Skip to content

Commit

Permalink
Remove channel binding workarounds.
Browse files Browse the repository at this point in the history
Servers should rather upgrade to a version where
these issues are fixed than working around in this library.
  • Loading branch information
mdosch committed Nov 6, 2023
1 parent 10c26c8 commit 6fd0e54
Showing 1 changed file with 4 additions and 26 deletions.
30 changes: 4 additions & 26 deletions xmpp.go
Original file line number Diff line number Diff line change
Expand Up @@ -471,32 +471,10 @@ func (c *Client) init(o *Options) error {
tlsState := tlsConn.ConnectionState()
switch tlsState.Version {
case tls.VersionTLS13:
// Some ejabberd versions do not support "tls-exporter" but do channel
// binding for TLSv1.3 using "tls-unique". This will work around the
// issue.
for _, cb := range f.ChannelBinding.ChannelBinding {
if cb.Type == "tls-exporter" {
tls13 = true
keyingMaterial, err = tlsState.ExportKeyingMaterial("EXPORTER-Channel-Binding", nil, 32)
if err != nil {
return err
}
}
// Use "tls-unique" if "tls-exporter" is not supported.
if !tls13 {
keyingMaterial = tlsState.TLSUnique
}
}
// Metronome also uses "tls-unique" instead of "tls-exporter"
// when TLSv1.3 is used but doesn't report the supported channel binding
// methods. Therefore assume "tls-exporter" which is the correct channel
// binding method for TLSv1.3 in this case.
if len(f.ChannelBinding.ChannelBinding) == 0 {
tls13 = true
keyingMaterial, err = tlsState.ExportKeyingMaterial("EXPORTER-Channel-Binding", nil, 32)
if err != nil {
return err
}
tls13 = true
keyingMaterial, err = tlsState.ExportKeyingMaterial("EXPORTER-Channel-Binding", nil, 32)
if err != nil {
return err
}
case tls.VersionTLS10, tls.VersionTLS11, tls.VersionTLS12:
keyingMaterial = tlsState.TLSUnique
Expand Down

0 comments on commit 6fd0e54

Please sign in to comment.