From 488bdd0b80cd1084359e34b8d36ae536520b1f86 Mon Sep 17 00:00:00 2001
From: Ralph Meijer <ralphm@ik.nu>
Date: Tue, 7 May 2019 12:26:14 -0400
Subject: [PATCH 01/17] Use optionsForClientTLS to verify server certificate by
 default

---
 .../words/protocols/jabber/xmlstream.py       |  2 +-
 .../words/test/test_jabberxmlstream.py        | 61 +++++++++++++------
 2 files changed, 44 insertions(+), 19 deletions(-)

diff --git a/src/twisted/words/protocols/jabber/xmlstream.py b/src/twisted/words/protocols/jabber/xmlstream.py
index c191e9ae219..70d9267b705 100644
--- a/src/twisted/words/protocols/jabber/xmlstream.py
+++ b/src/twisted/words/protocols/jabber/xmlstream.py
@@ -414,7 +414,7 @@ def onProceed(self, obj):
         """
 
         self.xmlstream.removeObserver('/failure', self.onFailure)
-        ctx = ssl.CertificateOptions()
+        ctx = ssl.optionsForClientTLS(self.xmlstream.otherEntity.host)
         self.xmlstream.transport.startTLS(ctx)
         self.xmlstream.reset()
         self.xmlstream.sendHeader()
diff --git a/src/twisted/words/test/test_jabberxmlstream.py b/src/twisted/words/test/test_jabberxmlstream.py
index 302171d7297..ccccf87372c 100644
--- a/src/twisted/words/test/test_jabberxmlstream.py
+++ b/src/twisted/words/test/test_jabberxmlstream.py
@@ -14,6 +14,7 @@
 from twisted.internet import defer, task
 from twisted.internet.error import ConnectionLost
 from twisted.internet.interfaces import IProtocolFactory
+from twisted.internet._sslverify import ClientTLSOptions
 from twisted.python import failure
 from twisted.python.compat import unicode
 from twisted.test import proto_helpers
@@ -665,7 +666,7 @@ def setUp(self):
 
         self.savedSSL = xmlstream.ssl
 
-        self.authenticator = xmlstream.Authenticator()
+        self.authenticator = xmlstream.ConnectAuthenticator(u'example.com')
         self.xmlstream = xmlstream.XmlStream(self.authenticator)
         self.xmlstream.send = self.output.append
         self.xmlstream.connectionMade()
@@ -679,9 +680,9 @@ def tearDown(self):
         xmlstream.ssl = self.savedSSL
 
 
-    def testWantedSupported(self):
+    def test_wantedSupported(self):
         """
-        Test start when TLS is wanted and the SSL library available.
+        When TLS is wanted and SSL available, StartTLS is initiated.
         """
         self.xmlstream.transport = proto_helpers.StringTransport()
         self.xmlstream.transport.startTLS = lambda ctx: self.done.append('TLS')
@@ -690,7 +691,8 @@ def testWantedSupported(self):
 
         d = self.init.start()
         d.addCallback(self.assertEqual, xmlstream.Reset)
-        starttls = self.output[0]
+        self.assertEqual(2, len(self.output))
+        starttls = self.output[1]
         self.assertEqual('starttls', starttls.name)
         self.assertEqual(NS_XMPP_TLS, starttls.uri)
         self.xmlstream.dataReceived("<proceed xmlns='%s'/>" % NS_XMPP_TLS)
@@ -698,40 +700,63 @@ def testWantedSupported(self):
 
         return d
 
+
+    def test_certificateVerify(self):
+        """
+        The server certificate will be verified.
+        """
+
+        def fakeStartTLS(contextFactory):
+            self.assertIsInstance(contextFactory, ClientTLSOptions)
+            self.assertEqual(contextFactory._hostname, u"example.com")
+            self.done.append('TLS')
+
+        self.xmlstream.transport = proto_helpers.StringTransport()
+        self.xmlstream.transport.startTLS = fakeStartTLS
+        self.xmlstream.reset = lambda: self.done.append('reset')
+        self.xmlstream.sendHeader = lambda: self.done.append('header')
+
+        d = self.init.start()
+        self.xmlstream.dataReceived("<proceed xmlns='%s'/>" % NS_XMPP_TLS)
+        self.assertEqual(['TLS', 'reset', 'header'], self.done)
+        return d
+
+
     if not xmlstream.ssl:
         testWantedSupported.skip = "SSL not available"
+        test_certificateVerify = "SSL not available"
 
 
-    def testWantedNotSupportedNotRequired(self):
+    def test_wantedNotSupportedNotRequired(self):
         """
-        Test start when TLS is wanted and the SSL library available.
+        No StartTLS is initiated when wanted, not required, SSL not available.
         """
         xmlstream.ssl = None
 
         d = self.init.start()
         d.addCallback(self.assertEqual, None)
-        self.assertEqual([], self.output)
+        self.assertEqual(1, len(self.output))
 
         return d
 
 
-    def testWantedNotSupportedRequired(self):
+    def test_wantedNotSupportedRequired(self):
         """
-        Test start when TLS is wanted and the SSL library available.
+        TLSNotSupported is raised when TLS is required but not available.
         """
         xmlstream.ssl = None
         self.init.required = True
 
         d = self.init.start()
         self.assertFailure(d, xmlstream.TLSNotSupported)
-        self.assertEqual([], self.output)
+        self.assertEqual(1, len(self.output))
 
         return d
 
 
-    def testNotWantedRequired(self):
+    def test_notWantedRequired(self):
         """
-        Test start when TLS is not wanted, but required by the server.
+        TLSRequired is raised when TLS is not wanted, but required by server.
         """
         tls = domish.Element(('urn:ietf:params:xml:ns:xmpp-tls', 'starttls'))
         tls.addElement('required')
@@ -739,15 +764,15 @@ def testNotWantedRequired(self):
         self.init.wanted = False
 
         d = self.init.start()
-        self.assertEqual([], self.output)
+        self.assertEqual(1, len(self.output))
         self.assertFailure(d, xmlstream.TLSRequired)
 
         return d
 
 
-    def testNotWantedNotRequired(self):
+    def test_notWantedNotRequired(self):
         """
-        Test start when TLS is not wanted, but required by the server.
+        No StartTLS is initiated when not wanted and not required.
         """
         tls = domish.Element(('urn:ietf:params:xml:ns:xmpp-tls', 'starttls'))
         self.xmlstream.features = {(tls.uri, tls.name): tls}
@@ -755,13 +780,13 @@ def testNotWantedNotRequired(self):
 
         d = self.init.start()
         d.addCallback(self.assertEqual, None)
-        self.assertEqual([], self.output)
+        self.assertEqual(1, len(self.output))
         return d
 
 
-    def testFailed(self):
+    def test_failed(self):
         """
-        Test failed TLS negotiation.
+        TLSFailed is raised when the server responds with a failure.
         """
         # Pretend that ssl is supported, it isn't actually used when the
         # server starts out with a failure in response to our initial

From 0ff32b1bf115acc90d223b9ce9820063cf89003d Mon Sep 17 00:00:00 2001
From: Ralph Meijer <ralphm@ik.nu>
Date: Tue, 7 May 2019 15:54:33 -0400
Subject: [PATCH 02/17] Fix client example to print disconnection reason

