Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Hide service name option #2304

Merged
merged 6 commits into from
Oct 17, 2019
Merged

Hide service name option #2304

merged 6 commits into from
Oct 17, 2019

Conversation

fenek
Copy link
Member

@fenek fenek commented May 16, 2019

This PR adds a new option, that allows to hide XMPP service type when a client purposefully sends malformed data to XMPP socket. With hide_service_name option enabled, MongooseIM will simply close the connection instead of acting by the RFC 6120 which obliges the XMPP server to reply with stream error anyway.

@fenek fenek changed the title Feature hide service name Hide service name option May 16, 2019
@mongoose-im

This comment has been minimized.

@codecov
Copy link

codecov bot commented May 17, 2019

Codecov Report

Merging #2304 into master will decrease coverage by 0.36%.
The diff coverage is 100%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master    #2304      +/-   ##
==========================================
- Coverage   78.73%   78.36%   -0.37%     
==========================================
  Files         340      340              
  Lines       29438    29438              
==========================================
- Hits        23178    23070     -108     
- Misses       6260     6368     +108
Impacted Files Coverage Δ
src/ejabberd_c2s.erl 87.29% <100%> (+0.07%) ⬆️
src/inbox/mod_inbox_rdbms_mysql.erl 0% <0%> (-100%) ⬇️
src/ejabberd_sm_redis.erl 0% <0%> (-97.92%) ⬇️
src/mod_private_mysql.erl 0% <0%> (-91.67%) ⬇️
src/mongoose_redis.erl 0% <0%> (-87.5%) ⬇️
src/rdbms/mongoose_rdbms_mysql.erl 43.47% <0%> (-47.83%) ⬇️
src/ejabberd_binary.erl 77.77% <0%> (-11.12%) ⬇️
src/rdbms/rdbms_queries.erl 77.83% <0%> (-5.42%) ⬇️
src/pubsub/mod_pubsub_db_rdbms_sql.erl 90.19% <0%> (-3.93%) ⬇️
src/muc_light/mod_muc_light_db_rdbms_sql.erl 93.1% <0%> (-3.45%) ⬇️
... and 15 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 79ba256...b9d4afa. Read the comment docs.

@mongoose-im

This comment has been minimized.

Copy link
Contributor

@arcusfelis arcusfelis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

useful

@mongoose-im
Copy link
Collaborator

mongoose-im commented Sep 2, 2019

7080.1 / Erlang 22.0 / small_tests / 66c000a
Reports root / small


7080.2 / Erlang 22.0 / internal_mnesia / 66c000a
Reports root/ big
OK: 1264 / Failed: 0 / User-skipped: 175 / Auto-skipped: 0


7080.3 / Erlang 22.0 / odbc_mssql_mnesia / 66c000a
Reports root/ big
OK: 3171 / Failed: 0 / User-skipped: 284 / Auto-skipped: 0


7080.4 / Erlang 22.0 / mysql_redis / 66c000a
Reports root/ big
OK: 3198 / Failed: 2 / User-skipped: 286 / Auto-skipped: 0

mod_global_distrib_SUITE:mod_global_distrib:test_pm_with_graceful_reconnection_to_different_server
{error,
  {timeout_when_waiting_for_stanza,
    [{escalus_client,wait_for_stanza,
       [{client,<<"eve81.915020@localhost/res1">>,escalus_tcp,
          <0.26918.3>,
          [{event_manager,<0.26911.3>},
           {server,<<"localhost">>},
           {username,<<"eve81.915020">>},
           {resource,<<"res1">>}],
          [{event_client,
             [{event_manager,<0.26911.3>},
            {server,<<"localhost">>},
            {username,<<"eve81.915020">>},
            {resource,<<"res1">>}]},
           {resource,<<"res1">>},
           {username,<<"eve81.915020">>},
           {server,<<"localhost">>},
           {host,<<"localhost">>},
           {port,5222},
           {auth,{escalus_auth,auth_plain}},
           {wspath,undefined},
           {port,5222},
           {username,<<"eve81.915020">>},
           {server,<<"localhost">>},
           {password,<<"password">>},
           {port,5252},
           {stream_id,<<"893BE5F90F6649C7">>}]},
        5000],
       [{file,
          "/home/travis/build/esl/MongooseIM/big_tests/_build/default/lib/escalus/src/escalus_client.erl"},
        {line,136}]},
     {mod_global_distrib_SUITE,
       '-test_pm_with_graceful_reconnection_to_different_server/1-fun-0-',
       3,
       [{file,
          "/home/travis/build/esl/MongooseIM/big_tests/_build/default/lib/ejabberd_tests/tests/mod_global_distrib_SUITE.erl"},
        {line,573}]},
     {escalus_story,story,4,
       [{file,
          "/home/travis/build/esl/MongooseIM...

