fix(xmpp): obfuscate client identity in protocol exchanges

Modify version responses to return a generic client name and omit
version strings. Drop the "profanity." prefix from dynamically
generated JID resources. Clear the XEP-0115 capabilities node URI to
prevent service discovery fingerprinting. These adjustments reduce the
client's attack surface by minimizing identifiable metadata.

src/command/cmd_ac.c

@@ -110,8 +110,6 @@ static char* _software_autocomplete(ProfWin* window, const char* const input, gb
 static char* _url_autocomplete(ProfWin* window, const char* const input, gboolean previous);
 static char* _executable_autocomplete(ProfWin* window, const char* const input, gboolean previous);
 static char* _lastactivity_autocomplete(ProfWin* window, const char* const input, gboolean previous);
-static char* _disco_autocomplete(ProfWin* window, const char* const input, gboolean previous);
-static char* _roster_jid_autocomplete(const char* const input, const char* const prefix, gboolean previous);
 static char* _intype_autocomplete(ProfWin* window, const char* const input, gboolean previous);
 static char* _mood_autocomplete(ProfWin* window, const char* const input, gboolean previous);
 static char* _strophe_autocomplete(ProfWin* window, const char* const input, gboolean previous);
@@ -124,7 +122,6 @@ static char* _ai_autocomplete(ProfWin* window, const char* const input, gboolean
 static char* _script_autocomplete_func(const char* const prefix, gboolean previous, void* context);
 
 static char* _cmd_ac_complete_params(ProfWin* window, const char* const input, gboolean previous);
-static gboolean _is_connected(void);
 
 static Autocomplete commands_ac;
 static Autocomplete who_room_ac;
@@ -1429,7 +1426,6 @@ cmd_ac_init(void)
     g_hash_table_insert(ac_funcs, "/color", _color_autocomplete);
     g_hash_table_insert(ac_funcs, "/connect", _connect_autocomplete);
     g_hash_table_insert(ac_funcs, "/console", _console_autocomplete);
-    g_hash_table_insert(ac_funcs, "/disco", _disco_autocomplete);
     g_hash_table_insert(ac_funcs, "/correct", _correct_autocomplete);
     g_hash_table_insert(ac_funcs, "/correction", _correction_autocomplete);
     g_hash_table_insert(ac_funcs, "/executable", _executable_autocomplete);
@@ -1866,12 +1862,10 @@ _cmd_ac_complete_params(ProfWin* window, const char* const input, gboolean previ
     }
 
     gchar* history_jid_subcmds[] = { "/history verify", "/history export", "/history import" };
-    if (conn_status == JABBER_CONNECTED) {
-        for (size_t i = 0; i < ARRAY_SIZE(history_jid_subcmds); i++) {
-            result = autocomplete_param_with_func(input, history_jid_subcmds[i], roster_barejid_autocomplete, previous, NULL);
-            if (result) {
-                return result;
-            }
+    for (size_t i = 0; i < ARRAY_SIZE(history_jid_subcmds); i++) {
+        result = autocomplete_param_with_func(input, history_jid_subcmds[i], roster_barejid_autocomplete, previous, NULL);
+        if (result) {
+            return result;
         }
     }
 
@@ -1947,6 +1941,7 @@ _cmd_ac_complete_params(ProfWin* window, const char* const input, gboolean previ
         Autocomplete completer;
     } ac_cmds[] = {
         { "/prefs", prefs_ac },
+        { "/disco", disco_ac },
         { "/room", room_ac },
         { "/mainwin", winpos_ac },
         { "/inputwin", winpos_ac },
@@ -1996,31 +1991,6 @@ _cmd_ac_complete_params(ProfWin* window, const char* const input, gboolean previ
     return NULL;
 }
 