---
 docs/words/examples/xmpp_client.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/docs/words/examples/xmpp_client.py b/docs/words/examples/xmpp_client.py
index cb80202c67f..4a3651009b4 100644
--- a/docs/words/examples/xmpp_client.py
+++ b/docs/words/examples/xmpp_client.py
@@ -53,8 +53,9 @@ def connected(self, xs):
         xs.rawDataOutFn = self.rawDataOut
 
 
-    def disconnected(self, xs):
+    def disconnected(self, reason):
         print('Disconnected.')
+        print(reason)
 
         self.finished.callback(None)
 

From 89954dfb18e613be583c74e22a3dd55d66e7d975 Mon Sep 17 00:00:00 2001
From: Ralph Meijer <ralphm@ik.nu>
Date: Tue, 7 May 2019 18:23:49 -0400
Subject: [PATCH 03/17] Allow for custom contextFactory to TLS initializer

---
 .../words/protocols/jabber/xmlstream.py       |  6 ++++-
 .../words/test/test_jabberxmlstream.py        | 24 +++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/src/twisted/words/protocols/jabber/xmlstream.py b/src/twisted/words/protocols/jabber/xmlstream.py
index 70d9267b705..51a8466b16a 100644
--- a/src/twisted/words/protocols/jabber/xmlstream.py
+++ b/src/twisted/words/protocols/jabber/xmlstream.py
@@ -406,6 +406,7 @@ class TLSInitiatingInitializer(BaseFeatureInitiatingInitializer):
 
     feature = (NS_XMPP_TLS, 'starttls')
     wanted = True
+    contextFactory = None
     _deferred = None
 
     def onProceed(self, obj):
@@ -414,7 +415,10 @@ def onProceed(self, obj):
         """
 
         self.xmlstream.removeObserver('/failure', self.onFailure)
-        ctx = ssl.optionsForClientTLS(self.xmlstream.otherEntity.host)
+        if self.contextFactory:
+            ctx = self.contextFactory
+        else:
+            ctx = ssl.optionsForClientTLS(self.xmlstream.otherEntity.host)
         self.xmlstream.transport.startTLS(ctx)
         self.xmlstream.reset()
         self.xmlstream.sendHeader()
diff --git a/src/twisted/words/test/test_jabberxmlstream.py b/src/twisted/words/test/test_jabberxmlstream.py
index ccccf87372c..863cad0f328 100644
--- a/src/twisted/words/test/test_jabberxmlstream.py
+++ b/src/twisted/words/test/test_jabberxmlstream.py
@@ -14,6 +14,7 @@
 from twisted.internet import defer, task
 from twisted.internet.error import ConnectionLost
 from twisted.internet.interfaces import IProtocolFactory
+from twisted.internet.ssl import CertificateOptions
 from twisted.internet._sslverify import ClientTLSOptions
 from twisted.python import failure
 from twisted.python.compat import unicode
@@ -722,9 +723,32 @@ def fakeStartTLS(contextFactory):
         return d
 
 
+    def test_certificateVerifyContext(self):
+        """
+        A custom contextFactory is passed through to startTLS.
+        """
+        ctx = CertificateOptions()
+        self.init.contextFactory = ctx
+
+        def fakeStartTLS(contextFactory):
+            self.assertIs(ctx, contextFactory)
+            self.done.append('TLS')
+
+        self.xmlstream.transport = proto_helpers.StringTransport()
+        self.xmlstream.transport.startTLS = fakeStartTLS
+        self.xmlstream.reset = lambda: self.done.append('reset')
+        self.xmlstream.sendHeader = lambda: self.done.append('header')
+
+        d = self.init.start()
+        self.xmlstream.dataReceived("<proceed xmlns='%s'/>" % NS_XMPP_TLS)
+        self.assertEqual(['TLS', 'reset', 'header'], self.done)
+        return d
+
+
     if not xmlstream.ssl:
         testWantedSupported.skip = "SSL not available"
         test_certificateVerify = "SSL not available"
+        test_certificateVerifyContext = "SSL not available"
 
 
     def test_wantedNotSupportedNotRequired(self):

From 4759e27af0ffa2e61538d5e0a66c3e57e20d3f5b Mon Sep 17 00:00:00 2001
From: Ralph Meijer <ralphm@ik.nu>
Date: Wed, 8 May 2019 13:19:17 -0400
Subject: [PATCH 04/17] Add docstrings for new contextFactory attribute

---
 src/twisted/words/protocols/jabber/xmlstream.py | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/twisted/words/protocols/jabber/xmlstream.py b/src/twisted/words/protocols/jabber/xmlstream.py
index 51a8466b16a..88ad21f76a6 100644
--- a/src/twisted/words/protocols/jabber/xmlstream.py
+++ b/src/twisted/words/protocols/jabber/xmlstream.py
@@ -402,6 +402,11 @@ class TLSInitiatingInitializer(BaseFeatureInitiatingInitializer):
 
     @cvar wanted: indicates if TLS negotiation is wanted.
     @type wanted: C{bool}
+
+    @cvar contextFactory: An object which creates appropriately configured TLS
+        connections. This is passed to C{startTLS} on the transport and is
+        preferably created using L{twisted.internet.ssl.optionsForClientTLS}.
+    @type contextFactory: L{IOpenSSLClientConnectionCreator}
     """
 
     feature = (NS_XMPP_TLS, 'starttls')

From fa18e8e65cf486ea9adc8e9a9a6df7e168098ce8 Mon Sep 17 00:00:00 2001
From: Ralph Meijer <ralphm@ik.nu>
Date: Thu, 9 May 2019 11:11:14 -0400
Subject: [PATCH 05/17] Clean up connecting authenticators

This adds an option `required` argument to the inits of initializers
deriving from BaseFeatureInitiatingInitializer, to simplify setup.
Additionally it changes the requiredness of two initializers used by
XMPPAuthenticator:

* Setup of TLS is now required by default. This ensures that if StartTLS
is not advertized by the server, initialization fails instead of
silently proceeding to authentication without encryption.
* Binding a resource is required by default, because without it servers
will not allow any further meaningful interaction.
---
 src/twisted/words/protocols/jabber/client.py  | 28 +++++--------
 .../words/protocols/jabber/xmlstream.py       |  9 +++--
 src/twisted/words/test/test_jabberclient.py   | 39 ++++++++++++++++++-
 .../words/test/test_jabberxmlstream.py        |  9 +++++
 4 files changed, 61 insertions(+), 24 deletions(-)

diff --git a/src/twisted/words/protocols/jabber/client.py b/src/twisted/words/protocols/jabber/client.py
index ffe6c939d8a..566bc9ff177 100644
--- a/src/twisted/words/protocols/jabber/client.py
+++ b/src/twisted/words/protocols/jabber/client.py
@@ -206,14 +206,10 @@ def associateWithStream(self, xs):
         xs.version = (0, 0)
         xmlstream.ConnectAuthenticator.associateWithStream(self, xs)
 
-        inits = [ (xmlstream.TLSInitiatingInitializer, False),
-                  (IQAuthInitializer, True),
-                ]
-
-        for initClass, required in inits:
-            init = initClass(xs)
-            init.required = required
-            xs.initializers.append(init)
+        xs.initializers = [
+            xmlstream.TLSInitiatingInitializer(xs, required=False),
+            IQAuthInitializer(xs),
+        ]
 
