[Flightgear-devel] TerraSync via https: Testers needed

[Torsten Dreyer]

Hi,

just a few days ago the world celebrated the safer internet day[1] - more
or less.
To support the strive towards a safer FlightGear, James and I have just
found out that our beloved curl based terrasync client seems to support
https:// right out of the box.

I'd like to have some more people test the https protocol, especially on
OSX and Windows and report their experience.

Testing is easy: just use this command line switch for starting fgfs:
--prop:string:/sim/terrasync/http-server=https://dream.t3r.de/fgscenery
It will keep your previously sync'ed files and should work as before but
use the encrypted protocol.

Torsten

[1] https://www.saferinternetday.org/

[Paterson, Keith]

Hi,

a quick test of terramaster brought up a potential problem.
https://fgfs.goneabitbursar.com/terrascenery/ leads to a Certificate
without root and mismatching hostname. I won't be able to follow that
path with terramaster unless the certificates are trusted by java. There
are ways round it, but that would put a great strain on the user.

Besides that. Https without proper certificates and checking of hostname
validity doesn't help IMO

Keith (PortreeKid)

[Torsten Dreyer]

> Hi,
>
> a quick test of terramaster brought up a potential problem.
> https://fgfs.goneabitbursar.com/terrascenery/ leads to a Certificate
> without root and mismatching hostname. I won't be able to follow that
> path with terramaster unless the certificates are trusted by java. There
> are ways round it, but that would put a great strain on the user.
>
Thanks for the quick response.


>
> Besides that. Https without proper certificates and checking of hostname
> validity doesn't help IMO
>
Yes, thats why I asked to test with the https://dream.t3r.de/fgscenery
mirror. It has a valid certificate signed by letsencrypt.

Could you test again with that mirror?

Torsten

[Paterson, Keith]

Am 12.02.2017 um 11:42 schrieb Torsten Dreyer:

>
> Hi,
>
> a quick test of terramaster brought up a potential problem.
> https://fgfs.goneabitbursar.com/terrascenery/ leads to a Certificate
> without root and mismatching hostname. I won't be able to follow that
> path with terramaster unless the certificates are trusted by java.
> There
> are ways round it, but that would put a great strain on the user.
>
> Thanks for the quick response.
It's saturday ;-) And I am al
>
> Besides that. Https without proper certificates and checking of
> hostname
> validity doesn't help IMO
>
> Yes, thats why I asked to test with the https://dream.t3r.de/fgscenery
> mirror. It has a valid certificate signed by letsencrypt.
>
> Could you test again with that mirror?
Done. JDK 1.8 is fine. JDK 1.7 (71) seems to be missing the root
certificate. I could possibly ship terramaster with a custom truststore
to circumvent this problem.
After some googling I found :

Java: only works with 7u111+ and 8u101+ as the "DST Root CA X3" was
added with these versions on 2016-07-19
(seehttps://bugs.openjdk.java.net/browse/JDK-815475710133)

So all systems go from me.

Keith

[p***@t-online.de]

Hi Thorsten,



I use the Version 2016.4.4. Fetch with Terramaster-tool (see
[Flightgear-devel] Scenery Layers (for osm2city, improved from Keith)) UK
and Ireland Scenery (http-based).The download speed is lower than with
svn-based data.


Logically I check the performance without showing osm2city. I noticed that
a user of FlightGear in the old version can easily use. Framerate is higher
than svn-based scenery. I'm looking forward to the 2017.1 version. I have
not been using Repos's for a long time. After some difficulties, which
almost drove me mad.

Conclusion: You made a good job. I hope that my airfields buildings I
designed not influenced by the osm2City project.

By the way. From 2017.1, please create the console for the output of the
placed building data. Customized ways to go requires ease of work in
building management.

Your
Thomas Polzer
(scenemodels autor)





-----Original-Nachricht-----



Betreff: [Flightgear-devel] TerraSync via https: Testers needed



Datum: 2017-02-12T10:26:01+0100



Von: "Torsten Dreyer" <***@t3r.de>



An: "FlightGear developers discussions"
<flightgear-***@lists.sourceforge.net>





Hi,

just a few days ago the world celebrated the safer internet day[1] - more
or less.
To support the strive towards a safer FlightGear, James and I have just
found out that our beloved curl based terrasync client seems to support
https:// right out of the box.

