[solved] HTTP error 304 - Authentication Issue

schaf · February 17, 2024, 10:20am

Hi, I got similar problems with HTTP error 304. Can you please post the final structure of both the cert-folders for me to compare. From my understanding, the “client” folder should hold the original certificates from the box

/teddycloud/certs# ls -la client
-rw-r--r-- 1 root root 1419 Feb 17 09:33 ca.der
-rw-r--r-- 1 root root 1030 Feb 17 09:33 client.der
-rw-r--r-- 1 root root 1191 Feb 17 09:33 private.der

and the “server” directory should hold the newly generated certificates for Box<->TeddyCloud communication.

/teddycloud/certs# ls -liah server/
151626 -rw-r--r-- 1 root root 1.2K Jan 29 20:52 ca-key.pem
151622 -rw-r--r-- 1 root root 1.2K Jan 29 20:52 ca-root.pem
151634 -rw-r--r-- 1 root root  787 Jan 29 20:52 ca.der
151635 -rw-r--r-- 1 root root 1.2K Jan 29 20:52 teddy-cert.pem
151636 -rw-r--r-- 1 root root 1.2K Jan 29 20:52 teddy-key.pem

Edit: I extracted the old certificates from the orginal firmware again. Size was identical but md5 different for client.der and private.der
Exchanged both certificates and everything works as expected.
I can’t reproduce what went wrong exactly. I flashed over the web interface and needed several tries to finish everything.
For anyone encountering the same issue: if you get a 304-error then the boxine-CA should to be correct, it seems to hint to an authentication issue.

schaf · February 17, 2024, 8:39am

After flashing, connection from Box to Teddycloud seems fine, but with cloud operations I get the following error

I used the certificates from the original firmware (ca.de, client.der and private.de) and put them into /certs/client/
Anything I missed?

Wurst420 · February 17, 2024, 8:46am

Hi schaf,

I don’t know why you get an 304, this should be a “not modified” http error.
One thing you can try in the webinterface, you can drop the Client Certs, it’s called: “Client certificate upload”, you may give this a try and upload your Tonieboxes Client Certs there.

schaf · February 17, 2024, 9:42am

Hi Wurst420,
I also tried uploading the client certs via the webinterface - same outcome.

Without certificates, the error is slightliy different:

INFO |server.c:0248:httpServerRequestCallback| UA=toniebox-esp32-eu/v5.230.0, ESPFW=eu/v5.230.0
INFO |handler_cloud.c:0303:handleCloudContent|  >> client requested content for rUID (..)
INFO |handler_cloud.c:0476:handleCloudContent| Serve cloud content from /v2/content/(..)
INFO |cloud_request.c:0158:web_request| Connecting to HTTP server prod.de.tbs.toys:443...
INFO |cloud_request.c:0208:web_request|   trying IP: 3.69.182.181
INFO |cloud_request.c:0036:httpClientTlsInitCallbackBase| Initializing TLS...
ERROR|cloud_request.c:0218:web_request| Failed to connect to HTTP server! Error=2

HTTP 304 just makes no sense for me. Same error when trying to get the time from the cloud.

Wurst420 · February 17, 2024, 9:44am

Do you have some kind of firewall or proxy running?

schaf · February 17, 2024, 9:55am

I don’t think so. It is a pretty standard home environment with a fritzbox. Could it be a problem that I did not assign a hostname to the Teddycloud Server? During the flash, the web-frontend suggested to use the IP.

Only other thing I noticed ist some errors during startup of the server:

INFO |toniesJson.c:0057:tonies_update| Updating tonies.json from GitHub...
INFO |cloud_request.c:0158:web_request| Connecting to HTTP server raw.githubusercontent.com:443...
INFO |cloud_request.c:0208:web_request|   trying IP: 185.199.108.133
INFO |cloud_request.c:0036:httpClientTlsInitCallbackBase| Initializing TLS...
cyclone/cyclone_crypto/cipher/aes.c:260:47: runtime error: left shift of 238 by 24 places cannot be represented in type 'int'
cyclone/cyclone_crypto/cipher/aes.c:268:55: runtime error: left shift of 204 by 24 places cannot be represented in type 'int'
cyclone/cyclone_crypto/cipher/aes.c:395:34: runtime error: left shift of 228 by 24 places cannot be represented in type 'int'
INFO |cloud_request.c:0071:httpClientTlsInitCallbackBase| Initializing TLS done
cyclone/cyclone_crypto/cipher/aes.c:385:34: runtime error: left shift of 222 by 24 places cannot be represented in type 'int'
cyclone/cyclone_crypto/cipher/aes.c:390:34: runtime error: left shift of 174 by 24 places cannot be represented in type 'int'
src/cyclone/cyclone_crypto/mpi.c:792:48: runtime error: left shift of 141 by 24 places cannot be represented in type 'int'
cyclone/cyclone_crypto/cipher/aes.c:400:34: runtime error: left shift of 203 by 24 places cannot be represented in type 'int'
INFO |cloud_request.c:0308:web_request| HTTP code: 200

Edit: I will try to continue in Teddycloud Error=537 (ESP32) because there someone encountered error 304 as well.

Wurst420 · February 18, 2024, 1:12pm

Could you please post your solution when you mark this thread [solved], so others can participate more easy from your findings.

Duselbauer · February 18, 2024, 1:40pm

Hello @schaf,

here are the both cert folders after fixing my issue:

certs/server:

certs/client

Clear recommendation from my end:

Ensure you still have the very first “read” backup from your tonibox which didn’t get modified.
Create a new container with new folder mounts
Start the process as shown on the blog post teddyCloud | Toniebox Hacking
After sucessful read of the firmware, rename the just read firmware file in /teddycloud/data/firmware to ESP32.bin.broken because it holds the patched files already. They wouldn’T work.
Copy your very first backup file from step 1. and copy it to the /teddycloud/data/firmware folder.
Dump the certificates as described in tutorial from the backup you copied to the firmware folder.
Follow the tutorial from here as ususal (patching/writing fiile). You should have three files in your ./firmware folder:
restart the container and it should work as expected

It makes no difference if you used an IP or hostname. I used for example an IP address but definitely prefer a DNS name on the long run.

Last but not least, try to use a MACVLAN driver for network instead. Maybe your Host, has an internal firewall which blocks traffic per default. Windows firewall shouldn’T be a problem.

Good luck!