     # TODO: move registration into an Initializer?
 
@@ -377,14 +373,10 @@ def associateWithStream(self, xs):
         """
         xmlstream.ConnectAuthenticator.associateWithStream(self, xs)
 
-        xs.initializers = [CheckVersionInitializer(xs)]
-        inits = [ (xmlstream.TLSInitiatingInitializer, False),
-                  (sasl.SASLInitiatingInitializer, True),
-                  (BindInitializer, False),
-                  (SessionInitializer, False),
+        xs.initializers = [
+                CheckVersionInitializer(xs),
+                xmlstream.TLSInitiatingInitializer(xs, required=True),
+                sasl.SASLInitiatingInitializer(xs, required=True),
+                BindInitializer(xs, required=True),
+                SessionInitializer(xs, required=False),
                 ]
-
-        for initClass, required in inits:
-            init = initClass(xs)
-            init.required = required
-            xs.initializers.append(init)
diff --git a/src/twisted/words/protocols/jabber/xmlstream.py b/src/twisted/words/protocols/jabber/xmlstream.py
index 88ad21f76a6..f7512016c5a 100644
--- a/src/twisted/words/protocols/jabber/xmlstream.py
+++ b/src/twisted/words/protocols/jabber/xmlstream.py
@@ -316,16 +316,17 @@ class BaseFeatureInitiatingInitializer(object):
 
     @cvar feature: tuple of (uri, name) of the stream feature root element.
     @type feature: tuple of (C{str}, C{str})
+
     @ivar required: whether the stream feature is required to be advertized
                     by the receiving entity.
     @type required: C{bool}
     """
 
     feature = None
-    required = False
 
-    def __init__(self, xs):
+    def __init__(self, xs, required=False):
         self.xmlstream = xs
+        self.required = required
 
 
     def initialize(self):
@@ -400,10 +401,10 @@ class TLSInitiatingInitializer(BaseFeatureInitiatingInitializer):
     set the C{wanted} attribute to False instead of removing it from the list
     of initializers, so a proper exception L{TLSRequired} can be raised.
 
-    @cvar wanted: indicates if TLS negotiation is wanted.
+    @ivar wanted: indicates if TLS negotiation is wanted.
     @type wanted: C{bool}
 
-    @cvar contextFactory: An object which creates appropriately configured TLS
+    @ivar contextFactory: An object which creates appropriately configured TLS
         connections. This is passed to C{startTLS} on the transport and is
         preferably created using L{twisted.internet.ssl.optionsForClientTLS}.
     @type contextFactory: L{IOpenSSLClientConnectionCreator}
diff --git a/src/twisted/words/test/test_jabberclient.py b/src/twisted/words/test/test_jabberclient.py
index d54f88651ad..19be60b34eb 100644
--- a/src/twisted/words/test/test_jabberclient.py
+++ b/src/twisted/words/test/test_jabberclient.py
@@ -379,6 +379,41 @@ def onSession(iq):
 
 
 
+class BasicAuthenticatorTests(unittest.TestCase):
+    """
+    Test for both XMPPAuthenticator and XMPPClientFactory.
+    """
+    def testBasic(self):
+        """
+        Test basic operations.
+
+        Setup a basicClientFactory, which sets up a BasicAuthenticator, and let
+        it produce a protocol instance. Then inspect the instance variables of
+        the authenticator and XML stream objects.
+        """
+        self.client_jid = jid.JID('user@example.com/resource')
+
+        # Get an XmlStream instance. Note that it gets initialized with the
+        # XMPPAuthenticator (that has its associateWithXmlStream called) that
+        # is in turn initialized with the arguments to the factory.
+        xs = client.basicClientFactory(self.client_jid,
+                                      'secret').buildProtocol(None)
+
+        # test authenticator's instance variables
+        self.assertEqual('example.com', xs.authenticator.otherHost)
+        self.assertEqual(self.client_jid, xs.authenticator.jid)
+        self.assertEqual('secret', xs.authenticator.password)
+
+        # test list of initializers
+        tls, auth = xs.initializers
+
+        self.assertIsInstance(tls, xmlstream.TLSInitiatingInitializer)
+        self.assertIsInstance(auth, client.IQAuthInitializer)
+
+        self.assertFalse(tls.required)
+
+
+
 class XMPPAuthenticatorTests(unittest.TestCase):
     """
     Test for both XMPPAuthenticator and XMPPClientFactory.
@@ -412,7 +447,7 @@ def testBasic(self):
         self.assertIsInstance(bind, client.BindInitializer)
         self.assertIsInstance(session, client.SessionInitializer)
 
-        self.assertFalse(tls.required)
+        self.assertTrue(tls.required)
         self.assertTrue(sasl.required)
-        self.assertFalse(bind.required)
+        self.assertTrue(bind.required)
         self.assertFalse(session.required)
diff --git a/src/twisted/words/test/test_jabberxmlstream.py b/src/twisted/words/test/test_jabberxmlstream.py
index 863cad0f328..6df336deb20 100644
--- a/src/twisted/words/test/test_jabberxmlstream.py
+++ b/src/twisted/words/test/test_jabberxmlstream.py
@@ -681,6 +681,15 @@ def tearDown(self):
         xmlstream.ssl = self.savedSSL
 
 
+    def test_initRequired(self):
+        """
+        Passing required sets the instance variable.
+        """
+        self.init = xmlstream.TLSInitiatingInitializer(self.xmlstream,
+                                                       required=True)
+        self.assertTrue(self.init.required)
+
+
     def test_wantedSupported(self):
         """
         When TLS is wanted and SSL available, StartTLS is initiated.

From cadf08f3481b689929ad471a17ce29683dc0635d Mon Sep 17 00:00:00 2001
From: Ralph Meijer <ralphm@ik.nu>
Date: Thu, 9 May 2019 12:05:21 -0400
Subject: [PATCH 06/17] Provide a way to use custom certificate options for
 XMPP clients

This adds an optional `contextFactory` argument to `XMPPClientFactory`
that is passed on to `XMPPAuthenticator`, which in turn passes it to
`TLSInitiatingInitializer`.
---
 src/twisted/words/protocols/jabber/client.py  | 25 ++++++++++---
 .../words/protocols/jabber/xmlstream.py       |  9 +++++
 src/twisted/words/test/test_jabberclient.py   | 35 ++++++++++++++++---
 3 files changed, 61 insertions(+), 8 deletions(-)

diff --git a/src/twisted/words/protocols/jabber/client.py b/src/twisted/words/protocols/jabber/client.py
index 566bc9ff177..4b310e34f38 100644
--- a/src/twisted/words/protocols/jabber/client.py
+++ b/src/twisted/words/protocols/jabber/client.py
@@ -298,7 +298,7 @@ def start(self):
 
 
 
-def XMPPClientFactory(jid, password):
+def XMPPClientFactory(jid, password, contextFactory=None):
     """
     Client factory for XMPP 1.0 (only).
 
