Bug 318729 - telepathy cannot connect to Jabber accounts: ktp-auth-handler(7229) TlsHandler::onCertVerifierFinished: Error verifying TLS certificate: "Cert.Unknown" - "Invalid certificate type"
Summary: telepathy cannot connect to Jabber accounts: ktp-auth-handler(7229) TlsHandle...
Status: RESOLVED FIXED
Alias: None
Product: telepathy
Classification: Frameworks and Libraries
Component: auth-handler (show other bugs)
Version: 0.6.1
Platform: Ubuntu Linux
: NOR grave
Target Milestone: Future
Assignee: Telepathy Bugs
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-04-22 17:35 UTC by Thomas Dreibholz
Modified: 2015-11-23 07:56 UTC (History)
6 users (show)

See Also:
Latest Commit:
Version Fixed In: 0.6.3


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Dreibholz 2013-04-22 17:35:22 UTC
Telepathy (version 0.6.1) under Ubuntu 13.04 fails to connect to Jabber accounts. Tried both, Google as well as Facebook XMPP. The error is "authorization failed" for the Google accounts and "network failure" for the Facebook account. All accounts work without problems in Kopete, on the system (I turned off Kopete while testing with Telepathy, of course).

Therefore, I ran "usr/lib/kde4/libexec/ktp-auth-handler --debug --persist" in the console. The output is:
ktp-auth-handler(8129) TlsHandler::onCertVerifierFinished: Error verifying TLS certificate: "Cert.Unknown" - "Invalid certificate type"
for the Google accounts. No message here for the Facebook account (it is probably not an authorization issue here).

I also tried Telepathy with Yahoo and ICQ accounts. These protocols work.



Reproducible: Always

Steps to Reproduce:
1. Using a plain Kubuntu 13.04
2. Add a Jabber account to Telepathy (tried with Google and Facebook accounts).
3. Try to connect

Actual Results:  
Telepathy cannot connect to the Jabber accounts, while Kopete has no problems with them.

Expected Results:  
Successfully connecting to the Jabber accounts (like Kopete does).

$ uname -a
Linux lupo 3.8.0-19-generic #29-Ubuntu SMP Wed Apr 17 18:16:28 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux

$ apt-show-versions|grep telepathy
gir1.2-telepathyglib-0.12/raring uptodate 0.20.2-0ubuntu1
kde-config-telepathy-accounts/raring uptodate 0.6.1-0ubuntu1
kde-telepathy/raring uptodate 0.6.0ubuntu1
kde-telepathy-approver/raring uptodate 0.6.1-0ubuntu1
kde-telepathy-auth-handler/raring uptodate 0.6.1-0ubuntu1
kde-telepathy-contact-list/raring uptodate 0.6.1-0ubuntu1
kde-telepathy-data/raring uptodate 0.6.1-0ubuntu1
kde-telepathy-desktop-applets/raring uptodate 0.6.1-0ubuntu1
kde-telepathy-filetransfe$ apt-show-versions|grep telepathy
gir1.2-telepathyglib-0.12/raring uptodate 0.20.2-0ubuntu1
kde-config-telepathy-accounts/raring uptodate 0.6.1-0ubuntu1
kde-telepathy/raring uptodate 0.6.0ubuntu1
kde-telepathy-approver/raring uptodate 0.6.1-0ubuntu1
kde-telepathy-auth-handler/raring uptodate 0.6.1-0ubuntu1
kde-telepathy-contact-list/raring uptodate 0.6.1-0ubuntu1
kde-telepathy-data/raring uptodate 0.6.1-0ubuntu1
kde-telepathy-desktop-applets/raring uptodate 0.6.1-0ubuntu1
kde-telepathy-filetransfer-handler/raring uptodate 0.6.1-0ubuntu1
kde-telepathy-integration-module/raring uptodate 0.6.1-0ubuntu1
kde-telepathy-minimal/raring uptodate 0.6.0ubuntu1
kde-telepathy-send-file/raring uptodate 0.6.1-0ubuntu1
kde-telepathy-text-ui/raring uptodate 0.6.1-0ubuntu1
libfolks-telepathy25/raring uptodate 0.8.0-1
libtelepathy-farstream-0.4-dev/raring uptodate 0.4.0-3ubuntu1
libtelepathy-farstream2/raring uptodate 0.4.0-3ubuntu1
libtelepathy-farstream3/raring uptodate 0.6.0-1
libtelepathy-glib-dev/raring uptodate 0.20.2-0ubuntu1
libtelepathy-glib0/raring uptodate 0.20.2-0ubuntu1
libtelepathy-logger-qt4-1/raring uptodate 0.6.0-0ubuntu1
libtelepathy-logger3/raring uptodate 0.8.0-0ubuntu1
libtelepathy-qt4-2/raring uptodate 0.9.3-0ubuntu4
libtelepathy-qt4-dev/raring uptodate 0.9.3-0ubuntu4
libtelepathy-qt4-farstream2/raring uptodate 0.9.3-0ubuntu4
telepathy-gabble/raring uptodate 0.16.5-0ubuntu1
telepathy-haze/raring uptodate 0.6.0-1
telepathy-idle/raring uptodate 0.1.14-1
telepathy-indicator/raring uptodate 0.3.1daily13.03.01-0ubuntu1
telepathy-logger/raring uptodate 0.8.0-0ubuntu1
telepathy-mission-control-5/raring uptodate 1:5.14.0-0ubuntu2
telepathy-salut/raring uptodate 0.8.1-1r-handler/raring uptodate 0.6.1-0ubuntu1
kde-telepathy-integration-module/raring uptodate 0.6.1-0ubuntu1
kde-telepathy-minimal/raring uptodate 0.6.0ubuntu1
kde-telepathy-send-file/raring uptodate 0.6.1-0ubuntu1
kde-telepathy-text-ui/raring uptodate 0.6.1-0ubuntu1
libfolks-telepathy25/raring uptodate 0.8.0-1
libtelepathy-farstream-0.4-dev/raring uptodate 0.4.0-3ubuntu1
libtelepathy-farstream2/raring uptodate 0.4.0-3ubuntu1
libtelepathy-farstream3/raring uptodate 0.6.0-1
libtelepathy-glib-dev/raring uptodate 0.20.2-0ubuntu1
libtelepathy-glib0/raring uptodate 0.20.2-0ubuntu1
libtelepathy-logger-qt4-1/raring uptodate 0.6.0-0ubuntu1
libtelepathy-logger3/raring uptodate 0.8.0-0ubuntu1
libtelepathy-qt4-2/raring uptodate 0.9.3-0ubuntu4
libtelepathy-qt4-dev/raring uptodate 0.9.3-0ubuntu4
libtelepathy-qt4-farstream2/raring uptodate 0.9.3-0ubuntu4
telepathy-gabble/raring uptodate 0.16.5-0ubuntu1
telepathy-haze/raring uptodate 0.6.0-1
telepathy-idle/raring uptodate 0.1.14-1
telepathy-indicator/raring uptodate 0.3.1daily13.03.01-0ubuntu1
telepathy-logger/raring uptodate 0.8.0-0ubuntu1
telepathy-mission-control-5/raring uptodate 1:5.14.0-0ubuntu2
telepathy-salut/raring uptodate 0.8.1-1
Comment 1 David Edmundson 2013-05-25 12:17:59 UTC
It seems to work here. Is there anything special about your network? Do you have any proxies normally that Kopete might be using that we're not?

From the code we raise this error if trying to match anything that is not an x509 certificate. I wonder if you're hitting a different certificate type to me.

I know this is a big request, but would it be possible for you to run ktp-auth-handler in a debugger, break on tls-cert-verifier-op.cpp:80 and print out m_certType.
or add a qDebug() at that point?
Comment 2 Omid Mo'menzadeh 2013-05-28 11:38:52 UTC
I have this problem with any XMPP account other than Google's. I don't use Facebook, but I get Network Error when trying to connect to duckgo.com's XMPP server, but it works with pidgin at least.
This is what I am talking about: https://dukgo.com/blog/using-pidgin-with-xmpp-jabber
Comment 3 David Edmundson 2013-05-28 11:44:51 UTC
@Omid 
Can we check it's the same issue.

