Bug 718619 - SSL/TLS encryption not usable due to gnutls misuse
Summary: SSL/TLS encryption not usable due to gnutls misuse
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: libgadu
Version: 15
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Dominik 'Rathann' Mierzejewski
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-07-04 03:03 UTC by shaftanista
Modified: 2011-07-15 01:27 UTC (History)
2 users (show)

Fixed In Version: libgadu-1.11.0-2.fc15
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-07-15 01:27:03 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description shaftanista 2011-07-04 03:03:21 UTC
Description of problem:
libgadu in Fedora is compiled with gnutls support, but the initialization is badly implemented, resulting in being unable to handshake.

Version-Release number of selected component (if applicable):
Both 1.10.1 from main repository and 1.11.0 from updates-testing both exhibit the same problem.

How reproducible:
Open any application that uses libgadu and try to connect with SSL enabled.

Steps to Reproduce:
1. Open kadu version 0.9.2 (installed from these RPMs: http://przemal.net/pub/rpm/kadu/)
2. Ensure the "Użyj szyfrowanego połączenia" ("Use encrypted connection") checkbox is checked in account settings
3. Try to connect
  
Actual results:
An error message saying "Połączenie niemożliwe, błąd negocjacji TLS" ("Unable to connect, TLS handshake error").

Expected results:
Successful connection.

Additional info:
After few hours of debugging, I found what is probably the reason:

libgadu.c:884 (in 1.11.0):
gnutls_priority_set_direct(tmp->session, "NORMAL:-VERS-TLS", NULL);

gnutls (version 2.10.5 used in Fedora 15), during the interpretation of the string, at gnutls_priority.c:687, makes a call to gnutls_protocol_get_id() with "TLS" as the argument. gnutls_protocol_get_id (gnutls_algorithms.c:1202) performs a lookup in an array of protocol names (sup_versions at gnutls_algorithms.c:116), which does not contain "TLS". Hence, "TLS" is an incorrect value for "VERS-" construct.

The gnutls_priority_set_direct() call fails (silently, because its errors are not caught at libgadu.c:884), causing the protocol table to be left uninitialized, and then when libgadu invokes gnutls_handshake() at events.c:771, it cannot find a usable protocol (it happens at _gnutls_version_max() - gnutls_algorithms.c:1156 - called from _gnutls_send_client_hello() at gnutls_handshake.c:2003).

I don't know anything about using gnutls properly, so I won't post a patch proposal, but I'd try tweaking with the "NORMAL:-VERS-TLS" string at libgadu.c:884. I'm not sure what is the commented line at libgadu.c:885, maybe that's a working version? ;)

Anyway, thanks in advance for a fix.

Comment 1 Dominik 'Rathann' Mierzejewski 2011-07-12 19:44:41 UTC
Thanks for the bug report and the detailed analysis. I've just found out that this has been fixed upstream, so I'll pull their patch and roll out new packages soon.

Comment 2 Fedora Update System 2011-07-13 15:00:40 UTC
libgadu-1.11.0-2.fc15 has been submitted as an update for Fedora 15.
https://admin.fedoraproject.org/updates/libgadu-1.11.0-2.fc15

Comment 3 shaftanista 2011-07-13 18:52:30 UTC
I just downloaded and installed 1.11.0-2 from koji and confirm kadu connecting with SSL enabled. Connection with GG server made on port 443, so I believe it's actually through SSL. Thanks!

Comment 4 Fedora Update System 2011-07-13 19:28:32 UTC
Package libgadu-1.11.0-2.fc15:
* should fix your issue,
* was pushed to the Fedora 15 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing libgadu-1.11.0-2.fc15'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/libgadu-1.11.0-2.fc15
then log in and leave karma (feedback).

Comment 5 Fedora Update System 2011-07-15 01:26:57 UTC
libgadu-1.11.0-2.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.