X-Git-Url: https://code.citadel.org/?p=citadel.git;a=blobdiff_plain;f=citadel%2Fmodules%2Fxmpp%2Fserv_xmpp.c;h=d62bcfe468ee99ced792b01fde6632897838bbb7;hp=922288f695bed26f71e7f404d2c15d9da2042098;hb=2976b35710982e72d499db16d648eee7b2cfaa94;hpb=1bca8e52ac5e6713c26867195fffed2e49861f0e diff --git a/citadel/modules/xmpp/serv_xmpp.c b/citadel/modules/xmpp/serv_xmpp.c index 922288f69..d62bcfe46 100644 --- a/citadel/modules/xmpp/serv_xmpp.c +++ b/citadel/modules/xmpp/serv_xmpp.c @@ -1,8 +1,8 @@ /* * XMPP (Jabber) service for the Citadel system - * Copyright (c) 2007-2010 by Art Cancro + * Copyright (c) 2007-2018 by Art Cancro and citadel.org * - * This program is free software; you can redistribute it and/or modify + * This program is open source software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 3 of the License, or * (at your option) any later version. @@ -57,19 +57,62 @@ #include "ctdl_module.h" #include "serv_xmpp.h" +/* uncomment for more verbosity - it will log all received XML tags */ +#define XMPP_XML_DEBUG + +/* XML_StopParser is present in expat 2.x */ +#if XML_MAJOR_VERSION > 1 +#define HAVE_XML_STOPPARSER +#endif + struct xmpp_event *xmpp_queue = NULL; + +#ifdef HAVE_XML_STOPPARSER +/* Stop the parser if an entity declaration is hit. */ +static void xmpp_entity_declaration(void *userData, const XML_Char *entityName, + int is_parameter_entity, const XML_Char *value, + int value_length, const XML_Char *base, + const XML_Char *systemId, const XML_Char *publicId, + const XML_Char *notationName +) { + syslog(LOG_WARNING, "xmpp: illegal entity declaration encountered; stopping parser."); + XML_StopParser(XMPP->xp, XML_FALSE); +} +#endif + + /* * Given a source string and a target buffer, returns the string * properly escaped for insertion into an XML stream. Returns a * pointer to the target buffer for convenience. - * - * BUG: this does not properly handle UTF-8 */ +static inline int Ctdl_GetUtf8SequenceLength(const char *CharS, const char *CharE) +{ + int n = 0; + unsigned char test = (1<<7); + + if ((*CharS & 0xC0) != 0xC0) + return 1; + + while ((n < 8) && + ((test & ((unsigned char)*CharS)) != 0)) + { + test = test >> 1; + n ++; + } + if ((n > 6) || ((CharE - CharS) < n)) + n = 0; + return n; +} + + char *xmlesc(char *buf, char *str, int bufsiz) { - char *ptr; + int IsUtf8Sequence; + char *ptr, *pche; unsigned char ch; + int inlen; int len = 0; if (!buf) return(NULL); @@ -78,6 +121,8 @@ char *xmlesc(char *buf, char *str, int bufsiz) if (!str) { return(buf); } + inlen = strlen(str); + pche = str + inlen; for (ptr=str; *ptr; ptr++) { ch = *ptr; @@ -103,10 +148,24 @@ char *xmlesc(char *buf, char *str, int bufsiz) buf[len] = 0; } else { - char oct[10]; - sprintf(oct, "&#%o;", ch); - strcpy(&buf[len], oct); - len += strlen(oct); + IsUtf8Sequence = Ctdl_GetUtf8SequenceLength(ptr, pche); + if (IsUtf8Sequence) + { + while ((IsUtf8Sequence > 0) && + (ptr < pche)) + { + buf[len] = *ptr; + ptr ++; + --IsUtf8Sequence; + } + } + else + { + char oct[10]; + sprintf(oct, "&#%o;", ch); + strcpy(&buf[len], oct); + len += strlen(oct); + } } if ((len + 6) > bufsiz) { return(buf); @@ -142,8 +201,10 @@ void xmpp_stream_start(void *data, const char *supplied_el, const char **attr) /* The features of this stream are... */ cprintf(""); -#ifdef HAVE_OPENSSL_XXXX_COMMENTED_OUT - /* TLS encryption (but only if it isn't already active) */ + /* + * TLS encryption (but only if it isn't already active) + */ +#ifdef HAVE_OPENSSL if (!CC->redirect_ssl) { cprintf(""); } @@ -178,12 +239,12 @@ void xmpp_xml_start(void *data, const char *supplied_el, const char **attr) { strcpy(el, ++sep); } - /* - CtdlLogPrintf(CTDL_DEBUG, "XMPP ELEMENT START: <%s>\n", el); +#ifdef XMPP_XML_DEBUG + syslog(LOG_DEBUG, "xmpp: ELEMENT