Bug 495969 - kdeconnectd dumps core due to QCA unconditionally using EVP_sha1()
Summary: kdeconnectd dumps core due to QCA unconditionally using EVP_sha1()
Status: RESOLVED NOT A BUG
Alias: None
Product: qca
Classification: Frameworks and Libraries
Component: general (other bugs)
Version First Reported In: 2.3.6
Platform: RedHat Enterprise Linux Linux
: NOR major
Target Milestone: ---
Assignee: Unassigned bugs mailing-list
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-11-08 13:59 UTC by Taketo Kabe
Modified: 2024-11-08 14:29 UTC (History)
3 users (show)

See Also:
Latest Commit:
Version Fixed In:
Sentry Crash Report:


Attachments
Patch to use EVP_sha256() instead of EVP_sha1(), if available (3.28 KB, message/rfc822)
2024-11-08 13:59 UTC, Taketo Kabe
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Taketo Kabe 2024-11-08 13:59:28 UTC
Created attachment 175649 [details]
Patch to use EVP_sha256() instead of EVP_sha1(), if available

SUMMARY
kdeconnect uses QCA to generate a self-signed certificate.
But it could not generate a proper X509 certificate by using EVP_sha1(),
but RHEL 9 family disables SHA-1 system-wide.
This causes X509 certificate lacking a signature, 
could not write a proper PEM to ~/.config/kdeconnect/certificate.pem,
and dumps core.

STEPS TO REPRODUCE
1.  pkill kdeconnectd
2. QT_LOGGING_RULES='kdeconnect.core.debug=true' /usr/libexec/kdeconnectd

OBSERVED RESULT
$ QT_LOGGING_RULES="kdeconnect.core.debug=true" /usr/libexec/kdeconnectd
kdeconnect.core: Daemon starting
kdeconnect.core: Certificate from "/home/kabe/.config/kdeconnect/certificate.pem" is not valid
kdeconnect.core: Generating certificate
kdeconnect.core: My id: "_22bbbb44_27a2_4e53_a567_084181656731_"
kdeconnect.daemon: "KDE Connect" : "Could not store certificate file: /home/kabe/.config/kdeconnect/certificate.pem"
kdeconnect.core: LanLinkProvider started
kdeconnect.core: Daemon started
kdeconnect.core: Broadcasting identity packet
Segmentation fault (core dumped)

EXPECTED RESULT
kdeconnectd continues to run


SOFTWARE/OS VERSIONS
Linux/KDE Plasma: kernel-5.14.0-427.16.1.el9_4 
KDE Plasma Version: plasma-workspace-common-5.27.11-1
KDE Frameworks Version: kf5-filesystem-5.115.0
Qt Version: qt5-qtbase-5.15.9

ADDITIONAL INFORMATION
The attached patch seems to fix this.

Problem is obseved on QCA 2.3.6, but git version still seems to have the problem.
Comment 1 Albert Astals Cid 2024-11-08 14:27:51 UTC
Why is this a bug against us and not against RHEL? They are the ones breaking our software.
Comment 2 Albert Astals Cid 2024-11-08 14:29:32 UTC
Also kdeconnect doesn't use QCA since more than a year, so I'm going to close this bug.