.local / mDNS requests fail with ERR_SSL_PROTOCOL_ERROR on macOS Sequoia 15.0.1 #40
Comments
|
Hey, I haven't heard of anything like this yet but I'll leave this issue open until I can help you resolve it. I'm unfortunately not on macOS 15 and I don't plan on upgrading for a while (it's usually disruptive to my life so I avoid updates until they're unavoidable.) I have heard that macOS 15 shipped with a variety of networking problems, although no one is very clear exactly what they are or what to do about it:
For future reference/completeness, could you share the results of running the following commands?
Based on what you've shared, I'm not sure what's going on. Some ideas for things to try:
|
peterldowns
added
bug
peterldowns
changed the title
So it seems most likely that I'm experiencing an mDNS-related issue? |
|
Additional data point, if I leave the Details of the installed caddy version: |
|
Awesome, thank you so much for the diagnostics. I'm going to prepare a localias build that uses the latest version of Caddy — hopefully you can then try that out, and it magically fixes the bugs, and we're all good to go! Really appreciate your help tracking this down! |
Interesting. If running caddyserver + updated /etc/hosts makes
So, to help figure this out, here's a darwin-arm64 build of localias built with caddyserver v2.8.4. The code changes are on this branch, if you'd rather build the binary yourself than download one that I've built:
Could you please try starting the proxy server with this custom build of localias, and seeing if your ~/code/localias/bin 🪵 pd/caddy-update # 5692b42 ❄️ nix:localias
• ./localias-darwin-arm64 version
v2.2.0+commit.5692b42
~/code/localias/bin 🪵 pd/caddy-update # 5692b42 ❄️ nix:localias
• ./localias-darwin-arm64 stop
daemon is not running
~/code/localias/bin 🪵 pd/caddy-update # 5692b42 ❄️ nix:localias
• ./localias-darwin-arm64 start
2024/10/21 20:43:42.911 INFO admin admin endpoint started {"address": "localhost:2019", "enforce_origin": false, "origins": ["//localhost:2019", "//[::1]:2019", "//127.0.0.1:2019"]}
2024/10/21 20:43:42.911 WARN tls DEPRECATED: on_demand.rate_limit will be removed in a future release; use permission modules or external certificate managers instead
2024/10/21 20:43:42.911 INFO tls.cache.maintenance started background certificate maintenance {"cache": "0x140000e5700"}
2024/10/21 20:43:42.911 INFO http.auto_https server is listening only on the HTTPS port but has no TLS connection policies; adding one to enable TLS {"server_name": "srv1", "https_port": 443}
2024/10/21 20:43:42.911 INFO http.auto_https enabling automatic HTTP->HTTPS redirects {"server_name": "srv1"}
2024/10/21 20:43:42.917 INFO pki.ca.local root certificate is already trusted by system {"path": "storage:pki/authorities/local/root.crt"}
2024/10/21 20:43:42.917 INFO http.log server running {"name": "srv0", "protocols": ["h1", "h2", "h3"]}
2024/10/21 20:43:42.917 INFO http enabling HTTP/3 listener {"addr": ":443"}
2024/10/21 20:43:42.917 INFO [INFO][FileStorage:/Users/pd/Library/Application Support/localias/caddy] Lock for 'storage_clean' is stale (created: 2024-10-21 16:43:28.447751 -0400 EDT, last update: 2024-10-21 16:43:28.447751 -0400 EDT); removing then retrying: /Users/pd/Library/Application Support/localias/caddy/locks/storage_clean.lock
2024/10/21 20:43:42.917 INFO http.log server running {"name": "srv1", "protocols": ["h1", "h2", "h3"]}
2024/10/21 20:43:42.917 INFO http.log server running {"name": "remaining_auto_https_redirects", "protocols": ["h1", "h2", "h3"]}
2024/10/21 20:43:42.917 INFO http enabling automatic TLS certificate management {"domains": ["back.local", "front.local"]}
mDNS: serving front.local (192.168.1.195,198.19.249.3,192.168.215.0,192.168.164.0,::1,127.0.0.1)
mDNS: serving back.local (192.168.1.195,198.19.249.3,192.168.215.0,192.168.164.0,::1,127.0.0.1)
~/code/localias/bin 🪵 pd/caddy-update # 5692b42 ❄️ nix:localias
• ./localias-darwin-arm64 status
daemon running with pid 65368
~/code/localias/bin 🪵 pd/caddy-update # 5692b42 ❄️ nix:localias
• pgrep localias
65368
~/code/localias/bin 🪵 pd/caddy-update # 5692b42 ❄️ nix:localias
• curl -vvv 'https://front.local'
* Trying [::1]:443...
* Connected to front.local (::1) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
* CAfile: /etc/ssl/cert.pem
* CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
* ALPN: server accepted h2
* Server certificate:
* subject: [NONE]
* start date: Oct 21 20:44:07 2024 GMT
* expire date: Oct 22 08:44:07 2024 GMT
* subjectAltName: host "front.local" matched cert's "front.local"
* issuer: CN=Localias Intermediate
* SSL certificate verify ok.
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://front.local/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: front.local]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.4.0]
* [HTTP/2] [1] [accept: */*]
> GET / HTTP/2
> Host: front.local
> User-Agent: curl/8.4.0
> Accept: */*
>
< HTTP/2 200
< alt-svc: h3=":443"; ma=2592000
< content-type: text/html; charset=utf-8
< date: Mon, 21 Oct 2024 20:44:07 GMT
< server: Caddy
< server: SimpleHTTP/0.6 Python/3.12.3
< content-length: 1216
<
<!DOCTYPE HTML>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Directory listing for /</title>
</head>
<body>
<h1>Directory listing for /</h1>
<hr>
<ul>
<li><a href=".direnv/">.direnv/</a></li>
<li><a href=".DS_Store">.DS_Store</a></li>
<li><a href=".envrc">.envrc</a></li>
<li><a href=".git/">.git/</a></li>
<li><a href=".github/">.github/</a></li>
<li><a href=".gitignore">.gitignore</a></li>
<li><a href=".golangci.yaml">.golangci.yaml</a></li>
<li><a href=".localias.yaml">.localias.yaml</a></li>
<li><a href=".toolchain/">.toolchain/</a></li>
<li><a href=".vscode/">.vscode/</a></li>
<li><a href="bin/">bin/</a></li>
<li><a href="cmd/">cmd/</a></li>
<li><a href="default.nix">default.nix</a></li>
<li><a href="flake.lock">flake.lock</a></li>
<li><a href="flake.nix">flake.nix</a></li>
<li><a href="go.mod">go.mod</a></li>
<li><a href="go.sum">go.sum</a></li>
<li><a href="Justfile">Justfile</a></li>
<li><a href="LICENSE">LICENSE</a></li>
<li><a href="pkg/">pkg/</a></li>
<li><a href="README.md">README.md</a></li>
<li><a href="result/">result@</a></li>
<li><a href="scripts/">scripts/</a></li>
<li><a href="shell.nix">shell.nix</a></li>
<li><a href="VERSION">VERSION</a></li>
</ul>
<hr>
</body>
</html>
* Connection #0 to host front.local left intact
~/code/localias/bin 🪵 pd/caddy-update # 5692b42 ❄️ nix:localias
• curl -vvv 'https://back.local'
* Trying [::1]:443...
* Connected to back.local (::1) port 443
* ALPN: curl offers h2,http/1.1
* (304) (OUT), TLS handshake, Client hello (1):
* CAfile: /etc/ssl/cert.pem
* CApath: none
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
* ALPN: server accepted h2
* Server certificate:
* subject: [NONE]
* start date: Oct 21 20:44:17 2024 GMT
* expire date: Oct 22 08:44:17 2024 GMT
* subjectAltName: host "back.local" matched cert's "back.local"
* issuer: CN=Localias Intermediate
* SSL certificate verify ok.
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://back.local/
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: back.local]
* [HTTP/2] [1] [:path: /]
* [HTTP/2] [1] [user-agent: curl/8.4.0]
* [HTTP/2] [1] [accept: */*]
> GET / HTTP/2
> Host: back.local
> User-Agent: curl/8.4.0
> Accept: */*
>
< HTTP/2 200
< alt-svc: h3=":443"; ma=2592000
< content-type: text/html; charset=utf-8
< date: Mon, 21 Oct 2024 20:44:17 GMT
< server: Caddy
< server: SimpleHTTP/0.6 Python/3.12.3
< content-length: 1216
<
<!DOCTYPE HTML>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Directory listing for /</title>
</head>
<body>
<h1>Directory listing for /</h1>
<hr>
<ul>
<li><a href=".direnv/">.direnv/</a></li>
<li><a href=".DS_Store">.DS_Store</a></li>
<li><a href=".envrc">.envrc</a></li>
<li><a href=".git/">.git/</a></li>
<li><a href=".github/">.github/</a></li>
<li><a href=".gitignore">.gitignore</a></li>
<li><a href=".golangci.yaml">.golangci.yaml</a></li>
<li><a href=".localias.yaml">.localias.yaml</a></li>
<li><a href=".toolchain/">.toolchain/</a></li>
<li><a href=".vscode/">.vscode/</a></li>
<li><a href="bin/">bin/</a></li>
<li><a href="cmd/">cmd/</a></li>
<li><a href="default.nix">default.nix</a></li>
<li><a href="flake.lock">flake.lock</a></li>
<li><a href="flake.nix">flake.nix</a></li>
<li><a href="go.mod">go.mod</a></li>
<li><a href="go.sum">go.sum</a></li>
<li><a href="Justfile">Justfile</a></li>
<li><a href="LICENSE">LICENSE</a></li>
<li><a href="pkg/">pkg/</a></li>
<li><a href="README.md">README.md</a></li>
<li><a href="result/">result@</a></li>
<li><a href="scripts/">scripts/</a></li>
<li><a href="shell.nix">shell.nix</a></li>
<li><a href="VERSION">VERSION</a></li>
</ul>
<hr>
</body>
</html>
* Connection #0 to host back.local left intact |
|
No change, this build exhibits the same failure as with the version in homebrew. However, while I was mucking about with it, I discovered something interesting: both versions work perfectly if I That it works when running as root implies that the issue is one of the new permissions checks added to macOS Sequoia - my money would be on the addition of "Local Network Privacy", although whatever localias does is not triggering the permission UI prompt. Looking through the various resources, it seems likely localias needs the multicast entitlement that has arrived from iOS. See also the somewhat-informal Local Network Privacy FAQ |
