X-Git-Url: https://code.citadel.org/?a=blobdiff_plain;f=citadel%2Fmodules%2Fxmpp%2Fserv_xmpp.c;h=126385129c82bdaa73faf9e20ed693a0d0c59904;hb=73bcf6081a14008eb1020126273f133a324bb910;hp=94d35b1d0f33ffd759456ce4394103d913fadcbf;hpb=d9a896503ba54a3b0b3c95059bac85541ba55090;p=citadel.git diff --git a/citadel/modules/xmpp/serv_xmpp.c b/citadel/modules/xmpp/serv_xmpp.c index 94d35b1d0..126385129 100644 --- a/citadel/modules/xmpp/serv_xmpp.c +++ b/citadel/modules/xmpp/serv_xmpp.c @@ -1,8 +1,8 @@ /* * XMPP (Jabber) service for the Citadel system - * Copyright (c) 2007-2010 by Art Cancro + * Copyright (c) 2007-2011 by Art Cancro * - * This program is free software; you can redistribute it and/or modify + * This program is open source software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 3 of the License, or * (at your option) any later version. @@ -17,6 +17,9 @@ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ +// uncomment for more verbosity +#define XMPP_DEBUG 1 + #include "sysdep.h" #include #include @@ -57,8 +60,55 @@ #include "ctdl_module.h" #include "serv_xmpp.h" +/* XML_StopParser is present in expat 2.x */ +#if XML_MAJOR_VERSION > 1 +#define HAVE_XML_STOPPARSER +#endif + struct xmpp_event *xmpp_queue = NULL; +int XMPPSrvDebugEnable = 0; + + + +#ifdef HAVE_XML_STOPPARSER +/* Stop the parser if an entity declaration is hit. */ +static void xmpp_entity_declaration(void *userData, const XML_Char *entityName, + int is_parameter_entity, const XML_Char *value, + int value_length, const XML_Char *base, + const XML_Char *systemId, const XML_Char *publicId, + const XML_Char *notationName +) { +<<<<<<< HEAD + syslog(LOG_WARNING, "Illegal entity declaration encountered; stopping parser."); +======= + XMPPM_syslog(LOG_WARNING, "Illegal entity declaration encountered; stopping parser."); +>>>>>>> 1c0b8162b0a90f2e97028a531005c11b09441498 + XML_StopParser(XMPP->xp, XML_FALSE); +} +#endif + +static inline int XMPP_GetUtf8SequenceLength(const char *CharS, const char *CharE) +{ + /* if this is is migrated to strbuf, remove this copy. */ + int n = 0; + unsigned char test = (1<<7); + + if ((*CharS & 0xC0) != 0xC0) + return 1; + + while ((n < 8) && + ((test & ((unsigned char)*CharS)) != 0)) + { + test = test >> 1; + n ++; + } + if ((n > 6) || ((CharE - CharS) < n)) + n = 0; + return n; +} + + /* * Given a source string and a target buffer, returns the string * properly escaped for insertion into an XML stream. Returns a @@ -69,8 +119,11 @@ struct xmpp_event *xmpp_queue = NULL; char *xmlesc(char *buf, char *str, int bufsiz) { char *ptr; + char *eiptr; unsigned char ch; + int inlen; int len = 0; + int IsUtf8Sequence; if (!buf) return(NULL); buf[0] = 0; @@ -79,6 +132,9 @@ char *xmlesc(char *buf, char *str, int bufsiz) return(buf); } + inlen = strlen(str); + eiptr = str + inlen; + for (ptr=str; *ptr; ptr++) { ch = *ptr; if (ch == '<') { @@ -103,10 +159,25 @@ char *xmlesc(char *buf, char *str, int bufsiz) buf[len] = 0; } else { - char