Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add JitsiXmppStringprep #105

Merged
merged 13 commits into from
Apr 26, 2024
9 changes: 8 additions & 1 deletion pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,9 @@
<packaging>bundle</packaging>
<properties>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<smack.version>4.4.6</smack.version>
<!-- Make sure this matches the version of the jxmpp artifacts inheriteb from smack. -->
bgrozev marked this conversation as resolved.
Show resolved Hide resolved
<jxmpp.version>1.0.3</jxmpp.version>
<smack.version>4.4.8</smack.version>
<junit.version>5.10.0</junit.version>
<kotlin.version>1.9.10</kotlin.version>
<kotest.version>5.7.2</kotest.version>
Expand Down Expand Up @@ -39,6 +41,11 @@
<artifactId>smack-xmlparser-stax</artifactId>
<version>${smack.version}</version>
</dependency>
<dependency>
<groupId>org.jxmpp</groupId>
<artifactId>jxmpp-stringprep-rocksxmppprecis</artifactId>
<version>${jxmpp.version}</version>
</dependency>
<dependency>
<groupId>org.jitsi</groupId>
<artifactId>jitsi-utils</artifactId>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -109,10 +109,12 @@ public C parse(XmlPullParser parser, int depth, XmlEnvironment xmlEnvironment)
namespace = parser.getNamespace();

if (logger.isLoggable(Level.FINEST))
{
logger.finest("Will parse event " + eventType
+ " for " + elementName
+ " ns=" + namespace
+ " class=" + packetExtension.getClass().getSimpleName());
+ " for " + elementName
+ " ns=" + namespace
+ " class=" + packetExtension.getClass().getSimpleName());
}

if (eventType == XmlPullParser.Event.START_ELEMENT)
{
Expand All @@ -122,7 +124,7 @@ public C parse(XmlPullParser parser, int depth, XmlEnvironment xmlEnvironment)
if (provider == null)
{
//we don't know how to handle this kind of extensions.
logger.fine("Could not add a provider for element "
logger.fine("Could not find a provider for element "
+ elementName + " from namespace " + namespace);
}
else
Expand Down
49 changes: 49 additions & 0 deletions src/main/kotlin/org/jitsi/xmpp/Smack.kt
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
/*
* Copyright @ 2024 - present 8x8, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.jitsi.xmpp

import org.jitsi.utils.logging2.createLogger
import org.jitsi.xmpp.stringprep.JitsiXmppStringprep
import org.jivesoftware.smack.SmackConfiguration
import org.jivesoftware.smack.parsing.ExceptionLoggingCallback
import org.jivesoftware.smackx.bytestreams.socks5.Socks5Proxy
import org.jxmpp.JxmppContext
import org.jxmpp.jid.impl.JidCreate

object Smack {
val logger = createLogger()

fun initialize() {
logger.info("Setting XML parsing limits.")
System.setProperty("jdk.xml.entityExpansionLimit", "0")
System.setProperty("jdk.xml.maxOccurLimit", "0")
System.setProperty("jdk.xml.elementAttributeLimit", "524288")
System.setProperty("jdk.xml.totalEntitySizeLimit", "0")
System.setProperty("jdk.xml.maxXMLNameLimit", "524288")
System.setProperty("jdk.xml.entityReplacementLimit", "0")

// Force XmppStringPrepUtil to load before we override the context, otherwise it gets reverted.
// https://github.com/igniterealtime/jxmpp/pull/44
JidCreate.from("example")
logger.info("Using JitsiXmppStringprep.")
JxmppContext.setDefaultXmppStringprep(JitsiXmppStringprep.INSTANCE)

