Read first: Previous version support information

"Exception caught when connecting to helper" and "Could not connect on port…" system.log entries

adam667
adam667
Community Member
edited May 2013 in 1Password 3 – 7 for Mac

Hi,

My system.log is overwhelmingly full of messages of the form:

May 15 09:26:12 dali [0x0-0x700700].org.mozilla.firefox[43313]: error: onepassword: [AGENT] Exception caught when connecting to helper: null -

Each time this error happens (and it happens often, although I haven't dug to see the cause), I get 12 nearly identical messages:

May 15 09:26:12 dali [0x0-0x700700].org.mozilla.firefox[43313]: error: onepassword: [AGENT] Exception caught when connecting to helper: null -
May 15 09:26:12 dali [0x0-0x700700].org.mozilla.firefox[43313]: error: onepassword: [AGENT] Could not connect on port 25007; trying again on next port.
May 15 09:26:12 dali [0x0-0x700700].org.mozilla.firefox[43313]: error: onepassword: [AGENT] Exception caught when connecting to helper: null -
May 15 09:26:12 dali [0x0-0x700700].org.mozilla.firefox[43313]: error: onepassword: [AGENT] Could not connect on port 38151; trying again on next port.
May 15 09:26:12 dali [0x0-0x700700].org.mozilla.firefox[43313]: error: onepassword: [AGENT] Exception caught when connecting to helper: null -
May 15 09:26:12 dali [0x0-0x700700].org.mozilla.firefox[43313]: error: onepassword: [AGENT] Could not connect on port 46360; trying again on next port.
May 15 09:26:12 dali [0x0-0x700700].org.mozilla.firefox[43313]: error: onepassword: [AGENT] Exception caught when connecting to helper: null -
May 15 09:26:12 dali [0x0-0x700700].org.mozilla.firefox[43313]: error: onepassword: [AGENT] Could not connect on port 49801; trying again on next port.
May 15 09:26:12 dali [0x0-0x700700].org.mozilla.firefox[43313]: error: onepassword: [AGENT] Exception caught when connecting to helper: null -
May 15 09:26:12 dali [0x0-0x700700].org.mozilla.firefox[43313]: error: onepassword: [AGENT] Could not connect on port 55730; trying again on next port.
May 15 09:26:12 dali [0x0-0x700700].org.mozilla.firefox[43313]: error: onepassword: [AGENT] Exception caught when connecting to helper: null -
May 15 09:26:12 dali [0x0-0x700700].org.mozilla.firefox[43313]: error: onepassword: [AGENT] Could not connect on port 59483; trying again on next port.

It would be great to fix the root cause of this, but it would also be great to simply log the first one and then a summary of the ports you tried.

I suspect the root cause may be Little Snitch blocking the loopback, but as I said, I haven't dug in.

Comments

  • khad
    khad
    1Password Alumni

    Yeah, it's probably Little Snitch.

    1Password manages the data exchange between itself and the browser extensions through WebSocket. This allows the 1Password background process to communicate with the browser extensions while still respecting the sandboxing rules enforced by modern web browsers. Although these appear as network connections, they are limited to your local machine. These connections are encrypted and authenticated, so they cannot be used to deliver information to any other processes beyond the extensions and the main 1Password application.

    If the connections are blocked for any reason, the extension will not be able to connect to 1Password, and no data transfer can occur. The most common symptom of this problem is an Helper Not Connected error in the browser extension. The simplest solution is to ensure that local connections are not blocked on 127.0.0.1 by a proxy server or software firewall.

    The specific ports that 1Password uses through its WebSocket connections are 6258, 10191, 14821, 24861, 25007, 38151, 46360, 49801, 55730, 59483, but it is much simpler to just allow all connections to 127.0.0.1 (localhost).

  • adam667
    adam667
    Community Member

    Thanks! Cross-posting to the LS forum here http://forums.obdev.at/viewtopic.php?f=1&t=8443

  • khad
    khad
    1Password Alumni
    edited May 2013

    On second thought, Little Snitch shouldn't be blocking any local connections unless you configured it to do so. I don't believe its default configuration should interfere with 1Password's WebSocket communications. Have you changed something that would impede this?

  • adam667
    adam667
    Community Member

    I've changed the defaults in LS to allow fewer connections to Apple & icloud, but don't believe that should impact this. I have the default "any process" rules which allow incoming connections from local network, and have added an explicit rule for FF to allow connect from 127.0.0.1. I've also checked the OS advanced firewall rules, and 1password is set to allow incoming connections, firefox isn't mentioned.

  • khad
    khad
    1Password Alumni

    Does the issue disappear if you quit Little Snitch? That would be a simple test to see if the issue is in Little Snitch or elsewhere.

  • adam667
    adam667
    Community Member

    I've used their "stop network filter" and "silent mode", and neither impacted on this. It turns out the problem was my RequestPolicy FF plugin. I think that's a useful block (after all, I don't want random websites connecting to localhost), and I wonder if (as a feature suggestion), moving to a named pipe would work as well as the localhost connections?

  • khad
    khad
    1Password Alumni

    We have a support article on configuring RequestPolicy. It sounds like you already know how to do so, but here are the step-by-step instructions:

    How To: Configure the RequestPolicy Firefox Extension

    If you would like to specifically limit access to just those localhost ports that the 1Password Helper listens on you can restrict to ports 6258, 10191, 14821, 24861, 25007, 38151, 46360, 49801, 55730 and 59483. (The 1Password Helper will first try using 6258, but if that is occupied by something else it will then try 10191, and so on. This will particularly come into play if you have more than one user on the same machine using 1Password.)

    Note that a connection to localhost/127.0.0.1 is to your own machine only. 1Password does not make any connections to the the network beyond your machine, and this one is used so that 1Password in the browser can talk to the 1Password application on your Mac for syncing data.

    There are many ways on the Mac for opening up interprocess communication (named pipe, unix socket, etc), but using a WebSocket on localhost is the only mechanism that complies with both the security requirements of browser extensions and of Apple's sandboxing rules.

    With whatever mechanism we used, 1Password extension and the 1Password Helper mutually authenticate with each other to ensure that it can't be tricked into exchanging data with the wrong instance.

    You can read more about all of the network connections that 1Password or its components make in this document:

    http://help.agilebits.com/1Password3/outbound_connections.html

    I hope that this helps clarify things. Again, by enabling Firefox to talk to WebSockets on your own computer, you aren't opening any floodgates. But if you do wish to specify particular ports you can do so using the list from above.

    Cheers!

  • adam667
    adam667
    Community Member

    Thanks!

    May I suggest that you add the syslog lines to the RP article to aid searchers?

  • MikeT
    MikeT

    Hi Adam,

    Done, thanks for your great suggestion, we appreciate it!

This discussion has been closed.