Ubuntu
knewstuff package

[SRU to impish] Mitigate KNS load on KDE servers

Bug #1962157 reported by Rik Mills
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
knewstuff (Ubuntu)
New
Undecided
Unassigned
Impish
Fix Released
Undecided
Unassigned

Bug Description

See: https://mail.kde.org/pipermail/distributions/2022-February/001140.html

Dear distributors,
In the last few days, we have been looking into mitigating the impact
of Discover against certain KDE web services.

Some of the problems can be addressed in the service itself but not
them entirely, so it would be useful if the following changes were
backported into your own packaging. We have already included it in our
stable branches but on the distributions that ship unsupported
versions of our software it would be useful you can apply these
patches.

https://invent.kde.org/frameworks/knewstuff/-/commit/c8165b7a0d622e318b3353ccf257a8f229dd12c9
https://invent.kde.org/frameworks/knewstuff/-/commit/e1c6f2bf383876a31cd3e3f9e6edcaa19dc0a7dd

https://invent.kde.org/plasma/plasma-desktop/-/commit/b85cf34298c274b5f16cb6c2aead7b87f0dabbb8
https://invent.kde.org/plasma/discover/-/commit/6257e21c313e21afd80d101d24c78d66621236b1

If you feel unsure about the patch on a specific branch, feel free to
contact me here or in private and I will backport it if necessary.

Impact]

 * Effectively a DDOS on some KDE servers that were not intended to take this traffic

[Test Plan]

 * Launch one of the affected KCMs via the command line with kcmshell5.
 * in the kcm, hit the "get new" something button.
 * Check that a warning message that the "Please make sure" << configfile << "has ProvidersUrl=https://autoconfig.kde.org/ocs/providers.xml" message is displayed indicating that the correct providers url has been substituted.
 * Check that resources are displayed to choose from and download.

e.g.

$ kcmshell5 kcm_kwin_effects
$ kcmshell5 kwinscripts
$ kcmshell5 kwintabbox

[Where problems could occur]

 * KNS enabled apps could fail to fetch resources, crash etc. It will need to be tested with a reasonable sample of these that this does not happen.

See original description
Rik Mills (rikmills)
description: updated
Rik Mills (rikmills)
Changed in knewstuff (Ubuntu Impish):
status: New → In Progress
Revision history for this message
Łukasz Zemczak (sil2100) wrote : Please test proposed package

Hello Rik, or anyone else affected,

Accepted knewstuff into impish-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/knewstuff/5.86.0-0ubuntu3.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-impish to verification-done-impish. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-impish. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in knewstuff (Ubuntu Impish):
status: In Progress → Fix Committed
tags: added: verification-needed verification-needed-impish
Rik Mills (rikmills)
description: updated
description: updated
Revision history for this message
Rik Mills (rikmills) wrote :

Tests successful for me :)

description: updated
Revision history for this message
Marco Parillo (marco-parillo) wrote :
Download full text (3.8 KiB)

All three applications appeared to work, but I did not see the expected warning message:

$ kcmshell5 kcm_kwin_effects
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/kirigami.2/templates/OverlaySheet.qml:220:38: QML FocusScope: Binding loop detected for property "contentItemMaximumWidth"
kf.kirigami: Units.devicePixelRatio is deprecated (since 5.86 ): This returns 1 when using Qt HiDPI scaling.
QCoreApplication::postEvent: Unexpected null receiver
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/kirigami.2/Page.qml:448: TypeError: Cannot read property 'globalToolBar' of null
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/kirigami.2/AbstractApplicationItem.qml:94: TypeError: Cannot read property 'position' of null
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/kirigami.2/AbstractApplicationItem.qml:93: TypeError: Cannot read property 'background' of null
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/newstuff/qml/Page.qml:155: TypeError: Cannot read property 'useLabel' of null
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/newstuff/qml/Dialog.qml:129: TypeError: Cannot read property 'uploadEnabled' of null
QCoreApplication::postEvent: Unexpected null receiver
kf.kirigami: Units.devicePixelRatio is deprecated (since 5.86 ): This returns 1 when using Qt HiDPI scaling.
kf.kirigami: Previous message repeats 71 times.
kio_http_cache_cleaner: Already running!
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/kirigami.2/templates/OverlaySheet.qml:220:38: QML FocusScope: Binding loop detected for property "contentItemMaximumWidth"
kf.kirigami: Units.devicePixelRatio is deprecated (since 5.86 ): This returns 1 when using Qt HiDPI scaling.
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/kirigami.2/Page.qml:448: TypeError: Cannot read property 'globalToolBar' of null
kf.kirigami: Units.devicePixelRatio is deprecated (since 5.86 ): This returns 1 when using Qt HiDPI scaling.
kf.kirigami: Previous message repeats 35 times.

$ kcmshell5 kwinscripts
kf.coreaddons: "Could not load plugin from "
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/kirigami.2/templates/OverlaySheet.qml:220:38: QML FocusScope: Binding loop detected for property "contentItemMaximumWidth"
kf.kirigami: Units.devicePixelRatio is deprecated (since 5.86 ): This returns 1 when using Qt HiDPI scaling.
QCoreApplication::postEvent: Unexpected null receiver
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/kirigami.2/AbstractApplicationItem.qml:94: TypeError: Cannot read property 'position' of null
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/kirigami.2/AbstractApplicationItem.qml:93: TypeError: Cannot read property 'background' of null
mparillo@mparillo-virtual-machine:~$ kcmshell5 kwinscripts

$ kcmshell5 kwintabbox
kf.coreaddons: "Could not load plugin from "
load shortcut for "Walk Through Windows"
load shortcut for "Walk Through Windows (Reverse)"
load shortcut for "Walk Through Windows of Current Application"
load shortcut for "Walk Through Windows of Current Application (Reverse)"
load shortcut for "Walk Through Windows Alternative"
load shortcut for "Walk Through Windows Alternative (Reverse)"
load shortcut for "Walk Through Windows of Current Application Alternati...

Read more...

Revision history for this message
Rik Mills (rikmills) wrote : Re: [Bug 1962157] Re: [SRU to impish] Mitigate KNS load on KDE servers

On 01/03/2022 23:52, Marco Parillo wrote:
> All three applications appeared to work, but I did not see the expected
> warning message:

Do you have the knewstuff packages from proposed installed?

https://launchpad.net/ubuntu/+source/knewstuff/5.86.0-0ubuntu3.1

If you do, you should see as I do:

kcmshell5 kwinscripts
kf.coreaddons: "Could not load plugin from "
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/kirigami.2/templates/OverlaySheet.qml:220:38:
QML FocusScope: Binding loop detected for property "contentItemMaximumWidth"
kf.kirigami: Units.devicePixelRatio is deprecated (since 5.86 ): This
returns 1 when using Qt HiDPI scaling.
kf.newstuff.core: Please make sure "kwinscripts.knsrc" has
ProvidersUrl=https://autoconfig.kde.org/ocs/providers.xml
QCoreApplication::postEvent: Unexpected null receiver
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/kirigami.2/AbstractApplicationItem.qml:94:
TypeError: Cannot read property 'position' of null
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/kirigami.2/AbstractApplicationItem.qml:93:
TypeError: Cannot read property 'background' of null
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/kirigami.2/AbstractApplicationItem.qml:94:
TypeError: Cannot read property 'position' of null
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/kirigami.2/AbstractApplicationItem.qml:93:
TypeError: Cannot read property 'background' of null

The:

kf.newstuff.core: Please make sure "kwinscripts.knsrc" has
ProvidersUrl=https://autoconfig.kde.org/ocs/providers.xml

being the important part

Revision history for this message
Rik Mills (rikmills) wrote :

In addition to testing and verifying the KCMs that were using the wrong endpoint, I have spent some time trying other Knewstuff enabled pasrts of plasma and apps. All seem to still be working ok.

Revision history for this message
Marco Parillo (marco-parillo) wrote :
Download full text (4.0 KiB)

Successful test.