oct[10]; - sprintf(oct, "&#%o;", ch); - strcpy(&buf[len], oct); - len += strlen(oct); + char oct[32]; + + IsUtf8Sequence = XMPP_GetUtf8SequenceLength(&buf[len], eiptr); + if (IsUtf8Sequence) + { + while (IsUtf8Sequence > 0){ + buf[len] = *ptr; + len ++; + if (--IsUtf8Sequence) + ptr++; + } + buf[len] = '\0'; + } + else + { + sprintf(oct, "&#%o;", ch); + strcpy(&buf[len], oct); + len += strlen(oct); + } } if ((len + 6) > bufsiz) { return(buf); @@ -144,13 +215,21 @@ void xmpp_stream_start(void *data, const char *supplied_el, const char **attr) /* * TLS encryption (but only if it isn't already active) +<<<<<<< HEAD */ +======= + * / +>>>>>>> 1c0b8162b0a90f2e97028a531005c11b09441498 #ifdef HAVE_OPENSSL if (!CC->redirect_ssl) { cprintf(""); } #endif +<<<<<<< HEAD +======= + */ +>>>>>>> 1c0b8162b0a90f2e97028a531005c11b09441498 if (!CC->logged_in) { /* If we're not logged in yet, offer SASL as our feature set */ xmpp_output_auth_mechs(); @@ -162,13 +241,22 @@ void xmpp_stream_start(void *data, const char *supplied_el, const char **attr) /* Offer binding and sessions as part of our feature set */ cprintf(""); cprintf(""); +<<<<<<< HEAD + + cprintf(""); +======= +>>>>>>> 1c0b8162b0a90f2e97028a531005c11b09441498 cprintf(""); +<<<<<<< HEAD + +======= CC->is_async = 1; /* XMPP sessions are inherently async-capable */ } +>>>>>>> 1c0b8162b0a90f2e97028a531005c11b09441498 void xmpp_xml_start(void *data, const char *supplied_el, const char **attr) { char el[256]; char *sep = NULL; @@ -180,12 +268,21 @@ void xmpp_xml_start(void *data, const char *supplied_el, const char **attr) { strcpy(el, ++sep); } - /* +<<<<<<< HEAD +#ifdef XMPP_DEBUG syslog(LOG_DEBUG, "XMPP ELEMENT START: <%s>\n", el); for (i=0; attr[i] != NULL; i+=2) { syslog(LOG_DEBUG, " Attribute '%s' = '%s'\n", attr[i], attr[i+1]); } +#endif /* XMPP_DEBUG */ +======= + /* + XMPP_syslog(LOG_DEBUG, "XMPP ELEMENT START: <%s>\n", el); + for (i=0; attr[i] != NULL; i+=2) { + XMPP_syslog(LOG_DEBUG, " Attribute '%s' = '%s'\n", attr[i], attr[i+1]); + } uncomment for more verbosity */ +>>>>>>> 1c0b8162b0a90f2e97028a531005c11b09441498 if (!strcasecmp(el, "stream")) { xmpp_stream_start(data, supplied_el, attr); @@ -194,6 +291,46 @@ void xmpp_xml_start(void *data, const char *supplied_el, const char **attr) { else if (!strcasecmp(el, "query")) { XMPP->iq_query_xmlns[0] = 0; safestrncpy(XMPP->iq_query_xmlns, supplied_el, sizeof XMPP->iq_query_xmlns); +<<<<<<< HEAD + } + + else if (!strcasecmp(el, "bind")) { + XMPP->bind_requested = 1; + } + + else if (!strcasecmp(el, "iq")) { + for (i=0; attr[i] != NULL; i+=2) { + if (!strcasecmp(attr[i], "type")) { + safestrncpy(XMPP->iq_type, attr[i+1], sizeof XMPP->iq_type); + } + else if (!strcasecmp(attr[i], "id")) { + safestrncpy(XMPP->iq_id, attr[i+1], sizeof XMPP->iq_id); + } + else if (!strcasecmp(attr[i], "from")) { + safestrncpy(XMPP->iq_from, attr[i+1], sizeof XMPP->iq_from); + } + else if (!strcasecmp(attr[i], "to")) { + safestrncpy(XMPP->iq_to, attr[i+1], sizeof XMPP->iq_to); + } + } + } + + else