Bug 485323

Summary: Underscore in deviceID shall be sanitized in SNI before sending ClientHello
Product: [Applications] kdeconnect Reporter: Keyu Tao <taoky1999>
Component: ios-applicationAssignee: Lucas W. <lucas.wang>
Status: REPORTED ---    
Severity: normal    
Priority: NOR    
Version First Reported In: unspecified   
Target Milestone: ---   
Platform: Apple App Store   
OS: iOS   
Latest Commit: Version Fixed/Implemented In:
Sentry Crash Report:

Description Keyu Tao 2024-04-10 12:34:55 UTC
***
If you're not sure this is actually a bug, instead post about it at https://discuss.kde.org

If you're reporting a crash, attach a backtrace with debug symbols; see https://community.kde.org/Guidelines_and_HOWTOs/Debugging/How_to_create_useful_crash_reports
***

SUMMARY

In LanLinkProvider.m didReadData(), deviceId received from computer is directly used in tlsSettings. For implementations following https://invent.kde.org/network/kdeconnect-meta/-/merge_requests/4, the deviceId would contain underscore. However, gnutls does not accept names with underscore (<https://github.com/gnutls/gnutls/blob/49f4ae2109b7cc969539b90be92a5844bbe7b322/lib/str.h#L71>), and implementations using that would report "A disallowed SNI server name has been received" to users.

I did not test with official KDE connect server implementation. Testing with https://github.com/andyholmes/valent (main branch) reports me this and takes me some time to read code.

STEPS TO REPRODUCE
1. Install KDE Connect from iOS App Store on an iPhone
2. On computer, compile valent and run. Start wireshark and capture
3. Try pair

OBSERVED RESULT

Both sides show nothing. Wireshark shows the TCP connection FINs after the Client Hello from iPhone, with SNI equals to deviceID sent from server which contains underscore.

EXPECTED RESULT

SNI in ClientHello does not contain characters that gnutls does not accept, and connects successfully.

SOFTWARE/OS VERSIONS
Windows: N/A
macOS: N/A
Linux/KDE Plasma: Arch Linux + GNOME 46
(available in About System)
KDE Plasma Version: N/A
KDE Frameworks Version: N/A
Qt Version: N/A
iOS client version: 0.3.0 (9)

ADDITIONAL INFORMATION