Not logged in. · Lost password · Register
Forum: agsXMPP RSS
How to make sure your IM and file transfer is secure
Avatar
Dmitriy #1
Member since Feb 2009 · 6 posts · Location: Pennsylvania, U.S.
Group memberships: Members
Show profile · Link to this post
Subject: IM and File Transfer to Google Talk with SSL and port 443
AG-Software has just helped us with a technical issue, and I thought the least I can do is post the solution here on this forum, so that other agsXMPP SDK users could benefit from it.

Problem:

Our corporate network does not allow XMPP clients to connect to Google Talk on ports 5222 or 5223.
Using port 80 is an option, but I needed a better (more secure) option, which is SSL via port # 443.

This way, your login credentials, instant messages, and transferred files are encrypted, and - as far as I know - only a network administrator with access to the XMPP server and to the currently used SSL certificate, would be able to decrypt your IM/FileTransfer traffic.
That is, only Google folks, and no one else.

Of course, if you're using your own XMPP server (such as Openfire, ejabberd, etc.), and it's you who controls your private XMPP network, then your traffic is as secure as it can possibly be nowadays.

Using code snippets from some other posts on this forum,
and with help from AG-Software (by the way, their responsiveness is incredible!.. and it took them only a few minutes to figure out what the heck was wrong with the non-working code I sent to them, and provide a working solution; that's freakin' AWESOME!),
here's exactly what I had to do to ensure that the sample MiniClient (included in the agsXMPP SDK) does the following:
1. Connects to GTalk on port 443 with SSL.
2. Sends file transfers to another MiniClient or Spark Jabber client...
3. ...and file transfer is also done via port # 443.

--------------

1. In MiniClient, open frmLogin.cs, cmdLogin_Click event method, here are the changes:

#region Original settings
/*
_connection.Port = int.Parse(txtPort.Text);
_connection.UseSSL = chkSSL.Checked;
_connection.AutoResolveConnectServer  = true;
_connection.UseCompression = false;
*/
#endregion
#region New settings
_connection.AutoResolveConnectServer = false;
_connection.Port = 443;
_connection.ConnectServer = "talk.google.com";
_connection.UseStartTLS = false;
_connection.UseSSL = true;
#endregion

2. In frmFileTransfer.cs:

(a)

//Original: const string PROXY = "proxy.ag-software.de";
const string PROXY = "talk.google.com";

(b) SendStreamHosts()

for (int i = 0; i < iphe.AddressList.Length; i++)
{
  Console.WriteLine("IP address: {0}", iphe.AddressList[ i ].ToString());
  //TODO: note the next line:
  bsIq.Query.AddStreamHost(m_XmppCon.MyJID, iphe.AddressList[ i ].ToString(), 1000 /*you might want to change the port here, too*/);
}

//Original: bsIq.Query.AddStreamHost(new Jid(PROXY), PROXY, 7777);
bsIq.Query.AddStreamHost(new Jid(PROXY), PROXY, 443);

(c) SendStreamHostsResult method:

//Original: _p2pSocks5Socket.Port = 7777;
_p2pSocks5Socket.Port = 443;

----------------

I hope this helps someone who comes across the same task/issue.
This post was edited on 2009-02-20, 21:16 by Dmitriy.
Avatar
Alex #2
Member since Feb 2003 · 4327 posts · Location: Germany
Group memberships: Administrators, Members
Show profile · Link to this post
Hi Dmitriy,

thank for posting this tutorial.

When you are in a LAN the file transfer is always peer to peer. So the proxy is not used.
talk.google.com is a xmpp server, but not a file transfer proxy. So using talk.google.com on port 443 as file transfer Socks proxy will not work.

Alex
Avatar
Dmitriy #3
Member since Feb 2009 · 6 posts · Location: Pennsylvania, U.S.
Group memberships: Members
Show profile · Link to this post
Alex,

Thank you very much for your reply and for the correction.

I have a few questions about peer-to-peer file transfer proxy.

Goal:

To ensure that file transfer between 2 clients (who are **not** on a LAN) is done via a proxy server and *never* in-band (so that the XMPP server(s) like GTalk do not impose file size etc. restrictions).



XEP-0065 defines "Proxy" as "A Jabber entity which is not NAT/Firewalled and is willing to be a middleman for the bytestream between the Initiator and the Target".


1. Since there is no requirement for a proxy to be an XMPP *server*, I assume that the proxy might as well be a Jabber **client**, with the only requirements that it must be installed on a "public" server which:
(A) is *not* behind a NAT router: that is, has a static IP address (optionally mapped to a domain name);
and
(B) either is *not* behind a firewall, or at least the required ports are open (for example, port 7777).

If this assumption is correct, could you show the necessary changes in my sample code (above - in my previous post), please?

If it is only partially correct, meaning that the file transfer proxy *can* be a *client*, but it must have some extra stuff in it (so, it cannot be, for example, a standard Psi or GTalk Desktop client), what needs to be added to MiniClient so that it is capable of being a file transfer proxy?

The "3.2 Mediated Connection" part of XEP-0065 explains what exactly is supposed to happen between the three entities, but how do I do that in code using agsXMPP?
For example, how do I set up MiniClient to listen on port 7777 so that it acts as a proxy, if that's at all possible?


2. If my assumptions and questions in # 1 are totally naive and wrong,
and a proxy *must* be an XMPP *server* which supports File Transfer by being configured as a proxy server (such as Openfire or IceWarp),
my other 2 questions are:

(1)

Can the proxy server be on a different XMPP network from the 2 clients?
For example,
Client_1 is JohnDoe@gmail.com in New York,
Client_2 is MarySmith@gmail.com in Singapore,
[so, both are on GTalk network],
but the file transfer proxy is an Openfire server running on some_domain.com ?

If this is possible, I assume the only changes in MiniClient would be:
- set the PROXY to some_domain.com
- set the proxy port to 7777 (or, whatever port is configured in that Openfire for file transfer).


(2)

Is there anything else that I'm missing here? Maybe, federation between XMPP servers, or something else?

===================================

Basically, I'm just trying to figure out how to set up a file transfer proxy for non-LAN clients without risking the file transfer being blocked or restricted by the clients' XMPP network, particularly GTalk.

Thank you very much.
Avatar
Alex #4
Member since Feb 2003 · 4327 posts · Location: Germany
Group memberships: Administrators, Members
Show profile · Link to this post
Dmitriy,

there are different ways to transfer files in XMPP. The most popular techniques are

IBB is splitting files in small chunks and sends them over your normal XMPP session. This works in all cases. As you mentioned some public like Google Talk have restrictions to block abusive usages of IBB technologies. So depending on the amount of files and their size its possible that yo hit the limit or not. If you run your own server this is the easiest way to transfer files, and you can set your own limits or remove them.

SOCKS5 is using the XMPP connection only to negotiate the file transfer, when possible and no firewalls are involved its using peer to peer to transfer the files. When this is not possible that SOCKS5 proxies are needed. The SOCKS5 proxies streams the file from client A to client B. Because it has a public IP and domain both client are always able to connect to the proxy. But this proxy component needs to speak also XMPP, becuase the stream must client A to client B must be activated as described in the XEP. Many existing XMPP server ship with a SOCKS5 proxy, and also different code bases are available which you can plugin to every server.

If both clients are firewalled and the admin don't wants you to establish a peer to peer connection then you need always a public server which routes your traffic. This can be the XMPP server like in IBB, a SOCKS5 server like in XEP-0065 or some other media relay.

So the advantage of SOCKS5 is that it keeps away load from your server for the users where a p2p connection is possible. While IBB always sends the file through the server, also in cases where its not necessary. Both technologies have their advantages and disadvantages.

Alex
Avatar
Alex #5
Member since Feb 2003 · 4327 posts · Location: Germany
Group memberships: Administrators, Members
Show profile · Link to this post
In reply to post #3
Quote by Dmitriy:
Basically, I'm just trying to figure out how to set up a file transfer proxy for non-LAN clients without risking the file transfer being blocked or restricted by the clients' XMPP network, particularly GTalk.

this is pretty easy. You have to install a XMPP and a SOCKS5 proxy. GTalk users use this proxy over s2s then. There is no way to block it.

Alex
Avatar
Dmitriy #6
Member since Feb 2009 · 6 posts · Location: Pennsylvania, U.S.
Group memberships: Members
Show profile · Link to this post
Quote by Alex:
this is pretty easy. You have to install a XMPP and a SOCKS5 proxy. GTalk users use this proxy over s2s then. There is no way to block it.

Alex

Alex, thank you for the explanations.

So, if my understanding is correct, I need to do the following:
1. Install an XMPP server (such as Openfire) on a publicly accessible server.
2. Configure it to act as a file transfer proxy, including setting the proxy port.
3. In MiniClient, set the PROXY value to the server's domain or IP address, and set the proxy port as configured in the previous step.
4. Now, the non-LAN (firewalled and NAT-ted) MiniClient clients connected to Google Talk should be able to transfer files to each other via the new proxy server.

Please correct me if I'm wrong.

Also, I have another question:
Does the agsXMPP library "know" which method to use: SOCKS5 or IBB when negotiating file transfer between 2 firewalled clients via a proxy server?

Thank you.
Avatar
Alex #7
Member since Feb 2003 · 4327 posts · Location: Germany
Group memberships: Administrators, Members
Show profile · Link to this post
Quote by Dmitriy:
So, if my understanding is correct, I need to do the following:
1. Install an XMPP server (such as Openfire) on a publicly accessible server.
2. Configure it to act as a file transfer proxy, including setting the proxy port.
3. In MiniClient, set the PROXY value to the server's domain or IP address, and set the proxy port as configured in the previous step.
4. Now, the non-LAN (firewalled and NAT-ted) MiniClient clients connected to Google Talk should be able to transfer files to each other via the new proxy server.

