To quote a couple specifications: <https://tools.ietf.org/html/rfc6066#section-3> (SNI) "HostName" contains the fully qualified DNS hostname of the server, as understood by the client. The hostname is represented as a byte string using ASCII encoding without a trailing dot. <https://tools.ietf.org/html/rfc7230#section-5.4> (HTTP) A client MUST send a Host header field in all HTTP/1.1 request messages. If the target URI includes an authority component, then a client MUST send a field-value for Host that is identical to that authority component, excluding any userinfo subcomponent and its "@" delimiter (Section 2.7.1). That means that the SNI host name and HTTP Host header do not always match. The SNI host name must never have a trailing dot, but the HTTP Host header must reflect a host name that is identical to the host name of the URI, so if the URI's host has a trailing dot, the HTTP Host header must include that trailing dot. For example, if the URI of a page is <https://sni.velox.ch./>, the following values should be sent by the Web browser: SNI host: sni.velox.ch HTTP host: sni.velox.ch. However, Konqueror sends "sni.velox.ch." as the SNI host name, causing the server to throw an error. Reproducible: Always Steps to Reproduce: 0. Load any page page in which the domain has a trailing dot in the domain (for example, <https://sni.velox.ch./>) 1. Konqueror will send a malformed SNI host name 2. If the server software does not accept malformed SNI host names, the error will be visible. Actual Results: Konqueror sends "sni.velox.ch." as the SNI host name, causing the server to throw an error. Expected Results: Konqueror *should* strip the trailing dot off of the SNI host name to make it comply with RFC 6066 while leaving the trailing dot in the HTTP Host header to comply with RFC 7230.
Thank you for reporting this bug in KDE software. As it has been a while since this issue was reported, can we please ask you to see if you can reproduce the issue with a recent software version? If you can reproduce the issue, please change the status to "CONFIRMED" when replying. Thank you!
Dear Bug Submitter, This bug has been in NEEDSINFO status with no change for at least 15 days. Please provide the requested information as soon as possible and set the bug status as REPORTED. Due to regular bug tracker maintenance, if the bug is still in NEEDSINFO status with no change in 30 days the bug will be closed as RESOLVED > WORKSFORME due to lack of needed information. For more information about our bug triaging procedures please read the wiki located here: https://community.kde.org/Guidelines_and_HOWTOs/Bug_triaging If you have already provided the requested information, please mark the bug as REPORTED so that the KDE team knows that the bug is ready to be confirmed. Thank you for helping us make KDE software even better for everyone!
I'm sorry it's taking so long to get back to you on this. I'm having difficulty getting recent versions of Konqueror to play nicely with my network proxy. Guides online say to go to "Settings" -> "Configure Konqueror..." -> "Proxy", but in "Configure Konqueror...", no "Proxy" option seems to exist. I can also usually force applications through the proxy from outside the application, but Konqueror seems to somehow be bypassing this. I'm not sure how. Anyway, anything that doesn't go through the proxy gets blocked by my firewall (and has been blocked by my firewall since long before I submitted this bug report), so until I can get a more recent version of Konqueror to properly go through the local network's proxy, I'm finding it rather difficult to test said version. Basically, I need to do more research on how to get Konqueror to function with a proxy before I can retest this bug. I appologise for the inconvenience.
(In reply to Yst Dawson from comment #3) > I'm sorry it's taking so long to get back to you on this. I'm having > difficulty getting recent versions of Konqueror to play nicely with my > network proxy. Guides online say to go to "Settings" -> "Configure > Konqueror..." -> "Proxy", but in "Configure Konqueror...", no "Proxy" option > seems to exist. Which version of Konqueror and of the KDE frameworks are you using? Keep in mind that the "Proxy" page in the Konqueror settings dialog isn't provided by Konqueror itself, but by the KIO framework (which is required for Konqueror), so maybe there's something wrong with it. Could you please try checking whether a "Proxy" page exists in System Settings? If it doesn't , it means that you're missing KIO or a part of it: installing it again should fix the problem. If the page exists, could you please check whether the following files exist on your system (keep in mind that their path might be slightly different from this): - /usr/lib64/qt5/plugins/kcm_proxy.so - /usr/share/kservices5/proxy.desktop If they exist, but are in a different path, could you please post that path? It seems that Konqueror doesn't find them. If you succeed in having the Proxy page in the Konqueror settings dialog, you must be aware that since Konqueror switched its web engine from KWebKitPart to QtWebEngine (which happened some years ago), due to limitations in QtWebEngine, it can't support all of the proxy settings displayed in the dialog. It will try to detect settings it doesn't support and warn you about them.