if (!strcasecmp(el, "auth")) { + XMPP->sasl_auth_mech[0] = 0; + for (i=0; attr[i] != NULL; i+=2) { + if (!strcasecmp(attr[i], "mechanism")) { + safestrncpy(XMPP->sasl_auth_mech, attr[i+1], sizeof XMPP->sasl_auth_mech); + } + } + } + + else if (!strcasecmp(el, "message")) { + for (i=0; attr[i] != NULL; i+=2) { + if (!strcasecmp(attr[i], "to")) { + safestrncpy(XMPP->message_to, attr[i+1], sizeof XMPP->message_to); + } + } +======= } else if (!strcasecmp(el, "bind")) { @@ -253,11 +390,37 @@ void xmpp_xml_end(void *data, const char *supplied_el) { } /* + XMPP_syslog(LOG_DEBUG, "XMPP ELEMENT END : <%s>\n", el); + if (XMPP->chardata_len > 0) { + XMPP_syslog(LOG_DEBUG, " chardata: %s\n", XMPP->chardata); +>>>>>>> 1c0b8162b0a90f2e97028a531005c11b09441498 + } + +<<<<<<< HEAD + else if (!strcasecmp(el, "html")) { + ++XMPP->html_tag_level; + } +} + + + +void xmpp_xml_end(void *data, const char *supplied_el) { + char el[256]; + char *sep = NULL; + char xmlbuf[256]; + + /* Axe the namespace, we don't care about it */ + safestrncpy(el, supplied_el, sizeof el); + while (sep = strchr(el, ':'), sep) { + strcpy(el, ++sep); + } + +#ifdef XMPP_DEBUG syslog(LOG_DEBUG, "XMPP ELEMENT END : <%s>\n", el); if (XMPP->chardata_len > 0) { syslog(LOG_DEBUG, " chardata: %s\n", XMPP->chardata); } - uncomment for more verbosity */ +#endif /* XMPP_DEBUG */ if (!strcasecmp(el, "resource")) { if (XMPP->chardata_len > 0) { @@ -285,6 +448,34 @@ void xmpp_xml_end(void *data, const char *supplied_el) { else if (!strcasecmp(el, "iq")) { +======= + if (!strcasecmp(el, "resource")) { + if (XMPP->chardata_len > 0) { + safestrncpy(XMPP->iq_client_resource, XMPP->chardata, + sizeof XMPP->iq_client_resource); + striplt(XMPP->iq_client_resource); + } + } + + else if (!strcasecmp(el, "username")) { /* NON SASL ONLY */ + if (XMPP->chardata_len > 0) { + safestrncpy(XMPP->iq_client_username, XMPP->chardata, + sizeof XMPP->iq_client_username); + striplt(XMPP->iq_client_username); + } + } + + else if (!strcasecmp(el, "password")) { /* NON SASL ONLY */ + if (XMPP->chardata_len > 0) { + safestrncpy(XMPP->iq_client_password, XMPP->chardata, + sizeof XMPP->iq_client_password); + striplt(XMPP->iq_client_password); + } + } + + else if (!strcasecmp(el, "iq")) { + +>>>>>>> 1c0b8162b0a90f2e97028a531005c11b09441498 /* * iq type="get" (handle queries) */ @@ -316,9 +507,13 @@ void xmpp_xml_end(void *data, const char *supplied_el) { * Unknown query ... return the XML equivalent of a blank stare */ else { +<<<<<<< HEAD syslog(LOG_DEBUG, - "Unknown query <%s> - returning \n", - el +======= + XMPP_syslog(LOG_DEBUG, +>>>>>>> 1c0b8162b0a90f2e97028a531005c11b09441498 + "Unknown query <%s> - returning \n", + el ); cprintf("", xmlesc(xmlbuf, XMPP->iq_id, sizeof xmlbuf)); cprintf("" @@ -448,6 +643,7 @@ void xmpp_xml_end(void *data, const char *supplied_el) { else if (!strcasecmp(el, "ping")) { XMPP->ping_requested = 1; +<<<<<<< HEAD } else if (!strcasecmp(el, "stream")) { @@ -457,8 +653,25 @@ void