xtool auth login fails with HTTPClientError.connectTimeout after entering 2FA code on Linux (intermittent TLS stall to gsa.apple.com)

オープン
  • 何か問題がありますか？
#414 コメント 1 件 リアクション 1 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
50/100
issue の種類
バグ
明瞭さ
おおむね明確
活発さ
活発
技術スタック
swift
領域
authentication, networking

調査の方向性

Start by tracing xtool auth login from the 2FA submission through the sequential requests to gsa.apple.com; the payload does not name source files or tests. Check the HTTP client’s connection and TLS timeout handling and whether those requests can be retried safely. Done means intermittent stalls no longer force users to restart login, with retry behavior covered by an appropriate test.

索引モデルが issue の本文から書いたものです。

説明

Environment
  • xtool 1.24.0 (AppImage, x86_64)
  • Debian 13, Linux 6.12, Swift 6.4.2
  • Network: cloud VM behind a transparent proxy (fake-IP DNS, outbound HTTPS only)
Steps to reproduce
  1. xtool auth login
  2. Choose 1: Password
  3. Enter Apple ID and password; receive and enter the 2FA code
Actual result
Logging in...
Code: ******
Error: HTTPClientError.connectTimeout

xtool auth status still reports Logged out. Anisette provisioning had already succeeded (files written under ~/.config/xtool/data) and the 2FA code was delivered, so the first auth round worked.

Investigation
  • Every host used by the login flow was tested from the same machine: developerservices2.apple.com, idmsa.apple.com and mac-ani.jkcoxson.com (HTTPS and wss) always answered in about 0.15 s.
  • gsa.apple.com occasionally stalls right after the TLS ClientHello and never replies (curl stops at TLS handshake, Client hello). This happened in about 1 of 8 to 1 of 150 attempts.
  • After the 2FA step, the client makes several sequential requests to gsa.apple.com, so a single stall makes the whole login fail. Because the connect timeout is fixed at 60 s and there is no retry, the user has to start over and get a new 2FA code. Which request stalled could not be seen directly, so this part is an inference.
Workaround

I ran a small local CONNECT proxy that re-dials when the server has not sent a byte within 6 s (safe, because nothing has been received yet), and pointed xtool at it:

XTL_HTTP_PROXY=127.0.0.1:18080 XTL_DEBUG_ERRORS=1 xtool auth login

With it, login succeeded. In 300 test connections to gsa.apple.com through the proxy there were 0 failures, and one stall was recovered on retry. During the successful login itself no stall happened, so that run did not need the retry.

Suggestions
  • Retry the connection or TLS handshake (with a shorter per-attempt timeout) for idempotent auth requests, especially those after the 2FA code is submitted.
  • Optionally make the connect timeout configurable (e.g. XTL_CONNECT_TIMEOUT).
  • Document XTL_HTTP_PROXY / XTL_DEBUG_ERRORS in the README for users on restricted networks.
主要言語
Swift
スター
5.5k
フォーク
163
平均マージ
1日 12時間
マージ済み PR（30日）
33

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

xtool-org/xtool のほかの issue

xtool-org/xtool の issue をすべて見る

似ている issue

Swift の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。