Commits

commits@gajim.org

17632 discussions

python-nbxmpp: store only depth 0 certificate, and don't store f...
by Yann Leboulanger 30 Dec '13

30 Dec '13

changeset 9486848a00ed in /home/hg/repos/python-nbxmpp details:http://hg.gajim.org/python-nbxmpp?cmd=changeset;node=9486848a00ed description: store only depth 0 certificate, and don't store fingerprint and pem. Fixes #11 diffstat: nbxmpp/bosh.py | 6 ++---- nbxmpp/tls_nb.py | 9 +++------ nbxmpp/transports_nb.py | 6 ++---- 3 files changed, 7 insertions(+), 14 deletions(-) diffs (51 lines): diff -r fccda8ea864e -r 9486848a00ed nbxmpp/bosh.py --- a/nbxmpp/bosh.py Sat Nov 30 11:29:05 2013 +0100 +++ b/nbxmpp/bosh.py Fri Dec 06 21:19:37 2013 +0100 @@ -90,10 +90,8 @@ self.proxy_dict['credentials'] = self.proxy_creds # ssl variables - self.ssl_fingerprint_sha1 = [] - self.ssl_certificate = [] - self.ssl_errnum = [] - self.ssl_cert_pem = [] + self.ssl_certificate = None + self.ssl_errnum = None def connect(self, conn_5tuple, on_connect, on_connect_failure): diff -r fccda8ea864e -r 9486848a00ed nbxmpp/tls_nb.py --- a/nbxmpp/tls_nb.py Sat Nov 30 11:29:05 2013 +0100 +++ b/nbxmpp/tls_nb.py Fri Dec 06 21:19:37 2013 +0100 @@ -461,12 +461,9 @@ def _ssl_verify_callback(self, sslconn, cert, errnum, depth, ok): # Exceptions can't propagate up through this callback, so print them here. try: - self._owner.ssl_fingerprint_sha1.append(cert.digest('sha1').decode( - 'utf-8')) - self._owner.ssl_certificate.append(cert) - self._owner.ssl_errnum.append(errnum) - self._owner.ssl_cert_pem.append(OpenSSL.crypto.dump_certificate( - OpenSSL.crypto.FILETYPE_PEM, cert).decode('utf-8')) + if depth == 0: + self._owner.ssl_certificate = cert + self._owner.ssl_errnum = errnum return True except: log.error("Exception caught in _ssl_info_callback:", exc_info=True) diff -r fccda8ea864e -r 9486848a00ed nbxmpp/transports_nb.py --- a/nbxmpp/transports_nb.py Sat Nov 30 11:29:05 2013 +0100 +++ b/nbxmpp/transports_nb.py Fri Dec 06 21:19:37 2013 +0100 @@ -317,10 +317,8 @@ self.on_remote_disconnect = self.disconnect # ssl variables - self.ssl_fingerprint_sha1 = [] - self.ssl_certificate = [] - self.ssl_errnum = [] - self.ssl_cert_pem = [] + self.ssl_certificate = None + self.ssl_errnum = None # FIXME: transport should not be aware xmpp def start_disconnect(self):

1 0

python-nbxmpp: [Fedor Brunner] Use better random number generato...
by Yann Leboulanger 30 Dec '13

30 Dec '13

changeset ee5bca6b1591 in /home/hg/repos/python-nbxmpp details:http://hg.gajim.org/python-nbxmpp?cmd=changeset;node=ee5bca6b1591 description: [Fedor Brunner] Use better random number generator when openssl is available. Fixes #12 diffstat: nbxmpp/auth_nb.py | 9 ++++----- nbxmpp/bosh.py | 8 ++++---- nbxmpp/rndg.py | 49 +++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 57 insertions(+), 9 deletions(-) diffs (125 lines): diff -r 9486848a00ed -r ee5bca6b1591 nbxmpp/auth_nb.py --- a/nbxmpp/auth_nb.py Fri Dec 06 21:19:37 2013 +0100 +++ b/nbxmpp/auth_nb.py Sat Dec 14 10:04:51 2013 +0100 @@ -27,7 +27,6 @@ from .plugin import PlugIn from .smacks import Smacks import base64 -import random import itertools from . import dispatcher_nb import hashlib @@ -37,6 +36,8 @@ import logging log = logging.getLogger('nbxmpp.auth_nb') +import rndg + def HH(some): return hashlib.md5(some).hexdigest() def H(some): return hashlib.md5(some).digest() def C(some): return b':'.join(some) @@ -440,8 +441,7 @@ else: self.resp['realm'] = self._owner.Server self.resp['nonce'] = chal['nonce'] - self.resp['cnonce'] = ''.join("%x" % randint(0, 2**28) for randint \ - in itertools.repeat(random.randint, 7)) + self.resp['cnonce'] = '%x' % rngd.getrandbits(196) self.resp['nc'] = ('00000001') self.resp['qop'] = 'auth' self.resp['digest-uri'] = 'xmpp/' + self._owner.Server @@ -471,8 +471,7 @@ def set_password(self, password): self.password = '' if password is None else password if self.mechanism == 'SCRAM-SHA-1': - nonce = ''.join('%x' % randint(0, 2 ** 28) for randint in \ - itertools.repeat(random.randint, 7)) + nonce = '%x' % rndg.getrandbits(196) self.scram_soup = 'n=' + self.username + ',r=' + nonce self.scram_gs2 = 'n,,' # No CB yet. sasl_data = base64.b64encode((self.scram_gs2 + self.scram_soup).\ diff -r 9486848a00ed -r ee5bca6b1591 nbxmpp/bosh.py --- a/nbxmpp/bosh.py Fri Dec 06 21:19:37 2013 +0100 +++ b/nbxmpp/bosh.py Sat Dec 14 10:04:51 2013 +0100 @@ -18,7 +18,7 @@ ## along with Gajim. If not, see <http://www.gnu.org/licenses/>. -import locale, random +import locale from hashlib import sha1 from .transports_nb import NonBlockingTransport, NonBlockingHTTPBOSH,\ CONNECTED, CONNECTING, DISCONNECTED, DISCONNECTING,\ @@ -29,6 +29,8 @@ import logging log = logging.getLogger('nbxmpp.bosh') +import rndg + KEY_COUNT = 10 # Fake file descriptor - it's used for setting read_timeout in idlequeue for @@ -486,9 +488,7 @@ # to 7881299347898368 messages to raise rid over 2**53 # (see http://www.xmpp.org/extensions/xep-0124.html#rids) # it's also used for sequence key initialization - r = random.Random() - r.seed() - return r.getrandbits(50) + return rndg.getrandbits(50) diff -r 9486848a00ed -r ee5bca6b1591 nbxmpp/rndg.py --- /dev/null Thu Jan 01 00:00:00 1970 +0000 +++ b/nbxmpp/rndg.py Sat Dec 14 10:04:51 2013 +0100 @@ -0,0 +1,49 @@ +## rndg.py +## +## cryptographically secure pseudo-random number generator. +## When possible use OpenSSL PRNG combined with os.random, +## if OpenSSL PRNG is not available, use only os.random. +## +## Copyright (C) 2013 Fedor Brunner <fedor.brunner(a)azet.sk> +## +## This file is part of Gajim. +## +## Gajim is free software; you can redistribute it and/or modify +## it under the terms of the GNU General Public License as published +## by the Free Software Foundation; version 3 only. +## +## Gajim is distributed in the hope that it will be useful, +## but WITHOUT ANY WARRANTY; without even the implied warranty of +## MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +## GNU General Public License for more details. +## +## You should have received a copy of the GNU General Public License +## along with Gajim. If not, see <http://www.gnu.org/licenses/>. + +USE_PYOPENSSL = False +try: + import OpenSSL.rand + import binascii, os + USE_PYOPENSSL = True +except ImportError: + import random + +if not USE_PYOPENSSL: + getrandbits = random.SystemRandom().getrandbits +else: + def getrandbits(k): + """getrandbits(k) -> x. Generates a long int with k random bits.""" + if k <= 0: + raise ValueError('number of bits must be greater than zero') + if k != int(k): + raise TypeError('number of bits should be an integer') + + bytes = (k + 7) // 8 # bits / 8 and rounded up + + # Add system entropy to OpenSSL PRNG + OpenSSL.rand.add(os.urandom(bytes), bytes) + # Extract random bytes from OpenSSL PRNG + random_str = OpenSSL.rand.bytes(bytes) + + x = long(binascii.hexlify(random_str), 16) + return x >> (bytes * 8 - k) # trim excess bits