Report log

mod_global_distrib_SUITE:mod_global_distrib:test_pm_with_graceful_reconnection_to_different_server
{error,
  {timeout_when_waiting_for_stanza,
    [{escalus_client,wait_for_stanza,
       [{client,<<"eve7.90357@localhost/res1">>,escalus_tcp,
          <0.27301.3>,
          [{event_manager,<0.27294.3>},
           {server,<<"localhost">>},
           {username,<<"eve7.90357">>},
           {resource,<<"res1">>}],
          [{event_client,
             [{event_manager,<0.27294.3>},
            {server,<<"localhost">>},
            {username,<<"eve7.90357">>},
            {resource,<<"res1">>}]},
           {resource,<<"res1">>},
           {username,<<"eve7.90357">>},
           {server,<<"localhost">>},
           {host,<<"localhost">>},
           {port,5222},
           {auth,{escalus_auth,auth_plain}},
           {wspath,undefined},
           {port,5222},
           {username,<<"eve7.90357">>},
           {server,<<"localhost">>},
           {password,<<"password">>},
           {port,5252},
           {stream_id,<<"FA068A53DA2905A4">>}]},
        5000],
       [{file,
          "/home/travis/build/esl/MongooseIM/big_tests/_build/default/lib/escalus/src/escalus_client.erl"},
        {line,136}]},
     {mod_global_distrib_SUITE,
       '-test_pm_with_graceful_reconnection_to_different_server/1-fun-0-',
       3,
       [{file,
          "/home/travis/build/esl/MongooseIM/big_tests/_build/default/lib/ejabberd_tests/tests/mod_global_distrib_SUITE.erl"},
        {line,573}]},
     {escalus_story,story,4,
       [{file,
          "/home/travis/build/esl/MongooseIM/big_tests...

Report log


7080.5 / Erlang 22.0 / riak_mnesia / 66c000a
Reports root/ big
OK: 1500 / Failed: 1 / User-skipped: 176 / Auto-skipped: 0

connect_SUITE:security:return_proper_stream_error_if_service_is_not_hidden
{error,{{badmatch,true},
    [{connect_SUITE,return_proper_stream_error_if_service_is_not_hidden,1,
            [{file,"/home/travis/build/esl/MongooseIM/big_tests/_build/default/lib/ejabberd_tests/tests/connect_SUITE.erl"},
             {line,647}]},
     {test_server,ts_tc,3,[{file,"test_server.erl"},{line,1748}]},
     {test_server,run_test_case_eval1,6,
            [{file,"test_server.erl"},{line,1263}]},
     {test_server,run_test_case_eval,9,
            [{file,"test_server.erl"},{line,1195}]}]}}

Report log


7080.7 / Erlang 22.0 / elasticsearch_and_cassandra_mnesia / 66c000a
Reports root/ big
OK: 548 / Failed: 0 / User-skipped: 55 / Auto-skipped: 0


7080.6 / Erlang 22.0 / ldap_mnesia / 66c000a
Reports root/ big
OK: 1236 / Failed: 2 / User-skipped: 208 / Auto-skipped: 0

connect_SUITE:security:return_proper_stream_error_if_service_is_not_hidden
{error,{{badmatch,true},
    [{connect_SUITE,return_proper_stream_error_if_service_is_not_hidden,1,
            [{file,"/home/travis/build/esl/MongooseIM/big_tests/_build/default/lib/ejabberd_tests/tests/connect_SUITE.erl"},
             {line,647}]},
     {test_server,ts_tc,3,[{file,"test_server.erl"},{line,1748}]},
     {test_server,run_test_case_eval1,6,
            [{file,"test_server.erl"},{line,1263}]},
     {test_server,run_test_case_eval,9,
            [{file,"test_server.erl"},{line,1195}]}]}}

Report log

connect_SUITE:security:return_proper_stream_error_if_service_is_not_hidden
{error,{{badmatch,true},
    [{connect_SUITE,return_proper_stream_error_if_service_is_not_hidden,1,
            [{file,"/home/travis/build/esl/MongooseIM/big_tests/_build/default/lib/ejabberd_tests/tests/connect_SUITE.erl"},
             {line,647}]},
     {test_server,ts_tc,3,[{file,"test_server.erl"},{line,1748}]},
     {test_server,run_test_case_eval1,6,
            [{file,"test_server.erl"},{line,1263}]},
     {test_server,run_test_case_eval,9,
            [{file,"test_server.erl"},{line,1195}]}]}}

Report log


7080.9 / Erlang 21.3 / pgsql_mnesia / 66c000a
Reports root/ big / small
OK: 3195 / Failed: 2 / User-skipped: 271 / Auto-skipped: 0

connect_SUITE:security:return_proper_stream_error_if_service_is_not_hidden
{error,{{badmatch,true},
    [{connect_SUITE,return_proper_stream_error_if_service_is_not_hidden,1,
            [{file,"/home/travis/build/esl/MongooseIM/big_tests/_build/default/lib/ejabberd_tests/tests/connect_SUITE.erl"},
             {line,647}]},
     {test_server,ts_tc,3,[{file,"test_server.erl"},{line,1562}]},
     {test_server,run_test_case_eval1,6,
            [{file,"test_server.erl"},{line,1080}]},
     {test_server,run_test_case_eval,9,
            [{file,"test_server.erl"},{line,1012}]}]}}

Report log

sm_SUITE:parallel_manual_ack_freq_1:resume_session_state_stop_c2s
{error,{{assertion_failed,assert_many,true,
              [is_presence,#Fun<sm_SUITE.16.18584150>],
              [{xmlel,<<"presence">>,
                  [{<<"from">>,
                  <<"alicE50.962665@localhost/escalus-default-resource">>},
                   {<<"to">>,
                  <<"alice50.962665@localhost/escalus-default-resource">>},
                   {<<"xml:lang">>,<<"en">>}],
                  []},
               {xmlel,<<"presence">>,
                  [{<<"from">>,
                  <<"alicE50.962665@localhost/escalus-default-resource">>},
                   {<<"to">>,
                  <<"alice50.962665@localhost/escalus-default-resource">>},
                   {<<"xml:lang">>,<<"en">>}],
                  []}],
              "   <presence from='alicE50.962665@localhost/escalus-default-resource' to='alice50.962665@localhost/escalus-default-resource' xml:lang='en'/>   <presence from='alicE50.962665@localhost/escalus-default-resource' to='alice50.962665@localhost/escalus-default-resource' xml:lang='en'/>"},
    [{escalus_new_assert,assert_true,2,
               [{file,"/home/travis/build/esl/MongooseIM/big_tests/_build/default/lib/escalus/src/escalus_new_assert.erl"},
                {line,84}]},
     {sm_SUITE,resume_session_state_stop_c2s,1,
           [{file,"/home/travis/build/esl/MongooseIM/big_tests/_build/default/lib/ejabberd_tests/tests/sm_SUITE.erl"},
          {line,569}]},
     {test_server,ts_tc,3,[{file,"test_server.erl"},{line,1562}]},
     ...

Report log

@mongoose-im
Copy link
Collaborator

mongoose-im commented Sep 11, 2019

7152.1 / Erlang 22.0 / small_tests / aeb467e
Reports root / small


7152.2 / Erlang 22.0 / internal_mnesia / aeb467e
Reports root/ big
OK: 1246 / Failed: 0 / User-skipped: 136 / Auto-skipped: 0


7152.3 / Erlang 22.0 / odbc_mssql_mnesia / aeb467e
Reports root/ big
OK: 3138 / Failed: 0 / User-skipped: 260 / Auto-skipped: 0


7152.4 / Erlang 22.0 / mysql_redis / aeb467e
Reports root/ big
OK: 3136 / Failed: 0 / User-skipped: 262 / Auto-skipped: 0


7152.6 / Erlang 22.0 / ldap_mnesia / aeb467e
Reports root/ big
OK: 1241 / Failed: 2 / User-skipped: 167 / Auto-skipped: 0

mod_global_distrib_SUITE:mod_global_distrib:test_pm_with_graceful_reconnection_to_different_server
{error,
  {timeout_when_waiting_for_stanza,
    [{escalus_client,wait_for_stanza,
       [{client,<<"eve65.385442@localhost/res1">>,escalus_tcp,
          <0.14494.1>,
          [{event_manager,<0.14487.1>},
           {server,<<"localhost">>},
           {username,<<"eve65.385442">>},
           {resource,<<"res1">>}],
          [{event_client,
             [{event_manager,<0.14487.1>},
            {server,<<"localhost">>},
            {username,<<"eve65.385442">>},
            {resource,<<"res1">>}]},
           {resource,<<"res1">>},
           {username,<<"eve65.385442">>},
           {server,<<"localhost">>},
           {host,<<"localhost">>},
           {port,5222},
           {auth,{escalus_auth,auth_plain}},
           {wspath,undefined},
           {port,5222},
           {username,<<"eve65.385442">>},
           {server,<<"localhost">>},
           {password,<<"password">>},
           {port,5252},
           {stream_id,<<"7CAE3FAE6829F8A9">>}]},
        5000],
       [{file,
          "/home/travis/build/esl/MongooseIM/big_tests/_build/default/lib/escalus/src/escalus_client.erl"},
        {line,136}]},
     {mod_global_distrib_SUITE,
       '-test_pm_with_graceful_reconnection_to_different_server/1-fun-0-',
       3,
       [{file,
          "/home/travis/build/esl/MongooseIM/big_tests/_build/default/lib/ejabberd_tests/tests/mod_global_distrib_SUITE.erl"},
        {line,573}]},
     {escalus_story,story,4,
       [{file,
          "/home/travis/build/esl/MongooseIM...