START: <%s>", el); for (i=0; attr[i] != NULL; i+=2) { - CtdlLogPrintf(CTDL_DEBUG, " Attribute '%s' = '%s'\n", attr[i], attr[i+1]); + syslog(LOG_DEBUG, "xmpp: Attribute '%s' = '%s'", attr[i], attr[i+1]); } - uncomment for more verbosity */ +#endif if (!strcasecmp(el, "stream")) { xmpp_stream_start(data, supplied_el, attr); @@ -250,33 +311,30 @@ void xmpp_xml_end(void *data, const char *supplied_el) { strcpy(el, ++sep); } - /* - CtdlLogPrintf(CTDL_DEBUG, "XMPP ELEMENT END : <%s>\n", el); +#ifdef XMPP_XML_DEBUG + syslog(LOG_DEBUG, "xmpp: ELEMENT END : <%s>", el); if (XMPP->chardata_len > 0) { - CtdlLogPrintf(CTDL_DEBUG, " chardata: %s\n", XMPP->chardata); + syslog(LOG_DEBUG, "xmpp: chardata: %s", XMPP->chardata); } - uncomment for more verbosity */ +#endif if (!strcasecmp(el, "resource")) { if (XMPP->chardata_len > 0) { - safestrncpy(XMPP->iq_client_resource, XMPP->chardata, - sizeof XMPP->iq_client_resource); + safestrncpy(XMPP->iq_client_resource, XMPP->chardata, sizeof XMPP->iq_client_resource); striplt(XMPP->iq_client_resource); } } else if (!strcasecmp(el, "username")) { /* NON SASL ONLY */ if (XMPP->chardata_len > 0) { - safestrncpy(XMPP->iq_client_username, XMPP->chardata, - sizeof XMPP->iq_client_username); + safestrncpy(XMPP->iq_client_username, XMPP->chardata, sizeof XMPP->iq_client_username); striplt(XMPP->iq_client_username); } } else if (!strcasecmp(el, "password")) { /* NON SASL ONLY */ if (XMPP->chardata_len > 0) { - safestrncpy(XMPP->iq_client_password, XMPP->chardata, - sizeof XMPP->iq_client_password); + safestrncpy(XMPP->iq_client_password, XMPP->chardata, sizeof XMPP->iq_client_password); striplt(XMPP->iq_client_password); } } @@ -292,8 +350,7 @@ void xmpp_xml_end(void *data, const char *supplied_el) { * Query on a namespace */ if (!IsEmptyStr(XMPP->iq_query_xmlns)) { - xmpp_query_namespace(XMPP->iq_id, XMPP->iq_from, - XMPP->iq_to, XMPP->iq_query_xmlns); + xmpp_query_namespace(XMPP->iq_id, XMPP->iq_from, XMPP->iq_to, XMPP->iq_query_xmlns); } /* @@ -314,10 +371,7 @@ void xmpp_xml_end(void *data, const char *supplied_el) { * Unknown query ... return the XML equivalent of a blank stare */ else { - CtdlLogPrintf(CTDL_DEBUG, - "Unknown query <%s> - returning \n", - el - ); + syslog(LOG_DEBUG, "xmpp: Unknown query <%s> - returning ", el); cprintf("", xmlesc(xmlbuf, XMPP->iq_id, sizeof xmlbuf)); cprintf("" "" @@ -338,8 +392,7 @@ void xmpp_xml_end(void *data, const char *supplied_el) { xmpp_non_sasl_authenticate( XMPP->iq_id, XMPP->iq_client_username, - XMPP->iq_client_password, - XMPP->iq_client_resource + XMPP->iq_client_password ); } @@ -349,17 +402,17 @@ void xmpp_xml_end(void *data, const char *supplied_el) { else if ( (XMPP->bind_requested) && (!IsEmptyStr(XMPP->iq_id)) - && (!IsEmptyStr(XMPP->iq_client_resource)) && (CC->logged_in) - ) { + ) { - /* Generate the "full JID" of the client resource */ + /* If the client has not specified a client resource, generate one */ - snprintf(XMPP->client_jid, sizeof XMPP->client_jid, - "%s/%s", - CC->cs_inet_email, - XMPP->iq_client_resource - ); + if (IsEmptyStr(XMPP->iq_client_resource)) { + snprintf(XMPP->iq_client_resource, sizeof XMPP->iq_client_resource, "%d", CC->cs_pid); + } + + /* Generate the "full JID" of the client resource */ + snprintf(XMPP->client_jid, sizeof XMPP->client_jid, "%s/%s", CC->cs_inet_email, XMPP->iq_client_resource); /* Tell the client what its JID is */ @@ -377,8 +430,9 @@ void xmpp_xml_end(void *data, const char *supplied_el) { else { cprintf("", xmlesc(xmlbuf, XMPP->iq_id, sizeof xmlbuf)); - cprintf("Don't know howto do '%s'!", xmlesc(xmlbuf, XMPP->iq_type, sizeof xmlbuf)); + cprintf("Don't know how to do '%s'!", xmlesc(xmlbuf, XMPP->iq_type, sizeof xmlbuf)); cprintf(""); + syslog(LOG_DEBUG, "XMPP: don't