I'm using version 5.78.0-5 of KIO, according to my package manager. I'm guessing the "-5" part is package-manager-specific and not a part of KIO's actual version number, but I'm not sure how to ask KIO for its version number directly. Konqueror is at version 20.12.0. There's no proxy settings in system settings, but I'm also not running KDE Plasma as my desktop; I'm only using the Konqueror Web browser/file manager itself. Does Konqueror not have a way to set a proxy itself and relies on a system-wide proxy setting? That's a problem for anyone not using the full Plasma experience or anyone that only wants to provide the proxy information to specific applications. I'm currently testing on my unsecure computer because my secure computer is currently way out-of-date software-wise (I've been too busy to back up all my data, wipe the machine, and install the next operating system version), so I can provide a system-wide proxy if need-be for testing this bug on my test machine, but that's something I'd be really uneasy about doing if I were testing on my main computer. Not having a system-wide proxy lets me prevent applications from accessing the network if I'm not aware that they're trying to do so. Is there no way to specify a proxy for Konqueror and only Konqueror to use? <file:///usr/share/kservices5/proxy.desktop> exists. <file:///usr/lib64/> has no subdirectories, so no file exists at <file:///usr/lib64/qt5/plugins/kcm_proxy.so>.
(In reply to Yst Dawson from comment #5) > I'm using version 5.78.0-5 of KIO, according to my package manager. I'm > guessing the "-5" part is package-manager-specific and not a part of KIO's > actual version number, but I'm not sure how to ask KIO for its version > number directly. Konqueror is at version 20.12.0. > > There's no proxy settings in system settings, but I'm also not running KDE > Plasma as my desktop; I'm only using the Konqueror Web browser/file manager > itself. Does Konqueror not have a way to set a proxy itself and relies on a > system-wide proxy setting? That's a problem for anyone not using the full > Plasma experience or anyone that only wants to provide the proxy information > to specific applications. I'm currently testing on my unsecure computer > because my secure computer is currently way out-of-date software-wise (I've > been too busy to back up all my data, wipe the machine, and install the next > operating system version), so I can provide a system-wide proxy if need-be > for testing this bug on my test machine, but that's something I'd be really > uneasy about doing if I were testing on my main computer. Not having a > system-wide proxy lets me prevent applications from accessing the network if > I'm not aware that they're trying to do so. Is there no way to specify a > proxy for Konqueror and only Konqueror to use? > > <file:///usr/share/kservices5/proxy.desktop> exists. <file:///usr/lib64/> > has no subdirectories, so no file exists at > <file:///usr/lib64/qt5/plugins/kcm_proxy.so>. (In reply to Yst Dawson from comment #5) > I'm using version 5.78.0-5 of KIO, according to my package manager. I'm > guessing the "-5" part is package-manager-specific and not a part of KIO's > actual version number, but I'm not sure how to ask KIO for its version > number directly. Konqueror is at version 20.12.0. > > There's no proxy settings in system settings, but I'm also not running KDE > Plasma as my desktop; I'm only using the Konqueror Web browser/file manager > itself. Does Konqueror not have a way to set a proxy itself and relies on a > system-wide proxy setting? That's a problem for anyone not using the full > Plasma experience or anyone that only wants to provide the proxy information > to specific applications. I'm currently testing on my unsecure computer > because my secure computer is currently way out-of-date software-wise (I've > been too busy to back up all my data, wipe the machine, and install the next > operating system version), so I can provide a system-wide proxy if need-be > for testing this bug on my test machine, but that's something I'd be really > uneasy about doing if I were testing on my main computer. Not having a > system-wide proxy lets me prevent applications from accessing the network if > I'm not aware that they're trying to do so. Is there no way to specify a > proxy for Konqueror and only Konqueror to use? > > <file:///usr/share/kservices5/proxy.desktop> exists. <file:///usr/lib64/> > has no subdirectories, so no file exists at > <file:///usr/lib64/qt5/plugins/kcm_proxy.so>. Not running Plasma is not the problem you're having (or at least, it shouldn't be). KIO is one of the libraries (actually, it's a set of libraries) which Konqueror needs to work correctly, just like the Qt libraries. You can't even build Konqueror if you don't have KIO installed. Among many other things, KIO provides several of the pages in the Konqueror settings dialog, including the Proxy one. To display the Proxy page in the settings dialog, Konqueror needs the file kcm_proxy.so to be installed on your system; moreover the file needs to be in a directory which Konqueror knows about. To check whether the file exists, you can use find: find /usr -name kcm_proxy.so After doing that: - if the file doesn't exist, I think something is broken in your installation. I suggest to try reinstalling KIO using your package manager: after that, see whether the Proxy page appears in Konqueror; if not try again checking whether the file exists or not - if the file exists, most likely the problem is that Konqueror doesn't know that it's there: could you please post the path of the file, then try running Konqueror from a terminal emulator and post any output it prints on screen?
