| Summary: | IQ reply spoofing detection should be aware that @from is optional | ||
|---|---|---|---|
| Product: | Wocky | Reporter: | Simon McVittie <smcv> |
| Component: | General | Assignee: | Simon McVittie <smcv> |
| Status: | RESOLVED FIXED | QA Contact: | Telepathy bugs list <telepathy-bugs> |
| Severity: | normal | ||
| Priority: | medium | Keywords: | patch |
| Version: | unspecified | ||
| Hardware: | Other | ||
| OS: | All | ||
| URL: | http://git.collabora.co.uk/?p=user/smcv/wocky.git;a=shortlog;h=refs/heads/spoofing | ||
| Whiteboard: | |||
| i915 platform: | i915 features: | ||
| Bug Depends on: | 26961 | ||
| Bug Blocks: | |||
|
Description
Simon McVittie
2010-06-21 04:45:06 UTC
Aagh, pressed Send too early. Here's what the description should have been. When my Prosody 0.6.1 installation fails to reply to a disco request for my bare JID (Bug #28599), it omits @from from the error reply (which is meant to be equivalent to using my own bare JID). This leads Wocky to believe that the reply is spoofed. (telepathy-gabble:2069): wocky-DEBUG: Parsing chunk: <iq id='788917834034' type='error' to='smcv@XXX/reptile'><error type='cancel'><service-unavailable xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'/></error></iq> ... (telepathy-gabble:2069): wocky-DEBUG: handle_iq_reply: wocky-porter.c:842: '(null)' (normal: '(null)') attempts to spoof an IQ reply from 'smcv@XXX' (telepathy-gabble:2069): gabble-DEBUG: connection_iq_unknown_cb: got unknown iq: * iq xmlns='jabber:client' id='788917834034' type='error' to='smcv@XXX/reptile' * error type='cancel' * service-unavailable xmlns='urn:ietf:params:xml:ns:xmpp-stanzas' As a result, the request times out, rather than failing immediately. The attached branch also closes Bug #26961. Please also review <http://git.collabora.co.uk/?p=user/smcv/telepathy-gabble-smcv.git;a=shortlog;h=refs/heads/not-actually-spoofing> which merges it into Gabble. I've verified that the resulting Gabble build deals with the error gracefully, rather than via a timeout. Fixed in git, and in the snapshot in Gabble 0.9.14. |
Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.