search

jelmer / prometheus-xmpp-alerts

XMPP Web hook for Prometheus
Apache License 2.0
31 stars 9 forks source link

slixmpp new release for inclusion #47

Closed rr-sam closed 1 month ago

rr-sam commented 8 months ago

slixmpp has a new release (1.8.5) that fixes the scram-sha1 issues with logging into prosody servers, https://codeberg.org/poezio/slixmpp/releases/tag/slix-1.8.5. 

Fix connections to Snikket instances: Snikket decided to forbid PLAIN
authentication, which is good but exposed a bug in slixmpp, which was trying
to do SCRAM-SHA-1-PLUS authentication on TLSv1.3 using the tls-unique channel
binding, which is forbidden by spec on this version of TLS as it has various
known attacks. TLSv1.3 has the tls-exporter binding which replaces tls-unique,
but we cannot currently use it in slixmpp because CPython does not support it.
For now, connections to Snikket instances will use SCRAM-SHA-1 without binding
(note that the stanzas may say SCRAM-SHA-1-PLUS, but it is the SCRAM payload
which is important here).

I have the same setup with prosody enforcing better auth, same as snikket.

jelmer commented 5 months ago

What's necessary for this on the prometheus-xmpp-alerts side?

jelmer commented 1 month ago

prometheus-xmpp-alerts doesn't have a bound on the version of slixmpp, so I don't think there is anything to do here. Please reopen if I'm missing something.