Hmm. It's odd that that file's missing then, on both my up-to-date machine and my out-of-date machine. I tried reinstalling, which didn't work, so I looked up a list of the files the <apt:kio> package contains: <https://packages.debian.org/bullseye/amd64/kio/filelist>. It seems the Debian package doesn't contain that file. So, I searched for packages that *do* contain that file <https://packages.debian.org/search?mode=exactfilename&searchon=contents&keywords=kcm_proxy.so>. No such file exists in the packages in the official Debian repositories. From what it looks like, it's a Debian problem, then. That file has for some reason been left out of the package, preventing Konqueror on Debian from setting a proxy. I'm sort of at a loss as to how to test to see if the SNI bug is still present, given that oversight. When I get time, I guess I'll try compiling KIO, but I'm not super skilled at compiling, so we'll see how that goes. It really depends on how easy the build scripts make it and if build instructions are included.
(In reply to Yst Dawson from comment #7) > Hmm. It's odd that that file's missing then, on both my up-to-date machine > and my out-of-date machine. I tried reinstalling, which didn't work, so I > looked up a list of the files the <apt:kio> package contains: > <https://packages.debian.org/bullseye/amd64/kio/filelist>. It seems the > Debian package doesn't contain that file. So, I searched for packages that > *do* contain that file > <https://packages.debian.org/ > search?mode=exactfilename&searchon=contents&keywords=kcm_proxy.so>. No such > file exists in the packages in the official Debian repositories. From what > it looks like, it's a Debian problem, then. That file has for some reason > been left out of the package, preventing Konqueror on Debian from setting a > proxy. It may be that the name of the file has changed in more recent versions, so that in your system it has a different name. I'll look into it.
(In reply to Stefano Crocco from comment #8) > (In reply to Yst Dawson from comment #7) > > Hmm. It's odd that that file's missing then, on both my up-to-date machine > > and my out-of-date machine. I tried reinstalling, which didn't work, so I > > looked up a list of the files the <apt:kio> package contains: > > <https://packages.debian.org/bullseye/amd64/kio/filelist>. It seems the > > Debian package doesn't contain that file. So, I searched for packages that > > *do* contain that file > > <https://packages.debian.org/ > > search?mode=exactfilename&searchon=contents&keywords=kcm_proxy.so>. No such > > file exists in the packages in the official Debian repositories. From what > > it looks like, it's a Debian problem, then. That file has for some reason > > been left out of the package, preventing Konqueror on Debian from setting a > > proxy. > > It may be that the name of the file has changed in more recent versions, so > that in your system it has a different name. I'll look into it. I checked and the name of the file in your version of KIO was kcm_kio.so
Okay, I do have that file, then. It's at <file:///usr/lib/x86_64-linux-gnu/qt5/plugins/kcm_kio.so>. Running Konqueror from the command like provides the following output: yst@nova:~$ konqueror Icon theme "breeze" not found. kf.xmlgui: Shortcut for action "walletFillFormsNow" "&Fill forms now" set with QAction::setShortcut()! Use KActionCollection::setDefaultShortcut(s) instead. kf.xmlgui: Shortcut for action "walletFillFormsNow" "&Fill forms now" set with QAction::setShortcut()! Use KActionCollection::setDefaultShortcut(s) instead. qt.qpa.xcb: QXcbConnection: XCB error: 3 (BadWindow), sequence: 485, resource id: 4979294, major code: 40 (TranslateCoords), minor code: 0 When I open up the settings menu to see that the proxy section is missing, these two lines are added to the command line output: org.kde.konqueror: Unable to load the "File Management" configuration module org.kde.konqueror: Unable to load the "Web Browsing" configuration module
