[iOS]how to use NSURLConnection with a private IP address?
I have an iOS app on A (iPhone), there is a computer B in the same network as A is in, and there is also a remote server C on the Internet. Originally, through NSURLConnection, I can call GET https://domain_of_C/resources directly from the app to get some resources on C. Now the requirement is that I need to first call B at 192.168.1.2 (B's IP address) by:GET https://192.168.1.2/resources, and then B should help A forward everything to C, as well as getting the response back from C to A. B should blindly pass through the packets, including the SSL packets.
Below is a code snippet:
NSURL *newUrl = [NSURL URLWithString:@"https://192.168.1.2/resources"];
NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:newUrl];
[NSURLConnection sendAsynchronousRequest:request queue:[[NSOperationQueue alloc] init] completionHandler:^(NSURLResponse *response, NSData *data, NSError *connectionError)
I am getting the following error:
2018-11-26 10:10:50.666321-0500 [72744:1796043] TIC SSL Trust Error [3:0x600002c98180]: 3:0
2018-11-26 10:10:50.667535-0500 [72744:1796043] NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9843)
2018-11-26 10:10:50.667641-0500 [72744:1796043] Task <68E602A9-1FF8-4A60-AE72-191AA1D8D730>.<0> HTTP load failed (error code: -1202 [3:-9843])
However, if I use http://192.168.1.2/resources as the URL(HTTP here, not HTTPS), it works, meaning that I can successfully access the resources on the remote server from A. The design of B is that it should blindly pass through everything to C, including SSL session, which means that I don't hope to deal with SSL certificates at all.
I don't exactly know why iOS is throwing error in this case but I want to know if there is any way that i can avoid this error.
ios ssl nsurlconnection
asked Nov 26 '18 at 15:49
peakpeaktanpeakpeaktan
11
add a comment |
I have an iOS app on A (iPhone), there is a computer B in the same network as A is in, and there is also a remote server C on the Internet. Originally, through NSURLConnection, I can call GET https://domain_of_C/resources directly from the app to get some resources on C. Now the requirement is that I need to first call B at 192.168.1.2 (B's IP address) by:GET https://192.168.1.2/resources, and then B should help A forward everything to C, as well as getting the response back from C to A. B should blindly pass through the packets, including the SSL packets.
Below is a code snippet:
NSURL *newUrl = [NSURL URLWithString:@"https://192.168.1.2/resources"];
NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:newUrl];
[NSURLConnection sendAsynchronousRequest:request queue:[[NSOperationQueue alloc] init] completionHandler:^(NSURLResponse *response, NSData *data, NSError *connectionError)
I am getting the following error:
2018-11-26 10:10:50.666321-0500 [72744:1796043] TIC SSL Trust Error [3:0x600002c98180]: 3:0
2018-11-26 10:10:50.667535-0500 [72744:1796043] NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9843)
2018-11-26 10:10:50.667641-0500 [72744:1796043] Task <68E602A9-1FF8-4A60-AE72-191AA1D8D730>.<0> HTTP load failed (error code: -1202 [3:-9843])
However, if I use http://192.168.1.2/resources as the URL(HTTP here, not HTTPS), it works, meaning that I can successfully access the resources on the remote server from A. The design of B is that it should blindly pass through everything to C, including SSL session, which means that I don't hope to deal with SSL certificates at all.
I don't exactly know why iOS is throwing error in this case but I want to know if there is any way that i can avoid this error.
ios ssl nsurlconnection
asked Nov 26 '18 at 15:49
peakpeaktanpeakpeaktan
11
HTTPS URLs with only IP addresses and not hostnames, are not a good idea. First it will be difficult (but not completely impossible) to get proper X.509 certificates with an IP address in them instead of a domain name. Then at the OS/webserver level it means you are wasting a given IP for only one HTTPS service as you will not be able to have others due to the lack of SNI. As for generic TCP/TLS proxy, have a look at HAProxy, nginx, or pound.
– Patrick Mevzek
Nov 26 '18 at 16:18
B can't be "blindly passing everything...including the SSL session" since you have opened an https connection to B. To get the pass through you described, B would need to be acting as an http proxy (using theCONNECTdirective) or acting as a Socks proxy (which again would require specific socksified code in your iOS app). You are getting -1202 which indicates that the certificate from B is not trusted. If B did somehow use the same certificate as A then would would get a certificate subject error since what you have is a MITM. TLS is designed to prevent what you are doing
– Paulw11
Nov 26 '18 at 18:49
add a comment |
I have an iOS app on A (iPhone), there is a computer B in the same network as A is in, and there is also a remote server C on the Internet. Originally, through NSURLConnection, I can call GET https://domain_of_C/resources directly from the app to get some resources on C. Now the requirement is that I need to first call B at 192.168.1.2 (B's IP address) by:GET https://192.168.1.2/resources, and then B should help A forward everything to C, as well as getting the response back from C to A. B should blindly pass through the packets, including the SSL packets.
