Security

After working on TLS stuff, I noticed that we still allowed unencrypted SCRAM to be negociated, which is really not good. For packagers who only want this security fix, the commit fd66aef38d48b6474654cbe87464d7d416d6a5f3 should apply cleanly on any slixmpp version.

(most servers in the wild have unencrypted connections entirely disabled, so this is only an issue for Man in the Middle attacks)

Enhancements

• slixmpp now supports XEP-0368 and allows to choose easily between direct TLS, or STARTTLS.

Breaking Changes

• The security issue mentioned above is a breaking change if you actively want to connect to servers without encryption. If that is a desired behavior, you can still set xmpp['feature_mechanisms'].unencrypted_scram = True on init.

• Removal of the timeout_callback parameter anywhere it was present. Users are encouraged to await on the coroutine or the future returned by the function, which will raise an IqTimeout exception when appropriate.

• Removal of the custom google plugins, which I am guessing have not worked in a very long time (both the google and gmail_notify plugin).

• Removal of the Stream Compression ( XEP-0138 ) plugin. It was not working at all and use of compression is actively discouraged for security reasons .

• Due to the new connection code, the configuration of the connection parameters has changed quite a bit:

  • The XMLStream (from which inherits the ClientXMPP class) does not have a use_ssl parameter anymore. Instead it has enable_direct_tls and enable_starttls as well as enable_plaintext attributes. Those attributes control whether we want to connect using starttls or direct TLS. The plaintext is for components since we only implement the jabber component protocol ( XEP-0114 ).
  • Handling of custom addresses has changed a bit, now they are set through calling connect() , and kept until connect() is called without arguments again.
  • The DNS code will now fetch both xmpps-client and xmpp-client records (unless direct TLS is explicitly disabled) and prefer direct TLS if it has the same priority as STARTTLS.
  • The SRV targeted by the queries can be customized using the tls_services and starttls_services of ClientXMPP (but have no idea why anyone would do this)

Fixes

• Another issue encountered with the Rust JID, trying to compare a JID against strings that cannot be parsed or other objects would raise an InvalidJID exception instead of returning False .
• The ssl_cert event would only be invoked on STARTTLS.
• One of the asyncio warnings on program exit (that a coroutine is still running).
• Traceback with BaseXMPP.get .
• A potential edge case in the disco ( XEP-0030 ) plugin when using strings instead of JIDs.
• A traceback in vcard-temp ( XEP-0054 ) and Legacy Delayed Delivery ( XEP-0091 ) when parsing datetimes.
• A traceback when manipulating conditions in feature mechanisms.
• A traceback in Ad-hoc commands ( XEP-0050 ) during error handling.
• Many tracebacks in OAuth over XMPP ( XEP-0235 ) due to urllib API changes.

Links

You can find the new release on codeberg , pypi , or the distributions that package it in a short while.