I'd like to have some more people test the https protocol, especially on
OSX and Windows and report their experience.

Testing is easy: just use this command line switch for starting fgfs:
--prop:string:/sim/terrasync/http-server=https://dream.t3r.de/fgscenery
<https://dream.t3r.de/fgscenery>
It will keep your previously sync'ed files and should work as before but
use the encrypted protocol.

Torsten

[1] https://www.saferinternetday.org/ <https://www.saferinternetday.org/>


[w***@gmail.com]

On 02/12/2017 04:23 AM, Torsten Dreyer wrote:
> Testing is easy: just use this command line switch for starting fgfs:
> --prop:string:/sim/terrasync/http-server=https://dream.t3r.de/fgscenery It
> will keep your previously sync'ed files and should work as before but use
> the encrypted protocol.

this should work with the SF servers, too, right??

# for now, force the terrasync server to sourceforge instead of automatic
#--prop:/sim/terrasync/http-server=automatic
# switch to https instead of plain old http
#--prop:/sim/terrasync/http-server=http://flightgear.sourceforge.net/scenery
--prop:/sim/terrasync/http-server=https://flightgear.sourceforge.net/scenery

i've been doing this specifically to keep my FG using the same server as
terrasync.py so as to avoid problems or complications where the mirrors may get
out of sync... i've been using the default in the script but can easily add the
--url option to point to the https side just as i'll adjust my prop string as
above in the FGFS --launcher...

since i'm on linux this may not be a very much needed test for this but i can at
least do this small part...


[edit]

hummm... i know i do SF via https in my browser... so i just tried the above
scenery url in FF but told me it couldn't connect...

https://sourceforge.net/ works
http://flightgear.sourceforge.net/ works
https://flightgear.sourceforge.net/ fails

color me confused at the moment... maybe there's a switch to flip in the
configuration at SF?


--
NOTE: No off-list assistance is given without prior approval.
*Please keep mailing list traffic on the list* unless
private contact is specifically requested and granted.

[Torsten Dreyer]

>
>
> this should work with the SF servers, too, right??
>
Nope. Currently, flightgear.sourceforge.net is http only.

>
> https://sourceforge.net/ works
> http://flightgear.sourceforge.net/ works
> https://flightgear.sourceforge.net/ fails
>
Sure, see above.

Anyway, thanks for the feedback.

Torsten

[Ron H]

I am getting the following in the fgfs.log.


general:3:E:\Projects\fgmeta\flightgear\src\Main\positioninit.cxx:203:Attempting to set starting position from airport code CYXU heading 0
event:3:E:\Projects\fgmeta\simgear\simgear\timing\sg_time.cxx:84:Reading timezone info from: Path "E:/Projects/fgmeta/data/Timezone/zone.tab"
view:3:E:\Projects\fgmeta\flightgear\src\Viewer\splash.cxx:459:Splash screen progress creating-subsystems
general:3:E:\Projects\fgmeta\flightgear\src\Main\fg_init.cxx:695:Creating Subsystems
general:3:E:\Projects\fgmeta\flightgear\src\Main\fg_init.cxx:696:========== ==========
input:3:E:\Projects\fgmeta\simgear\simgear\scene\material\matlib.cxx:74:Reading materials from E:/Projects/fgmeta/data/Materials/regions/materials.xml
terrasync:3:E:\Projects\fgmeta\simgear\simgear\scene\tsync\terrasync.cxx:592:sync of https://dream.t3r.de/fgscenery/Models started, queue size is 26
io:4:E:\Projects\fgmeta\simgear\simgear\io\HTTPClient.cxx:201:CURL Result:1 Unsupported protocol
io:4:E:\Projects\fgmeta\simgear\simgear\io\HTTPRequest.cxx:333:HTTP request: set failure:1 reason Unsupported protocol
terrasync:4:E:\Projects\fgmeta\simgear\simgear\io\HTTPRepository.cxx:1103:Failed to get root of repo:https://dream.t3r.de/fgscenery/Models 2
terrasync:3:E:\Projects\fgmeta\simgear\simgear\scene\tsync\terrasync.cxx:687:Failed to sync'Models'
terrasync:3:E:\Projects\fgmeta\simgear\simgear\scene\tsync\terrasync.cxx:592:sync of https://dream.t3r.de/fgscenery/Airports/L started, queue size is 25
io:4:E:\Projects\fgmeta\simgear\simgear\io\HTTPClient.cxx:201:CURL Result:1 Unsupported protocol
io:4:E:\Projects\fgmeta\simgear\simgear\io\HTTPRequest.cxx:333:HTTP request: set failure:1 reason Unsupported protocol
terrasync:4:E:\Projects\fgmeta\simgear\simgear\io\HTTPRepository.cxx:1103:Failed to get root of repo:https://dream.t3r.de/fgscenery/Airports/L 2
terrasync:3:E:\Projects\fgmeta\simgear\simgear\scene\tsync\terrasync.cxx:687:Failed to sync'Airports/L'
terrasync:3:E:\Projects\fgmeta\simgear\simgear\scene\tsync\terrasync.cxx:592:sync of https://dream.t3r.de/fgscenery/Airports/K started, queue size is 24
io:4:E:\Projects\fgmeta\simgear\simgear\io\HTTPClient.cxx:201:CURL Result:1 Unsupported protocol

