Mercury-IM/Smack
Mercury-IM/Smack
1
0
Fork 0
mirror of https://codeberg.org/Mercury-IM/Smack synced 2025-09-10 18:59:41 +02:00
Code Issues Releases Wiki Activity

Add and use IQReplyFilter (SMACK-533)

Browse source 
In the absence of checks on the from address, it is possible for other
clients to fake an answer to an IQ request.

This commit adds an IQReplyFilter, which drops all packets which are not
a valid reply to an IQ request. In particular, it checks for packet id,
from address and packet type.

Most(?) places waiting for a reply to an IQ request are converted to use
the IQReplyFilter.

For a discussion of the issues, see the thread "Spoofing of iq ids and
misbehaving servers" from 2014-01 on the jdev@jabber.org mailing list
and following discussion in February and March.
This commit is contained in:
Lars Noschinski 2014-02-23 21:08:35 +01:00 • committed by Florian Schmaus
parent 980047c4e1
commit 6c7296a37b
13 changed files with 520 additions and 134 deletions
Download patch file Download diff file Expand all files Collapse all files

5
extensions/src/main/java/org/jivesoftware/smackx/filetransfer/FileTransferNegotiator.java
View file

@ -31,7 +31,6 @@ import org.jivesoftware.smack.Connection;
import org.jivesoftware.smack.ConnectionListener;
import org.jivesoftware.smack.PacketCollector;
import org.jivesoftware.smack.XMPPException;
import org.jivesoftware.smack.filter.PacketIDFilter;
import org.jivesoftware.smack.packet.IQ;
import org.jivesoftware.smack.packet.Packet;
import org.jivesoftware.smack.packet.XMPPError;
@ -409,9 +408,7 @@ public class FileTransferNegotiator {
si.setTo(userID);
si.setType(IQ.Type.SET);
PacketCollector collector = connection
.createPacketCollector(new PacketIDFilter(si.getPacketID()));
connection.sendPacket(si);
PacketCollector collector = connection.createPacketCollectorAndSend(si);
Packet siResponse = collector.nextResult(responseTimeout);
collector.cancel();

3
extensions/src/test/java/org/jivesoftware/util/ConnectionUtils.java
View file

@ -23,6 +23,7 @@ import org.jivesoftware.smack.PacketCollector;
import org.jivesoftware.smack.Connection;
import org.jivesoftware.smack.XMPPException;
import org.jivesoftware.smack.filter.PacketFilter;
import org.jivesoftware.smack.packet.IQ;
import org.jivesoftware.smack.packet.Packet;
import org.jivesoftware.smack.packet.XMPPError;
import org.jivesoftware.smackx.disco.ServiceDiscoveryManager;
@ -79,7 +80,7 @@ public class ConnectionUtils {
}
};
when(connection.createPacketCollectorAndSend(isA(Packet.class))).thenAnswer(collectorAndSend);
when(connection.createPacketCollectorAndSend(isA(IQ.class))).thenAnswer(collectorAndSend);
// mock send method
Answer<Object> addIncoming = new Answer<Object>() {