1 0

python-nbxmpp: [Fedor] Fix unit test (new parameter cipher_list)
by Yann Leboulanger 30 Dec '13

30 Dec '13

changeset e3dfdfcdb006 in /home/hg/repos/python-nbxmpp details:http://hg.gajim.org/python-nbxmpp?cmd=changeset;node=e3dfdfcdb006 description: [Fedor] Fix unit test (new parameter cipher_list) diffstat: test/unit/test_xmpp_transports_nb2.py | 2 ++ 1 files changed, 2 insertions(+), 0 deletions(-) diffs (19 lines): diff -r ee5bca6b1591 -r e3dfdfcdb006 test/unit/test_xmpp_transports_nb2.py --- a/test/unit/test_xmpp_transports_nb2.py Sat Dec 14 10:04:51 2013 +0100 +++ b/test/unit/test_xmpp_transports_nb2.py Mon Dec 16 11:19:00 2013 +0100 @@ -82,6 +82,7 @@ idlequeue=self.idlequeue, estabilish_tls=establish_tls, certs=('../data/other/cacerts.pem', 'tmp/cacerts.pem'), + cipher_list=None, proxy_dict=proxy_dict) self.socket.PlugIn(self) @@ -215,6 +216,7 @@ idlequeue=self.idlequeue_thread.iq, estabilish_tls=False, certs=None, + cipher_list=None, on_http_request_possible=lambda: None, on_persistent_fallback=None, http_dict=http_dict,

1 0

python-nbxmpp: fix typo
by Yann Leboulanger 30 Dec '13

30 Dec '13

changeset ece0c96568ba in /home/hg/repos/python-nbxmpp details:http://hg.gajim.org/python-nbxmpp?cmd=changeset;node=ece0c96568ba description: fix typo diffstat: nbxmpp/auth_nb.py | 5 +---- 1 files changed, 1 insertions(+), 4 deletions(-) diffs (24 lines): diff -r e3dfdfcdb006 -r ece0c96568ba nbxmpp/auth_nb.py --- a/nbxmpp/auth_nb.py Mon Dec 16 11:19:00 2013 +0100 +++ b/nbxmpp/auth_nb.py Mon Dec 16 15:55:53 2013 +0100 @@ -25,11 +25,8 @@ from .protocol import NS_STREAM_MGMT from .protocol import Node, NodeProcessed, isResultNode, Iq, Protocol, JID from .plugin import PlugIn -from .smacks import Smacks import base64 -import itertools from . import dispatcher_nb -import hashlib import hmac import hashlib @@ -441,7 +438,7 @@ else: self.resp['realm'] = self._owner.Server self.resp['nonce'] = chal['nonce'] - self.resp['cnonce'] = '%x' % rngd.getrandbits(196) + self.resp['cnonce'] = '%x' % rndg.getrandbits(196) self.resp['nc'] = ('00000001') self.resp['qop'] = 'auth' self.resp['digest-uri'] = 'xmpp/' + self._owner.Server