Seems not to be working for me.

Simgear
[e21ad4]<https://sourceforge.net/p/flightgear/simgear/ci/e21ad4b5c189022d64483bdbdb321d09a90f47bd/>
FlightGear
[8f24de]<https://sourceforge.net/p/flightgear/flightgear/ci/8f24de831d5b9486e6820f1ccbb6ce2d45054778/>
Ron




________________________________
From: Torsten Dreyer <***@t3r.de>
Sent: February 12, 2017 4:23 AM
To: FlightGear developers discussions
Subject: [Flightgear-devel] TerraSync via https: Testers needed

Hi,

just a few days ago the world celebrated the safer internet day[1] - more or less.
To support the strive towards a safer FlightGear, James and I have just found out that our beloved curl based terrasync client seems to support https:// right out of the box.

I'd like to have some more people test the https protocol, especially on OSX and Windows and report their experience.

Testing is easy: just use this command line switch for starting fgfs:
--prop:string:/sim/terrasync/http-server=https://dream.t3r.de/fgscenery
It will keep your previously sync'ed files and should work as before but use the encrypted protocol.

Torsten

[1] https://www.saferinternetday.org/
[https://www.saferinternetday.org/bikportal-theme/images/custom/color_schemes/sid/logo_sid.png]<https://www.saferinternetday.org/>

Safer Internet Day - Home<https://www.saferinternetday.org/>
www.saferinternetday.org
Safer Internet Day (SID) is organised by Insafe in February of each year to promote safer and more responsible use of online technology and mobile phones, especially ...

[Florent Rougon]

Hi,

Ron H <***@hotmail.com> wrote:

> io:4:E:\Projects\fgmeta\simgear\simgear\io\HTTPRequest.cxx:333:HTTP request:
> set failure:1 reason Unsupported protocol

It's a wild guess, but I imagine curl has to be built with something
like openSSL or gnutls to provide HTTPS support, and maybe the Windows
builds/your build don't/doesn't have this.

Regards

--
Florent

[Ron H]

I tested my own build and the windows -nightly build - both had the same errors.

Ron
________________________________
From: Florent Rougon <***@free.fr>
Sent: February 13, 2017 2:43 AM
To: flightgear-***@lists.sourceforge.net
Subject: Re: [Flightgear-devel] TerraSync via https: Testers needed

Hi,

Ron H <***@hotmail.com> wrote:

> io:4:E:\Projects\fgmeta\simgear\simgear\io\HTTPRequest.cxx:333:HTTP request:
> set failure:1 reason Unsupported protocol

It's a wild guess, but I imagine curl has to be built with something
like openSSL or gnutls to provide HTTPS support, and maybe the Windows
builds/your build don't/doesn't have this.

Regards

--
Florent

[James Turner]

> On 12 Feb 2017, at 23:43, Florent Rougon <***@free.fr> wrote:
>
>>
>> io:4:E:\Projects\fgmeta\simgear\simgear\io\HTTPRequest.cxx:333:HTTP request:
>> set failure:1 reason Unsupported protocol
>
> It's a wild guess, but I imagine curl has to be built with something
> like openSSL or gnutls to provide HTTPS support, and maybe the Windows
> builds/your build don't/doesn't have this.