xmpp_xml_end(void *data, const char *supplied_el) { CC->kill_me = KILLME_CLIENT_LOGGED_OUT; } + else if (!strcasecmp(el, "query")) { + // no action required here, we picked up the xmlns= parameter during xmpp_xml_start() + } + else { syslog(LOG_DEBUG, "Ignoring unknown tag <%s>\n", el); +======= + } + + else if (!strcasecmp(el, "stream")) { + XMPPM_syslog(LOG_DEBUG, "XMPP client shut down their stream\n"); + xmpp_massacre_roster(); + cprintf("\n"); + CC->kill_me = KILLME_CLIENT_LOGGED_OUT; + } + + else { + XMPP_syslog(LOG_DEBUG, "Ignoring unknown tag <%s>\n", el); +>>>>>>> 1c0b8162b0a90f2e97028a531005c11b09441498 } XMPP->chardata_len = 0; @@ -532,6 +745,17 @@ void xmpp_greeting(void) { XML_SetCharacterDataHandler(XMPP->xp, xmpp_xml_chardata); // XML_SetUserData(XMPP->xp, something...); + /* Prevent the "billion laughs" attack against expat by disabling + * internal entity expansion. With 2.x, forcibly stop the parser + * if an entity is declared - this is safer and a more obvious + * failure mode. With older versions, simply prevent expansion + * of such entities. */ +#ifdef HAVE_XML_STOPPARSER + XML_SetEntityDeclHandler(XMPP->xp, xmpp_entity_declaration); +#else + XML_SetDefaultHandler(XMPP->xp, NULL); +#endif + CC->can_receive_im = 1; /* This protocol is capable of receiving instant messages */ } @@ -546,10 +770,11 @@ void xmpp_command_loop(void) { time(&CC->lastcmd); rc = client_read_random_blob(stream_input, 30); if (rc > 0) { + syslog(LOG_DEBUG, "\033[32m%s\033[0m", ChrPtr(stream_input)); XML_Parse(XMPP->xp, ChrPtr(stream_input), rc, 0); } else { - syslog(LOG_ERR, "XMPP: client disconnected: ending session.\n"); + syslog(LOG_ERR, "client disconnected: ending session.\n"); CC->kill_me = KILLME_CLIENT_DISCONNECTED; } FreeStrBuf(&stream_input); @@ -581,6 +806,10 @@ void xmpp_logout_hook(void) { } +void LogXMPPSrvDebugEnable(const int n) +{ + XMPPSrvDebugEnable = n; +} const char *CitadelServiceXMPP="XMPP"; extern void xmpp_cleanup_events(void); CTDL_MODULE_INIT(xmpp) @@ -593,15 +822,16 @@ CTDL_MODULE_INIT(xmpp) xmpp_async_loop, CitadelServiceXMPP ); - CtdlRegisterSessionHook(xmpp_cleanup_function, EVT_STOP); - CtdlRegisterSessionHook(xmpp_login_hook, EVT_LOGIN); - CtdlRegisterSessionHook(xmpp_logout_hook, EVT_LOGOUT); - CtdlRegisterSessionHook(xmpp_login_hook, EVT_UNSTEALTH); - CtdlRegisterSessionHook(xmpp_logout_hook, EVT_STEALTH); + CtdlRegisterDebugFlagHook(HKEY("serv_xmpp"), LogXMPPSrvDebugEnable, &XMPPSrvDebugEnable); + CtdlRegisterSessionHook(xmpp_cleanup_function, EVT_STOP, PRIO_STOP + 70); + CtdlRegisterSessionHook(xmpp_login_hook, EVT_LOGIN, PRIO_LOGIN + 90); + CtdlRegisterSessionHook(xmpp_logout_hook, EVT_LOGOUT, PRIO_LOGOUT + 90); + CtdlRegisterSessionHook(xmpp_login_hook, EVT_UNSTEALTH, PRIO_UNSTEALTH + 1); + CtdlRegisterSessionHook(xmpp_logout_hook, EVT_STEALTH, PRIO_STEALTH + 1); CtdlRegisterCleanupHook(xmpp_cleanup_events); } - /* return our Subversion id for the Log */ + /* return our module name for the log */ return "xmpp"; }