Add better error message when TLS fails [was: I can not install any plugins or update]

[pedro22]

Version 1.4.3 as the topic - I can not install any plugins or update - when I click "update" tries to download and display the "installation <name_plugin> failed" in the settings, I have checked "force HTTP instead of HTTPS for downloading Plugin list"

However, during the installation of a new plugin there are no errors - after restart the plugin is not listed.

Notepad++ v7.3.2 (32-bit)
Build time : Feb 12 2017 - 23:15:39
Path : C:\Program Files\Notepad++\notepad++.exe
Admin mode : OFF
Local Conf mode : OFF
OS : Windows XP (32-bit)
Plugins : ComparePlugin.dll JSMinNPP.dll LightExplorer.dll mimeTools.dll NppConverter.dll NppExport.dll NppTextFX.dll PluginManager.dll

[bruderstein]

Which plugin are you trying to update?

And which new plugin are you trying to install?

[pedro22]

Which plugin are you trying to update?
JSTool, Compare

And which new plugin are you trying to install?
Eg: JSON Viewer

[chcg]

• New Installation of the two plugins you try to update work fine for me on WIN 10. Are you using SP3 of WinXP?

• Compare 2.0.0 should still be running on winxp sp3.

• Maybe the issue with JSTool the renaming from JSMinNPP, also JSMin is added as alias to the plugin manager db,so the update should be possible

• See https://npppm.bruderste.in/plugins/edit/json-viewer, there is no install sequence configured for this plugin, just the version number is there, so this is an issue of the plugin provider

@bruderstein Is it possible to add just a single dll like in https://github.com/kapilratnani/JSON-Viewer/releases/download/1.24/NPPJSONViewer-win32.dll for the download and installation in the webinterface? Or must it be a zip file?

[pedro22]

Yes, I have SP3 on XP

[quote]Compare 2.0.0 should still be running on winxp sp3.[/quote]
Maybe working, I still have version 1.5.6

[quote]Maybe the issue with JSTool the renaming from JSMinNPP, also JSMin is added as alias to the plugin manager db,so the update should be possible[/quote]
Does not work .

[quote]See https://npppm.bruderste.in/plugins/edit/json-viewer, there is no install sequence configured for this plugin, just the version number is there, so this is an issue of the plugin provider[/quote]
I can not, ask for a login

Maybe I should enable: Admin mode: or Local Conf mode

[pedro22]

So from now on I will have to install and update all plugins manually?

Nobody do not care XP system, even though many people are still using it.

[chcg]

Hope not, but as I have no win xp around it is hard to find the root cause of the problem you face.

• As n++ 7.3.2 is still bundled with PluginManager 1.3.5 how did you update to PluginManager 1.4.3?
• Regarding: "However, during the installation of a new plugin there are no errors - after restart the plugin is not listed.", just not listed in PluginManagers list of installed plugins or not available at all from N++, at least with JSON Viewer I see the issue that it seems a installation happens, but as no download is configuered in the plugin database it behaves weird.
• Could you install other plugins apart from JSON Viewer, e.g. AnalysisPlugin?

[pedro22]

Yes, I have PluginManager version 1.4.3

No, I can not install AnalysePlugin - I get: "installation of AnalysePlugin failed"

Whereas, I can install a plugin eg: Preview HTML

[chcg]

• Is the download of AnalysePlugin ok and just the copy process failes?
• JsonViewer server config is updated now at the dev list.

[pedro22]

No, at the beginning of the download AnalysePlugin - crashes error.

[chcg]

See also https://notepad-plus-plus.org/community/topic/13346/error-installing-plugin-manager

[bruderstein]

@chcg short answer: yes it has to be a zip file. Long answer: PM actually supports downloading single files, but the current admin interface doesn't. New one supports it, so it will be possible when we switch over.

[chcg]

@pedro22

• And how does your system behave on a manual download of https://sourceforge.net/projects/analyseplugin/files/binaries/v01.10-R32.zip/download. Is this possible with your webbrowser. PluginManager takes your windows internet configuration and maybe there is an issue with https connections that tls 1.1 and 1.2 are not supported by winxp, see https://blogs.msdn.microsoft.com/kaushal/2011/10/02/support-for-ssltls-protocols-on-windows/
• Could you try to install the JSON Viewer from the dev list

[pedro22]

Unfortunately, I can not manually download this plugin - IE has problems, Firefox downloads and Chrome
too - does not help change the default browser. So I have to install any plug-ins manually?

Why Google is working and Sourceforge not?

[chcg]

@pedro22
The browser have build in ssl libraries and as you problaby have a newer version of firefox and chrome they might support TLS1.2, could be checked at e.g.

https://cc.dcsec.uni-hannover.de/

For my firefox:

User-Agent:
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:51.0) Gecko/20100101 Firefox/51.0
Preferred SSL/TLS version:
TLSv1.2
SNI information:
cc.dcsec.uni-hannover.de
SSL stack current time:
The TLS stack of your browser did not send a time value.

This connection uses TLSv1.2 with ECDHE-RSA-AES128-GCM-SHA256 and a 128 Bit key for encryption.

, but the build in ssl lib of winxp doesn't get updates any more. So if some website requires explicitly TLS > 1.0 their might the problem occur that the download fails. Maybe that could be detected more gracefully. I will have to check that in the code.

In this case you should see problems with all the plugins hosted at sourceforge.

[pedro22]

Firefox:
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:51.0) Gecko/20100101 Firefox/51.0 Preferred SSL/TLS version: TLSv1.2 SNI information: cc.dcsec.uni-hannover.de SSL stack current time: The TLS stack of your browser did not send a time value.

and Chrome:
User-Agent:Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36 Preferred SSL/TLS version: TLSv1.2 SNI information: cc.dcsec.uni-hannover.de SSL stack current time: The TLS stack of your browser did not send a time value.

are able to open this page, IE NOT.

[bruderstein]

Yep, so as @chcg said, these sites are now using more secure algorithms, and disallowing older less secure (or insecure) algorithms for HTTPS that XP doesn't support. Sadly, in order for plugin manager to support these more secure algorithms, we'd have to do a lot of work including another SSL implementation, and then deal with the added risks of there being security related bugs in that library, which would mean we'd need to be aggressive in updating, and spend more time than we already do.

So, the answer is, there's nothing we can do, but I would advise you to upgrade your OS - running a 15+ year old operating system that is no longer updated with security patches leaves you open to many attacks.

If it's financially difficult to upgrade, then I'd recommend Linux, which is kept up to date - no native Notepad++, but there are many other editors.

[pedro22]

And you could add to the Plugin Manager SSL libraries to handle XP?

[chcg]

What I will check if it is possible to show a better error message with the hint that TLS support might be a problem and that a manual download and installation is needed maybe with the appropriate link.

[bruderstein]

And you could add to the Plugin Manager SSL libraries to handle XP?

Yes, but as I said, that's a lot of work, and introduces extra risk, so it's not something I'm prepared to do.

[chcg]

@pedro22 See #85. For WinXP TLS 1.2 support is available via:

https://www.catalog.update.microsoft.com/Search.aspx?q=KB4019276, the relevant one is "Update für WES09 und POSReady 2009 (KB4019276)" , afterwards TLS1.1 and TLS 1.2 have to be enabled via registry, see https://support.microsoft.com/en-us/help/4019276/update-to-add-support-for-tls-1-1-and-tls-1-2-in-windows.

[pedro22]

@chcg Thanks, but now I have Windows 7 - and Plugin Manager works good.

[chcg]

@pedro22 Fine. I think it is better to have a still supported OS.