@@ -310,12 +310,20 @@ def XMPPClientFactory(jid, password):
 
     @param jid: Jabber ID to connect with.
     @type jid: L{jid.JID}
+
     @param password: password to authenticate with.
     @type password: L{unicode}
+
+    @param contextFactory: An object which creates appropriately configured TLS
+        connections. This is passed to C{startTLS} on the transport and is
+        preferably created using L{twisted.internet.ssl.optionsForClientTLS}.
+        See L{xmlstream.TLSInitiatingInitializer} for details.
+    @type contextFactory: L{IOpenSSLClientConnectionCreator}
+
     @return: XML stream factory.
     @rtype: L{xmlstream.XmlStreamFactory}
     """
-    a = XMPPAuthenticator(jid, password)
+    a = XMPPAuthenticator(jid, password, contextFactory=contextFactory)
     return xmlstream.XmlStreamFactory(a)
 
 
@@ -350,16 +358,24 @@ class XMPPAuthenticator(xmlstream.ConnectAuthenticator):
                resource binding step, and this is stored in this instance
                variable.
     @type jid: L{jid.JID}
+
     @ivar password: password to be used during SASL authentication.
     @type password: L{unicode}
+
+    @ivar contextFactory: An object which creates appropriately configured TLS
+        connections. This is passed to C{startTLS} on the transport and is
+        preferably created using L{twisted.internet.ssl.optionsForClientTLS}.
+        See L{xmlstream.TLSInitiatingInitializer} for details.
+    @type contextFactory: L{IOpenSSLClientConnectionCreator}
     """
 
     namespace = 'jabber:client'
 
-    def __init__(self, jid, password):
+    def __init__(self, jid, password, contextFactory=None):
         xmlstream.ConnectAuthenticator.__init__(self, jid.host)
         self.jid = jid
         self.password = password
+        self.contextFactory = contextFactory
 
 
     def associateWithStream(self, xs):
@@ -375,7 +391,8 @@ def associateWithStream(self, xs):
 
         xs.initializers = [
                 CheckVersionInitializer(xs),
-                xmlstream.TLSInitiatingInitializer(xs, required=True),
+                xmlstream.TLSInitiatingInitializer(
+                    xs, required=True, contextFactory=self.contextFactory),
                 sasl.SASLInitiatingInitializer(xs, required=True),
                 BindInitializer(xs, required=True),
                 SessionInitializer(xs, required=False),
diff --git a/src/twisted/words/protocols/jabber/xmlstream.py b/src/twisted/words/protocols/jabber/xmlstream.py
index f7512016c5a..1ed79d47726 100644
--- a/src/twisted/words/protocols/jabber/xmlstream.py
+++ b/src/twisted/words/protocols/jabber/xmlstream.py
@@ -407,6 +407,9 @@ class TLSInitiatingInitializer(BaseFeatureInitiatingInitializer):
     @ivar contextFactory: An object which creates appropriately configured TLS
         connections. This is passed to C{startTLS} on the transport and is
         preferably created using L{twisted.internet.ssl.optionsForClientTLS}.
+        If C{None}, the default is to verify the server certificate against
+        the trust roots as provided by the platform. See
+        L{twisted.internet._sslverify.platformTrust}.
     @type contextFactory: L{IOpenSSLClientConnectionCreator}
     """
 
@@ -415,6 +418,12 @@ class TLSInitiatingInitializer(BaseFeatureInitiatingInitializer):
     contextFactory = None
     _deferred = None
 
+    def __init__(self, xs, required=True, contextFactory=None):
+        super(TLSInitiatingInitializer, self).__init__(
+                xs, required=required)
+        self.contextFactory = contextFactory
+
+
     def onProceed(self, obj):
         """
         Proceed with TLS negotiation and reset the XML stream.
diff --git a/src/twisted/words/test/test_jabberclient.py b/src/twisted/words/test/test_jabberclient.py
index 19be60b34eb..2e39de72cee 100644
--- a/src/twisted/words/test/test_jabberclient.py
+++ b/src/twisted/words/test/test_jabberclient.py
@@ -9,7 +9,7 @@
 
 from hashlib import sha1
 
-from twisted.internet import defer
+from twisted.internet import defer, ssl
 from twisted.python.compat import unicode
 from twisted.trial import unittest
 from twisted.words.protocols.jabber import client, error, jid, xmlstream
@@ -381,9 +381,10 @@ def onSession(iq):
 
 class BasicAuthenticatorTests(unittest.TestCase):
     """
-    Test for both XMPPAuthenticator and XMPPClientFactory.
+    Test for both BasicAuthenticator and basicClientFactory.
     """
-    def testBasic(self):
+
+    def test_basic(self):
         """
         Test basic operations.
 
@@ -418,7 +419,8 @@ class XMPPAuthenticatorTests(unittest.TestCase):
     """
     Test for both XMPPAuthenticator and XMPPClientFactory.
     """
-    def testBasic(self):
+
+    def test_basic(self):
         """
         Test basic operations.
 
@@ -451,3 +453,28 @@ def testBasic(self):
         self.assertTrue(sasl.required)
         self.assertTrue(bind.required)
         self.assertFalse(session.required)
+
+
+    def test_tlsContextFactory(self):
+        """
+        Test basic operations.
+
+        Setup an XMPPClientFactory, which sets up an XMPPAuthenticator, and let
+        it produce a protocol instance. Then inspect the instance variables of
+        the authenticator and XML stream objects.
+        """
+        self.client_jid = jid.JID('user@example.com/resource')
+
+        # Get an XmlStream instance. Note that it gets initialized with the
+        # XMPPAuthenticator (that has its associateWithXmlStream called) that
+        # is in turn initialized with the arguments to the factory.
+        contextFactory = ssl.CertificateOptions()
+        factory = client.XMPPClientFactory(self.client_jid, 'secret',
+                                           contextFactory=contextFactory)
+        xs = factory.buildProtocol(None)
+
+        # test list of initializers
+        version, tls, sasl, bind, session = xs.initializers
+
+        self.assertIsInstance(tls, xmlstream.TLSInitiatingInitializer)
+        self.assertIs(contextFactory, tls.contextFactory)

From 5ed194c0514a04500b3190b0ecbad0cce8b9b82d Mon Sep 17 00:00:00 2001
From: Ralph Meijer <ralphm@ik.nu>
Date: Thu, 9 May 2019 12:12:32 -0400
Subject: [PATCH 07/17] Adjust tests to TLSInitiatingInitializer being required
 by default

---
 src/twisted/words/test/test_jabberxmlstream.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/twisted/words/test/test_jabberxmlstream.py b/src/twisted/words/test/test_jabberxmlstream.py
index 6df336deb20..2b8dcd9516e 100644
--- a/src/twisted/words/test/test_jabberxmlstream.py
+++ b/src/twisted/words/test/test_jabberxmlstream.py
@@ -765,6 +765,7 @@ def test_wantedNotSupportedNotRequired(self):
         No StartTLS is initiated when wanted, not required, SSL not available.
         """
         xmlstream.ssl = None
+        self.init.required = False
 
         d = self.init.start()
         d.addCallback(self.assertEqual, None)
@@ -810,6 +811,7 @@ def test_notWantedNotRequired(self):
         tls = domish.Element(('urn:ietf:params:xml:ns:xmpp-tls', 'starttls'))
         self.xmlstream.features = {(tls.uri, tls.name): tls}
         self.init.wanted = False
+        self.init.required = False
 
         d = self.init.start()
         d.addCallback(self.assertEqual, None)