// if there is a parsing error, do not break the connection to the server(the default behaviour) as we need
// it for the other conferences.
SmackConfiguration.setDefaultParsingExceptionCallback(ExceptionLoggingCallback())
Socks5Proxy.setLocalSocks5ProxyEnabled(false)
}
}
75 changes: 75 additions & 0 deletions src/main/kotlin/org/jitsi/xmpp/stringprep/JitsiXmppStringprep.kt
Original file line number Diff line number Diff line change
@@ -0,0 +1,75 @@
/*
* Copyright @ 2024 - present 8x8, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.jitsi.xmpp.stringprep

import org.jxmpp.stringprep.XmppStringprep
import org.jxmpp.stringprep.XmppStringprepException
import org.jxmpp.stringprep.rocksxmppprecis.RocksXmppPrecisStringprep
import rocks.xmpp.precis.PrecisProfile
import java.net.IDN
import java.text.Normalizer
import java.util.regex.Pattern

/**
* Extends [RocksXmppPrecisStringprep] to allow underscores (_) in the domain part.
*
* This is needed because jitsi-meet URLs of the form https://domain/tenant/room get translated into a JID of the
* form [email protected], and the tenant field has been allowed to use underscores for a long time (in
* fact '.' in the tenant is translated into '_').
*/
class JitsiXmppStringprep : XmppStringprep by RocksXmppPrecisStringprep.INSTANCE {
override fun domainprep(string: String?): String {
try {
return idnWithUnderscoreProfile.enforce(string)
} catch (e: IllegalArgumentException) {
throw XmppStringprepException(string, e)
}
}

companion object {
val INSTANCE = JitsiXmppStringprep()
private val idnWithUnderscoreProfile = IDNWithUnderscoreProfile()
}
}

/**
* Based on [PrecisProfiles.IDN], but allows underscores.
*/
class IDNWithUnderscoreProfile : PrecisProfile(false) {
override fun prepare(input: CharSequence): String {
val str = input.toString()

// Throws if it contains invalid characters
IDN.toASCII(str.replace("_", ""), IDN.USE_STD3_ASCII_RULES)

return IDN.toUnicode(IDN.toASCII(str), IDN.USE_STD3_ASCII_RULES)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't understand what this will do with actual IDNs (domains that have unicode and/or the IDN encoding --xn--). Do we want to write tests for this?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure what's going here, but please be careful with Java and IDN, as per this comment: dnsjava/dnsjava#207 (comment) (disregard the specifics for dnsjava).

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks! It does indeed convert "ß" to "ss" under the few openjdk versions I tried. I've added a test to document it, but I think it should be fine for our purpose here.

For context: we're adding stricter validation of the JIDs used in jicofo (and the other components) to prevent obviously invalid JIDs to be processed. But we've been using _ and % as part of the "tenant" for years and prefer to continue accepting to prevent breaking conference URLs that used to work. Unicode characters in the URL are urlencoded before they are used in JIDs, so in practice this shouldn't affect URLs that use unicode.

As an example the URL https://meet.jit.si/fuß.ball/foo ends up using the following MUC JID: [email protected]%c3%9f_ball.meet.jit.si. The domain part is invalid due to % and _, but we want to allow it anyway.

}

override fun applyWidthMappingRule(charSequence: CharSequence) = widthMap(charSequence)
override fun applyAdditionalMappingRule(charSequence: CharSequence) =
LABEL_SEPARATOR.matcher(charSequence).replaceAll(".")
override fun applyCaseMappingRule(charSequence: CharSequence) = charSequence.toString().lowercase()

override fun applyNormalizationRule(charSequence: CharSequence) =
Normalizer.normalize(charSequence, Normalizer.Form.NFC)

override fun applyDirectionalityRule(charSequence: CharSequence) = charSequence

companion object {
private const val DOTS: String = "[.\u3002\uFF0E\uFF61]"
private val LABEL_SEPARATOR: Pattern = Pattern.compile(DOTS)
}
}
130 changes: 130 additions & 0 deletions src/test/kotlin/org/jitsi/xmpp/JidTest.kt
Original file line number Diff line number Diff line change
@@ -0,0 +1,130 @@
/*
* Jicofo, the Jitsi Conference Focus.
*
* Copyright @ 2024-Present 8x8, Inc.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.jitsi.xmpp

