[BUG] RPPairing TLS tunnel times out after TCP connection succeeds (LC+SS nightly) #12

Describe the bug

The built-in SideStore bundled with LiveContainer + SideStore nightly repeatedly fails to establish the Remote Pairing (RPPairing) TLS tunnel.

The pairing-file parser is invoked successfully, and SideStore discovers the Remote Pairing service. TCP connectivity to the dynamically discovered endpoint also succeeds. However, the TLS tunnel repeatedly fails with:

InternalError("TLS tunnel: Operation Timeout")

This prevents SideStore from retrieving the device UDID and breaks operations that require a connection to the device, including app refresh and the Developer Disk Image (DDI) check.

I am reporting this specifically in the LiveContainer/SideStore repository because this is the SideStore fork bundled in the LiveContainer + SideStore build I want to use.

Environment

• LiveContainer: 3.8.11-Release (main/9108ae6)
• SideStore: 0.7.0-20261017.511+ee3cc16a
• iOS: 18.7.9 (22H355)
• Installation method: iLoader → Import IPA
• Connection mode: Local VPN (.localVPN)
• VPN interface: utun4
• VPN interface IP: 10.7.1.1
• Derived tunnel peer IP: 10.7.0.1
• Pairing-file payload length: 439 bytes
• Remote Pairing port discovered by Bonjour: 65489

Steps to reproduce

1. Install the LiveContainer + SideStore nightly IPA using iLoader's Import IPA option.
2. Open LiveContainer and launch its built-in SideStore.
3. Configure the Remote Pairing pairing file.
4. Start the Local VPN connection used by SideStore.
5. Open SideStore's Settings and trigger an operation that requires device access, such as checking the device connection, checking DDI status, or refreshing an app.
6. Observe the console logs.

Actual result

The connection fails despite successful TCP connectivity to the discovered endpoint.

The relevant sequence is:

1. SideStore loads the pairing-file payload.
2. The initial TCP probe to 10.7.0.1:49152 fails.
3. Bonjour discovers a Remote Pairing service and identifies port 65489.
4. TCP connectivity to 10.7.0.1:65489 succeeds.
5. tunnel_create_rppairing_with_options is called.
6. The TLS tunnel times out.
7. fetchUDID() fails, leaving the device UDID unavailable.
8. Operations that depend on the device connection fail.

The same TLS timeout occurs repeatedly during fetchUDID(), isDDIMounted(), and app refresh.

Relevant console logs

The following lines are from the current build:

[IdeviceGateway] start() calling rp_pairing_file_from_bytes

[IdeviceGateway] start() called, pairingFileContent length: 439

[minimuxer] [net] testTCP(10.7.0.1:65489) -> connected (took 1ms)

[IdeviceGateway] ensureRPConnection() calling tunnel_create_rppairing_with_options with deviceEndpointIp: 10.7.0.1:65489

[IdeviceGateway] ensureRPConnection() tunnel_create_rppairing failed with code: 16, subCode: 0, message: InternalError("TLS tunnel: Operation Timeout")

A subsequent app refresh produces:

[AppManager] refresh() called for apps: ["com.kdt.livecontainer"]

[IdeviceGateway] ensureRPConnection() calling tunnel_create_rppairing_with_options with deviceEndpointIp: 10.7.0.1:65489

[IdeviceGateway] ensureRPConnection() tunnel_create_rppairing failed with code: 16, subCode: 0, message: InternalError("TLS tunnel: Operation Timeout")

[Operation Summary]
| Operation: refresh                            |
| App ID: com.kdt.livecontainer                  |
| Status: FAILED                                 |
| Error: Invalid parameters:                     |
| FetchUDID: InternalError("TLS tunnel: Operation Timeout") |

The full redacted console log is attached.

Troubleshooting already performed

I have tested the following:

• Regenerating/resetting the pairing file.
• Reinstalling the relevant builds and restarting the VPN/device.
• Trying different Wi-Fi networks.
• Trying different tunnel configurations, including Local VPN and WireGuard.
• Testing the available Minimuxer backends.
• Testing standalone SideStore stable and nightly.
• Testing LiveContainer + SideStore stable and nightly.

The results differ by build:

• Standalone SideStore stable: crashes during login.
• Standalone SideStore nightly: pairing/connection problem.
• LiveContainer + SideStore stable: also has problems.
• LiveContainer + SideStore nightly: installs and launches, but the RPPairing TLS tunnel repeatedly times out as described above.

I specifically want to get the LiveContainer + SideStore nightly build working.

Related reports

I previously reported similar symptoms in:

• SideStore/SideStore#1592 — RPPairing TLS tunnel times out after successful TCP connectivity.
• LiveContainer/LiveContainer#1619 — .rppairing UDID not found despite a loaded pairing file.

I am opening this issue in the LiveContainer/SideStore repository because the current build uses this fork, and I want to investigate the behavior of the exact bundled SideStore implementation.

The installed nightly is 0.7.0-20261017.511+ee3cc16a. Its release changelog starts at 30db41d8, associated with the earlier commit titled "temporary solution to the pairing file issue." However, the TLS timeout remains reproducible in my installed build.

Expected behavior

SideStore should establish the RPPairing TLS tunnel after discovering the correct endpoint and connecting to it, allowing fetchUDID() and other device operations to complete successfully.

Questions

Could you investigate why tunnel_create_rppairing_with_options continues to time out after TCP connectivity succeeds?

In particular:

1. Is the pairing implementation in this fork expected to establish a TLS tunnel successfully with this 439-byte pairing-file payload?
2. Are any additional changes required in the pairing implementation, Minimuxer, or Remote Pairing dependencies?
3. Is there any additional diagnostic information that would help distinguish a pairing-credential/handshake problem from a tunnel implementation problem?

I am not attaching the pairing file itself because it contains private cryptographic key material.

Attachments

Redacted console log from the current build:

LiveContainer_SideStore_RPPairing_TLS_timeout_redacted.log