[JDEV] fatal bug in mod_filter design causing jabberd problems

[Matthias Wimmer]

Hi!

I discovered a big problem in the design of the mod_filter function of
jabberd.
I had a user on the charente.de server that had an auto reply rule when
he was offline. Also he had used the news service at jabberbuddy.com.

When jabberbuddy.com transmitted a news message the jabber server sent
the auto reply. jabberbuddy.com was responding with an error message
that the command is unsupported. This was answered with the auto reply
again ... error message ... auto reply ... error message ... auto reply
... and so on.

The user.xml for this user grew to about one MByte before I could find
out what the problem was that charente.de got bigger and bigger delays in
delivering messages. The jabberd was jammed by parsing the user.xml file
again and again.

I think this should be seen as a bug in mod_filter or even the jabber
protocol design. Automatic messages should have to be flaged as such and
there should be no auto reply for them. The protocol has to prevent
autoreply loops. This is also the reason why the IRC protocol differs
between messages and notices. (For messages you can send auto replies
that are notices then, you're not allowed to send automated replies for
notices.)

For jabber we could use a special attribute to the <message/> tag or add
a special tag into the message if it is an automated reply. All programs
that generate automated replies on incoming messages whould have to
check for the absence of this attribute/tag before sending the reply.


Tot kijk
   Matthias
-- 
Fon: +49-(0)70 0770 07770               http://matthias-wimmer.de/
Fax: +49-(0)89 312 88 654               jabber:mawis at charente.de
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 240 bytes
Desc: not available
URL: <https://www.jabber.org/jdev/attachments/20020321/f5c642f5/attachment-0002.pgp>