I installed the proposed pocket knewstuff packages with Discover > Settings > Software Sources > Updates Tab > Check Pre-released updates. Then refreshed and upgraded and rebooted. Afterwards:

mparillo@mparillo-virtual-machine:~$ kcmshell5 kcm_kwin_effects
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/kirigami.2/templates/OverlaySheet.qml:220:38: QML FocusScope: Binding loop detected for property "contentItemMaximumWidth"
kf.kirigami: Units.devicePixelRatio is deprecated (since 5.86 ): This returns 1 when using Qt HiDPI scaling.
QCoreApplication::postEvent: Unexpected null receiver
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/kirigami.2/Page.qml:448: TypeError: Cannot read property 'globalToolBar' of null
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/kirigami.2/AbstractApplicationItem.qml:94: TypeError: Cannot read property 'position' of null
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/kirigami.2/AbstractApplicationItem.qml:93: TypeError: Cannot read property 'background' of null
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/newstuff/qml/Page.qml:155: TypeError: Cannot read property 'useLabel' of null
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/newstuff/qml/Dialog.qml:129: TypeError: Cannot read property 'uploadEnabled' of null
QCoreApplication::postEvent: Unexpected null receiver
kf.newstuff.core: Please make sure "kwineffect.knsrc" has ProvidersUrl=https://autoconfig.kde.org/ocs/providers.xml
kf.kirigami: Units.devicePixelRatio is deprecated (since 5.86 ): This returns 1 when using Qt HiDPI scaling.
kf.kirigami: Previous message repeats 71 times.
kf.kirigami: Units.devicePixelRatio is deprecated (since 5.86 ): This returns 1 when using Qt HiDPI scaling.
mparillo@mparillo-virtual-machine:~$
mparillo@mparillo-virtual-machine:~$ kcmshell5 kwinscripts
kf.coreaddons: "Could not load plugin from "
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/kirigami.2/templates/OverlaySheet.qml:220:38: QML FocusScope: Binding loop detected for property "contentItemMaximumWidth"
kf.kirigami: Units.devicePixelRatio is deprecated (since 5.86 ): This returns 1 when using Qt HiDPI scaling.
kf.newstuff.core: Please make sure "kwinscripts.knsrc" has ProvidersUrl=https://autoconfig.kde.org/ocs/providers.xml
QCoreApplication::postEvent: Unexpected null receiver
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/kirigami.2/AbstractApplicationItem.qml:94: TypeError: Cannot read property 'position' of null
file:///usr/lib/x86_64-linux-gnu/qt5/qml/org/kde/kirigami.2/AbstractApplicationItem.qml:93: TypeError: Cannot read property 'background' of null
mparillo@mparillo-virtual-machine:~$
mparillo@mparillo-virtual-machine:~$ kcmshell5 kwintabbox
kf.coreaddons: "Could not load plugin from "
load shortcut for "Walk Through Windows"
load shortcut for "Walk Through Windows (Reverse)"
load shortcut for "Walk Through Windows of Current Application"
load shortcut for "Walk Through Windows of Current Application (Reverse)"
load shortcut for "Walk Through Windows Alternative"
load shortcut for "Walk Through Windows Alternative (Reverse)"
load shortcut for "Walk Through Windows of Current Application Alternative"
load shortcut for "W...

Read more...

Rik Mills (rikmills)
tags: added: verification-done verification-done-impish
removed: verification-needed verification-needed-impish
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package knewstuff - 5.86.0-0ubuntu3.1

---------------
knewstuff (5.86.0-0ubuntu3.1) impish; urgency=medium

  * Add upstream patches requested to mitigate KDE server loads.
    (LP: #1962157)
    - d/p/upstream_ensure-correct-providers-url.patch
    - d/p/upstream_add-conditional-cache-preference-to-http-requests.patch

 -- Rik Mills <email address hidden> Thu, 24 Feb 2022 10:24:02 +0000

Changed in knewstuff (Ubuntu Impish):
status: Fix Committed → Fix Released
Revision history for this message
Łukasz Zemczak (sil2100) wrote : Update Released

The verification of the Stable Release Update for knewstuff has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.