Report log

mod_global_distrib_SUITE:mod_global_distrib:test_pm_with_graceful_reconnection_to_different_server
{error,
  {timeout_when_waiting_for_stanza,
    [{escalus_client,wait_for_stanza,
       [{client,<<"eve90.878529@localhost/res1">>,escalus_tcp,
          <0.15059.1>,
          [{event_manager,<0.15052.1>},
           {server,<<"localhost">>},
           {username,<<"eve90.878529">>},
           {resource,<<"res1">>}],
          [{event_client,
             [{event_manager,<0.15052.1>},
            {server,<<"localhost">>},
            {username,<<"eve90.878529">>},
            {resource,<<"res1">>}]},
           {resource,<<"res1">>},
           {username,<<"eve90.878529">>},
           {server,<<"localhost">>},
           {host,<<"localhost">>},
           {port,5222},
           {auth,{escalus_auth,auth_plain}},
           {wspath,undefined},
           {port,5222},
           {username,<<"eve90.878529">>},
           {server,<<"localhost">>},
           {password,<<"password">>},
           {port,5252},
           {stream_id,<<"C7F5A7D34A2D3377">>}]},
        5000],
       [{file,
          "/home/travis/build/esl/MongooseIM/big_tests/_build/default/lib/escalus/src/escalus_client.erl"},
        {line,136}]},
     {mod_global_distrib_SUITE,
       '-test_pm_with_graceful_reconnection_to_different_server/1-fun-0-',
       3,
       [{file,
          "/home/travis/build/esl/MongooseIM/big_tests/_build/default/lib/ejabberd_tests/tests/mod_global_distrib_SUITE.erl"},
        {line,573}]},
     {escalus_story,story,4,
       [{file,
          "/home/travis/build/esl/MongooseIM...

Report log


7152.5 / Erlang 22.0 / riak_mnesia / aeb467e
Reports root/ big
OK: 1470 / Failed: 0 / User-skipped: 145 / Auto-skipped: 0


7152.9 / Erlang 21.3 / pgsql_mnesia / aeb467e
Reports root/ big / small
OK: 3151 / Failed: 0 / User-skipped: 247 / Auto-skipped: 0

@mongoose-im
Copy link
Collaborator

mongoose-im commented Sep 11, 2019

7153.1 / Erlang 22.0 / small_tests / 914e8ee
Reports root / small


7153.2 / Erlang 22.0 / internal_mnesia / 914e8ee
Reports root/ big
OK: 1246 / Failed: 0 / User-skipped: 136 / Auto-skipped: 0


7153.3 / Erlang 22.0 / odbc_mssql_mnesia / 914e8ee
Reports root/ big
OK: 3138 / Failed: 0 / User-skipped: 260 / Auto-skipped: 0


7153.4 / Erlang 22.0 / mysql_redis / 914e8ee
Reports root/ big
OK: 3149 / Failed: 1 / User-skipped: 262 / Auto-skipped: 0