From a1f43907c60cb3f92699067c43fdf166cbac2cea Mon Sep 17 00:00:00 2001
From: Ralph Meijer <ralphm@ik.nu>
Date: Mon, 27 May 2019 11:00:39 +0200
Subject: [PATCH 08/17] Add news fragments

---
 src/twisted/words/newsfragments/9561.bugfix  | 1 +
 src/twisted/words/newsfragments/9561.feature | 1 +
 2 files changed, 2 insertions(+)
 create mode 100644 src/twisted/words/newsfragments/9561.bugfix
 create mode 100644 src/twisted/words/newsfragments/9561.feature

diff --git a/src/twisted/words/newsfragments/9561.bugfix b/src/twisted/words/newsfragments/9561.bugfix
new file mode 100644
index 00000000000..ac5f905a104
--- /dev/null
+++ b/src/twisted/words/newsfragments/9561.bugfix
@@ -0,0 +1 @@
+twisted.words.protocols.jabber.xmlstream.TLSInitiatingInitializer now properly verifies the server's certificate against platform CAs and the stream's domain.
diff --git a/src/twisted/words/newsfragments/9561.feature b/src/twisted/words/newsfragments/9561.feature
new file mode 100644
index 00000000000..955790a0f24
--- /dev/null
+++ b/src/twisted/words/newsfragments/9561.feature
@@ -0,0 +1 @@
+twisted.words.protocols.jabber.xmlstream.TLSInitiatingInitializer and twisted.words.protocols.jabber.client.XMPPClientFactory now take an optional contextFactory for customizing certificate options for StartTLS.

From 0a93949f91ea22cfc5453c326e36e927c8da1015 Mon Sep 17 00:00:00 2001
From: Ralph Meijer <ralphm@ik.nu>
Date: Mon, 27 May 2019 13:53:31 +0200
Subject: [PATCH 09/17] Fix skipping renamed test when SSL is not available

---
 src/twisted/words/test/test_jabberxmlstream.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/twisted/words/test/test_jabberxmlstream.py b/src/twisted/words/test/test_jabberxmlstream.py
index 2b8dcd9516e..d9f4962ec0c 100644
--- a/src/twisted/words/test/test_jabberxmlstream.py
+++ b/src/twisted/words/test/test_jabberxmlstream.py
@@ -755,7 +755,7 @@ def fakeStartTLS(contextFactory):
 
 
     if not xmlstream.ssl:
-        testWantedSupported.skip = "SSL not available"
+        test_wantedSupported.skip = "SSL not available"
         test_certificateVerify = "SSL not available"
         test_certificateVerifyContext = "SSL not available"
 

From 751ac6f754146e5b61ab65d2995be2a9534bd41d Mon Sep 17 00:00:00 2001
From: Ralph Meijer <ralphm@ik.nu>
Date: Mon, 27 May 2019 14:48:26 +0200
Subject: [PATCH 10/17] Skip TLS tests if OpenSSL is not available

---
 src/twisted/words/test/test_jabberclient.py   | 12 +++++++++-
 .../words/test/test_jabberxmlstream.py        | 22 ++++++++++++-------
 2 files changed, 25 insertions(+), 9 deletions(-)

diff --git a/src/twisted/words/test/test_jabberclient.py b/src/twisted/words/test/test_jabberclient.py
index 2e39de72cee..8afb92951f7 100644
--- a/src/twisted/words/test/test_jabberclient.py
+++ b/src/twisted/words/test/test_jabberclient.py
@@ -9,13 +9,21 @@
 
 from hashlib import sha1
 
-from twisted.internet import defer, ssl
+from twisted.internet import defer
 from twisted.python.compat import unicode
 from twisted.trial import unittest
 from twisted.words.protocols.jabber import client, error, jid, xmlstream
 from twisted.words.protocols.jabber.sasl import SASLInitiatingInitializer
 from twisted.words.xish import utility
 
+try:
+   from twisted.internet import ssl
+except ImportError:
+    ssl = None
+    skipWhenNoSSL = "SSL not available"
+else:
+    skipWhenNoSSL = None
+
 IQ_AUTH_GET = '/iq[@type="get"]/query[@xmlns="jabber:iq:auth"]'
 IQ_AUTH_SET = '/iq[@type="set"]/query[@xmlns="jabber:iq:auth"]'
 NS_BIND = 'urn:ietf:params:xml:ns:xmpp-bind'
@@ -478,3 +486,5 @@ def test_tlsContextFactory(self):
 
         self.assertIsInstance(tls, xmlstream.TLSInitiatingInitializer)
         self.assertIs(contextFactory, tls.contextFactory)
+
+    test_tlsContextFactory.skip = skipWhenNoSSL
diff --git a/src/twisted/words/test/test_jabberxmlstream.py b/src/twisted/words/test/test_jabberxmlstream.py
index d9f4962ec0c..aad0305ef99 100644
--- a/src/twisted/words/test/test_jabberxmlstream.py
+++ b/src/twisted/words/test/test_jabberxmlstream.py
@@ -14,8 +14,6 @@
 from twisted.internet import defer, task
 from twisted.internet.error import ConnectionLost
 from twisted.internet.interfaces import IProtocolFactory
-from twisted.internet.ssl import CertificateOptions
-from twisted.internet._sslverify import ClientTLSOptions
 from twisted.python import failure
 from twisted.python.compat import unicode
 from twisted.test import proto_helpers
@@ -23,7 +21,15 @@
 from twisted.words.xish import domish
 from twisted.words.protocols.jabber import error, ijabber, jid, xmlstream
 
-
+try:
+   from twisted.internet import ssl
+except ImportError:
+    ssl = None
+    skipWhenNoSSL = "SSL not available"
+else:
+    skipWhenNoSSL = None
+    from twisted.internet.ssl import CertificateOptions
+    from twisted.internet._sslverify import ClientTLSOptions
 
 NS_XMPP_TLS = 'urn:ietf:params:xml:ns:xmpp-tls'
 
@@ -710,6 +716,8 @@ def test_wantedSupported(self):
 
         return d
 
+    test_wantedSupported.skip = skipWhenNoSSL
+
 
     def test_certificateVerify(self):
         """
@@ -731,6 +739,8 @@ def fakeStartTLS(contextFactory):
         self.assertEqual(['TLS', 'reset', 'header'], self.done)
         return d
 
+    test_certificateVerify.skip = skipWhenNoSSL
+
 
     def test_certificateVerifyContext(self):
         """
@@ -753,11 +763,7 @@ def fakeStartTLS(contextFactory):
         self.assertEqual(['TLS', 'reset', 'header'], self.done)
         return d
 
-
-    if not xmlstream.ssl:
-        test_wantedSupported.skip = "SSL not available"
-        test_certificateVerify = "SSL not available"
-        test_certificateVerifyContext = "SSL not available"
+    test_certificateVerifyContext.skip = skipWhenNoSSL
 
 
     def test_wantedNotSupportedNotRequired(self):

From 672a6338dea08a17cbe18af3d47bdb14fcd0d84b Mon Sep 17 00:00:00 2001
From: Ralph Meijer <ralphm@ik.nu>
Date: Mon, 27 May 2019 15:33:20 +0200
Subject: [PATCH 11/17] Fix indents

---
 src/twisted/words/test/test_jabberclient.py    | 4 ++--
 src/twisted/words/test/test_jabberxmlstream.py | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/twisted/words/test/test_jabberclient.py b/src/twisted/words/test/test_jabberclient.py
index 8afb92951f7..7c31bed8656 100644
--- a/src/twisted/words/test/test_jabberclient.py
+++ b/src/twisted/words/test/test_jabberclient.py
@@ -17,7 +17,7 @@
 from twisted.words.xish import utility
 
 try:
-   from twisted.internet import ssl
+    from twisted.internet import ssl
 except ImportError:
     ssl = None
     skipWhenNoSSL = "SSL not available"
@@ -406,7 +406,7 @@ def test_basic(self):
         # XMPPAuthenticator (that has its associateWithXmlStream called) that
         # is in turn initialized with the arguments to the factory.
         xs = client.basicClientFactory(self.client_jid,
-                                      'secret').buildProtocol(None)
+                                       'secret').buildProtocol(None)
 
         # test authenticator's instance variables
         self.assertEqual('example.com', xs.authenticator.otherHost)
diff --git a/src/twisted/words/test/test_jabberxmlstream.py b/src/twisted/words/test/test_jabberxmlstream.py
index aad0305ef99..7b384645a2c 100644
--- a/src/twisted/words/test/test_jabberxmlstream.py
+++ b/src/twisted/words/test/test_jabberxmlstream.py
@@ -22,7 +22,7 @@
 from twisted.words.protocols.jabber import error, ijabber, jid, xmlstream
 
 try:
-   from twisted.internet import ssl
+    from twisted.internet import ssl
 except ImportError:
     ssl = None
     skipWhenNoSSL = "SSL not available"

From a649757186c12d2b4f4a8e215b4d36ba26bd331f Mon Sep 17 00:00:00 2001
From: Ralph Meijer <ralphm@ik.nu>
Date: Tue, 28 May 2019 16:53:22 +0200
Subject: [PATCH 12/17] Better docstring for BasicAuthenticatorTests

---
 src/twisted/words/test/test_jabberclient.py | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/src/twisted/words/test/test_jabberclient.py b/src/twisted/words/test/test_jabberclient.py
index 7c31bed8656..1403131baf6 100644
--- a/src/twisted/words/test/test_jabberclient.py
+++ b/src/twisted/words/test/test_jabberclient.py
@@ -394,11 +394,14 @@ class BasicAuthenticatorTests(unittest.TestCase):
 
     def test_basic(self):
         """
-        Test basic operations.
-
-        Setup a basicClientFactory, which sets up a BasicAuthenticator, and let
-        it produce a protocol instance. Then inspect the instance variables of
-        the authenticator and XML stream objects.
+        Authenticator and stream are properly constructed by the factory.
+
+        The L{xmlstream.XmlStream} protocol created by the factory has the new
+        L{client.BasicAuthenticator} instance in its C{authenticator}
+        attribute.  It is set up with C{jid} and C{password} as passed to the
+        factory, C{otherHost} taken from the client JID. The stream futher has
+        two initializers, for TLS and authentication, of which the first has
+        its C{required} attribute set to C{True}.
         """
         self.client_jid = jid.JID('user@example.com/resource')
 

From ea2d28f7035cdbc56063a0672acef426086875ff Mon Sep 17 00:00:00 2001
From: Ralph Meijer <ralphm@ik.nu>
Date: Sun, 16 Jun 2019 18:41:49 +0200
Subject: [PATCH 13/17] Rename contextFactory to configurationForTLS, make
 private vars

---
 src/twisted/words/newsfragments/9561.feature  |  2 +-
 src/twisted/words/protocols/jabber/client.py  | 37 +++++++++++--------
 .../words/protocols/jabber/xmlstream.py       | 28 +++++++-------
 src/twisted/words/test/test_jabberclient.py   | 26 +++++++------
 .../words/test/test_jabberxmlstream.py        |  3 ++
 5 files changed, 55 insertions(+), 41 deletions(-)

diff --git a/src/twisted/words/newsfragments/9561.feature b/src/twisted/words/newsfragments/9561.feature
index 955790a0f24..c3b41a6a4c3 100644
--- a/src/twisted/words/newsfragments/9561.feature
+++ b/src/twisted/words/newsfragments/9561.feature
@@ -1 +1 @@
-twisted.words.protocols.jabber.xmlstream.TLSInitiatingInitializer and twisted.words.protocols.jabber.client.XMPPClientFactory now take an optional contextFactory for customizing certificate options for StartTLS.
+twisted.words.protocols.jabber.xmlstream.TLSInitiatingInitializer and twisted.words.protocols.jabber.client.XMPPClientFactory now take an optional configurationForTLS for customizing certificate options for StartTLS.
diff --git a/src/twisted/words/protocols/jabber/client.py b/src/twisted/words/protocols/jabber/client.py
index 4b310e34f38..db4cbfccf21 100644
--- a/src/twisted/words/protocols/jabber/client.py
+++ b/src/twisted/words/protocols/jabber/client.py
@@ -298,7 +298,7 @@ def start(self):
 
 
 
-def XMPPClientFactory(jid, password, contextFactory=None):
+def XMPPClientFactory(jid, password, configurationForTLS=None):
     """
     Client factory for XMPP 1.0 (only).
 
@@ -314,16 +314,18 @@ def XMPPClientFactory(jid, password, contextFactory=None):
     @param password: password to authenticate with.
     @type password: L{unicode}
 
-    @param contextFactory: An object which creates appropriately configured TLS
-        connections. This is passed to C{startTLS} on the transport and is
-        preferably created using L{twisted.internet.ssl.optionsForClientTLS}.
-        See L{xmlstream.TLSInitiatingInitializer} for details.
-    @type contextFactory: L{IOpenSSLClientConnectionCreator}
+    @param configurationForTLS: An object which creates appropriately
+        configured TLS connections. This is passed to C{startTLS} on the
+        transport and is preferably created using
+        L{twisted.internet.ssl.optionsForClientTLS}.  See
+        L{xmlstream.TLSInitiatingInitializer} for details.
+    @type configurationForTLS: L{IOpenSSLClientConnectionCreator}
 
     @return: XML stream factory.
     @rtype: L{xmlstream.XmlStreamFactory}
     """
-    a = XMPPAuthenticator(jid, password, contextFactory=contextFactory)
+    a = XMPPAuthenticator(jid, password,
+                          configurationForTLS=configurationForTLS)
     return xmlstream.XmlStreamFactory(a)
 
 
@@ -361,21 +363,23 @@ class XMPPAuthenticator(xmlstream.ConnectAuthenticator):
 
     @ivar password: password to be used during SASL authentication.
     @type password: L{unicode}
-
-    @ivar contextFactory: An object which creates appropriately configured TLS
-        connections. This is passed to C{startTLS} on the transport and is
-        preferably created using L{twisted.internet.ssl.optionsForClientTLS}.
-        See L{xmlstream.TLSInitiatingInitializer} for details.
-    @type contextFactory: L{IOpenSSLClientConnectionCreator}
     """
 
     namespace = 'jabber:client'
 