(In reply to Yst Dawson from comment #10) > Okay, I do have that file, then. It's at > <file:///usr/lib/x86_64-linux-gnu/qt5/plugins/kcm_kio.so>. Running Konqueror > from the command like provides the following output: > > yst@nova:~$ konqueror > Icon theme "breeze" not found. > kf.xmlgui: Shortcut for action "walletFillFormsNow" "&Fill forms now" set > with QAction::setShortcut()! Use KActionCollection::setDefaultShortcut(s) > instead. > kf.xmlgui: Shortcut for action "walletFillFormsNow" "&Fill forms now" set > with QAction::setShortcut()! Use KActionCollection::setDefaultShortcut(s) > instead. > qt.qpa.xcb: QXcbConnection: XCB error: 3 (BadWindow), sequence: 485, > resource id: 4979294, major code: 40 (TranslateCoords), minor code: 0 > > When I open up the settings menu to see that the proxy section is missing, > these two lines are added to the command line output: > > org.kde.konqueror: Unable to load the "File Management" configuration module > org.kde.konqueror: Unable to load the "Web Browsing" configuration module It seems that Konqueror can't find some .so files. Could you please tell me which Debian release are you using? I'd like to try installing it in a virtual machine and see if I can find out what's happening.
I've been trying this on Debian 11.2, but I just updated to Debian 11.5 (the latest stable version), and the issue persists. My outdated main machine is running Debian 10.13, and has the same issue in Konqueror.
(In reply to Yst Dawson from comment #12) > I've been trying this on Debian 11.2, but I just updated to Debian 11.5 (the > latest stable version), and the issue persists. My outdated main machine is > running Debian 10.13, and has the same issue in Konqueror. I just installed Debian 11.5 in a virtual machine and the settings dialog works perfectly, including the proxy page. I don't really know what could be wrong with your system. Just to be sure: - could you open the /usr/share/kservices5/proxy.desktop file with a text editor and check that the X-KDE-Library entry is kcm_kio? - could you try creating a new user and check whether you have the same problem with Konqueror if you log in as the new user? If it works, it means there's something wrong with your user's configuration - could you please try reinstalling either the kio or the Konqueror packages? If nothing works, then I'm out of ideas (short of building Konqueror and/or kio yourself). You'd better try asking on a Debian mailing list or forum to see if someone else has encountered the same problem you have.
Because I couldn't get the proxy setting to work, I had to wipe my laptop so it'd be safe to use it on an unsafe network, then had to take it down to the local library to use their network. I'll wipe it again, then get all my data transferred back onto it later so I can use it on my secure network again, I guess ... Anyway, as the website mentioned in the bug report is now down, I've found this new one: <https://check-tls.akamaized.net./>. It does have the flaw that it appears to be trying to test to see if the SNI host name and the HTTP Host header match, when according to the two RFCs mentioned in the initial bug report, they shouldn't match when the host name in the URI is fully-qualified (ends in a dot). Still, it shows the two important pieces of information: the SNI host and the HTTP Host header. It seems that the most-recent versions of Konqueror not only still have the bug, but actually introduce a second bug. The dot at the end in the hostname in the URI (if present) *MUST* be stripped in the SNI host (RFC 6066), but Konqueror does not strip this dot. This was the original bug reported. The dot at the end of the hostname in the URI (if present) *MUST NOT* be stripped in the HTTP Host header (RFC 7230), but Konqueror does strip this dot. This is a newly-introduced bug. In other words, the dot is stripped only in the place it shouldn't be stripped.