Question

I’m trying to develop a XMPP “Proxy” which will be in the middle of a standard Jabber communication.

The schema will be something like this:

Pidgin ---> Proxy <--- eJabberD
              |
              v
           Console

The purpose of this proxy is to log all the stanzas which go over the wire. IMHO, this is very convenient when you’re developing XMPP based solutions.

I’m doing this with EventMachine and Ruby, and the main problem is to know how to decypher the traffic after the TLS/SASL handshake.

Before the starttls, all works perfectly, the server and client can talk between them, but when the tls handshake begins, although it works, it is impossible to dump the clear content as all of the traffic is encrypted.

I’m not an expert in TLS/SASL thing, so I don’t know which is the best approach to do this. I think one way to achieve this, should be to grab the certificate in the handshake and use it to decypher the content as it goes throught the proxy.

Thanks!

Answer 1

If you could do what you say (grab the certificate on the wire and use it to decrypt), then TLS would be pretty worthless. This is one of the primary attacks TLS exists to prevent.

If the server will allow it, just don’t send starttls. This is not required by spec. If starttls is required by your server, then you can configure it to use a null cipher, which will leave the traffic unencrypted. Not all servers will support that of course.

You can man-in-the-middle the starttls. Respond with your own tunnel to the client, and send a separate starttls negotiation to the server. This should generate certificate warnings on the client, but since you control the client you can tell it to accept the certificate anyway.

If you control the server, you can use the private key from it to decrypt the traffic. I’m not aware with any off-the-shelf code to do that easily, but it’s writable.