Validating Info/Query (IQ) stanzas in the Extensible Messaging and Presence Protocol (XMPP)
me@thijsalkema.de
This document provides security recommendations for the validation and generation of Info/Query (IQ) stanzas in the Extensible Messaging and Presence Protocol (XMPP). This document updates RFC 6120.
The Extensible Messaging and Presence Protocol (XMPP) uses Info/Query (IQ) stanzas as a "request-response" mechanism. The semantics of IQ enable an entity to make a request of, and receive a response from, another entity. The interaction is tracked by the requesting entity through use of the 'id' attribute. Thus, IQ interactions follow a common pattern of structured data exchange such as get/result or set/result (although an error can be returned in reply to a request if appropriate).
However, it was found not all implementations properly verify the origin of IQ responses. This documents provides recommendations on how to avoid spoofed responses.
Various security-related terms are to be understood in the sense defined in .
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in .
The discussion venue for this document is the mailing list of the XMPP Working Group, for which archives and subscription information can be found at .
Section 8.1.2.1. of specifies that IQ stanzas sent on behalf of the user's own account MUST either (a) include no 'from' attribute or (b) use the user's bare JID as 'from' address (i.e., <localpart@domainpart>). For compatibility with incorrect servers and servers still following , implementations MAY additionally accept a reply with either (a) a 'from' address equal to the full JID of the client (i.e., <localpart@domainpart/resourcepart>) or (b) a 'from' address equal to the domainpart of the JID of the account (i.e., <domainpart>).
'id' attributes are used as end-to-end identifiers of stanzas: the same 'id' attribute is used across every hop. When delivered, the receiver will see the same 'id' value as the sender specified. As described in Section 8.1.3. of , it is REQUIRED to include 'id' values on IQ stanzas and RECOMMENDED for all other stanza types. The entity creating a stanza needs to ensure the 'id' values it generates are unique.
After sending an IQ stanza with type "get" or "set", an entity may store the 'id' and 'to' of the outgoing <iq/> element to identify the response. When an IQ stanza comes in with a matching 'id' and type "result" or "error", the entity MUST verify that the 'from' attribute on the <iq/> matches the 'to' of the outgoing stanza. If the 'from' and 'to' attributes do not match, the entity MUST ignore the stanza. As is mandatory in response to IQ stanzas of type "result" or "error", the entity MUST NOT return an error.
For queries where the intended recipient is the server acting on behalf of the user's own account entities MAY apply the exceptions in .
Many implementations use a counter to generate new 'id' attributes for stanzas to guarantee their uniqueness. However, this may leak presence information of the user: it can give an approximation of how long a client has been running and how many stanzas it has sent since a previous stanza. This could, for example, give an indication of how many messages a user has sent in a certain time. Therefore clients SHOULD NOT include a counter in the 'id' attribute.
Additionally, it is RECOMMENDED to use randomly or pseudo-randomly generated 'id' attributes. Implementations using to generate Universally Unique IDentifiers (UUIDs) to use as 'id' attributes MUST use version 4 UUIDs, which are randomly or pseudo-randomly generated and carry no identifying information. Implementations using a pseudo-random generator, either directly or for generating UUIDs, SHOULD make sure that future values are hard to predict. For more information see .
This document requests no actions of the IANA.
This document covers security.