Please correct me if I'm wrong.

correct, and you have to make sure that your server is able to talk to the GTalk server over s2s (called federation).

Quote by Dmitriy:
Does the agsXMPP library "know" which method to use: SOCKS5 or IBB when negotiating file transfer between 2 firewalled clients via a proxy server?

its up to you which technology to use. You decide on one. If you go with SOCKS5 there is no need to speak a second protocol like IBB. agsXMPP supports both and both are pretty easy to use.

If you want to use Gtalk users and they have limits as you pointed out before then SOCKS5 is the better way (I don't know if they have limits and what they are). Anyway, if you want to use GTalk clients you have to setup a server, because GTalk runs no SOCKS5 XEP-0065 server. Google has developed a own proprietary XMPP extensions for file transfers based on some scary technology called HTTP/TCP over UDP.
If you setup a server you could also provide your own user accounts and offer IBB on your server ;-).

Alex
Avatar
Dmitriy #8
Member since Feb 2009 · 6 posts · Location: Pennsylvania, U.S.
Group memberships: Members
Show profile · Link to this post
Quote by Alex:
[...]

If you setup a server you could also provide your own user accounts and offer IBB on your server ;-).

Alex

Yeah, I know. In my humble opinion, each and every small-to-midsize company that needs Instant Messaging (without full-blown Unified Communications stuff) should just install their own XMPP server and live happily ever after.

Setting it up is ridiculously easy nowadays.

But for some products (we are currently working on one of those), requiring the customer to *maintain* their own XMPP server/network is an overkill, if our product is just a small (yet useful ;-) utility.
Avatar
Alex #9
Member since Feb 2003 · 4327 posts · Location: Germany
Group memberships: Administrators, Members
Show profile · Link to this post
If your product is commercial you can sell the xmpp accounts as additional service or include in your calculation.

Alex
Avatar
anh25721 #10
Member since Dec 2009 · 1 post
Group memberships: Members
Show profile · Link to this post
Subject: XEP-0065 SOCKS5 proxy question
Dear Alex,
Could you help me to clarify this point:  If the 2 peers (client and server) are firewalled and they have to use socks5 proxy server.
The first peer can connect to socks5  proxy without problem as it initiates the connection. But How could socks5 connect to the target peer (server) as it's behind a FW ? Does this tagrget peer (server) need to initiate the connection first to socks5 or do reverse tunnelling?
P1(client)----FW-->SOCKS5_Proxy<------FW------>P2(server)
Thank in advance,
Robert
Avatar
Alex #11
Member since Feb 2003 · 4327 posts · Location: Germany
Group memberships: Administrators, Members
Show profile · Link to this post
Hi Robert,

both peers have to connect to the SOCKS5 proxy. When both peers are connected then the proxy tunnels the stream between both peers (clients).

Alex
Avatar
bob #12
Member since Apr 2010 · 1 post
Group memberships: Members
Show profile · Link to this post
Subject: Implementing File transferring for Gtalk over Smack API
Hi Alex,

I'm currently engaged in a research on how to implement file sharing for gtalk over Smack API. Although I've already tried various methods to get it done, still I'm unable to achieve my ultimate goal. So far I could implement file transferring utility with some other protocols such as yahoo messenger but I'm kind of stuck with it while implementing it for Gtalk since it uses jingle protocol for file transferring. Although it is recommended to use libjingle (which is the library used by google to implement file transferring) I don't think I'll be able to use it since I'm a java developer and that library is written in C++. So if I am to use that library, either I may need to totally convert into java or find a java implementation of it. Although the latter option is available for voice data transferring it does not provide facilities for file sharing. So I would be grateful if you could guide me through this to come up with an appropriate solution. (better if it's based on smack API).

Cheers,
Bob.
This post was edited on 2010-04-14, 14:32 by bob.
Avatar
Alex #13
Member since Feb 2003 · 4327 posts · Location: Germany
Group memberships: Administrators, Members
Show profile · Link to this post
Hi Bob,

AFAIK Google is using own non standard extensions for their file transfer. You have to check whether they documented it and then extend Smack based on their docs. If its not documented then you have to reverse engineer the protocol.
I have not look for a while at libjingle, so I don't know if it supports their file transfer extension.

Alex
Close Smaller – Larger + Reply to this post:
Verification code: VeriCode Please enter the word from the image into the text field below. (Type the letters only, lower case is okay.)
Smileys: :-) ;-) :-D :-p :blush: :cool: :rolleyes: :huh: :-/ <_< :-( :'( :#: :scared: 8-( :nuts: :-O
Special characters:
Forum: agsXMPP RSS