1 0

python-nbxmpp: prepare 0.3 release
by Yann Leboulanger 30 Dec '13

30 Dec '13

changeset 72257f8a4fc6 in /home/hg/repos/python-nbxmpp details:http://hg.gajim.org/python-nbxmpp?cmd=changeset;node=72257f8a4fc6 description: prepare 0.3 release diffstat: ChangeLog | 6 ++++++ nbxmpp/__init__.py | 2 ++ setup.py | 2 +- 3 files changed, 9 insertions(+), 1 deletions(-) diffs (34 lines): diff -r ece0c96568ba -r 72257f8a4fc6 ChangeLog --- a/ChangeLog Mon Dec 16 15:55:53 2013 +0100 +++ b/ChangeLog Mon Dec 23 16:52:52 2013 +0100 @@ -1,3 +1,9 @@ +python-nbxmpp 0.3 (23 December 2013) + + * Improve security level + * Ability to configure cipher list + * Store only depth 0 SSL certificate + python-nbxmpp 0.2 (26 July 2013) * Add some namespace diff -r ece0c96568ba -r 72257f8a4fc6 nbxmpp/__init__.py --- a/nbxmpp/__init__.py Mon Dec 16 15:55:53 2013 +0100 +++ b/nbxmpp/__init__.py Mon Dec 23 16:52:52 2013 +0100 @@ -16,3 +16,5 @@ from .client_nb import NonBlockingClient from .plugin import PlugIn from .smacks import Smacks + +__version__ = "0.3" diff -r ece0c96568ba -r 72257f8a4fc6 setup.py --- a/setup.py Mon Dec 16 15:55:53 2013 +0100 +++ b/setup.py Mon Dec 23 16:52:52 2013 +0100 @@ -3,7 +3,7 @@ from distutils.core import setup setup(name='nbxmpp', - version='0.2', + version='0.3', description='Non blocking Jabber/XMPP module', author='Yann Leboulanger', author_email='asterix(a)lagaule.org',

1 0

python-nbxmpp: py2 -> py3
by Yann Leboulanger 30 Dec '13

30 Dec '13

changeset 168bcc096a95 in /home/hg/repos/python-nbxmpp details:http://hg.gajim.org/python-nbxmpp?cmd=changeset;node=168bcc096a95 description: py2 -> py3 diffstat: nbxmpp/auth_nb.py | 2 +- nbxmpp/bosh.py | 2 +- nbxmpp/rndg.py | 2 +- nbxmpp/tls_nb.py | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diffs (46 lines): diff -r 72257f8a4fc6 -r 168bcc096a95 nbxmpp/auth_nb.py --- a/nbxmpp/auth_nb.py Mon Dec 23 16:52:52 2013 +0100 +++ b/nbxmpp/auth_nb.py Mon Dec 30 21:18:37 2013 +0100 @@ -33,7 +33,7 @@ import logging log = logging.getLogger('nbxmpp.auth_nb') -import rndg +from . import rndg def HH(some): return hashlib.md5(some).hexdigest() def H(some): return hashlib.md5(some).digest() diff -r 72257f8a4fc6 -r 168bcc096a95 nbxmpp/bosh.py --- a/nbxmpp/bosh.py Mon Dec 23 16:52:52 2013 +0100 +++ b/nbxmpp/bosh.py Mon Dec 30 21:18:37 2013 +0100 @@ -29,7 +29,7 @@ import logging log = logging.getLogger('nbxmpp.bosh') -import rndg +from . import rndg KEY_COUNT = 10 diff -r 72257f8a4fc6 -r 168bcc096a95 nbxmpp/rndg.py --- a/nbxmpp/rndg.py Mon Dec 23 16:52:52 2013 +0100 +++ b/nbxmpp/rndg.py Mon Dec 30 21:18:37 2013 +0100 @@ -45,5 +45,5 @@ # Extract random bytes from OpenSSL PRNG random_str = OpenSSL.rand.bytes(bytes) - x = long(binascii.hexlify(random_str), 16) + x = int(binascii.hexlify(random_str), 16) return x >> (bytes * 8 - k) # trim excess bits diff -r 72257f8a4fc6 -r 168bcc096a95 nbxmpp/tls_nb.py --- a/nbxmpp/tls_nb.py Mon Dec 23 16:52:52 2013 +0100 +++ b/nbxmpp/tls_nb.py Mon Dec 30 21:18:37 2013 +0100 @@ -363,7 +363,7 @@ OpenSSL.SSL.OP_SINGLE_DH_USE try: flags |= OpenSSL.SSL.OP_NO_TICKET - except AttributeError, e: + except AttributeError as e: # py-OpenSSL < 0.9 or old OpenSSL flags |= 16384 tcpsock._sslContext.set_options(flags)