mod_global_distrib_SUITE:mod_global_distrib:test_pm_with_graceful_reconnection_to_different_server
{error,
  {timeout_when_waiting_for_stanza,
    [{escalus_client,wait_for_stanza,
       [{client,<<"eve67.97868@localhost/res1">>,escalus_tcp,
          <0.22835.3>,
          [{event_manager,<0.22828.3>},
           {server,<<"localhost">>},
           {username,<<"eve67.97868">>},
           {resource,<<"res1">>}],
          [{event_client,
             [{event_manager,<0.22828.3>},
            {server,<<"localhost">>},
            {username,<<"eve67.97868">>},
            {resource,<<"res1">>}]},
           {resource,<<"res1">>},
           {username,<<"eve67.97868">>},
           {server,<<"localhost">>},
           {host,<<"localhost">>},
           {port,5222},
           {auth,{escalus_auth,auth_plain}},
           {wspath,undefined},
           {port,5222},
           {username,<<"eve67.97868">>},
           {server,<<"localhost">>},
           {password,<<"password">>},
           {port,5252},
           {stream_id,<<"5B71BB85DC3CE9E3">>}]},
        5000],
       [{file,
          "/home/travis/build/esl/MongooseIM/big_tests/_build/default/lib/escalus/src/escalus_client.erl"},
        {line,136}]},
     {mod_global_distrib_SUITE,
       '-test_pm_with_graceful_reconnection_to_different_server/1-fun-0-',
       3,
       [{file,
          "/home/travis/build/esl/MongooseIM/big_tests/_build/default/lib/ejabberd_tests/tests/mod_global_distrib_SUITE.erl"},
        {line,573}]},
     {escalus_story,story,4,
       [{file,
          "/home/travis/build/esl/MongooseIM/big_...

Report log


7153.5 / Erlang 22.0 / riak_mnesia / 914e8ee
Reports root/ big
OK: 1470 / Failed: 0 / User-skipped: 145 / Auto-skipped: 0


7153.6 / Erlang 22.0 / ldap_mnesia / 914e8ee
Reports root/ big
OK: 1215 / Failed: 0 / User-skipped: 167 / Auto-skipped: 0


7153.9 / Erlang 21.3 / pgsql_mnesia / 914e8ee
Reports root/ big / small
OK: 3151 / Failed: 0 / User-skipped: 247 / Auto-skipped: 0

Copy link
Contributor

@michalwski michalwski left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This can be useful, indeed. I left one comment to the code.

StreamErrorAssertion = {is_stream_error, [<<"xml-not-well-formed">>, <<>>]},
escalus_connection:receive_stanza(Connection, #{ assert => StreamErrorAssertion }),
%% Sometimes escalus needs a moment to report the connection as closed
mongoose_helper:wait_until(fun() -> escalus_connection:is_connected(Connection) end, false).
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is escalus_connection:wait_for_close/2 function which could be used here.

@@ -306,6 +306,12 @@ There are some additional options that influence all database connections in the
* **Default:** no value, i.e. `Cowboy` is used as a header value
* **Example:** `{cowboy_server_name, "Apache"}`

* **hide_service_name** (local)
* **Description:** According to RFC 6210, even when a client sends invalid data after opening a connection, the server must open XML stream and return stream error anyway. For extra security, this option may be enabled. It changes MIM behaviour to simply close the connection without any errors returned (effectively hiding server's identity).
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should read:

[...] the server must open an XML stream and return a stream error anyway.

[...] (effectively hiding the server's identity).

@mongoose-im
Copy link
Collaborator

mongoose-im commented Oct 16, 2019

7326.1 / Erlang 22.0 / small_tests / 3f4b2a7
Reports root / small


7326.2 / Erlang 22.0 / internal_mnesia / 3f4b2a7
Reports root/ big
OK: 1267 / Failed: 0 / User-skipped: 136 / Auto-skipped: 0


7326.3 / Erlang 22.0 / odbc_mssql_mnesia / 3f4b2a7
Reports root/ big
OK: 3181 / Failed: 0 / User-skipped: 262 / Auto-skipped: 0


7326.4 / Erlang 22.0 / mysql_redis / 3f4b2a7
Reports root/ big
OK: 3178 / Failed: 0 / User-skipped: 267 / Auto-skipped: 0


7326.5 / Erlang 22.0 / riak_mnesia / 3f4b2a7
Reports root/ big
OK: 1495 / Failed: 0 / User-skipped: 145 / Auto-skipped: 0


7326.7 / Erlang 22.0 / elasticsearch_and_cassandra_mnesia / 3f4b2a7
Reports root/ big
OK: 514 / Failed: 0 / User-skipped: 32 / Auto-skipped: 0


7326.6 / Erlang 22.0 / ldap_mnesia / 3f4b2a7
Reports root/ big
OK: 1238 / Failed: 0 / User-skipped: 167 / Auto-skipped: 0


7326.9 / Erlang 21.3 / pgsql_mnesia / 3f4b2a7
Reports root/ big / small
OK: 3196 / Failed: 0 / User-skipped: 249 / Auto-skipped: 0

@NelsonVides NelsonVides merged commit db22255 into master Oct 17, 2019
@NelsonVides NelsonVides deleted the feature-hide_service_name branch October 17, 2019 15:25
@michalwski michalwski added this to the 3.6.0 milestone Jan 22, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants