Fix pairing

Author: marcelveldt

README.md

@@ -6,18 +6,38 @@ Based on libraop by philippe44 (all rights reserved). See upstream repo for more
 
 ## Building
 
+**IMPORTANT:** Always use `STATIC=1` to statically link OpenSSL from crosstools. This ensures the binary is self-contained and doesn't depend on system OpenSSL libraries.
+
 ```sh
 apt-get update
 apt-get install -y build-essential cmake  libssl-dev
 git clone https://github.com/music-assistant/libraop.git
 cd libraop
 git submodule update --init
 
-# Build project for linux with static OpenSSL
-make HOST=linux PLATFORM=aarch64 STATIC=1
+# Build for Linux aarch64 (ALWAYS use STATIC=1!)
+make HOST=linux PLATFORM=aarch64 STATIC=1 -j4
 
-# Build project for macOS with static OpenSSL
-make HOST=macos PLATFORM=arm64 STATIC=1
+# Build for macOS ARM64 (ALWAYS use STATIC=1!)
+make HOST=macos PLATFORM=arm64 STATIC=1 -j4
 ```
 
-**IMPORTANT:** Always use `STATIC=1` to statically link OpenSSL from crosstools. This ensures the binary is self-contained and doesn't depend on system OpenSSL libraries.
+### Development Workflow
+
+When working on the code and testing changes:
+
+```sh
+# Clean previous build
+make clean
+
+# Rebuild with static OpenSSL (REQUIRED)
+make HOST=macos PLATFORM=arm64 STATIC=1 -j4
+
+# Test the binary
+./bin/cliraop-macos-arm64 -pair <device_ip>
+```
+
+**Common Mistakes:**
+- ❌ `make` without `STATIC=1` - will link against system OpenSSL (broken)
+- ❌ `CC=cc make HOST=macos PLATFORM=arm64` - will link against system OpenSSL (broken)
+- ✅ `make HOST=macos PLATFORM=arm64 STATIC=1` - correct way with static OpenSSL

src/cliraop.c

@@ -528,11 +528,13 @@ int main(int argc, char *argv[])
 
 		if (AppleTVpairing(NULL, &pair_secret, player.hostname, player.port))
 		{
-			printf("\nPairing successful!\nSecret: %s\n", pair_secret ? pair_secret : "(none)");
+			fprintf(stderr, "\nPairing successful!\nSecret: %s\n", pair_secret ? pair_secret : "(none)");
+			fflush(stderr);
 		}
 		else
 		{
-			printf("Pairing failed.\n");
+			fprintf(stderr, "Pairing failed.\n");
+			fflush(stderr);
 		}
 		exit(0);
 	}

src/pairing.cpp

@@ -132,13 +132,16 @@ extern "C" {
 bool AppleTVpairing(struct mdnssd_handle_s* mDNShandle, char **pSecret, const char *target_ip, int port) {
 	// make sure we can safely free these
 	A = a = NULL;
+	bool success = false;
 
 	if (!target_ip || !*target_ip) {
-		printf("Error: IP address is required for pairing\n");
+		fprintf(stderr, "Error: IP address is required for pairing\n");
+		fflush(stderr);
 		return false;
 	}
 
-	printf("Pairing with device at %s:%d\n", target_ip, port);
+	fprintf(stderr, "Pairing with device at %s:%d\n", target_ip, port);
+	fflush(stderr);
 
 	struct sockaddr_in peer = { };
 	key_data_t headers[16] = { };
@@ -154,6 +157,11 @@ bool AppleTVpairing(struct mdnssd_handle_s* mDNShandle, char **pSecret, const ch
 	kd_add(headers, "Content-Type", "application/octet-stream");
 
 	char *buffer = http_send(sock, "POST /pair-pin-start HTTP/1.1", headers);
+	if (!buffer) {
+		kd_free(headers);
+		closesocket(sock);
+		return false;
+	}
 	//printf("%s", buffer);
 	NFREE(buffer);
 	kd_free(headers);
@@ -172,7 +180,8 @@ bool AppleTVpairing(struct mdnssd_handle_s* mDNShandle, char **pSecret, const ch
 	if (1) {
 #endif
 		char pin[5];
-		printf("enter PIN code displayed on AppleTV: ");
+		fprintf(stderr, "enter PIN code displayed on AppleTV:\n");
+		fflush(stderr);
 #ifndef TEST_VECTOR
 		(void)!scanf("%4s", pin);
 #else
@@ -196,9 +205,15 @@ bool AppleTVpairing(struct mdnssd_handle_s* mDNShandle, char **pSecret, const ch
 		kd_vadd(headers, "Content-Length", "%zu", data.size());
 