1 0

python-nbxmpp: [fedor.brunner] Use only high encryption cipher s...
by Yann Leboulanger 30 Dec '13

30 Dec '13

changeset 6c7a69499a8d in /home/hg/repos/python-nbxmpp details:http://hg.gajim.org/python-nbxmpp?cmd=changeset;node=6c7a69499a8d description: [fedor.brunner] Use only high encryption cipher suites and RC4 as least choice. Fixes #7 diffstat: nbxmpp/tls_nb.py | 1 + 1 files changed, 1 insertions(+), 0 deletions(-) diffs (11 lines): diff -r 3405e0919e42 -r 6c7a69499a8d nbxmpp/tls_nb.py --- a/nbxmpp/tls_nb.py Wed Jul 31 10:07:57 2013 +0200 +++ b/nbxmpp/tls_nb.py Mon Sep 09 16:56:14 2013 +0200 @@ -400,6 +400,7 @@ tcpsock.ssl_errnum = [] tcpsock._sslContext.set_verify(OpenSSL.SSL.VERIFY_PEER, self._ssl_verify_callback) + tcpsock._sslContext.set_cipher_list('HIGH:!aNULL:!eNULL:RC4-SHA') store = tcpsock._sslContext.get_cert_store() self._load_cert_file(self.cacerts, store) self._load_cert_file(self.mycerts, store)

1 0

python-nbxmpp: [fedor] ephemeral key exchange and enable TLS 1.1...
by Yann Leboulanger 30 Dec '13

30 Dec '13

changeset 8b9b9ea9a20d in /home/hg/repos/python-nbxmpp details:http://hg.gajim.org/python-nbxmpp?cmd=changeset;node=8b9b9ea9a20d description: [fedor] ephemeral key exchange and enable TLS 1.1 and TLS 1.2 when connecting using client cert authentification. Fixes #8 diffstat: nbxmpp/tls_nb.py | 9 ++++++--- 1 files changed, 6 insertions(+), 3 deletions(-) diffs (26 lines): diff -r 6c7a69499a8d -r 8b9b9ea9a20d nbxmpp/tls_nb.py --- a/nbxmpp/tls_nb.py Mon Sep 09 16:56:14 2013 +0200 +++ b/nbxmpp/tls_nb.py Sun Nov 03 13:47:50 2013 +0100 @@ -359,8 +359,11 @@ conn = tcpsock._owner._caller # FIXME make a checkbox for Client Cert / SSLv23 / TLSv1 # If we are going to use a client cert/key pair for authentication, - # we choose TLSv1 method. - tcpsock._sslContext = OpenSSL.SSL.Context(OpenSSL.SSL.TLSv1_METHOD) + # we choose TLSv1* method. + tcpsock._sslContext = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD) + flags = (OpenSSL.SSL.OP_NO_SSLv2 | OpenSSL.SSL.OP_NO_SSLv3 + | OpenSSL.SSL.OP_SINGLE_DH_USE) + tcpsock._sslContext.set_options(flags) log.debug('Using client cert and key from %s' % conn.client_cert) try: p12 = OpenSSL.crypto.load_pkcs12(open(conn.client_cert).read(), @@ -389,7 +392,7 @@ else: # See http://docs.python.org/dev/library/ssl.html tcpsock._sslContext = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD) - flags = OpenSSL.SSL.OP_NO_SSLv2 + flags = OpenSSL.SSL.OP_NO_SSLv2 | OpenSSL.SSL.OP_SINGLE_DH_USE try: flags |= OpenSSL.SSL.OP_NO_TICKET except AttributeError as e:

