Proxy breaks other apps

[Tmarinus]

When using the website blocking proxy my deezer app (https://github.com/aunetx/deezer-linux) cannot connect anymore because of broken certificate. If I understand correctly this is because the deezer app uses electron which has its own (chrome?) browser inside using its own certificates.

Is there any way to fix this? I tried whitelisting deezer and even removing all other websites but it does not help.

[16:32:51.449][127.0.0.1:42324] client connect
[16:32:51.526][127.0.0.1:42324] server connect www.deezer.com:443 (88.221.24.185:443)
[16:32:51.529][127.0.0.1:42332] client connect
[16:32:51.559][127.0.0.1:42342] client connect
[16:32:51.562][127.0.0.1:42324] Client TLS handshake failed. The client does not trust the proxy's certificate for www.deezer.com (OpenSSL Error([('SSL routines', '', 'ssl/tls alert certificate unknown')]))
[16:32:51.562][127.0.0.1:42324] client disconnect

[kun-codes]

Hi,

I am not sure why this happens. I use cider v2 which is an apple music client built with electron and it works fine with Koncentro. My guess is that deezer-linux doesn't properly use the proxy set by the desktop environment. I would be investigating it by this wednesday.

How did you install Koncentro and deezer-linux? Was it through native packages or flatpak? Also what is your desktop environment and linux distro?

Thanks

[Tmarinus]

Thank you for getting back to me.
I use the deezer appimage.
I tried installing Koncentro using both the .deb (but also had some certificate issues) so it is now installed using flatpak.

As I am using firefox I first tried adding the certificate to firefox, however that did not work. So I ended up setting firefox to use system proxy. This way I got Koncentro to work except the above mentioned Deezer issue.

Linux: Linux Mint 22.1 Cinnamon, kernel 6.8.0-90-generic.

Please let me know if there is anything I can test/do to help.

[kun-codes]

As I am using firefox I first tried adding the certificate to firefox, however that did not work. So I ended up setting firefox to use system proxy. This way I got Koncentro to work except the above mentioned Deezer issue.

This is weird since it worked fine on gnome. I will test it on linux mint cinnamon edition

I will also check out the deb issue which you mentioned

Please let me know if there is anything I can test/do to help.

Thanks

[Tmarinus]

Not sure if this helps.
But I tried connecting my phone to my laptop proxy (ip + 8080) worked great to block websites also on the phone, with certificates added to android and firefox. However this also broke deezer on my phone. I dont know enough about certificates to know if this means anything or not. Anyway thought I at least share.

[kun-codes]

Maybe deezer doesn't trust self signed certificates? If you sign out of deezer linux with koncentro not running, can you sign in to deezer linux with koncentro running?

What about playing deezer on browser, if deezer supports it that is

[Tmarinus]

Happen to have tried this (I tested older installation to make sure it was not this linux install). I couldnt log into the app with koncentro running.
Website login and player works completely without issue.

Maybe an ugly solution would be possible to have some user settings that are passed to mitm? Think you can ignore certain domains? https://docs.mitmproxy.org/stable/howto/ignore-domains/

[kun-codes]

Maybe an ugly solution would be possible to have some user settings that are passed to mitm? Think you can ignore certain domains? https://docs.mitmproxy.org/stable/howto/ignore-domains/

Yes this can be done I guess but I need to figure out what the problem is with deezer to know if this is required

[Tmarinus]

So I do not think it is only deezer having the issue. I was testing the proxy for the other issue and noticed that for example steam is also unable to access the internet when koncentro proxy is active.

[Tmarinus]

So instead of messing with mitmproxy. I noticed that your own uniproxy has an option for bypassing certain domains. Adding the following line after setup of uniproxy fixes both Deezer and steam issue.

self.proxy = Uniproxy("127.0.0.1", ConfigValues.PROXY_PORT)
self.proxy.set_bypass_domains(['*.deezer.com', '*.dzcdn.net', '*steam*'])

[kun-codes]

does adding this in src/website_blocker/websiteBlockerManager.py solve your problem for steam?

you can add it in ~/.local/share/flatpak/app/com.bishwasaha.Koncentro/x86_64/stable/<folder with hash like name>/files/koncentro/src/website_blocker/website_blocker_manager.py

After adding it restart Koncentro

The lines to be added

        bypass_domains: list[str] = self.proxy.get_bypass_domains()
        self.proxy.set_bypass_domains(bypass_domains + ["steamserver.net"])

[kun-codes]

Some of the things which I tried:

• the "steamserver.net" thing in my above comment. It worked once but stopped working after it. I don't know why. https://github.com/ZenPrivacy/zen-desktop uses the same url to stop blocking steam and it works for them.
• trying to use the user agent of steam client to not intercept request. But to get the user agent, the request has to be intercepted so this method failed as well
• I tried using JA3 and JA4 hash, but this method wouldn't work since steam is built using CEF and many other apps are built using CEF. JA3/JA4 hash of a request can be derived without intercepting the request but using it to filter out requests by steam client won't be feasible since it would lead to requests of other apps built on CEF being filtered out and hence not being blocked by Koncentro

The reason I don't want to use *steam* as mentioned in this comment is because its too wide and not specific enough. Steam client pings a bunch of domains. Maintaining a list for each app is not feasible either.

I am open to adding steamserver.net to ignore list though if it works since a user can always block steam by placing store.steampowered.com in block list

As for deezer, I am not able to test it since its not available in India. @Tmarinus can you create a free deezer account for me and share the credentials of it if its not again the TOS of deezer?

how does steam and deezer work with https://github.com/ZenPrivacy/zen-desktop
They use the same method of using an mitm proxy to block domains

[Tmarinus]

I was able to test Zen and that works for both Deezer and Steam. I was unable to get a Deezer free account as those are not available in my country too.
Deezer works well for me with the bypass domains '*.deezer.com', '*.dzcdn.net'.

Would just adding a box to the settings allowing a user to set the bypass domains not be the best solution?

I think steam is really a non-issue. Why would you want to pass through steam when you are in focused mode anyways.

[kun-codes]

I will have to find a way to get a deezer account for testing.

I believe that a custom input for bypass domains is bad because the user can misuse it. I might add it in case it's the only option