peterldowns
changed the title
🧠 OK, now we're onto something! Is there a new I took a look at the links you posted, and did some other researching, and it frankly seems like a non-starter to me to have to start doing codesigning with an apple developer cert in order to ship mdns support. I'll keep looking into it, but I'd really prefer to find some other way, even if it's something like "you have to explicitly grant the binary permission by going into system preferences." I wonder what other apps are going to do? Thank you again for your report and research. I am all ears if you have any ideas for how best to work around this. |
|
There is a UI in system preferences, but it only lets you revoke the permission from apps that have previously triggered the prompt. I have seen the prompt trigger once or twice while mucking around with localias/caddy (unclear what exactly caused it), but it triggers for Terminal.app, rather than the specific tool (and doesn't appear to allow the tool through). The most relevant item from the FAQ suggests one can explicitly trigger the prompt by sending a dummy packet to the broadcast address - I guess that might be worth a try? |
|
Huh, that's weird. I'm super frustrated by not being able to help you better, but I can't pay the cost of upgrading right now for a variety of reasons. Is there any chance there's still a small "+" button in the preferences pane, kind of hard to notice? Here's what the accessibility preferences look like for me in Sonoma:
I'm not sure exactly how to do this — as far as I understand it already, localias should be broadcasting its routes by sending udp multicast packets already, so if that's not triggering the popup I don't know what else would. If you have a chance to play with the code and can make it happen, I'm completely open to upstreaming a PR. One other option is to go partially down the codesigning path by trying to embed an Info.plist with the relevant entitlement at build time, and seeing if that works without any further signing. At this point I've got to tell you that I don't have a path forward for you since I'm not on macOS 15 and I don't plan to be soon. I'm going to leave this issue open and hopefully someone can help contribute a fix. I know this will be a problem for me when I upgrade, and it will be a problem for you and others, but I don't want to upgrade my computer at the moment and until I do I'm unable to do much other than suggesting ideas to you. Sorry 😞 . |
|
One last thing would be to try using |
peterldowns
added
mdns
|
Heh. Well... You may or may not enjoy this news, but the issue has resolved itself on my machine, and I don't seem to be able to recreate it. Feel free to close this issue when you are satisfied. I tried After deleting the entire I probably should have realised earlier that the home-brew uninstall process didn't clear out Application Support directory. I'm assuming the permissions in that directory got messed up in the OS upgrade process - but honestly not sure how. |
|
You're right, that's insanely dissatisfactory. But I'm happy that your problem is resolved. In summary, here's what we know: at some point on macOS 15.0.1 Sequoia:
I'm going to close this issue as "wontfix", but if anyone else comes across this (or you encounter the same issue in the future) I will re-open and do my best to support. 😞 💢 |
|
Hi, I'm experiencing the same issue with Sequoia 15.2 and mDNS. The .local works on the same machine, but is not reachable from other machine from the network. Note that I have another mac on 14.7.1 with the same setup and the mDNS work flawlessly on the same network. The config: When running The two following variants display the same log and do not work better:
I can't add localias to System Preferences / Security / Local Network. I tried to add it to other section like Accessibility and Developement tool, but it didn't change anything. I even tried the So I also think, that the issue is around this new multicast entitlement: https://developer.apple.com/forums/thread/663271 |
Has anyone else encountered issues after upgrading to macOS Sequoia?
I upgraded my daily driver to macOS Sequoia 15.0.1 (24A348) yesterday, and localias seems to silently fail now. I've uninstalled and reinstalled, all still all connections to my configured aliases just return
ERR_SSL_PROTOCOL_ERROR.I do see one error in the start logs, looks like a missing caddy lock file. Is it possible I need to reset something in caddy's config as well?
Any attempt to connect to the alias just results in a TLS error. For example, using curl:
The text was updated successfully, but these errors were encountered: