapshot; it’s already been approved for merging but would be good to hear if it’s working for more people before actually merging

[HarryS1 (Harald Schlangmann)]

It looks like it is working for me. openHAB2.5.2 stable plus iCloud binding snapshot posted. It doesn’t throw exceptions and connects successfully.

[Taurus (NR)]

tested it on one 2.4 and one 2.5 installation and it works! Thanks.

in a first attempt I forgot to change the owner of the jar file to openhab after puting it into the /user/share/openhab2/addons folder on my rpi (just in case someone else is wondering why the addon is not being installed as well )

[Hawkeye (Erwin)]

The pull request has been merged (thanks @J-N-K), so it’ll be in the next release

[ds1664 (David Staples)]

Being a newbie to this, I cant make this work on a pi, i have changed the owner to openhab, rebooted but i still get errors. I am not sure i have the correct jar file, bundle:list report :-

2.5.2.202002010827

Have i got the correct jar file ?

[Taurus (NR)]

did you follow there steps?

1. Donwload the jar file from google drive
2. make sure that in /user/share/openhab/addons is not an old jar file (rm it otherwise)
3. copy the file to /user/share/openhab/addons
4. chown openhab:openhab icouldFileName.jar (maybe it is allready check with “ls -la”)
5. start the console with: “sudo openhab-cli console”
6. bundle:list and note the number from the icloud addon
7. bundle:uninstall “number of the addon”
8. with command logout quit the console
9. sudo service stop openhab2
10. sudo service start openhab2

[ds1664 (David Staples)]

Hi, thanks for that unfortunately I had done all that, twice !

error im getting seems to be something about a certificate

Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Any idea what i have forgotten ?

[Taurus (NR)]

gson is installed, right?

bundle:install https://repo1.maven.org/maven2/com/google/code/gson/gson/2.8.5/gson-2.8.5.jar

[ds1664 (David Staples)]

Great thanks didn’t see that requirement Having installed that everything now works

[baobao]

Thanks for the great work.
Everything now working flawlessly.

[Gens (Jens)]

Still not working reliable. I have installed the 2.5.2 Snapshot and after restarting it works for some hours. But then it is not updating datas anymore despite being shown as online. Disabling and enabling the device or ICloud it stays in the INITIALIZING mode and the Log Viewer shows:
[WARN ] [core.thing.internal.ThingManagerImpl] - Initializing handler for thing ‘icloud:device:xxxxxx:xxxxxx’ takes more than 5000ms. Anybody with the same issue and/or idea?

[Bredmich (Michael)]

Didn´t had any errors today after installing this build!
Thanks for your work.

[Brody (Anders Broberg)]

Installed, restarted openHAB and my iCloud connection returned without a single error in the log so far. Awesome work guys!