Mercurial > libervia-pubsub

comparison sat_pubsub/delegation.py @ 310:e6a9a3c93314

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
delegation: fixed bad security check which was rejecting all delegations from external servers: A hack is used to check delegation origin, but a better solution need to be implemented in the future. A list of trusted servers seems an acceptable solution.
author Goffi <goffi@goffi.org>
date Mon, 21 Dec 2015 13:44:21 +0100
parents 6918a0dad359
children 5d7c3787672e
comparison
equal deleted inserted replaced
309:890b24b37b56 310:e6a9a3c93314
171 def onForward(self, iq): 171 def onForward(self, iq):
172 """Manage forwarded iq 172 """Manage forwarded iq
173 173
174 @param iq(domish.Element): full delegation stanza 174 @param iq(domish.Element): full delegation stanza
175 """ 175 """
176
177 # FIXME: we use a hack supposing that our delegation come from hostname
178 # and we are a component named [name].hostname
179 # but we need to manage properly allowed servers
180 # TODO: do proper origin security check
181 _, allowed = iq['to'].split('.', 1)
182 if jid.JID(iq['from']) != jid.JID(allowed):
183 log.msg((u"SECURITY WARNING: forwarded stanza doesn't come from our server: {}"
184 .format(iq.toXml())).encode('utf-8'))
185 raise error.StanzaError('not-allowed')
186
176 try: 187 try:
177 fwd_iq = (iq.elements(DELEGATION_NS, 'delegation').next() 188 fwd_iq = (iq.elements(DELEGATION_NS, 'delegation').next()
178 .elements(FORWARDED_NS, 'forwarded').next() 189 .elements(FORWARDED_NS, 'forwarded').next()
179 .elements('jabber:client', 'iq').next()) 190 .elements('jabber:client', 'iq').next())
180 except StopIteration: 191 except StopIteration:
181 raise error.StanzaError('not-acceptable') 192 raise error.StanzaError('not-acceptable')
182 193
183 managed_entity = jid.JID(fwd_iq['from']) 194 managed_entity = jid.JID(fwd_iq['from'])
184
185 if managed_entity.host != iq['from']:
186 log.msg((u"SECURITY WARNING: forwarded stanza doesn't come from the emitting server: {}"
187 .format(iq.toXml())).encode('utf-8'))
188 raise error.StanzaError('not-allowed')
189 195
190 self._current_iqs[fwd_iq['id']] = (iq, managed_entity) 196 self._current_iqs[fwd_iq['id']] = (iq, managed_entity)
191 fwd_iq.delegated = True 197 fwd_iq.delegated = True
192 198
193 # we need a recipient in pubsub request for PEP 199 # we need a recipient in pubsub request for PEP