Android.dev-1026: adding Cloudlog-logbook entry fails, even test connection shows "fail"

[dk5cr]

• local wlan (the SAME wifi!!!!) is on and connected to Android tablet
• cloudlog is online on http://192.168.15.20/cloudlog
• subfolder is /cloudlog
• new API key was set active in Cloudlog
• Logging and key checking on - sorry! - FT8TW and other application works
• station id is correct
• API key is checked lot more than twice

BUT fail is the only result i can get.

As address i've tried everything:
http://
https://
ip only
with / after cloudlog
without / after cloudlog

I ain't got any further idea how to make things going.

[wrflzckr]

Additional findings / reproducible case

I can reproduce the same issue with FT8AF v0.148-dev.327 and a self-hosted Wavelog 3.1.0 instance on my local LAN.

• Wavelog: http://192.168.186.73/wavelog/ (HTTP only, no HTTPS)
• FT8AF: v0.148-dev.327
• Android device and Wavelog server are on the same LAN
• A newly generated Wavelog API key was tested and is valid.
• From Fedora, the API works successfully:
  POST /wavelog/index.php/api/version → HTTP 200, {"status":"ok","version":"3.1.0"}
• The Android browser can access the Wavelog instance successfully over HTTP.
• However, FT8AF's "Test Connection" always returns Fail.
• No HTTP request from FT8AF appears in Apache's access log.
• More importantly, tcpdump on the Wavelog server shows no TCP connection attempt at all from the Android device to port 80 when pressing "Test Connection".

This strongly suggests that the HTTP request is being blocked inside FT8AF/Android before any network connection is attempted, rather than being caused by the Wavelog URL, API key, API endpoint, or server configuration.

The relevant API endpoint for this installation is /wavelog/index.php/api/version; /wavelog/api/version returns 404.

This may therefore be related to FT8AF's Android network security configuration / cleartextTrafficPermitted=false when connecting to self-hosted Wavelog/Cloudlog instances over HTTP (ft8af/app/src/main/res/xml/network_security_config.xml).

[patrickrb]

Taking a look at this one today

[patrickrb]

Root cause found — and it's exactly what @wrflzckr suspected

The app shipped with network_security_config.xml set to cleartextTrafficPermitted="false" app-wide. When you point it at a self-hosted Cloudlog/Wavelog server over plain http:// on your LAN, Android's HttpURLConnection throws Cleartext HTTP traffic … not permitted before it opens the socket — which is why there's no request in Apache's access log and tcpdump sees no TCP attempt at all. The URL, key, and endpoint were never the problem.

Two things made it impossible to diagnose from the app:

• Every failure (cleartext block, 404, wrong key, dead host) collapsed to a bare "Fail" with nothing written to debug.log.
• Installs without URL rewriting only answer at /…/index.php/api/version; the app only ever tried /…/api/version (the 404 @wrflzckr noted).

Fix (PR #773, targets dev)

• Cleartext is permitted again by default — it only affects the logbook address you type. Every public API the app itself calls (QRZ, POTA, PSKReporter, etc.) is now individually pinned to HTTPS so nothing else can silently downgrade.
• The address is normalized: a scheme-less 192.168.15.20/cloudlog now gets http:// automatically, and leading/trailing whitespace is trimmed.
• Both the /api/… and /index.php/api/… URL shapes are tried, so no-rewrite installs work without you needing .htaccess/mod_rewrite.
• Test Connection now shows why it failed (HTTP status, host unreachable, key read-only/rejected) and writes the same line to debug.log (API key redacted), so future reports are self-diagnosing.
• Connect/read timeouts added so a firewalled/offline host fails fast instead of spinning.

@dk5cr your case (http://192.168.15.20/cloudlog, subfolder /cloudlog) is the same cleartext block and is covered by this. Once a build with PR #773 is available, Test Connection should pass; if it still fails it will now tell you the specific reason.

[patrickrb]

This fix is in testing on: https://github.com/patrickrb/FT8AF/releases/tag/android-dev.1137

[dk5cr]

Hi,
testing API key shows "pass" no, but logging completed QSO won't work for Cloudlog. No error, no hints or so.
I ain't got any ideas how to check further, what went wrong.
73s
Cornel