Bug 28647 - IQ reply spoofing detection should be aware that @from is optional
Summary: IQ reply spoofing detection should be aware that @from is optional
Status: RESOLVED FIXED
Alias: None
Product: Wocky
Classification: Unclassified
Component: General (show other bugs)
Version: unspecified
Hardware: Other All
: medium normal
Assignee: Simon McVittie
QA Contact: Telepathy bugs list
URL: http://git.collabora.co.uk/?p=user/sm...
Whiteboard:
Keywords: patch
Depends on: 26961
Blocks:
  Show dependency treegraph
 
Reported: 2010-06-21 04:45 UTC by Simon McVittie
Modified: 2010-06-22 11:10 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments

Description Simon McVittie 2010-06-21 04:45:06 UTC

    
Comment 1 Simon McVittie 2010-06-21 04:48:10 UTC
Aagh, pressed Send too early. Here's what the description should have been.

When my Prosody 0.6.1 installation fails to reply to a disco request for my bare JID (Bug #28599), it omits @from from the error reply (which is meant to be equivalent to using my own bare JID). This leads Wocky to believe that the reply is spoofed.

(telepathy-gabble:2069): wocky-DEBUG: Parsing chunk: <iq id='788917834034'
type='error' to='smcv@XXX/reptile'><error type='cancel'><service-unavailable
xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'/></error></iq>
...
(telepathy-gabble:2069): wocky-DEBUG: handle_iq_reply: wocky-porter.c:842:
'(null)' (normal: '(null)') attempts to spoof an IQ reply from 'smcv@XXX'
(telepathy-gabble:2069): gabble-DEBUG: connection_iq_unknown_cb: got unknown
iq:
* iq xmlns='jabber:client' id='788917834034' type='error' to='smcv@XXX/reptile'
    * error type='cancel'
        * service-unavailable xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'

As a result, the request times out, rather than failing immediately.
Comment 2 Simon McVittie 2010-06-22 09:27:46 UTC
The attached branch also closes Bug #26961.

Please also review <http://git.collabora.co.uk/?p=user/smcv/telepathy-gabble-smcv.git;a=shortlog;h=refs/heads/not-actually-spoofing> which merges it into Gabble. I've verified that the resulting Gabble build deals with the error gracefully, rather than via a timeout.
Comment 3 Simon McVittie 2010-06-22 11:10:13 UTC
Fixed in git, and in the snapshot in Gabble 0.9.14.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.