import io.kotest.assertions.throwables.shouldThrow
import io.kotest.assertions.withClue
import io.kotest.core.spec.IsolationMode
import io.kotest.core.spec.style.ShouldSpec
import io.kotest.core.test.TestCase
import io.kotest.matchers.shouldNotBe
import io.kotest.matchers.types.shouldBeInstanceOf
import org.jitsi.xmpp.stringprep.JitsiXmppStringprep
import org.jxmpp.JxmppContext
import org.jxmpp.jid.impl.JidCreate
import org.jxmpp.stringprep.XmppStringprepException

/**
* Test JID parsing. The lists below are based on the jxmpp corpora here, plus a couple additional ones:
* https://github.com/igniterealtime/jxmpp/tree/master/jxmpp-strings-testframework/src/main/resources/xmpp-strings/jids/valid/main
* https://github.com/igniterealtime/jxmpp/blob/master/jxmpp-strings-testframework/src/main/resources/xmpp-strings/jids/invalid/main
*/
class JidTest : ShouldSpec() {
override fun isolationMode(): IsolationMode {
return IsolationMode.SingleInstance
}
override suspend fun beforeAny(testCase: TestCase) {
super.beforeAny(testCase)
Smack.initialize()
}

init {
context("Parsing valid JIDs") {
JxmppContext.getDefaultContext().xmppStringprep.shouldBeInstanceOf<JitsiXmppStringprep>()
validJids.forEach {
withClue(it) {
JidCreate.from(it) shouldNotBe null
}
}
}
context("Parsing invalid JIDs") {
JxmppContext.getDefaultContext().xmppStringprep.shouldBeInstanceOf<JitsiXmppStringprep>()
invalidJids.forEach {
withClue(it) {
shouldThrow<XmppStringprepException> {
JidCreate.from((it))
}
}
}
}
}
}

val validJids = listOf(
"[email protected]",
"[email protected]/foo",
"[email protected]/foo bar",
"[email protected]/foo@bar",
"foo\\[email protected]",
"[email protected]",
"fuß[email protected]",
"π@example.com",
"Σ@example.com",
"ς@example.com",
"[email protected]/♚",
"example.com",
"example.com/foobar",
"a.example.com/[email protected]",
"server/resource@foo",
"server/resource@foo/bar",
"user@CaSe-InSeNsItIvE",
"[email protected]",
// "user@[2001:638:a000:4134::ffff:40]",
// "user@[2001:638:a000:4134::ffff:40%eno1]",
// "user@averylongdomainpartisstillvalideventhoughitexceedsthesixtyfourbytelimitofdnslabels",
"long-conference-name-1245c711a15e466687b6333577d83e0b@" +
"conference.vpaas-magic-cookie-a32a0c3311ee432eab711fa1fdf34793.8x8.vc",
"[email protected]/🍺",
// These are not valid according to the XMPP spec, but we accept it intentionally.
"do_main.com",
"u_s_e_r@_do_main_.com",
"user@do_ma-in.com"
)

val invalidJids = listOf(
"jul\[email protected]",
"\"juliet\"@example.com",
"foo [email protected]",
// This fails due to a corner case in JidCreate when "example.com" is already cached as a DomainpartJid
// "@example.com/",
"henryⅣ@example.com",
"♚@example.com",
"juliet@",
"/foobar",
"node@/server",
"@server",
"@server/resource",
"@/resource",
"@/",
"/",
"@",
"user@",
"user@@",
"user@@host",
"user@@host/resource",
"user@@host/",
"[email protected]/؜x",
"[email protected]@example.org",
"foo\[email protected]",
"foobar@ex\u0000ample.org",
// Leading - in domain part.
"[email protected]",
// Trailing - in domain part.
"[email protected]",
"[email protected]"
)
Loading
Loading