Skip to content

Improve XMPP protocol support for starttls on s_client - #2

Closed
clopez wants to merge 4 commits into
openssl:masterfrom
clopez:s_client-XMPP
Closed

clopez wants to merge 4 commits into
openssl:masterfrom
clopez:s_client-XMPP

Conversation

@clopez

@clopez clopez commented May 27, 2013

Copy link
Copy Markdown
Contributor

I submit this patches time ago to the openssl mailing list but got not answer.
I have rebased the patches on top of current master and I'm retrying submitting it here with the hope that it will caught more attention.

This pull request fixes the support for XMPP on openssl s_client. A number of reports on Internet complain about this. Examples:

clopez added 4 commits May 27, 2013 23:47
 * Some XMPP Servers (OpenFire) use double quotes.
 * This makes s_client starttls work with this servers.
 * Tested with OpenFire servers from http://xmpp.net/ ::

     openssl s_client -connect coderollers.com:5222 -starttls xmpp
 * When the host used in "-connect" is not what the remote XMPP server expects
   the server will return an error like this:
     <stream:error>
       <host-unknown xmlns='urn:ietf:params:xml:ns:xmpp-streams'/>
     </stream:error>
 * But the actual code will stay on the loop forever because the stop condition
   "/stream:features>" will never happen,
 * Make this more robust: The stop condition should be that BIO_read failed
 * Test if for example with ::

    openssl s_client  -connect random.jabb3r.net:5222 -starttls xmpp
 * Many XMPP servers are configured with multiple domains (virtual hosts)
 * In order to establish successfully the TLS connection you have to specify
   which virtual host you are trying to connect.
 * Test this, for example with ::
   * Fail:
       openssl s_client -connect talk.google.com:5222 -starttls xmpp
   * Works:
       openssl s_client -connect talk.google.com:5222 -starttls xmpp -xmpphost gmail.com
@benlaurie

Copy link
Copy Markdown
Contributor

Merged.

@benlaurie benlaurie closed this Sep 5, 2013
snhenson pushed a commit that referenced this pull request Apr 8, 2014
snhenson pushed a commit that referenced this pull request Apr 8, 2014
(cherry picked from commit a74bee5)
levitte pushed a commit that referenced this pull request Feb 8, 2016
Previous commit 7bb196a attempted to "fix" a problem with the way
SSL_shutdown() behaved whilst in mid-handshake. The original behaviour had
SSL_shutdown() return immediately having taken no action if called mid-
handshake with a return value of 1 (meaning everything was shutdown
successfully). In fact the shutdown has not been successful.

Commit 7bb196a changed that to send a close_notify anyway and then
return. This seems to be causing some problems for some applications so
perhaps a better (much simpler) approach is revert to the previous
behaviour (no attempt at a shutdown), but return -1 (meaning the shutdown
was not successful).

This also fixes a bug where SSL_shutdown always returns 0 when shutdown
*very* early in the handshake (i.e. we are still using SSLv23_method).

Reviewed-by: Viktor Dukhovni <[email protected]>
levitte pushed a commit that referenced this pull request Feb 8, 2016
Previous commit f73c737 attempted to "fix" a problem with the way
SSL_shutdown() behaved whilst in mid-handshake. The original behaviour had
SSL_shutdown() return immediately having taken no action if called mid-
handshake with a return value of 1 (meaning everything was shutdown
successfully). In fact the shutdown has not been successful.

Commit f73c737 changed that to send a close_notify anyway and then
return. This seems to be causing some problems for some applications so
perhaps a better (much simpler) approach is revert to the previous
behaviour (no attempt at a shutdown), but return -1 (meaning the shutdown
was not successful).

This also fixes a bug where SSL_shutdown always returns 0 when shutdown
*very* early in the handshake (i.e. we are still using SSLv23_method).

Reviewed-by: Viktor Dukhovni <[email protected]>
Tatsuya-Nonogaki added a commit to Tatsuya-Nonogaki/openssl that referenced this pull request Mar 22, 2016
Tatsuya-Nonogaki added a commit to Tatsuya-Nonogaki/openssl that referenced this pull request Mar 24, 2016
Added functions to create, delete a set of cert/key and PKCS#12, which can be used to manage a lot of auth-client key sets.

Revert some unnecessary changes

Revert some unnecessary changes openssl#2

Pair-Bag total manage capability added to CA.pl
@paulidale paulidale mentioned this pull request Jul 18, 2017
@slontis slontis mentioned this pull request Mar 4, 2026
2 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants