SSL issue on Android 9 Google Pixel One

问题

I am trying to perform HTTPS requests to a host 10.10.10.1 from Android host with 10.10.10.2 in network without Internet connection - only WiFi 2 peers AP and Android 9 Google Pixel One device.

I've created network_security_config.xml with my cert that is self-signed and has CN=10.10.10.1 and SAN= DNS: 10.10.10.1 PI: 10.10.10.1.

<?xml version="1.0" encoding="utf-8"?>
  <network-security-config>
    <base-config cleartextTrafficPermitted="true">
      <trust-anchors>
        <certificates src="system" />
        <certificates src="user" />
        <certificates src="@raw/zone"/>
      </trust-anchors>
    </base-config>
</network-security-config>

I don't receive verification error and observe successful requests incoming to server - data are HTTP request, decrypted and shown on the server log. But the server can't send data back! It sends, but for some reason these data are not being accepted by the Android phone - just ignored.

I see packets are going from the server to the phone and the server repeatedly retries to shutdown SSL socket until error or success (I made such behavior intentionally during surveying) - here is Wireshark dump from WiFi air:

Here is my request from AsyncTask

   protected String doInBackground(String... params) {
        StringBuilder result = new StringBuilder();
        try {
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            InputStream caInput = new BufferedInputStream(MainActivity.this.getResources().openRawResource(R.raw.zone));

            Certificate ca = cf.generateCertificate(caInput);

            String keyStoreType = KeyStore.getDefaultType();
            KeyStore keyStore = KeyStore.getInstance(keyStoreType);
            keyStore.load(null, null);
            keyStore.setCertificateEntry("ca", ca);

            String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
            TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
            tmf.init(keyStore);

            SSLContext ctx = SSLContext.getInstance("TLS");
            ctx.init(null, tmf.getTrustManagers(), null);

            URL url = new URL("https://10.10.10.1/connect");
            HttpsURLConnection conn = (HttpsURLConnection) url.openConnection();
            conn.setSSLSocketFactory(ctx.getSocketFactory());

            conn.setRequestProperty("param1", params[0]);
            conn.setRequestProperty("param2", params[1]);
            conn.setRequestMethod("POST");

            conn.setDoOutput(true);
            conn.setDoInput(true);

            mInputStream = conn.getInputStream();
            byte[] buffer = new byte[1024];
            ByteArrayOutputStream _buf = new ByteArrayOutputStream();
            int l;
            BufferedInputStream bufin = new BufferedInputStream(mInputStream);
            while ((l = bufin.read(buffer,0,1024)) != -1) {
                _buf.write(buffer, 0, l);
                String rec = _buf.toString("UTF-8");
                Log.d("MAIN", "Read: " + rec);
                result.append(rec);
            }
            Log.d("MAIN", "Read finished: " + result.toString());

        } catch (Exception e) {
            e.printStackTrace();
        }
        return result.toString();
    }

I suspect that Android 9 Network Security does block traffic somehow. I tried to use SSLSockets, change port from 443 to e.g. 1234 - no luck.

In fact my app is being created with Qt and firstly I used Qt stuff, but having no luck - I made fallback to Android Java code within my MainActivity, that I call via JNI from Qt code. Result is the same and I have no ideas more...

Where to dig?

UPD1

When the self-signed certificate is generated with SAN containing DNS:10.10.10.1 only (without IP:10.10.10.1) SSL fails with warnings:

W System.err: javax.net.ssl.SSLPeerUnverifiedException: Hostname 10.10.10.1 not verified:
W System.err:     certificate: sha1/gyr2GOhy5lA+ZAHEzh0E2SBEgx0=
W System.err:     DN: CN=10.10.10.1,O=Some ltd.,L=Knoxville,ST=TN,C=US
W System.err:     subjectAltNames: [10.10.10.1]
W System.err:   at com.android.okhttp.internal.io.RealConnection.connectTls(RealConnection.java:201)
W System.err:   at com.android.okhttp.internal.io.RealConnection.connectSocket(RealConnection.java:149)
W ...

And conversely, with SAN IP:10.10.10.1 (without DNS: 10.10.10.1) - works as before - session established, data transferred to server and decrypted, but responses from server to client just ignored by client.

UPD2

I've also tried to use domain name some.device for the 10.10.10.1 device and issued certificate with CN and SAN DNS = some.device. It's resolved by Android 9 client, data is being sent successfully but response is still not being accepting.

Looks like Android bug.

回答1:

After making additional surveying: 1. Some set of Android devices (builds), including Pixel 1, does not accept TCP session that was not finalized by mutual [FIN,ACK] and received data is not delivered to upper level of stack. Also data may not be accepted if TCP stream was not solid, with many retransmissions and Seq changing. 2. In case of using Qt - Android Network Security Configuration does not affect on communications. 3. This is not TLS related issue.

来源：https://stackoverflow.com/questions/53798484/ssl-issue-on-android-9-google-pixel-one