processone / processone/ejabberd

OMEMO does not work with several clients (Converse, Conversations, Dino, Gajim)

Open
#4,103 13 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Erlang
Stars
6.7k
Forks
1.6k
PR merge metrics
No merged PRs in 30d

Description

This is a follow-up for https://github.com/conversejs/converse.js/issues/3281.

Environment

Configuration (only if needed): grep -Ev '^$|^\s*#' ejabberd.yml

> grep -Ev '^$|^\s*#' ejabberd.yml
loglevel: 5
log_rotate_size: 10485760
log_rotate_count: 1
hosts:
  - "molgen.mpg.de"
certfiles:
  - "/home/ejabberd/conf/xmpp.molgen.mpg.de-key.pem"
  - "/home/ejabberd/conf/xmpp.molgen.mpg.de.pem"
ca_file: "/etc/ssl/cert.pem"
listen:
  -
    port: 5222
    ip: "::"
    module: ejabberd_c2s
    max_stanza_size: 262144
    shaper: c2s_shaper
    access: c2s
    starttls_required: true
  -
    port: 5223
    ip: "::"
    tls: true
    module: ejabberd_c2s
    max_stanza_size: 262144
    shaper: c2s_shaper
    access: c2s
  -
    port: 5269
    ip: "::"
    module: ejabberd_s2s_in
    max_stanza_size: 524288
    shaper: s2s_shaper
  -
    port: 5270
    ip: "::"
    tls: true
    module: ejabberd_s2s_in
    max_stanza_size: 524288
    shaper: s2s_shaper
  -
    port: 5280
    ip: "::"
    module: ejabberd_http
    request_handlers:
      "/ws": ejabberd_http_ws
      "/bosh": mod_bosh
      "/oauth": ejabberd_oauth
      "/api": mod_http_api
    captcha: false
  -
    port: 5443
    ip: 0.0.0.0
    module: ejabberd_http
    request_handlers:
      "/admin": ejabberd_web_admin
      "/api": mod_http_api
      "/bosh": mod_bosh
      "/upload": mod_http_upload
      "/ws": ejabberd_http_ws
    tls: true
s2s_use_starttls: optional
auth_method: ldap
ldap_servers:
  - "ldap.molgen.mpg.de"
ldap_encrypt: tls
ldap_rootdn: "cn=ejabberd,dc=ldap,dc=apps,dc=molgen,dc=mpg,dc=de"
ldap_password: "X"
ldap_base: "dc=user,dc=apps,dc=molgen,dc=mpg,dc=de"
ldap_filter: "(objectClass=molgenUser)"
shaper:
  normal: 1000
  fast: 50000
max_fsm_queue: 10000
acl:
  admin:
    user:
      - "admin@localhost"
      - "b@molgen.mpg.de"
  local:
    user_regexp: ""
  loopback:
    ip:
      - "127.0.0.0/8"
      - "::1/128"
      - "::FFFF:127.0.0.1/128"
shaper_rules:
  max_user_sessions: 10
  max_user_offline_messages:
    - 5000: admin
    - 100
  c2s_shaper:
    - none: admin
    - normal
  s2s_shaper: fast
access_rules:
  local:
    - allow: local
  c2s:
    - deny: blocked
    - allow
  announce:
    - allow: admin
  configure:
    - allow: admin
  muc_create:
    - allow: local
  pubsub_createnode:
    - allow: local
  register:
    - allow
  trusted_network:
    - allow: loopback
api_permissions:
  "console commands":
    from:
      - ejabberd_ctl
    who: all
    what: "*"
  "admin access":
    who:
      - access:
          - allow:
            - acl: loopback
            - acl: admin
      - oauth:
        - scope: "ejabberd:admin"
        - access:
          - allow:
            - acl: loopback
            - acl: admin
    what:
      - "*"
      - "!stop"
      - "!start"
  "public commands":
    who:
      - ip: "127.0.0.1/8"
    what:
      - "status"
      - "connected_users_number"
  
language: "en"
modules:
  mod_adhoc: {}
  mod_admin_extra: {}
  mod_announce: # recommends mod_adhoc
    access: announce
  mod_blocking: {} # requires mod_privacy
  mod_caps: {}
  mod_carboncopy: {}
  mod_client_state: {}
  mod_configure: {} # requires mod_adhoc
  mod_disco: {}
  mod_bosh: {}
  mod_http_upload:
    custom_headers:
      "Access-Control-Allow-Origin": "*"
      "Access-Control-Allow-Methods": "GET,HEAD,PUT,OPTIONS"
      "Access-Control-Allow-Headers": "Content-Type"
    put_url: "https://upload.@HOST@:5443/upload"
    thumbnail: false # otherwise needs ejabberd to be compiled with libgd support
  mod_last: {}
  mod_mam: # for xep0313, mnesia is limited to 2GB, better use an SQL backend
    assume_mam_usage: true
    default: always
  mod_muc:
    access:
      - allow
    access_admin:
      - allow: admin
    access_create: muc_create
    access_persistent: muc_create
    default_room_options:
      allow_subscription: true
      persistent: true
      mam: true
  mod_muc_admin: {}
  mod_offline:
    access_max_user_messages: max_user_offline_messages
  mod_ping: {}
  mod_privacy: {}
  mod_private: {}
  mod_pubsub:
    access_createnode: pubsub_createnode
    ignore_pep_from_offline: false
    last_item_cache: true
    plugins:
      - pep # pep requires mod_caps
      - flat
    force_node_config:
      eu.siacs.conversations.axolotl.*:
        access_model: open
      "storage:bookmarks":
        access_model: whitelist
  mod_push: {}
  mod_push_keepalive: {}
  mod_register:
    welcome_message:
      subject: "Welcome!"
      body: |-
        Hi.
        Welcome to this XMPP server.
    ip_access: trusted_network
    access: register
  mod_roster: {}
  mod_shared_roster: {}
  mod_vcard:
    search: false
  mod_vcard_xupdate: {}
  mod_avatar: {}
  mod_version: {}
  mod_stream_mgmt: {}
  mod_s2s_dialback: {}
  mod_http_api: {}
  mod_fail2ban: {}
allow_contrib_modules: true

Errors from error.log/crash.log

2023-10-19 15:55:16.445647+00:00 [debug] Won't add stanza for a@molgen.mpg.de/converse.js-8001973 to CSI queue
2023-10-19 15:55:16.445780+00:00 [debug] Flushing packets of b@molgen.mpg.de from CSI queue of a@molgen.mpg.de/converse.js-8001973
2023-10-19 15:55:16.446003+00:00 [notice] (websocket|<0.8795.0>) Send XML on stream = <<"<iq xml:lang='en' to='a@molgen.mpg.de/converse.js-8001973' from='b@molgen.mpg.de' type='error' id='aec42d48-36c6-410c-a400-239aed940a14:sendIQ'><pubsub xmlns='http://jabber.org/protocol/pubsub'><items node='eu.siacs.conversations.axolotl.devicelist'/></pubsub><error type='cancel'><closed-node xmlns='http://jabber.org/protocol/pubsub#errors'/><not-allowed xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'/></error></iq>">>

Bug description

Using Converse, Conversations, Dino and Gajim, all say OMEMO is not available.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the OMEMO failure with Converse, Conversations, Dino, or Gajim using the reported ejabberd configuration, focusing on mod_pubsub and the eu.siacs.conversations.axolotl.devicelist node. Read the error log showing closed-node and not-allowed responses. Done means OMEMO is available and works across the listed clients without those errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
erlang
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.