Subject: [xmpp] a dissertation on message delivery

From: "Peter Saint-Andre" <[email-masked]>
Date: Sat, 31 Jul 2010 10:25:28 -0600 (MDT)

I started to write a post about server handling of a headline message that
is sent to a full JID where no such resource is online, but while doing so
I recognized that there are broader issues here, thus the dissertation
that follows. My apologies for the length, but I think it's important to
get this right.

There are three primary considerations at play in server handling of
inbound messages, which sometimes are at odds but need to be managed in a
consistent way:

1. It's good to deliver a message if possible.

2. If a message can't be delivered, it's helpful to inform the sender.

3. It's bad to facilitate directory harvesting attacks and presence leaks.

Take groupchat messages as a fairly non-controversial example. Clearly we
want to deliver such messages to the user who has joined a groupchat room.
However, if the user who was in a room then went offline, it's helpful to
return an error to the chat service so that it can clean up any "ghosts"
in the room. On the other hand, it's dangerous to return an error if the
user doesn't exist when the same kind of message sent to an existing
account would not return an error (because that would enable a directory
harvesting attack).

One simple message handling rule that would meet all of the foregoing
criteria is "the server always returns an error in response to messages of
type groupchat sent to bare JIDs".

However, handling of groupchat messages sent to full JIDs is a bit more
complex. If the server delivers the message when there is an active
resource that matches the full JID but returns an error when there is no
matching full JID, then an attacker could send lots of messages to the
same account with various random resources and perhaps discover whether
the user is online. Whether the attack is practical is another matter --
the server could start to return a different error condition if it detects
such an attack from a particular JID, although the attacker could be smart
and send its messages from multiple JIDs. We need to weigh costs and
benefits, and recognize that there are legitimate tradeoffs between
functionality and security. IMHO it is more difficult to figure out what
the right tradeoffs are with respect to presence leaks than directory
harvesting attacks, which is one reason why I think we're having trouble
agreeing on the right behavior in the case of a headline message that is
sent to a full JID where no such resource is online.

I think there is one more principle here: from the perspective of an
attacker, there is little if any effective difference between the server's
(i) delivering the message or storing it offline and (ii) silently
ignoring it (because an error is not returned immediately in any of those
cases). Therefore, in scenarios where a server delivers a message or
places a message into offline storage for an existing account, it needs to
silently ignore the message if that account does not exist. This implies
that if a server deploys offline storage and thus would store offline a
message of type chat sent to the bare JID of an account that has no active
resources, it would need to silently ignore such a message if sent to a
bare JID for which there is no account.

I see two subsidiary conclusions:

1. Server handling of messages sent to bare JIDs has implications for
directory harvesting.

2. Server handling of messages send to full JIDs has implications for
presence leaks. However, the attack is less direct here (because the
attacker needs to try many different resources in an attempt to find the
one resource that matches) so it is of somewhat lesser concern, in my
opinion.

Therefore, I propose the following table. For this table to be useful, you
need to mentally walk through some of the scenarios, such as "if the
server receives a message of type chat for a full JID where the account
does not exist, then it would silently drop the message; whereas if the
server receives such a message and there is more than one resource with a
non-negative priority but there is no matching resource, then it would
deliver the message to the most-available resource or to all of the
resources (if they have opted in for receiving all chat messages)".

The conventions "O", "E", "D", "S", "M", and "A" are defined in Section
8.3.4 of draft-ietf-xmpp-3921bis-09.

Finally, a word about the choices (e.g., "S/E"). If a server is more
concerned about protecting against presence leaks, it would choose to
silently drop messages sent to the full JID because some messages will
always be delivered. If a server is more concerned about providing helpful
feedback to (some) senders, it would choose to return errors in some cases
(e.g., groupchat messages sent to full JIDs if there is no such active
resource).

I'd like it if we could simplify this table, but I found it helpful to
provisionally define the entire matrix (this matrix is different from the
one currently in 3921bis, and the text in 3921bis does not match this
matrix in all cases).

(I'm posting this via webmail so I hope it works! If not, perhaps someone
could clean it up and repost, because I am out of time. I might have
missed something so other corrections are welcome.)

+----------------------------------------------------------+
| Condition        | Normal | Chat  | Groupchat | Headline |
+----------------------------------------------------------+
| ACCOUNT DOES NOT EXIST                                   |
|  bare            |  S/E   |  S/E  |     E     |    S     |
|  full            |  S/E   |  S/E  |    S/E    |   S/E    |
+----------------------------------------------------------+
| ACCOUNT EXISTS, BUT NO ACTIVE RESOURCES                  |
|  bare            |  O/E   |  O/E  |     E     |    S     |
|  full (no match) |  S/E   |  O/E  |    S/E    |   S/E    |
+----------------------------------------------------------+
| 1 NEGATIVE RESOURCE                                      |
|  bare            |  O/E   |  O/E  |     E     |    S     |
|  full match      |   D    |   D   |     D     |    D     |
|  full no match   |  S/E   |  O/E  |    S/E    |   S/E    |
+----------------------------------------------------------+
| 1 NON-NEGATIVE RESOURCE                                  |
|  bare            |   D    |   D   |     E     |    D     |
|  full match      |   D    |   D   |     D     |    D     |
|  full no match   |  S/E   |   D   |    S/E    |   S/E    |
+----------------------------------------------------------+
| 1+ NON-NEGATIVE RESOURCES                                |
|  bare            |  M/A   |  M/A* |     E     |    A     |
|  full match      |   D    |  D/A* |     D     |    D     |
|  full no match   |  S/E   |  M/A* |    S/E    |   S/E    |
+----------------------------------------------------------+

I will be mostly offline for the next few days because of travel and
meetings, but I will try to reply to list discussion where possible.

Peter