-    def __init__(self, jid, password, contextFactory=None):
+    def __init__(self, jid, password, configurationForTLS=None):
+        """
+        @param configurationForTLS: An object which creates appropriately
+            configured TLS connections. This is passed to C{startTLS} on the
+            transport and is preferably created using
+            L{twisted.internet.ssl.optionsForClientTLS}. See
+            L{xmlstream.TLSInitiatingInitializer} for details.
+        @type configurationForTLS: L{IOpenSSLClientConnectionCreator}
+        """
         xmlstream.ConnectAuthenticator.__init__(self, jid.host)
         self.jid = jid
         self.password = password
-        self.contextFactory = contextFactory
+        self._configurationForTLS = configurationForTLS
 
 
     def associateWithStream(self, xs):
@@ -392,7 +396,8 @@ def associateWithStream(self, xs):
         xs.initializers = [
                 CheckVersionInitializer(xs),
                 xmlstream.TLSInitiatingInitializer(
-                    xs, required=True, contextFactory=self.contextFactory),
+                    xs, required=True,
+                    configurationForTLS=self._configurationForTLS),
                 sasl.SASLInitiatingInitializer(xs, required=True),
                 BindInitializer(xs, required=True),
                 SessionInitializer(xs, required=False),
diff --git a/src/twisted/words/protocols/jabber/xmlstream.py b/src/twisted/words/protocols/jabber/xmlstream.py
index 1ed79d47726..135d71295df 100644
--- a/src/twisted/words/protocols/jabber/xmlstream.py
+++ b/src/twisted/words/protocols/jabber/xmlstream.py
@@ -403,25 +403,27 @@ class TLSInitiatingInitializer(BaseFeatureInitiatingInitializer):
 
     @ivar wanted: indicates if TLS negotiation is wanted.
     @type wanted: C{bool}
-
-    @ivar contextFactory: An object which creates appropriately configured TLS
-        connections. This is passed to C{startTLS} on the transport and is
-        preferably created using L{twisted.internet.ssl.optionsForClientTLS}.
-        If C{None}, the default is to verify the server certificate against
-        the trust roots as provided by the platform. See
-        L{twisted.internet._sslverify.platformTrust}.
-    @type contextFactory: L{IOpenSSLClientConnectionCreator}
     """
 
     feature = (NS_XMPP_TLS, 'starttls')
     wanted = True
-    contextFactory = None
     _deferred = None
+    _configurationForTLS = None
 
-    def __init__(self, xs, required=True, contextFactory=None):
+    def __init__(self, xs, required=True, configurationForTLS=None):
+        """
+        @param configurationForTLS: An object which creates appropriately
+            configured TLS connections. This is passed to C{startTLS} on the
+            transport and is preferably created using
+            L{twisted.internet.ssl.optionsForClientTLS}.  If C{None}, the
+            default is to verify the server certificate against the trust roots
+            as provided by the platform. See
+            L{twisted.internet._sslverify.platformTrust}.
+        @type configurationForTLS: L{IOpenSSLClientConnectionCreator}
+        """
         super(TLSInitiatingInitializer, self).__init__(
                 xs, required=required)
-        self.contextFactory = contextFactory
+        self._configurationForTLS = configurationForTLS
 
 
     def onProceed(self, obj):
@@ -430,8 +432,8 @@ def onProceed(self, obj):
         """
 
         self.xmlstream.removeObserver('/failure', self.onFailure)
-        if self.contextFactory:
-            ctx = self.contextFactory
+        if self._configurationForTLS:
+            ctx = self._configurationForTLS
         else:
             ctx = ssl.optionsForClientTLS(self.xmlstream.otherEntity.host)
         self.xmlstream.transport.startTLS(ctx)
diff --git a/src/twisted/words/test/test_jabberclient.py b/src/twisted/words/test/test_jabberclient.py
index 1403131baf6..4f5c8092419 100644
--- a/src/twisted/words/test/test_jabberclient.py
+++ b/src/twisted/words/test/test_jabberclient.py
@@ -466,28 +466,32 @@ def test_basic(self):
         self.assertFalse(session.required)
 
 
-    def test_tlsContextFactory(self):
+    def test_tlsConfiguration(self):
         """
-        Test basic operations.
-
-        Setup an XMPPClientFactory, which sets up an XMPPAuthenticator, and let
-        it produce a protocol instance. Then inspect the instance variables of
-        the authenticator and XML stream objects.
+        A TLS configuration is passed to the TLS initializer.
         """
+        configs = []
+
+        def init(self, xs, required=True, configurationForTLS=None):
+            configs.append(configurationForTLS)
+
         self.client_jid = jid.JID('user@example.com/resource')
 
         # Get an XmlStream instance. Note that it gets initialized with the
         # XMPPAuthenticator (that has its associateWithXmlStream called) that
         # is in turn initialized with the arguments to the factory.
-        contextFactory = ssl.CertificateOptions()
-        factory = client.XMPPClientFactory(self.client_jid, 'secret',
-                                           contextFactory=contextFactory)
+        configurationForTLS = ssl.CertificateOptions()
+        factory = client.XMPPClientFactory(
+            self.client_jid, 'secret',
+            configurationForTLS=configurationForTLS)
+        self.patch(xmlstream.TLSInitiatingInitializer, "__init__", init)
         xs = factory.buildProtocol(None)
 
         # test list of initializers
         version, tls, sasl, bind, session = xs.initializers
 
         self.assertIsInstance(tls, xmlstream.TLSInitiatingInitializer)
-        self.assertIs(contextFactory, tls.contextFactory)
+        self.assertIs(configurationForTLS, configs[0])
+
 
-    test_tlsContextFactory.skip = skipWhenNoSSL
+    test_tlsConfiguration.skip = skipWhenNoSSL
diff --git a/src/twisted/words/test/test_jabberxmlstream.py b/src/twisted/words/test/test_jabberxmlstream.py
index 7b384645a2c..85f6d195d4a 100644
--- a/src/twisted/words/test/test_jabberxmlstream.py
+++ b/src/twisted/words/test/test_jabberxmlstream.py
@@ -747,6 +747,9 @@ def test_certificateVerifyContext(self):
         A custom contextFactory is passed through to startTLS.
         """
         ctx = CertificateOptions()
+        self.init = xmlstream.TLSInitiatingInitializer(
+            self.xmlstream, configurationForTLS=ctx)
+
         self.init.contextFactory = ctx
 
         def fakeStartTLS(contextFactory):

From 05556b6ca14a49e4c7f3b5e8ede83137b869926e Mon Sep 17 00:00:00 2001
From: Ralph Meijer <ralphm@ik.nu>
Date: Sun, 16 Jun 2019 19:02:52 +0200
Subject: [PATCH 14/17] Move check for configurationTLS being None to __init__

---
 src/twisted/words/protocols/jabber/xmlstream.py | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/twisted/words/protocols/jabber/xmlstream.py b/src/twisted/words/protocols/jabber/xmlstream.py
index 135d71295df..dd4bd8f1932 100644
--- a/src/twisted/words/protocols/jabber/xmlstream.py
+++ b/src/twisted/words/protocols/jabber/xmlstream.py
@@ -423,7 +423,11 @@ def __init__(self, xs, required=True, configurationForTLS=None):
         """
         super(TLSInitiatingInitializer, self).__init__(
                 xs, required=required)
-        self._configurationForTLS = configurationForTLS
+        if configurationForTLS:
+            self._configurationForTLS = configurationForTLS
+        else:
+            self._configurationForTLS = ssl.optionsForClientTLS(
+                self.xmlstream.authenticator.otherHost)
 
 
     def onProceed(self, obj):
@@ -432,11 +436,7 @@ def onProceed(self, obj):
         """
 
         self.xmlstream.removeObserver('/failure', self.onFailure)
-        if self._configurationForTLS:
-            ctx = self._configurationForTLS
-        else:
-            ctx = ssl.optionsForClientTLS(self.xmlstream.otherEntity.host)
-        self.xmlstream.transport.startTLS(ctx)
+        self.xmlstream.transport.startTLS(self._configurationForTLS)
         self.xmlstream.reset()
         self.xmlstream.sendHeader()
         self._deferred.callback(Reset)

From 7caf8ac8795492e346e8f52633ff6d343a07edde Mon Sep 17 00:00:00 2001
From: Ralph Meijer <ralphm@ik.nu>
Date: Sun, 16 Jun 2019 19:11:35 +0200
Subject: [PATCH 15/17] Document configurationForTLS being None directly

---
 src/twisted/words/protocols/jabber/client.py    | 16 ++++++++++------
 src/twisted/words/protocols/jabber/xmlstream.py |  3 ++-
 2 files changed, 12 insertions(+), 7 deletions(-)

diff --git a/src/twisted/words/protocols/jabber/client.py b/src/twisted/words/protocols/jabber/client.py
index db4cbfccf21..8f197cdafe1 100644
--- a/src/twisted/words/protocols/jabber/client.py
+++ b/src/twisted/words/protocols/jabber/client.py
@@ -317,9 +317,10 @@ def XMPPClientFactory(jid, password, configurationForTLS=None):
     @param configurationForTLS: An object which creates appropriately
         configured TLS connections. This is passed to C{startTLS} on the
         transport and is preferably created using
-        L{twisted.internet.ssl.optionsForClientTLS}.  See
-        L{xmlstream.TLSInitiatingInitializer} for details.
-    @type configurationForTLS: L{IOpenSSLClientConnectionCreator}
+        L{twisted.internet.ssl.optionsForClientTLS}. If C{None}, the default is
+        to verify the server certificate against the trust roots as provided by
+        the platform. See L{twisted.internet._sslverify.platformTrust}.
+    @type configurationForTLS: L{IOpenSSLClientConnectionCreator} or C{None}
 
     @return: XML stream factory.
     @rtype: L{xmlstream.XmlStreamFactory}
@@ -372,9 +373,12 @@ def __init__(self, jid, password, configurationForTLS=None):
         @param configurationForTLS: An object which creates appropriately
             configured TLS connections. This is passed to C{startTLS} on the
             transport and is preferably created using
-            L{twisted.internet.ssl.optionsForClientTLS}. See
-            L{xmlstream.TLSInitiatingInitializer} for details.
-        @type configurationForTLS: L{IOpenSSLClientConnectionCreator}
+            L{twisted.internet.ssl.optionsForClientTLS}. If C{None}, the
+            default is to verify the server certificate against the trust roots
+            as provided by the platform. See
+            L{twisted.internet._sslverify.platformTrust}.
+        @type configurationForTLS: L{IOpenSSLClientConnectionCreator} or
+            C{None}
         """
         xmlstream.ConnectAuthenticator.__init__(self, jid.host)
         self.jid = jid
diff --git a/src/twisted/words/protocols/jabber/xmlstream.py b/src/twisted/words/protocols/jabber/xmlstream.py
index dd4bd8f1932..905402c5360 100644
--- a/src/twisted/words/protocols/jabber/xmlstream.py
+++ b/src/twisted/words/protocols/jabber/xmlstream.py
@@ -419,7 +419,8 @@ def __init__(self, xs, required=True, configurationForTLS=None):
             default is to verify the server certificate against the trust roots
             as provided by the platform. See
             L{twisted.internet._sslverify.platformTrust}.
-        @type configurationForTLS: L{IOpenSSLClientConnectionCreator}
+        @type configurationForTLS: L{IOpenSSLClientConnectionCreator} or
+            C{None}
         """
         super(TLSInitiatingInitializer, self).__init__(
                 xs, required=required)

From a66878c15abe99fdb3c72d7ec533ee0ef54e7f95 Mon Sep 17 00:00:00 2001
From: Ralph Meijer <ralphm@ik.nu>
Date: Sun, 16 Jun 2019 19:14:04 +0200
Subject: [PATCH 16/17] Mention CVE-2019-12855 in news fragment

---
 src/twisted/words/newsfragments/9561.bugfix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/twisted/words/newsfragments/9561.bugfix b/src/twisted/words/newsfragments/9561.bugfix
index ac5f905a104..033a128491c 100644
--- a/src/twisted/words/newsfragments/9561.bugfix
+++ b/src/twisted/words/newsfragments/9561.bugfix
@@ -1 +1 @@
-twisted.words.protocols.jabber.xmlstream.TLSInitiatingInitializer now properly verifies the server's certificate against platform CAs and the stream's domain.
+twisted.words.protocols.jabber.xmlstream.TLSInitiatingInitializer now properly verifies the server's certificate against platform CAs and the stream's domain, mitigating CVE-2019-12855.

From abbf0fd52c13b1fb5e1429189a3fcc48565870a5 Mon Sep 17 00:00:00 2001
From: Ralph Meijer <ralphm@ik.nu>
Date: Sun, 16 Jun 2019 19:50:33 +0200
Subject: [PATCH 17/17] Revert "Move check for configurationTLS being None to
 __init__"

This reverts commit 05556b6ca14a49e4c7f3b5e8ede83137b869926e.
---
 src/twisted/words/protocols/jabber/xmlstream.py | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/twisted/words/protocols/jabber/xmlstream.py b/src/twisted/words/protocols/jabber/xmlstream.py
index 905402c5360..20948c6d3be 100644
--- a/src/twisted/words/protocols/jabber/xmlstream.py
+++ b/src/twisted/words/protocols/jabber/xmlstream.py
@@ -424,11 +424,7 @@ def __init__(self, xs, required=True, configurationForTLS=None):
         """
         super(TLSInitiatingInitializer, self).__init__(
                 xs, required=required)
-        if configurationForTLS:
-            self._configurationForTLS = configurationForTLS
-        else:
-            self._configurationForTLS = ssl.optionsForClientTLS(
-                self.xmlstream.authenticator.otherHost)
+        self._configurationForTLS = configurationForTLS
 
 
     def onProceed(self, obj):
@@ -437,7 +433,11 @@ def onProceed(self, obj):
         """
 
         self.xmlstream.removeObserver('/failure', self.onFailure)
-        self.xmlstream.transport.startTLS(self._configurationForTLS)
+        if self._configurationForTLS:
+            ctx = self._configurationForTLS
+        else:
+            ctx = ssl.optionsForClientTLS(self.xmlstream.otherEntity.host)
+        self.xmlstream.transport.startTLS(ctx)
         self.xmlstream.reset()
         self.xmlstream.sendHeader()
         self._deferred.callback(Reset)