wokkel.client.XMPPClient cannot authenticate when JID has escaped characters about wokkel HOT 5 CLOSED

I've now eventually gotten to where the SASL authentication is happening.

In sendResponse of SASLInitiatingInitializer in twisted.words.protocols.jabber.sasl.py, after being challenged by the XMPP server, the following data is sent:

(Pdb) pp data
u'username="jeff\\40myserver.com",nonce="1172501009",digest-uri="xmpp/chat.myserver.com",charset=utf-8,realm="chat.myserver.com",qop=auth,cnonce="efc56d019622aa571e508307e02b2dbd",nc=00000001,response=63d142e6cfd18b9653aaf4a7f3d316c7'

Here the username is still escaped correctly.

I don't find anything wrong with what Wokkel is doing during the authentication so I'm starting to question my previous assumption that this is a bug in Wokkel. Could this be an issue with ejabberd?

from wokkel.

I used Pidgin to log in to ejabberd with an account that has a special character in it. I was able to authenticate successfully and tailing ejabberd's log showed why.

Decoding the Base64 encoded data in the challenge response stanza sent from Pidgin to the XMPP server, showed the following:

'username="jeff\\\\40myserver.com",realm="chat.myserver.com",nonce="4209400094",cnonce="XsuCL4dl22t+3Iao9tIEdYWVVvTs0Dbzn6cA2kudUFE=",nc=00000001,qop=auth,digest-uri="xmpp/chat.myserver.com",response=ad7e44663abece0e0fb9359354d67281,charset=utf-8'

The escaped @ sign, which is supposed to be escaped to \40 (which is r"\40" or u"\\40" in python), is now escaped to \\\\40.

I quickly hacked sendResponse to change u'\\40' to u'\\\\40' and now authentication works.

Ok, I'm happy it worked, but I don't understand why ejabberd expects there to be two backslashes (4 backslashes when escaped), instead of just one.

XEP-106 dictates that @ must be escaped to \40.

Any idea why this is might be the case? Also, I'm not sure what the fix should look like.

from wokkel.

Hi @jcbrand!

I found this bug https://support.process-one.net/browse/EJAB-81, but that's for pretty old versions of ejabberd. Which version are you talking against?

from wokkel.

Hi @ralphm :)

I'm using 2.1.5 (which comes with debian squeeze). The ticket you mention points to this one (https://support.process-one.net/browse/EJAB-1006) where the user Badlop reports an issue that looks basically the same.

That ticket is filed against an older version and they rejected it :o/

I've implemented a crude workaround for now and will sometime check against a newer version of ejabberd.

I'm not sure whether anything should be done about this in Wokkel, so I guess you can close this ticket for now.

Thanks!

from wokkel.

Hmm. Yeah, I think trying to solve this in Wokkel might introduce problems for others. Thanks for the report anyway.

from wokkel.