If you run "usr/lib/kde4/libexec/ktp-auth-handler --debug --persist" in the console. Then reconnect do you get:

ktp-auth-handler(8129) TlsHandler::onCertVerifierFinished: Error verifying TLS certificate: "Cert.Unknown" - "Invalid certificate type"
Comment 4 Omid Mo'menzadeh 2013-05-28 12:11:15 UTC
(In reply to comment #3)
> @Omid 
> Can we check it's the same issue.
> 
> If you run "usr/lib/kde4/libexec/ktp-auth-handler --debug --persist" in the
> console. Then reconnect do you get:
> 
> ktp-auth-handler(8129) TlsHandler::onCertVerifierFinished: Error verifying
> TLS certificate: "Cert.Unknown" - "Invalid certificate type"

I get this error:
ktp-auth-handler(3256) TlsHandler::onCertVerifierFinished: Error verifying TLS certificate: "Cert.Unknown" - "Invalid certificate type" 
However, this might be a problem with my internet connection, in which many secure connections are dropped(active filtering, you know :|).
Comment 5 David Edmundson 2013-05-29 20:31:53 UTC
Omid, are you able to provide the information I need from Comment 1?

If not I'll add a debug line in the code so that it is in 0.6.3, and we'll have to wait until we make that.
Comment 6 Konstantin Shchepanovskyi 2013-06-04 21:10:28 UTC
(In reply to comment #5)
> Omid, are you able to provide the information I need from Comment 1?
> 
> If not I'll add a debug line in the code so that it is in 0.6.3, and we'll
> have to wait until we make that.

Hello David. I have exactly the same issue:
ktp-auth-handler(3384) TlsHandler::onCertVerifierFinished: Error verifying TLS certificate: "Cert.Unknown" - "Invalid certificate type"
Are there any progress? I can help with debugging if needed.
Comment 7 David Edmundson 2013-06-10 19:52:17 UTC
@Thomas,
do you have empathy installed?

also can one of you run:
mc-tool list.

Find the account that can't connect and run:
mc-tool show account/path

filter out the sensitive information and paste here.
Comment 8 Konstantin Shchepanovskyi 2013-06-14 21:18:01 UTC
Debug info:
Breakpoint 1, TlsCertVerifierOp::gotProperties (this=0xa24ee0, op=<optimized out>)
    at /build/buildd/ktp-auth-handler-0.6.1/tls-cert-verifier-op.cpp:81
81      in /build/buildd/ktp-auth-handler-0.6.1/tls-cert-verifier-op.cpp
(gdb) print m_certType
$3 = {static null = {<No data fields>}, static shared_null = {ref = {_q_value = 3174}, alloc = 0, size = 0, 
    data = 0x62909a <QString::shared_null+26>, clean = 0, simpletext = 0, righttoleft = 0, asciiCache = 0, capacity = 0, 
    reserved = 0, array = {0}}, static shared_empty = {ref = {_q_value = 65}, alloc = 0, size = 0, 
    data = 0x7f6c0cc9b91a <QString::shared_empty+26>, clean = 0, simpletext = 0, righttoleft = 0, asciiCache = 0, capacity = 0, 
    reserved = 0, array = {0}}, d = 0xa2c690, static codecForCStrings = 0x0}
(gdb) 

mc-tool info:
konstantin@ks-laptop:~$ mc-tool show gabble/jabber/k***********40gmail_2ecom0
     Account: gabble/jabber/k*********40gmail_2ecom0
Display Name: k*********@gmail.com
     Enabled: enabled
        Icon: jabber
    Connects: only when requested
     Service: jabber

Presences:
   Automatic: available (2) ""
     Current: offline (1) ""
   Requested: available (2) ""
    Changing: yes

Storage:
    Provider: im.telepathy.Account.Storage.UOA
  Identifier: uint32 1
Restrictions: Cannot_Set_Service