Right, we need to add CMake checks to ensure Curl was compiled with SSL support. I believed (maybe I was wrong) that our windows-3rd-party build of Curl did include support, and I would assume the system libCurl on Mac and Linux would also include support, but maybe that’s an optimistic assumption.

Kind regards,
James

[Torsten Dreyer]

>
> Right, we need to add CMake checks to ensure Curl was compiled with SSL
> support. I believed (maybe I was wrong) that our windows-3rd-party build of
> Curl did include support, and I would assume the system libCurl on Mac and
> Linux would also include support, but maybe that’s an optimistic assumption.
>
> Yeah - looks like the SSL support is missing at least on Windows.
This puts the SSLed terrasync back into the backlog until "someone" gets
us a new libcurl.

Torsten

[James Turner]

> On 13 Feb 2017, at 08:16, Torsten Dreyer <***@t3r.de> wrote:
>
> Yeah - looks like the SSL support is missing at least on Windows.
> This puts the SSLed terrasync back into the backlog until "someone" gets us a new libcurl.

I’m on the road for the next seven days, will rebuild the libCurl with SSL support for Windows then. Although I really thought I had already done that option, oh well.

Kind regards,
James

[Torsten Dreyer]

Have a safe trip. This is not a pressing issue and it can wait.

Torsten

James Turner <***@mac.com> schrieb am Mo., 13. Feb. 2017 um 21:31 Uhr:

>
> > On 13 Feb 2017, at 08:16, Torsten Dreyer <***@t3r.de> wrote:
> >
> > Yeah - looks like the SSL support is missing at least on Windows.
> > This puts the SSLed terrasync back into the backlog until "someone"
> gets us a new libcurl.
>
> I’m on the road for the next seven days, will rebuild the libCurl with SSL
> support for Windows then. Although I really thought I had already done that
> option, oh well.
>
> Kind regards,
> James
>
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
> _______________________________________________
> Flightgear-devel mailing list
> Flightgear-***@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/flightgear-devel
>

[Florent Rougon]

Hi,

Torsten Dreyer <***@t3r.de> wrote:

> I'd like to have some more people test the https protocol, especially on
> OSX and Windows and report their experience.
>
> Testing is easy: just use this command line switch for starting fgfs:
> --prop:string:/sim/terrasync/http-server=https://dream.t3r.de/fgscenery

The scenery appears here on Linux (tried at CYVR and FNLU), but I also
have “Failed to get root of repo” messages in the console output. Log
for FNLU with:

--log-class=terrasync
--log-level=info
--prop:string:/sim/terrasync/http-server=https://dream.t3r.de/fgscenery

here:

http://pastebin.com/PkR8N6s1

This was with:

SimGear e21ad4b5 Sun, 12 Feb 2017 23:55:03 +0100
FlightGear 8f24de831 Sun, 12 Feb 2017 21:30:51 +0100
FGData 347eb3d7b Wed, 8 Feb 2017 10:11:27 +0100
FGAddon r2415 2017-02-07 17:04:56 +0100 (Tue, 07 Feb 2017)
libopenscenegraph100v5:amd64 3.2.3+dfsg1-2+b2

Regards

--
Florent

[Alan Teeder]

Also getting "failed to get root of repo" with windows here.

Log file has
terrasync:3:C:\FlightGear\simgear\simgear\scene\tsync\terrasync.cxx:592:sync
of https://dream.t3r.de/fgscenery/Models started, queue size is 26
io:4:C:\FlightGear\simgear\simgear\io\HTTPClient.cxx:201:CURL Result:60 Peer
certificate cannot be authenticated with given CA certificates
io:4:C:\FlightGear\simgear\simgear\io\HTTPRequest.cxx:333:HTTP request: set
failure:60 reason Peer certificate cannot be authenticated with given CA
certificates
terrasync:4:C:\FlightGear\simgear\simgear\io\HTTPRepository.cxx:1098:Failed
to get root of repo:https://dream.t3r.de/fgscenery/Models 2
terrasync:3:C:\FlightGear\simgear\simgear\scene\tsync\terrasync.cxx:687:Failed
to sync'Models'

Alan