 		char* httpStr = http_send(sock, "POST /pair-setup-pin HTTP/1.1", headers);
+		if (!httpStr) {
+			kd_free(headers);
+			closesocket(sock);
+			return false;
+		}
 		send(sock, (const char*) data.data(), data.size(), 0);
 		//printf("%s", httpStr);
-		printf("step1 ... verifying pin\n");
+		fprintf(stderr, "step1 ... verifying pin\n");
+		fflush(stderr);
 		NFREE(httpStr);
 		kd_free(headers);
 
@@ -234,8 +249,14 @@ bool AppleTVpairing(struct mdnssd_handle_s* mDNShandle, char **pSecret, const ch
 			kd_vadd(headers, "Content-Length", "%zu", data.size());
 
 			char* httpStr = http_send(sock, "POST /pair-setup-pin HTTP/1.1", headers);
+			if (!httpStr) {
+				kd_free(headers);
+				closesocket(sock);
+				return false;
+			}
 			send(sock, (const char*)data.data(), data.size(), 0);
-			printf("step2 ... verifying M1\n");
+			fprintf(stderr, "step2 ... verifying M1\n");
+			fflush(stderr);
 			//printf("%s", httpStr);
 			NFREE(httpStr);
 			kd_free(headers);
@@ -304,9 +325,15 @@ bool AppleTVpairing(struct mdnssd_handle_s* mDNShandle, char **pSecret, const ch
 				kd_vadd(headers, "Content-Length", "%zu", data.size());
 
 				char* httpStr = http_send(sock, "POST /pair-setup-pin HTTP/1.1", headers);
+				if (!httpStr) {
+					kd_free(headers);
+					closesocket(sock);
+					return false;
+				}
 				send(sock, (const char*)data.data(), data.size(), 0);
 				//printf("%s", httpStr);
-				printf("step3 ... verifying AES\n");
+				fprintf(stderr, "step3 ... verifying AES\n");
+				fflush(stderr);
 				NFREE(httpStr);
 				kd_free(headers);
 
@@ -320,24 +347,31 @@ bool AppleTVpairing(struct mdnssd_handle_s* mDNShandle, char **pSecret, const ch
 				if (1) {
 #endif
 
-					printf("success!\nsecret is %s\n", *pSecret);
+					fprintf(stderr, "success!\nsecret is %s\n", *pSecret);
+					fflush(stderr);
+					success = true;
 				} else {
-					printf("can't authentify, error %s", resource);
+					fprintf(stderr, "can't authentify, error %s\n", resource);
+					fflush(stderr);
 				}
 			}
 		} else {
-			printf("pin failed %s", resource);
+			fprintf(stderr, "pin failed %s\n", resource);
+			fflush(stderr);
 		}
 
 		NFREE(body);
-	} 
+	} else {
+		fprintf(stderr, "device did not respond to pairing request\n");
+		fflush(stderr);
+	}
 
 	if (a) BN_free(a);
 	if (A) BN_free(A);
 
 	kd_free(headers);
 	if (sock != -1) closesocket(sock);
-	return true;
+	return success;
 }
 
 } // extern "C"

src/raop_client.c

@@ -1009,8 +1009,8 @@ bool raopcl_connect(struct raopcl_s *p, struct in_addr peer, uint16_t destport,
 	// RTSP pairing verify for AppleTV
 	if (*p->secret && !rtspcl_pair_verify(p->rtspcl, p->secret)) goto erexit;
 
-	// Send pubkey for MFi devices
-	if (strchr(p->et, '4')) rtspcl_auth_setup(p->rtspcl);
+	// Send pubkey for MFi devices (but not if we already did pair-verify)
+	if (strchr(p->et, '4') && !*p->secret) rtspcl_auth_setup(p->rtspcl);
 
 	// build sdp parameter
 	buf = strdup(inet_ntoa(peer));