know how to do iq_type='%s' with iq_query_xmlns='%s'", XMPP->iq_type, XMPP->iq_query_xmlns); } /* Now clear these fields out so they don't get used by a future stanza */ @@ -437,10 +491,10 @@ void xmpp_xml_end(void *data, const char *supplied_el) { #ifdef HAVE_OPENSSL cprintf(""); CtdlModuleStartCryptoMsgs(NULL, NULL, NULL); - if (!CC->redirect_ssl) CC->kill_me = 1; + if (!CC->redirect_ssl) CC->kill_me = KILLME_NO_CRYPTO; #else cprintf(""); - CC->kill_me = 1; + CC->kill_me = KILLME_NO_CRYPTO; #endif } @@ -449,14 +503,22 @@ void xmpp_xml_end(void *data, const char *supplied_el) { } else if (!strcasecmp(el, "stream")) { - CtdlLogPrintf(CTDL_DEBUG, "XMPP client shut down their stream\n"); + syslog(LOG_DEBUG, "xmpp: client shut down their stream"); xmpp_massacre_roster(); cprintf("\n"); - CC->kill_me = 1; + CC->kill_me = KILLME_CLIENT_LOGGED_OUT; + } + + else if (!strcasecmp(el, "query")) { + /* already processed , no further action needed here */ + } + + else if (!strcasecmp(el, "bind")) { + /* already processed , no further action needed here */ } else { - CtdlLogPrintf(CTDL_DEBUG, "Ignoring unknown tag <%s>\n", el); + syslog(LOG_DEBUG, "xmpp: ignoring unknown tag <%s>", el); } XMPP->chardata_len = 0; @@ -506,7 +568,6 @@ void xmpp_cleanup_function(void) { } - /* * Here's where our XMPP session begins its happy day. */ @@ -521,8 +582,8 @@ void xmpp_greeting(void) { XMPP->xp = XML_ParserCreateNS("UTF-8", ':'); if (XMPP->xp == NULL) { - CtdlLogPrintf(CTDL_ALERT, "Cannot create XML parser!\n"); - CC->kill_me = 1; + syslog(LOG_ERR, "xmpp: cannot create XML parser"); + CC->kill_me = KILLME_XML_PARSER; return; } @@ -530,6 +591,17 @@ void xmpp_greeting(void) { XML_SetCharacterDataHandler(XMPP->xp, xmpp_xml_chardata); // XML_SetUserData(XMPP->xp, something...); + /* Prevent the "billion laughs" attack against expat by disabling + * internal entity expansion. With 2.x, forcibly stop the parser + * if an entity is declared - this is safer and a more obvious + * failure mode. With older versions, simply prevent expansion + * of such entities. */ +#ifdef HAVE_XML_STOPPARSER + XML_SetEntityDeclHandler(XMPP->xp, xmpp_entity_declaration); +#else + XML_SetDefaultHandler(XMPP->xp, NULL); +#endif + CC->can_receive_im = 1; /* This protocol is capable of receiving instant messages */ } @@ -547,8 +619,8 @@ void xmpp_command_loop(void) { XML_Parse(XMPP->xp, ChrPtr(stream_input), rc, 0); } else { - CtdlLogPrintf(CTDL_ERR, "Client disconnected: ending session.\n"); - CC->kill_me = 1; + syslog(LOG_ERR, "xmpp: client disconnected: ending session."); + CC->kill_me = KILLME_CLIENT_DISCONNECTED; } FreeStrBuf(&stream_input); } @@ -584,22 +656,22 @@ extern void xmpp_cleanup_events(void); CTDL_MODULE_INIT(xmpp) { if (!threading) { - CtdlRegisterServiceHook(config.c_xmpp_c2s_port, + CtdlRegisterServiceHook(CtdlGetConfigInt("c_xmpp_c2s_port"), NULL, xmpp_greeting, xmpp_command_loop, xmpp_async_loop, CitadelServiceXMPP ); - CtdlRegisterSessionHook(xmpp_cleanup_function, EVT_STOP); - CtdlRegisterSessionHook(xmpp_login_hook, EVT_LOGIN); - CtdlRegisterSessionHook(xmpp_logout_hook, EVT_LOGOUT); - CtdlRegisterSessionHook(xmpp_login_hook, EVT_UNSTEALTH); - CtdlRegisterSessionHook(xmpp_logout_hook, EVT_STEALTH); + CtdlRegisterSessionHook(xmpp_cleanup_function, EVT_STOP, PRIO_STOP + 70); + CtdlRegisterSessionHook(xmpp_login_hook, EVT_LOGIN, PRIO_LOGIN + 90); + CtdlRegisterSessionHook(xmpp_logout_hook, EVT_LOGOUT, PRIO_LOGOUT + 90); + CtdlRegisterSessionHook(xmpp_login_hook, EVT_UNSTEALTH, PRIO_UNSTEALTH + 1); + CtdlRegisterSessionHook(xmpp_logout_hook, EVT_STEALTH, PRIO_STEALTH + 1); CtdlRegisterCleanupHook(xmpp_cleanup_events); } - /* return our Subversion id for the Log */ + /* return our module name for the log */ return "xmpp"; }