Software / code / prosody-modules
Changeset
6150:f77f5e408d6a
mod_sasl2_fast: Restore non-FAST SASL handler upon reset
This fixes an issue where, after failed FAST authentication, the FAST handler
was still used (even though the client now wants to try with a password or
other non-FAST credentials).
A little hacky perhaps, but probably the best we can do without baking FAST
support directly into mod_sasl2.
| author | Matthew Wild <mwild1@gmail.com> |
|---|---|
| date | Thu, 16 Jan 2025 15:46:15 +0000 |
| parents | 6149:045abdc53ba4 |
| children | 6151:0afd83bbdf09 |
| files | mod_sasl2_fast/mod_sasl2_fast.lua |
| diffstat | 1 files changed, 9 insertions(+), 2 deletions(-) [+] |
line wrap: on
line diff
--- a/mod_sasl2_fast/mod_sasl2_fast.lua Thu Jan 16 15:44:24 2025 +0000 +++ b/mod_sasl2_fast/mod_sasl2_fast.lua Thu Jan 16 15:46:15 2025 +0000 @@ -98,12 +98,19 @@ end end -function get_sasl_handler() +-- If FAST fails, we want to restore back to a non-FAST handler +local function _clean_clone_shim(self) + return self.nonfast_sasl_handler:clean_clone(); +end + +function get_sasl_handler(username, nonfast_sasl_handler) -- luacheck: ignore 212/username local token_auth_profile = { ht_sha_256 = new_token_tester(hash.hmac_sha256); }; local handler = sasl.new(module.host, token_auth_profile); handler.fast = true; + handler.nonfast_sasl_handler = nonfast_sasl_handler; + handler.clean_clone = _clean_clone_shim; return handler; end @@ -115,7 +122,7 @@ username = jid.node(event.stream.from); if not username then return; end end - local sasl_handler = get_sasl_handler(username); + local sasl_handler = get_sasl_handler(username, session.sasl_handler); if not sasl_handler then return; end sasl_handler.fast_auth = true; -- For informational purposes -- Copy channel binding info from primary SASL handler if it's compatible