      (string) server = talk.google.com
      (string) fallback-conference-server = groupchat.google.com
        (uint) port = 5223
       (GStrv) fallback-socks5-proxies = [""]
      (string) resource = kde-telepathy-771168
        (bool) old-ssl = true
      (string) account = k*********@gmail.com
Comment 9 Konstantin Shchepanovskyi 2013-06-14 21:29:03 UTC
Sorry, here is more readable debug info:
(gdb) print m_certType
$2 = {static null = {<No data fields>}, static shared_null = {ref = {_q_value = 3134}, alloc = 0, size = 0, 
    data = 0x62909a <QString::shared_null+26>, clean = 0, simpletext = 0, righttoleft = 0, asciiCache = 0, capacity = 0, 
    reserved = 0, array = {0}}, static shared_empty = {ref = {_q_value = 65}, alloc = 0, size = 0, 
    data = 0x7faefad6a91a <QString::shared_empty+26>, clean = 0, simpletext = 0, righttoleft = 0, asciiCache = 0, capacity = 0, 
    reserved = 0, array = {0}}, d = 0x12b39c0, static codecForCStrings = 0x0}
(gdb) define printqstring
Type commands for definition of "printqstring".
End with a line saying just "end".
>    printf "(QString)0x%x (length=%i): \"",&$arg0,$arg0.d->size
>    set $i=0
>    while $i < $arg0.d->size
 >        set $c=$arg0.d->data[$i++]
 >        if $c < 32 || $c > 127
  >                printf "\\u0x%04x", $c
  >        else
  >                printf "%c", (char)$c
  >        end
 >    end
>    printf "\"\n"
>end
(gdb) printqstring m_certType
(QString)0x12ba0a8 (length=4): "x509"
(gdb)
Comment 10 Konstantin Shchepanovskyi 2013-06-14 21:45:55 UTC
if(m_certType.compare(QLatin1String("\"x509\""), Qt::CaseInsensitive)) { ...

m_certType = "x509", but should be "\"x509\""
Comment 11 Daniele E. Domenichelli 2013-06-14 23:58:41 UTC
(In reply to comment #8)
>         Icon: jabber
>      Service: jabber

Service should be google-talk... Did you use our accounts GUI to create the account? Or did you use Empathy? If you used our, did you choose to create a "jabber" account or a "Google Talk" account?

> Storage:
>  Provider: im.telepathy.Account.Storage.UOA
>  Identifier: uint32 1
>  Restrictions: Cannot_Set_Service

Also I'm quite sure that we don't use the Storage interface, so this definitely looks like an account created from Empathy

Can you try deleting the account and recreating it from our gui?
Comment 12 Konstantin Shchepanovskyi 2013-06-15 09:20:54 UTC
(In reply to comment #7)
> do you have empathy installed?
Yes, I have Empathy installed.  I'm using Ubuntu 13.04 + "kubuntu-full" package.

(In reply to comment #11)
> Can you try deleting the account and recreating it from our gui?
I removed all old acounts and created the new one using "KDE IM Contacts", choosed "Google Talk" account:
konstantin@ks-laptop:~$ mc-tool show gabble/jabber/k**********_40gmail_2ecom1
     Account: gabble/jabber/k***********_40gmail_2ecom1
Display Name: k***********@gmail.com
     Enabled: enabled
        Icon: im-jabber
    Connects: only when requested
     Service: google-talk

Presences:
   Automatic: available (2) ""
     Current: offline (1) ""
   Requested: available (2) ""
    Changing: yes

Storage:
    Provider: im.telepathy.Account.Storage.UOA
  Identifier: uint32 3
Restrictions: Cannot_Set_Service

      (string) fallback-conference-server = groupchat.google.com
        (bool) old-ssl = true
      (string) server = talk.google.com
      (string) resource = kde-telepathy-771168
        (uint) port = 5223
      (string) account = k***********@gmail.com

Result is the same:
konstantin@ks-laptop:~$ /usr/lib/kde4/libexec/ktp-auth-handler --debug --persist
ktp-auth-handler(7240) TlsHandler::onCertVerifierFinished: Error verifying TLS certificate: "Cert.Unknown" - "Invalid certificate type"
Comment 13 Bartosz 2013-06-21 12:12:32 UTC
I had the same problem and I've solved it today. Try following steps:

1. Run KDE Wallet Manager
2. Delete the kdewallet Wallet
3. Log out from your computer account and log in again (or reboot computer)

Telepathy will require new wallet and, after creating one, will ask for passwords to your chat accounts. And it works :)

If it doesn't work, try it again, but set the empty password for new wallet (leave the fields empty). It worked for me.
Comment 14 David Edmundson 2013-07-19 12:39:42 UTC
Git commit 048ae61e33d4026b24d6da474dba37f4c5868c8b by David Edmundson.
Committed on 15/07/2013 at 13:05.
Pushed by davidedmundson into branch 'kde-telepathy-0.6'.

Correctly search to see if we support the certificate type
FIXED-IN: 0.6.3
REVIEWED-BY: Daniele Domenichelli

M  +5    -2    tls-cert-verifier-op.cpp

http://commits.kde.org/telepathy-auth-handler/048ae61e33d4026b24d6da474dba37f4c5868c8b