Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.

Bug 521911

Summary: qt: list of trusted CA certificates should not be compiled into library
Product: [Fedora] Fedora Reporter: Tomas Hoger <thoger>
Component: qtAssignee: Than Ngo <than>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: rawhideCC: jorton, kevin, ltinkl, rdieter, than
Target Milestone: ---Keywords: Patch
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: 4.5.3-7.fc10 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 734444 (view as bug list) Environment:
Last Closed: 2009-09-08 18:12:55 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 521902    
Attachments:
Description Flags
proposed patch to use system ca-certificates, using debian's as guide none

Description Tomas Hoger 2009-09-08 16:49:56 UTC
Description of problem:
List of trusted certificates used by default by QtSslSocket (ca-bundle.crt from sources) is compiled into the QtNetwork.so library, not allowing users to customize list of trusted CAs without re-compiling Qt.

Separate file with trusted certificates provides better manageability, but may better be added upstream.  Preferably, usage of "system" bundle from ca-certificates may be a reasonable default.

Note: Impact of this problem is lowered by the fact that most KDE applications use certificate bundle shipped with kdelibs, provided as separate file.  However, there reportedly are applications that only use Qt's bundle by default:

  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=530532

According to the bug, Qt had a (broken) support for loading system CA bundle, which was removed in recent Qt version (in between 4.5.2 and 4.5.3, it seems; search path did not include /etc/pki directories used by Fedora).


Steps to Reproduce:
$ strings /usr/lib/libQtNetwork.so.4

Comment 1 Kevin Kofler 2009-09-08 17:07:21 UTC
I think we should patch it to use the system ca-certificates. Nokia is excessively paranoid about backwards compatibility and it seems they want to keep bug-compatibility here (the code was not just broken, it was completely disabled because the #ifdef had a typo). :-( (This is quite silly, as they made some "fixes" in 4.5.0 and even 4.5.1 which actually broke things, but they don't want to make this change which is clearly a bugfix.)

Comment 2 Rex Dieter 2009-09-08 17:17:37 UTC
agreed (provided it's tested to be reliable).

Comment 3 Rex Dieter 2009-09-08 17:47:40 UTC
Created attachment 360112 [details]
proposed patch to use system ca-certificates, using debian's as guide

Comment 4 Rex Dieter 2009-09-08 18:12:55 UTC
included in qt-4.5.2-15 , test away.

Comment 5 Joe Orton 2009-09-09 08:39:19 UTC
Thanks for looking into this Rex!

My reading of that patch is that it's going to load any cert matching:

  /etc/pki/tls/certs/*.crt

and treat them as trusted - is that correct?  If so, that's not desirable - it should really just be the file:

  /etc/pki/tls/certs/ca-bundle.crt

Comment 6 Tomas Hoger 2009-09-09 09:06:43 UTC
Besides Joe's comment, there are 2 possible catches here:

- The part of the code fixed by the patch has been removed upstream completely, as was indicated in the Debian bug report:

http://qt.gitorious.org/qt/qt/blobs/master/src/network/ssl/qsslsocket_openssl.cpp#line483

So if that's way we're going to use, we'll need to carry on that code junk as a whole in future Qt versions (it can possibly be simplified though to just load one file instead of looping through all *.crt)

- I guess this patch will not remove the compiled-in bundle, rather corrects Qt to use system one too.  While this makes it easier to add more trusted CAs, it does not allow removing users consider untrusted from Qt's bundle.  Please correct me if I'm wrong at this point.

Comment 7 Than Ngo 2009-09-09 12:18:39 UTC
> Description of problem:
> List of trusted certificates used by default by QtSslSocket (ca-bundle.crt from
> sources) is compiled into the QtNetwork.so library, not allowing users to
> customize list of trusted CAs without re-compiling Qt.
> 
> Separate file with trusted certificates provides better manageability, but may
> better be added upstream.  Preferably, usage of "system" bundle from
> ca-certificates may be a reasonable default.
> 
> Note: Impact of this problem is lowered by the fact that most KDE applications
> use certificate bundle shipped with kdelibs, provided as separate file. 
> However, there reportedly are applications that only use Qt's bundle by
> default:
> 
>   http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=530532
> 
> According to the bug, Qt had a (broken) support for loading system CA bundle,
> which was removed in recent Qt version (in between 4.5.2 and 4.5.3, it seems;
> search path did not include /etc/pki directories used by Fedora).
> 
> 
> Steps to Reproduce:
> $ strings /usr/lib/libQtNetwork.so.4  

it's sadly that there's a typo bug in #ifdef that makes Qt always uses the own bundle which is compiled into library. The obove debian patch fixes the typo bug, so that the systemwide bundle will be used by default. If there's no systemwide bundle found it will fall back to qt bundle.



(In reply to comment #5)

> My reading of that patch is that it's going to load any cert matching:
> 
>   /etc/pki/tls/certs/*.crt
> 
> and treat them as trusted - is that correct?  If so, that's not desirable - it

the obove patches will load only one cert matching. If there're many bundles in the directories the fisrt matching will be loaded.


> should really just be the file:
> 
>   /etc/pki/tls/certs/ca-bundle.crt  

is there any reason we only read the file ca-bundle.crt ?

Comment 8 Than Ngo 2009-09-09 12:24:46 UTC
sorry, the debian patch gives a list of bundle back, not the first maching!
it's wrong. I will fix it.

Comment 9 Rex Dieter 2009-09-09 12:32:24 UTC
I thought it was desirable to have modular loading of CA certs, ie, drop certs into /etc/pki/tls/certs without having to manually modify ca-bundle.crt, akin to other similar stuff like /etc/ld.so.conf.d/  /etc/prelink.conf.d /etc/profile.d/

Comment 10 Than Ngo 2009-09-09 12:45:30 UTC
(In reply to comment #6)
> Besides Joe's comment, there are 2 possible catches here:
> 
> - The part of the code fixed by the patch has been removed upstream completely,
> as was indicated in the Debian bug report:
> 
> http://qt.gitorious.org/qt/qt/blobs/master/src/network/ssl/qsslsocket_openssl.cpp#line483
> 
> So if that's way we're going to use, we'll need to carry on that code junk as a
> whole in future Qt versions (it can possibly be simplified though to just load
> one file instead of looping through all *.crt)
> 

it seems the future qt only loads the own qt-ca-bundle.crt. If we want qt to load the systemwide *.crt, we have to carry on this code.
The question is do we want it? it's really needed? 


> - I guess this patch will not remove the compiled-in bundle, rather corrects Qt
> to use system one too.  While this makes it easier to add more trusted CAs, it
> does not allow removing users consider untrusted from Qt's bundle.  Please
> correct me if I'm wrong at this point.  

this debian patch doesn't remove the  compiled-in bundle, it only correct to use system one

Comment 11 Fedora Update System 2009-10-11 23:49:16 UTC
qt-4.5.3-4.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/qt-4.5.3-4.fc11

Comment 12 Fedora Update System 2009-11-04 12:03:14 UTC
qt-4.5.3-7.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 13 Fedora Update System 2009-11-04 12:35:28 UTC
qt-4.5.3-7.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.