Below is a code snippet:
NSURL *newUrl = [NSURL URLWithString:@"https://192.168.1.2/resources"];
NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:newUrl];
[NSURLConnection sendAsynchronousRequest:request queue:[[NSOperationQueue alloc] init] completionHandler:^(NSURLResponse *response, NSData *data, NSError *connectionError)
I am getting the following error:
2018-11-26 10:10:50.666321-0500 [72744:1796043] TIC SSL Trust Error [3:0x600002c98180]: 3:0
2018-11-26 10:10:50.667535-0500 [72744:1796043] NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9843)
2018-11-26 10:10:50.667641-0500 [72744:1796043] Task <68E602A9-1FF8-4A60-AE72-191AA1D8D730>.<0> HTTP load failed (error code: -1202 [3:-9843])
However, if I use http://192.168.1.2/resources as the URL(HTTP here, not HTTPS), it works, meaning that I can successfully access the resources on the remote server from A. The design of B is that it should blindly pass through everything to C, including SSL session, which means that I don't hope to deal with SSL certificates at all.
I don't exactly know why iOS is throwing error in this case but I want to know if there is any way that i can avoid this error.
ios ssl nsurlconnection
asked Nov 26 '18 at 15:49
peakpeaktanpeakpeaktan
11
I have an iOS app on A (iPhone), there is a computer B in the same network as A is in, and there is also a remote server C on the Internet. Originally, through NSURLConnection, I can call GET https://domain_of_C/resources directly from the app to get some resources on C. Now the requirement is that I need to first call B at 192.168.1.2 (B's IP address) by:GET https://192.168.1.2/resources, and then B should help A forward everything to C, as well as getting the response back from C to A. B should blindly pass through the packets, including the SSL packets.
Below is a code snippet:
NSURL *newUrl = [NSURL URLWithString:@"https://192.168.1.2/resources"];
NSMutableURLRequest *request = [NSMutableURLRequest requestWithURL:newUrl];
[NSURLConnection sendAsynchronousRequest:request queue:[[NSOperationQueue alloc] init] completionHandler:^(NSURLResponse *response, NSData *data, NSError *connectionError)
I am getting the following error:
2018-11-26 10:10:50.666321-0500 [72744:1796043] TIC SSL Trust Error [3:0x600002c98180]: 3:0
2018-11-26 10:10:50.667535-0500 [72744:1796043] NSURLSession/NSURLConnection HTTP load failed (kCFStreamErrorDomainSSL, -9843)
2018-11-26 10:10:50.667641-0500 [72744:1796043] Task <68E602A9-1FF8-4A60-AE72-191AA1D8D730>.<0> HTTP load failed (error code: -1202 [3:-9843])
However, if I use http://192.168.1.2/resources as the URL(HTTP here, not HTTPS), it works, meaning that I can successfully access the resources on the remote server from A. The design of B is that it should blindly pass through everything to C, including SSL session, which means that I don't hope to deal with SSL certificates at all.
I don't exactly know why iOS is throwing error in this case but I want to know if there is any way that i can avoid this error.
ios ssl nsurlconnection
ios ssl nsurlconnection
asked Nov 26 '18 at 15:49
peakpeaktanpeakpeaktan
11
asked Nov 26 '18 at 15:49
peakpeaktanpeakpeaktan
11
asked Nov 26 '18 at 15:49
peakpeaktanpeakpeaktan
11
asked Nov 26 '18 at 15:49
peakpeaktanpeakpeaktan
11
asked Nov 26 '18 at 15:49
peakpeaktanpeakpeaktan
11
11
HTTPS URLs with only IP addresses and not hostnames, are not a good idea. First it will be difficult (but not completely impossible) to get proper X.509 certificates with an IP address in them instead of a domain name. Then at the OS/webserver level it means you are wasting a given IP for only one HTTPS service as you will not be able to have others due to the lack of SNI. As for generic TCP/TLS proxy, have a look at HAProxy, nginx, or pound.
