Comments (5)
I've now eventually gotten to where the SASL authentication is happening.
In sendResponse
of SASLInitiatingInitializer
in twisted.words.protocols.jabber.sasl.py
, after being challenged by the XMPP server, the following data is sent:
(Pdb) pp data
u'username="jeff\\40myserver.com",nonce="1172501009",digest-uri="xmpp/chat.myserver.com",charset=utf-8,realm="chat.myserver.com",qop=auth,cnonce="efc56d019622aa571e508307e02b2dbd",nc=00000001,response=63d142e6cfd18b9653aaf4a7f3d316c7'
Here the username is still escaped correctly.
I don't find anything wrong with what Wokkel is doing during the authentication so I'm starting to question my previous assumption that this is a bug in Wokkel. Could this be an issue with ejabberd?
from wokkel.
I used Pidgin to log in to ejabberd with an account that has a special character in it. I was able to authenticate successfully and tailing ejabberd's log showed why.
Decoding the Base64 encoded data in the challenge response stanza sent from Pidgin to the XMPP server, showed the following:
'username="jeff\\\\40myserver.com",realm="chat.myserver.com",nonce="4209400094",cnonce="XsuCL4dl22t+3Iao9tIEdYWVVvTs0Dbzn6cA2kudUFE=",nc=00000001,qop=auth,digest-uri="xmpp/chat.myserver.com",response=ad7e44663abece0e0fb9359354d67281,charset=utf-8'
The escaped @
sign, which is supposed to be escaped to \40
(which is r"\40" or u"\\40"
in python), is now escaped to \\\\40
.
I quickly hacked sendResponse
to change u'\\40'
to u'\\\\40'
and now authentication works.
Ok, I'm happy it worked, but I don't understand why ejabberd expects there to be two backslashes (4 backslashes when escaped), instead of just one.
XEP-106 dictates that @
must be escaped to \40
.
Any idea why this is might be the case? Also, I'm not sure what the fix should look like.
from wokkel.
Hi @jcbrand!
I found this bug https://support.process-one.net/browse/EJAB-81, but that's for pretty old versions of ejabberd. Which version are you talking against?
from wokkel.
Hi @ralphm :)
I'm using 2.1.5 (which comes with debian squeeze). The ticket you mention points to this one (https://support.process-one.net/browse/EJAB-1006) where the user Badlop reports an issue that looks basically the same.
That ticket is filed against an older version and they rejected it :o/
I've implemented a crude workaround for now and will sometime check against a newer version of ejabberd.
I'm not sure whether anything should be done about this in Wokkel, so I guess you can close this ticket for now.
Thanks!
from wokkel.
Hmm. Yeah, I think trying to solve this in Wokkel might introduce problems for others. Thanks for the report anyway.
from wokkel.
Related Issues (14)
- SSL/TLS Connection HOT 1
- Specifying python 3 classifiers in setup.py HOT 2
- Python 3 Python Decorator issues HOT 2
- Wokkel release HOT 4
- Error building with utf characters HOT 1
- add a __version__ (PEP 396) HOT 1
- No longer possible to use a non-TLS connection with Twisted 19.7.0+ HOT 3
- Python Twisted Wokkel keeps disconnecting HOT 4
- Please give me example for xmpp server and xmpp client in two files - one for client one for server.
- Wokkel is not working with lastest version of Twisted (21.02) HOT 1
- User affiliation and role are not updated when wokkel.muc.MUCClient receives available presence. HOT 3
- Ability to reconnect HOT 1
- Timeout trying to join a room, even though join apparently succeeds HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from wokkel.