1 0

gajim: Enable use of 2048, 3072, 4096 bit DH groups in ESessions...
by Gajim 29 Dec '13

29 Dec '13

changeset 8f86332529fd in /home/hg/repos/gajim author: Fedor Brunner fedor.brunner(a)azet.sk branches: gajim_0.16 details:http://hg.gajim.org/gajim?cmd=changeset;node=8f86332529fd description: Enable use of 2048, 3072, 4096 bit DH groups in ESessions. The 3072-bit DH group is prefered. Fixes #7615 diffstat: src/common/config.py | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diffs (12 lines): diff -r ae3dc024ac52 -r 8f86332529fd src/common/config.py --- a/src/common/config.py Mon Sep 16 16:48:07 2013 +0200 +++ b/src/common/config.py Sun Dec 29 16:00:01 2013 +0100 @@ -217,7 +217,7 @@ 'tabs_always_visible': [opt_bool, False, _('Show tab when only one conversation?')], 'tabs_border': [opt_bool, False, _('Show tabbed notebook border in chat windows?')], 'tabs_close_button': [opt_bool, True, _('Show close button in tab?')], - 'esession_modp': [opt_str, '5,14', _('A list of modp groups to use in a Diffie-Hellman, highest preference first, separated by commas. Valid groups are 1, 2, 5, 14, 15, 16, 17 and 18. Higher numbers are more secure, but take longer to calculate when you start a session.')], + 'esession_modp': [opt_str, '15,16,14', _('A list of modp groups to use in a Diffie-Hellman, highest preference first, separated by commas. Valid groups are 1, 2, 5, 14, 15, 16, 17 and 18. Higher numbers are more secure, but take longer to calculate when you start a session.')], 'chat_avatar_width': [opt_int, 52], 'chat_avatar_height': [opt_int, 52], 'roster_avatar_width': [opt_int, 32],

1 0

gajim: apply modification to markedmsgcolor immediatly. Fixes #7436
by Gajim 28 Dec '13

28 Dec '13

changeset ae3dc024ac52 in /home/hg/repos/gajim author: Yann Leboulanger <asterix(a)lagaule.org> branches: gajim_0.16 details:http://hg.gajim.org/gajim?cmd=changeset;node=ae3dc024ac52 description: apply modification to markedmsgcolor immediatly. Fixes #7436 diffstat: src/conversation_textview.py | 10 ++++++---- 1 files changed, 6 insertions(+), 4 deletions(-) diffs (28 lines): diff -r a7e0c40fb1f5 -r ae3dc024ac52 src/conversation_textview.py --- a/src/conversation_textview.py Fri Dec 27 12:42:19 2013 +0100 +++ b/src/conversation_textview.py Mon Sep 16 16:48:07 2013 +0200 @@ -274,10 +274,10 @@ tag = buffer_.create_tag(tagname) tag.set_property('foreground', color) - tag = buffer_.create_tag('marked') + self.tagMarked = buffer_.create_tag('marked') color = gajim.config.get('markedmsgcolor') - tag.set_property('foreground', color) - tag.set_property('weight', pango.WEIGHT_BOLD) + self.tagMarked.set_property('foreground', color) + self.tagMarked.set_property('weight', pango.WEIGHT_BOLD) tag = buffer_.create_tag('time_sometimes') tag.set_property('foreground', 'darkgrey') @@ -339,7 +339,9 @@ self.tagIn.set_property('foreground', gajim.config.get('inmsgcolor')) self.tagOut.set_property('foreground', gajim.config.get('outmsgcolor')) self.tagStatus.set_property('foreground', - gajim.config.get('statusmsgcolor')) + gajim.config.get('statusmsgcolor')) + self.tagMarked.set_property('foreground', + gajim.config.get('markedmsgcolor')) color = gajim.config.get('urlmsgcolor') self.tv.tagURL.set_property('foreground', color) self.tv.tagMail.set_property('foreground', color)

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

Commits