Bug 485323 - Underscore in deviceID shall be sanitized in SNI before sending ClientHello
Summary: Underscore in deviceID shall be sanitized in SNI before sending ClientHello
Status: REPORTED
Alias: None
Product: kdeconnect
Classification: Applications
Component: ios-application (other bugs)
Version First Reported In: unspecified
Platform: Apple App Store iOS
: NOR normal
Target Milestone: ---
Assignee: Lucas W.
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-04-10 12:34 UTC by Keyu Tao
Modified: 2024-04-10 12:34 UTC (History)
0 users

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Keyu Tao 2024-04-10 12:34:55 UTC
***
If you're not sure this is actually a bug, instead post about it at https://discuss.kde.org

If you're reporting a crash, attach a backtrace with debug symbols; see https://community.kde.org/Guidelines_and_HOWTOs/Debugging/How_to_create_useful_crash_reports
***

SUMMARY

In LanLinkProvider.m didReadData(), deviceId received from computer is directly used in tlsSettings. For implementations following https://invent.kde.org/network/kdeconnect-meta/-/merge_requests/4, the deviceId would contain underscore. However, gnutls does not accept names with underscore (<https://github.com/gnutls/gnutls/blob/49f4ae2109b7cc969539b90be92a5844bbe7b322/lib/str.h#L71>), and implementations using that would report "A disallowed SNI server name has been received" to users.

I did not test with official KDE connect server implementation. Testing with https://github.com/andyholmes/valent (main branch) reports me this and takes me some time to read code.

STEPS TO REPRODUCE
1. Install KDE Connect from iOS App Store on an iPhone
2. On computer, compile valent and run. Start wireshark and capture
3. Try pair

OBSERVED RESULT

Both sides show nothing. Wireshark shows the TCP connection FINs after the Client Hello from iPhone, with SNI equals to deviceID sent from server which contains underscore.

EXPECTED RESULT

SNI in ClientHello does not contain characters that gnutls does not accept, and connects successfully.

SOFTWARE/OS VERSIONS
Windows: N/A
macOS: N/A
Linux/KDE Plasma: Arch Linux + GNOME 46
(available in About System)
KDE Plasma Version: N/A
KDE Frameworks Version: N/A
Qt Version: N/A
iOS client version: 0.3.0 (9)

ADDITIONAL INFORMATION