-static gboolean
-_is_connected(void)
-{
-    return connection_get_status() == JABBER_CONNECTED;
-}
-
-static char*
-_roster_jid_autocomplete(const char* const input, const char* const prefix, gboolean previous)
-{
-    if (!_is_connected()) {
-        return NULL;
-    }
-    char* result = NULL;
-    result = autocomplete_param_with_func(input, prefix, roster_contact_autocomplete, previous, NULL);
-    if (result) {
-        return result;
-    }
-    result = autocomplete_param_with_func(input, prefix, roster_barejid_autocomplete, previous, NULL);
-    if (result) {
-        return result;
-    }
-    result = autocomplete_param_with_func(input, prefix, roster_fulljid_autocomplete, previous, NULL);
-    return result;
-}
-
 static char*
 _caps_autocomplete(ProfWin* window, const char* const input, gboolean previous)
 {
@@ -2036,29 +2006,20 @@ _caps_autocomplete(ProfWin* window, const char* const input, gboolean previous)
         if (nick_ac) {
             result = autocomplete_param_with_ac(input, "/caps", nick_ac, TRUE, previous);
         }
-    } else {
-        result = _roster_jid_autocomplete(input, "/caps", previous);
+    } else if (connection_get_status() == JABBER_CONNECTED) {
+        result = autocomplete_param_with_func(input, "/caps", roster_contact_autocomplete, previous, NULL);
+        if (result) {
+            return result;
+        }
+        result = autocomplete_param_with_func(input, "/caps", roster_barejid_autocomplete, previous, NULL);
+        if (result) {
+            return result;
+        }
+        result = autocomplete_param_with_func(input, "/caps", roster_fulljid_autocomplete, previous, NULL);
     }
     return result;
 }
 
-static char*
-_disco_autocomplete(ProfWin* window, const char* const input, gboolean previous)
-{
-    char* result = NULL;
-    result = autocomplete_param_with_ac(input, "/disco", disco_ac, TRUE, previous);
-    if (result) {
-        return result;
-    }
-
-    result = _roster_jid_autocomplete(input, "/disco info", previous);
-    if (result) {
-        return result;
-    }
-    result = _roster_jid_autocomplete(input, "/disco items", previous);
-    return result;
-}
-
 static char*
 _sub_autocomplete(ProfWin* window, const char* const input, gboolean previous)
 {
@@ -3737,7 +3698,7 @@ _win_autocomplete(ProfWin* window, const char* const input, gboolean previous)
     }
 
     char* unquoted = strip_arg_quotes(input);
-    result = _roster_jid_autocomplete(input, "/win", previous);
+    result = autocomplete_param_with_func(unquoted, "/win", roster_contact_autocomplete, previous, NULL);
     free(unquoted);
     return result;
 }
@@ -4071,14 +4032,18 @@ _invite_autocomplete(ProfWin* window, const char* const input, gboolean previous
         return result;
     }
 
-    result = _roster_jid_autocomplete(input, "/invite send", previous);
-    if (result) {
-        return result;
-    }
+    jabber_conn_status_t conn_status = connection_get_status();
 
-    result = autocomplete_param_with_func(input, "/invite decline", muc_invites_find, previous, NULL);
-    if (result) {
-        return result;
+    if (conn_status == JABBER_CONNECTED) {
+        result = autocomplete_param_with_func(input, "/invite send", roster_contact_autocomplete, previous, NULL);
+        if (result) {
+            return result;
+        }
+
+        result = autocomplete_param_with_func(input, "/invite decline", muc_invites_find, previous, NULL);
+        if (result) {
+            return result;
+        }
     }
 
     return NULL;
@@ -4094,37 +4059,42 @@ _status_autocomplete(ProfWin* window, const char* const input, gboolean previous
         return result;
     }
 
-    // complete with: online, away etc.
-    result = autocomplete_param_with_ac(input, "/status set", account_status_ac, TRUE, previous);
-    if (result) {
-        return result;
-    }
+    jabber_conn_status_t conn_status = connection_get_status();
 
-    // Remove quote character before and after names when doing autocomplete
-    char* unquoted = strip_arg_quotes(input);
+    if (conn_status == JABBER_CONNECTED) {
 
-    // MUC completion with nicknames
-    if (window->type == WIN_MUC) {
-        ProfMucWin* mucwin = (ProfMucWin*)window;
-        assert(mucwin->memcheck == PROFMUCWIN_MEMCHECK);
-        Autocomplete nick_ac = muc_roster_ac(mucwin->roomjid);
-        if (nick_ac) {
-            result = autocomplete_param_with_ac(unquoted, "/status get", nick_ac, TRUE, previous);
+        // complete with: online, away etc.
+        result = autocomplete_param_with_ac(input, "/status set", account_status_ac, TRUE, previous);
+        if (result) {
+            return result;
+        }
+
+        // Remove quote character before and after names when doing autocomplete
+        char* unquoted = strip_arg_quotes(input);
+
+        // MUC completion with nicknames
+        if (window->type == WIN_MUC) {
+            ProfMucWin* mucwin = (ProfMucWin*)window;
+            assert(mucwin->memcheck == PROFMUCWIN_MEMCHECK);
+            Autocomplete nick_ac = muc_roster_ac(mucwin->roomjid);
+            if (nick_ac) {
+                result = autocomplete_param_with_ac(unquoted, "/status get", nick_ac, TRUE, previous);
+                if (result) {
+                    free(unquoted);
+                    return result;
+                }
+            }
+            // roster completion
+        } else {
+            result = autocomplete_param_with_func(unquoted, "/status get", roster_contact_autocomplete, previous, NULL);
             if (result) {
                 free(unquoted);
                 return result;
             }
         }
-        // roster completion
-    } else {
-        result = _roster_jid_autocomplete(input, "/status get", previous);
-        if (result) {
-            free(unquoted);
-            return result;
-        }
-    }
 
-    free(unquoted);
+        free(unquoted);
+    }
 
     return NULL;
 }
@@ -4232,12 +4202,14 @@ _software_autocomplete(ProfWin* window, const char* const input, gboolean previo
 {
     char* result = NULL;
 
-    if (window->type == WIN_CHAT && _is_connected()) {
+    if (window->type == WIN_CHAT) {
         ProfChatWin* chatwin = (ProfChatWin*)window;
         assert(chatwin->memcheck == PROFCHATWIN_MEMCHECK);
 
-        auto_gchar gchar* search_str = g_strdup_printf("/software %s", chatwin->barejid);
-        result = autocomplete_param_with_func(search_str, "/software", roster_fulljid_autocomplete, previous, NULL);
+        GString* search_str = g_string_new("/software ");
+        g_string_append(search_str, chatwin->barejid);
+        result = autocomplete_param_with_func(search_str->str, "/software", roster_fulljid_autocomplete, previous, NULL);
+        g_string_free(search_str, TRUE);
     } else if (window->type == WIN_MUC) {
         ProfMucWin* mucwin = (ProfMucWin*)window;
         assert(mucwin->memcheck == PROFMUCWIN_MEMCHECK);
@@ -4251,7 +4223,10 @@ _software_autocomplete(ProfWin* window, const char* const input, gboolean previo
             }
         }
     } else {
-        result = _roster_jid_autocomplete(input, "/software", previous);
+        result = autocomplete_param_with_func(input, "/software", roster_fulljid_autocomplete, previous, NULL);
+        if (result) {
+            return result;
+        }
     }
 
     return result;
@@ -4350,11 +4325,16 @@ _lastactivity_autocomplete(ProfWin* window, const char* const input, gboolean pr
         return result;
     }
 
-    result = autocomplete_param_with_func(input, "/lastactivity set", prefs_autocomplete_boolean_choice, previous, NULL);
-    if (result) {
-        return result;
+    jabber_conn_status_t conn_status = connection_get_status();
+
+    if (conn_status == JABBER_CONNECTED) {
+
+        result = autocomplete_param_with_func(input, "/lastactivity set", prefs_autocomplete_boolean_choice, previous, NULL);
+        if (result) {
+            return result;
+        }
+        result = autocomplete_param_with_func(input, "/lastactivity get", roster_barejid_autocomplete, previous, NULL);
     }
-    result = _roster_jid_autocomplete(input, "/lastactivity get", previous);
 
     return result;
 }
@@ -4534,19 +4514,19 @@ _vcard_autocomplete(ProfWin* window, const char* const input, gboolean previous)
     } else {
         char* unquoted = strip_arg_quotes(input);
 
-        result = _roster_jid_autocomplete(input, "/vcard get", previous);
+        result = autocomplete_param_with_func(unquoted, "/vcard get", roster_contact_autocomplete, previous, NULL);
         if (result) {
             free(unquoted);
             return result;
         }
 
-        result = _roster_jid_autocomplete(input, "/vcard photo open", previous);
+        result = autocomplete_param_with_func(unquoted, "/vcard photo open", roster_contact_autocomplete, previous, NULL);
         if (result) {
             free(unquoted);
             return result;
         }
 
-        result = _roster_jid_autocomplete(input, "/vcard photo save", previous);
+        result = autocomplete_param_with_func(unquoted, "/vcard photo save", roster_contact_autocomplete, previous, NULL);
         if (result) {
             free(unquoted);
             return result;

src/command/cmd_funcs.c

@@ -110,15 +110,6 @@ static gboolean _cmd_execute_default(ProfWin* window, const char* inp);
 static gboolean _cmd_execute_alias(ProfWin* window, const char* const inp, gboolean* ran);
 static gboolean
 _download_install_plugin(ProfWin* window, gchar* url, gchar* path);
-static const gchar*
-_resolve_contact_jid(const char* const name)
-{
-    char* barejid = roster_barejid_from_name(name);
-    if (barejid == NULL) {
-        barejid = (char*)name;
-    }
-    return barejid;
-}
 
 static void
 _vcard_editor_finished_cb(gchar* message, void* user_data)
@@ -3423,7 +3414,7 @@ cmd_caps(ProfWin* window, const char* const command, gchar** args)
     case WIN_CONSOLE:
     case WIN_XML:
         if (args[0]) {
-            auto_jid Jid* jid = jid_create(_resolve_contact_jid(args[0]));
+            auto_jid Jid* jid = jid_create(args[0]);
 
             if (jid == NULL || jid->fulljid == NULL) {
                 cons_show("You must provide a full jid to the /caps command.");
@@ -3465,7 +3456,7 @@ cmd_caps(ProfWin* window, const char* const command, gchar** args)
 }
 
 static void
-_send_software_version_iq_to_fulljid(const gchar* const request)
+_send_software_version_iq_to_fulljid(char* request)
 {
     auto_jid Jid* jid = jid_create(request);
 
@@ -3506,7 +3497,7 @@ cmd_software(ProfWin* window, const char* const command, gchar** args)
         break;
     case WIN_CHAT:
         if (args[0]) {
-            _send_software_version_iq_to_fulljid(_resolve_contact_jid(args[0]));
+            _send_software_version_iq_to_fulljid(args[0]);
             break;
         } else {
             ProfChatWin* chatwin = (ProfChatWin*)window;
@@ -3530,7 +3521,7 @@ cmd_software(ProfWin* window, const char* const command, gchar** args)
         }
     case WIN_CONSOLE:
         if (args[0]) {
-            _send_software_version_iq_to_fulljid(_resolve_contact_jid(args[0]));
+            _send_software_version_iq_to_fulljid(args[0]);
         } else {
             cons_show("You must provide a jid to the /software command.");
         }
@@ -4840,7 +4831,7 @@ cmd_disco(ProfWin* window, const char* const command, gchar** args)
         return TRUE;
     }
 
-    auto_gchar gchar* jid = g_strdup_printf("%s", args[1] ? _resolve_contact_jid(args[1]) : connection_get_jid()->domainpart);
+    auto_gchar gchar* jid = g_strdup_printf("%s", args[1] ?: connection_get_jid()->domainpart);
 
     if (g_strcmp0(args[0], "info") == 0) {
         iq_disco_info_request(jid);
@@ -5062,7 +5053,7 @@ cmd_lastactivity(ProfWin* window, const char* const command, gchar** args)
         if (args[1] == NULL) {
             iq_last_activity_request(connection_get_jid()->domainpart);
         } else {
-            iq_last_activity_request(_resolve_contact_jid(args[1]));
+            iq_last_activity_request(args[1]);
         }
         return TRUE;
     }
@@ -6415,17 +6406,17 @@ cmd_ping(ProfWin* window, const char* const command, gchar** args)
         return TRUE;
     }
 
-    if (args[0] != NULL) {
-        const gchar* ping_target = _resolve_contact_jid(args[0]);
-        if (caps_jid_has_feature(ping_target, XMPP_FEATURE_PING) == FALSE) {
-            cons_show("%s does not support ping requests.", ping_target);
-            return TRUE;
-        }
-        iq_send_ping(ping_target);
-        cons_show("Pinged %s…", ping_target);
-    } else {
-        iq_send_ping(NULL);
+    if (args[0] != NULL && caps_jid_has_feature(args[0], XMPP_FEATURE_PING) == FALSE) {
+        cons_show("%s does not support ping requests.", args[0]);
+        return TRUE;
+    }
+
+    iq_send_ping(args[0]);
+
+    if (args[0] == NULL) {
         cons_show("Pinged server…");
+    } else {
+        cons_show("Pinged %s…", args[0]);
     }
     return TRUE;
 }

src/xmpp/capabilities.c

@@ -277,11 +277,8 @@ caps_cache_clear(void)
 {
     g_hash_table_remove_all(jid_to_ver);
     g_hash_table_remove_all(jid_to_caps);
-    if (caps_prof_keyfile.keyfile) {
-        g_key_file_free(caps_prof_keyfile.keyfile);
-    }
-    caps_prof_keyfile.keyfile = g_key_file_new();
-    cache = caps_prof_keyfile.keyfile;
+    cache = g_key_file_new();
+    caps_prof_keyfile.keyfile = cache;
     save_keyfile(&caps_prof_keyfile);
 }
 

src/xmpp/jid.c

@@ -280,13 +280,9 @@ jid_fulljid_or_barejid(Jid* jid)
 gchar*
 jid_random_resource(void)
 {
-    gchar* rand = g_malloc0(29);
-    const gchar* digits = "0123456789";
+    auto_gchar gchar* rand = get_random_string(5);
 
-    for (int i = 0; i < 28; i++) {
-        rand[i] = digits[g_random_int_range(0, 10)];
-    }
-    rand[28] = '\0';
+    gchar* result = g_strdup_printf("%s", rand);
 
-    return rand;
+    return result;
 }

src/xmpp/stanza.c

@@ -931,22 +931,19 @@ stanza_create_caps_query_element(xmpp_ctx_t* ctx)
 
     xmpp_stanza_t* identity = xmpp_stanza_new(ctx);
     xmpp_stanza_set_name(identity, "identity");
-    xmpp_stanza_set_type(identity, "pc");
     xmpp_stanza_set_attribute(identity, "category", "client");
+    xmpp_stanza_set_type(identity, "pc");
 
     ProfAccount* account = accounts_get_account(session_get_account_name());
+    gchar* client = account->client;
+    bool is_custom_client = client != NULL;
 
-    auto_gchar gchar* name = g_strdup(account->client ? account->client : "Pidgin");
+    GString* name_str = g_string_new(is_custom_client ? client : "Pidgin");
 
-    if (account->client) {
-        gchar* space = strchr(name, ' ');
-        if (space) {
-            *space = '\0';
-        }
-    }
     account_free(account);
 
-    xmpp_stanza_set_attribute(identity, "name", name);
+    xmpp_stanza_set_attribute(identity, "name", name_str->str);
+    g_string_free(name_str, TRUE);
     xmpp_stanza_add_child(query, identity);
     xmpp_stanza_release(identity);