– Patrick Mevzek
Nov 26 '18 at 16:18
B can't be "blindly passing everything...including the SSL session" since you have opened an https connection to B. To get the pass through you described, B would need to be acting as an http proxy (using theCONNECTdirective) or acting as a Socks proxy (which again would require specific socksified code in your iOS app). You are getting -1202 which indicates that the certificate from B is not trusted. If B did somehow use the same certificate as A then would would get a certificate subject error since what you have is a MITM. TLS is designed to prevent what you are doing
– Paulw11
Nov 26 '18 at 18:49
add a comment |
HTTPS URLs with only IP addresses and not hostnames, are not a good idea. First it will be difficult (but not completely impossible) to get proper X.509 certificates with an IP address in them instead of a domain name. Then at the OS/webserver level it means you are wasting a given IP for only one HTTPS service as you will not be able to have others due to the lack of SNI. As for generic TCP/TLS proxy, have a look at HAProxy, nginx, or pound.
– Patrick Mevzek
Nov 26 '18 at 16:18
B can't be "blindly passing everything...including the SSL session" since you have opened an https connection to B. To get the pass through you described, B would need to be acting as an http proxy (using theCONNECTdirective) or acting as a Socks proxy (which again would require specific socksified code in your iOS app). You are getting -1202 which indicates that the certificate from B is not trusted. If B did somehow use the same certificate as A then would would get a certificate subject error since what you have is a MITM. TLS is designed to prevent what you are doing
– Paulw11
Nov 26 '18 at 18:49
HTTPS URLs with only IP addresses and not hostnames, are not a good idea. First it will be difficult (but not completely impossible) to get proper X.509 certificates with an IP address in them instead of a domain name. Then at the OS/webserver level it means you are wasting a given IP for only one HTTPS service as you will not be able to have others due to the lack of SNI. As for generic TCP/TLS proxy, have a look at HAProxy, nginx, or pound.
– Patrick Mevzek
Nov 26 '18 at 16:18
HTTPS URLs with only IP addresses and not hostnames, are not a good idea. First it will be difficult (but not completely impossible) to get proper X.509 certificates with an IP address in them instead of a domain name. Then at the OS/webserver level it means you are wasting a given IP for only one HTTPS service as you will not be able to have others due to the lack of SNI. As for generic TCP/TLS proxy, have a look at HAProxy, nginx, or pound.
– Patrick Mevzek
Nov 26 '18 at 16:18
B can't be "blindly passing everything...including the SSL session" since you have opened an https connection to B. To get the pass through you described, B would need to be acting as an http proxy (using the
CONNECT directive) or acting as a Socks proxy (which again would require specific socksified code in your iOS app). You are getting -1202 which indicates that the certificate from B is not trusted. If B did somehow use the same certificate as A then would would get a certificate subject error since what you have is a MITM. TLS is designed to prevent what you are doing– Paulw11
Nov 26 '18 at 18:49
B can't be "blindly passing everything...including the SSL session" since you have opened an https connection to B. To get the pass through you described, B would need to be acting as an http proxy (using the
CONNECT directive) or acting as a Socks proxy (which again would require specific socksified code in your iOS app). You are getting -1202 which indicates that the certificate from B is not trusted. If B did somehow use the same certificate as A then would would get a certificate subject error since what you have is a MITM. TLS is designed to prevent what you are doing– Paulw11
Nov 26 '18 at 18:49
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53484696%2fioshow-to-use-nsurlconnection-with-a-private-ip-address%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53484696%2fioshow-to-use-nsurlconnection-with-a-private-ip-address%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
HTTPS URLs with only IP addresses and not hostnames, are not a good idea. First it will be difficult (but not completely impossible) to get proper X.509 certificates with an IP address in them instead of a domain name. Then at the OS/webserver level it means you are wasting a given IP for only one HTTPS service as you will not be able to have others due to the lack of SNI. As for generic TCP/TLS proxy, have a look at HAProxy, nginx, or pound.
– Patrick Mevzek
Nov 26 '18 at 16:18
B can't be "blindly passing everything...including the SSL session" since you have opened an https connection to B. To get the pass through you described, B would need to be acting as an http proxy (using the
CONNECTdirective) or acting as a Socks proxy (which again would require specific socksified code in your iOS app). You are getting -1202 which indicates that the certificate from B is not trusted. If B did somehow use the same certificate as A then would would get a certificate subject error since what you have is a MITM. TLS is designed to prevent what you are doing– Paulw11
Nov 26 '18 at 18:49