headers
Magnus Henoch | 3 Feb 17:47
Picon
Gravatar

jabber.el 0.8.91 (was: Re: Back to normality)

On Wed, Dec 21, 2011 at 11:53 PM, Magnus Henoch <magnus.henoch <at> gmail.com> wrote:
> Hi all,
>
> Just wanted to let you know that I just pushed a change that is supposed
> to make jabber.el work equally well with Google Talk as well as some
> servers that didn't like the fix I made a few months ago.  So it would
> be great if you all could test if the latest version in Git is able to
> connect to various Jabber servers.  (ejabberd, Google Talk and Facebook
> seem to work for me.)
>
> I hope to roll a new pretest release before the new year, so you can try
> it out without bothering with Git.

...and by that, I of course meant the Tibetan New Year, which won't be
until 22nd February.  Sorry about the delay...

The files are here:
https://sourceforge.net/projects/emacs-jabber/files/emacs-jabber%20beta%20versions/0.8.91/

The above mentioned change is the only change from 0.8.90 (well, also
fixed the test suite), so if 0.8.90 works well with your Jabber server, the
only reason to upgrade is to provide me with fresh bug reports :) Which
is also, important of course.

Regards,
Magnus

------------------------------------------------------------------------------
Try before you buy = See our experts in action!
The most comprehensive online learning library for Microsoft developers
(Continue reading)

Permalink | Reply | 0 comments |
headers
Magnus Henoch | 6 Feb 09:25
Picon
Gravatar

Re: Supporting open-gnutls-stream

David Engster <deng <at> randomsample.de> writes:

> Emacs24-bzr can be compiled with native libgnutls support so that you no
> longer depend on gnutls-cli being installed. I've attached a tiny patch
> to make jabber.el support this.

Thanks for the patch!  This is something I've been meaning to do for a
long time.  I finally had time to look at your patch, and there's just
one thing that makes me hesitate about committing it: the
`open-gnutls-stream' function disables certificate host name checking,
which strictly speaking makes jabber.el less secure than what's there
now.

It's not exactly clear what the right thing to do here is, though.  This
patch only concerns old-style SSL/TLS connections (typically on port
5223), which are not specified in the XMPP RFCs.  For a STARTTLS
connection, it's clearly specified that the certificate hostname should
match the hostname part of the JID, _not_ the hostname that we end up
connecting to because of DNS SRV records, _but_ when I tried your patch
against Google Talk (where talk.google.com is the host to connect to for
5223-style connections) the certificate is only valid for
talk.google.com as far as I can see.  (On the other hand, certificate
hostname checks currently don't work properly for the DNS SRV case, so I
suspect most people have added "--insecure" to the Emacs gnutls
configuration anyway.)

My best idea right now is to add a new configuration variable for
ignoring certificate hostname mismatch (global or per account?
global would be simpler, both to implement and to configure, but per
account might make sense if you have only one server with a stupid
(Continue reading)

Permalink | Reply | 1 comment |
headers
David Engster | 17 Feb 17:43
Picon

Re: Supporting open-gnutls-stream

Magnus Henoch writes:
> David Engster <deng <at> randomsample.de> writes:
>
>> Emacs24-bzr can be compiled with native libgnutls support so that you no
>> longer depend on gnutls-cli being installed. I've attached a tiny patch
>> to make jabber.el support this.
>
> Thanks for the patch!  This is something I've been meaning to do for a
> long time.  I finally had time to look at your patch, and there's just
> one thing that makes me hesitate about committing it: the
> `open-gnutls-stream' function disables certificate host name checking,
> which strictly speaking makes jabber.el less secure than what's there
> now.

[...]

> My best idea right now is to add a new configuration variable for
> ignoring certificate hostname mismatch (global or per account?
> global would be simpler, both to implement and to configure, but per
> account might make sense if you have only one server with a stupid
> certificate), and hack jabber-conn to use `open-network-stream' and
> 'gnutls-negotiate', taking this variable into account.  And hopefully
> that should be easy to do for the STARTTLS case as well.
>
> Thoughts, ideas and opinions are very welcome.

I think using gnutls-negotiate directly and let the user choose to
ignore possible certificate errors is the way to go. I think the Gnus
guys do the same, or are at least planning to do so[1].  Of course it
would be better if this could be done per account, but if this is too
(Continue reading)

Permalink | Reply | 0 comments |

Gmane