Software /
code /
prosody
Annotate
util/sasl/digest-md5.lua @ 5799:4a7e90b4c97d
mod_s2s: Lower "Beginning new connection attempt" message from info to debug level
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Wed, 14 Aug 2013 14:44:56 +0200 |
parent | 5301:6279caf921f1 |
child | 6777:5de6b93d0190 |
rev | line source |
---|---|
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
1 -- sasl.lua v0.4 |
3094
5f625411b463
util.sasl: 2009 -> 2010 in copyright header.
Tobias Markmann <tm@ayena.de>
parents:
3092
diff
changeset
|
2 -- Copyright (C) 2008-2010 Tobias Markmann |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
3 -- |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
4 -- All rights reserved. |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
5 -- |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
6 -- Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
7 -- |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
8 -- * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
9 -- * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
10 -- * Neither the name of Tobias Markmann nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
11 -- |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
12 -- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
13 |
2188
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
14 local tostring = tostring; |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
15 local type = type; |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
16 |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
17 local s_gmatch = string.gmatch; |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
18 local s_match = string.match; |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
19 local t_concat = table.concat; |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
20 local t_insert = table.insert; |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
21 local to_byte, to_char = string.byte, string.char; |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
22 |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
23 local md5 = require "util.hashes".md5; |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
24 local log = require "util.logger".init("sasl"); |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
25 local generate_uuid = require "util.uuid".generate; |
5301
6279caf921f1
util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents:
4113
diff
changeset
|
26 local nodeprep = require "util.encodings".stringprep.nodeprep; |
2188
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
27 |
4113
65482a852c4d
util.sasl.*: Add 'sasl.' prefix to module names
Matthew Wild <mwild1@gmail.com>
parents:
3981
diff
changeset
|
28 module "sasl.digest-md5" |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
29 |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
30 --========================= |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
31 --SASL DIGEST-MD5 according to RFC 2831 |
2188
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
32 |
3092
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2936
diff
changeset
|
33 --[[ |
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2936
diff
changeset
|
34 Supported Authentication Backends |
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2936
diff
changeset
|
35 |
3122
579f17b9f948
util.sasl.*: Adjusting authentication provider names. All '-' replaced with '_'
Tobias Markmann <tm@ayena.de>
parents:
3094
diff
changeset
|
36 digest_md5: |
3092
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2936
diff
changeset
|
37 function(username, domain, realm, encoding) -- domain and realm are usually the same; for some broken |
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2936
diff
changeset
|
38 -- implementations it's not |
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2936
diff
changeset
|
39 return digesthash, state; |
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2936
diff
changeset
|
40 end |
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2936
diff
changeset
|
41 |
3122
579f17b9f948
util.sasl.*: Adjusting authentication provider names. All '-' replaced with '_'
Tobias Markmann <tm@ayena.de>
parents:
3094
diff
changeset
|
42 digest_md5_test: |
3092
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2936
diff
changeset
|
43 function(username, domain, realm, encoding, digesthash) |
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2936
diff
changeset
|
44 return true or false, state; |
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2936
diff
changeset
|
45 end |
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2936
diff
changeset
|
46 ]] |
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2936
diff
changeset
|
47 |
2188
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
48 local function digest(self, message) |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
49 --TODO complete support for authzid |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
50 |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
51 local function serialize(message) |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
52 local data = "" |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
53 |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
54 -- testing all possible values |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
55 if message["realm"] then data = data..[[realm="]]..message.realm..[[",]] end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
56 if message["nonce"] then data = data..[[nonce="]]..message.nonce..[[",]] end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
57 if message["qop"] then data = data..[[qop="]]..message.qop..[[",]] end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
58 if message["charset"] then data = data..[[charset=]]..message.charset.."," end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
59 if message["algorithm"] then data = data..[[algorithm=]]..message.algorithm.."," end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
60 if message["rspauth"] then data = data..[[rspauth=]]..message.rspauth.."," end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
61 data = data:gsub(",$", "") |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
62 return data |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
63 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
64 |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
65 local function utf8tolatin1ifpossible(passwd) |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
66 local i = 1; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
67 while i <= #passwd do |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
68 local passwd_i = to_byte(passwd:sub(i, i)); |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
69 if passwd_i > 0x7F then |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
70 if passwd_i < 0xC0 or passwd_i > 0xC3 then |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
71 return passwd; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
72 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
73 i = i + 1; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
74 passwd_i = to_byte(passwd:sub(i, i)); |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
75 if passwd_i < 0x80 or passwd_i > 0xBF then |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
76 return passwd; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
77 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
78 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
79 i = i + 1; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
80 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
81 |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
82 local p = {}; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
83 local j = 0; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
84 i = 1; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
85 while (i <= #passwd) do |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
86 local passwd_i = to_byte(passwd:sub(i, i)); |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
87 if passwd_i > 0x7F then |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
88 i = i + 1; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
89 local passwd_i_1 = to_byte(passwd:sub(i, i)); |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
90 t_insert(p, to_char(passwd_i%4*64 + passwd_i_1%64)); -- I'm so clever |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
91 else |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
92 t_insert(p, to_char(passwd_i)); |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
93 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
94 i = i + 1; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
95 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
96 return t_concat(p); |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
97 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
98 local function latin1toutf8(str) |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
99 local p = {}; |
2188
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
100 for ch in s_gmatch(str, ".") do |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
101 ch = to_byte(ch); |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
102 if (ch < 0x80) then |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
103 t_insert(p, to_char(ch)); |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
104 elseif (ch < 0xC0) then |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
105 t_insert(p, to_char(0xC2, ch)); |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
106 else |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
107 t_insert(p, to_char(0xC3, ch - 64)); |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
108 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
109 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
110 return t_concat(p); |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
111 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
112 local function parse(data) |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
113 local message = {} |
2212 | 114 -- COMPAT: %z in the pattern to work around jwchat bug (sends "charset=utf-8\0") |
2215
4678aa4567c8
SASL: Using locally mapped s_gmatch instead of unavailable gmatch.
Tobias Markmann <tm@ayena.de>
parents:
2212
diff
changeset
|
115 for k, v in s_gmatch(data, [[([%w%-]+)="?([^",%z]*)"?,?]]) do -- FIXME The hacky regex makes me shudder |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
116 message[k] = v; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
117 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
118 return message; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
119 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
120 |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
121 if not self.nonce then |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
122 self.nonce = generate_uuid(); |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
123 self.step = 0; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
124 self.nonce_count = {}; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
125 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
126 |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
127 self.step = self.step + 1; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
128 if (self.step == 1) then |
2188
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
129 local challenge = serialize({ nonce = self.nonce, |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
130 qop = "auth", |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
131 charset = "utf-8", |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
132 algorithm = "md5-sess", |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
133 realm = self.realm}); |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
134 return "challenge", challenge; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
135 elseif (self.step == 2) then |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
136 local response = parse(message); |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
137 -- check for replay attack |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
138 if response["nc"] then |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
139 if self.nonce_count[response["nc"]] then return "failure", "not-authorized" end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
140 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
141 |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
142 -- check for username, it's REQUIRED by RFC 2831 |
5301
6279caf921f1
util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents:
4113
diff
changeset
|
143 local username = response["username"]; |
6279caf921f1
util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents:
4113
diff
changeset
|
144 local _nodeprep = self.profile.nodeprep; |
6279caf921f1
util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents:
4113
diff
changeset
|
145 if username and _nodeprep ~= false then |
6279caf921f1
util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents:
4113
diff
changeset
|
146 username = (_nodeprep or nodeprep)(username); -- FIXME charset |
6279caf921f1
util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents:
4113
diff
changeset
|
147 end |
6279caf921f1
util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents:
4113
diff
changeset
|
148 if not username or username == "" then |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
149 return "failure", "malformed-request"; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
150 end |
5301
6279caf921f1
util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents:
4113
diff
changeset
|
151 self.username = username; |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
152 |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
153 -- check for nonce, ... |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
154 if not response["nonce"] then |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
155 return "failure", "malformed-request"; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
156 else |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
157 -- check if it's the right nonce |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
158 if response["nonce"] ~= tostring(self.nonce) then return "failure", "malformed-request" end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
159 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
160 |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
161 if not response["cnonce"] then return "failure", "malformed-request", "Missing entry for cnonce in SASL message." end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
162 if not response["qop"] then response["qop"] = "auth" end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
163 |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
164 if response["realm"] == nil or response["realm"] == "" then |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
165 response["realm"] = ""; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
166 elseif response["realm"] ~= self.realm then |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
167 return "failure", "not-authorized", "Incorrect realm value"; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
168 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
169 |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
170 local decoder; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
171 if response["charset"] == nil then |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
172 decoder = utf8tolatin1ifpossible; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
173 elseif response["charset"] ~= "utf-8" then |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
174 return "failure", "incorrect-encoding", "The client's response uses "..response["charset"].." for encoding with isn't supported by sasl.lua. Supported encodings are latin or utf-8."; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
175 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
176 |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
177 local domain = ""; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
178 local protocol = ""; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
179 if response["digest-uri"] then |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
180 protocol, domain = response["digest-uri"]:match("(%w+)/(.*)$"); |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
181 if protocol == nil or domain == nil then return "failure", "malformed-request" end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
182 else |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
183 return "failure", "malformed-request", "Missing entry for digest-uri in SASL message." |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
184 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
185 |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
186 --TODO maybe realm support |
2258
e4c5d0d21ac7
util.sasl.digest-md5: Fixing some variable access.
Tobias Markmann <tm@ayena.de>
parents:
2255
diff
changeset
|
187 local Y, state; |
2188
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
188 if self.profile.plain then |
3981
2b0b8fe68df2
util.sasl.*, mod_auth_*, mod_saslauth: Pass SASL handler as first parameter to SASL profile callbacks.
Waqas Hussain <waqas20@gmail.com>
parents:
3124
diff
changeset
|
189 local password, state = self.profile.plain(self, response["username"], self.realm) |
2188
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
190 if state == nil then return "failure", "not-authorized" |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
191 elseif state == false then return "failure", "account-disabled" end |
2189
1182e7ae2964
Broken DIGEST-MD5 client support again.
Tobias Markmann <tm@ayena.de>
parents:
2188
diff
changeset
|
192 Y = md5(response["username"]..":"..response["realm"]..":"..password); |
2188
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
193 elseif self.profile["digest-md5"] then |
3981
2b0b8fe68df2
util.sasl.*, mod_auth_*, mod_saslauth: Pass SASL handler as first parameter to SASL profile callbacks.
Waqas Hussain <waqas20@gmail.com>
parents:
3124
diff
changeset
|
194 Y, state = self.profile["digest-md5"](self, response["username"], self.realm, response["realm"], response["charset"]) |
2191
e79c0ce6cf54
Adding support for digest-md5 profile in DIGEST-MD5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2189
diff
changeset
|
195 if state == nil then return "failure", "not-authorized" |
e79c0ce6cf54
Adding support for digest-md5 profile in DIGEST-MD5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2189
diff
changeset
|
196 elseif state == false then return "failure", "account-disabled" end |
2188
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
197 elseif self.profile["digest-md5-test"] then |
2189
1182e7ae2964
Broken DIGEST-MD5 client support again.
Tobias Markmann <tm@ayena.de>
parents:
2188
diff
changeset
|
198 -- TODO |
2188
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
199 end |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
200 --local password_encoding, Y = self.credentials_handler("DIGEST-MD5", response["username"], self.realm, response["realm"], decoder); |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
201 --if Y == nil then return "failure", "not-authorized" |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
202 --elseif Y == false then return "failure", "account-disabled" end |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
203 local A1 = ""; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
204 if response.authzid then |
2193 | 205 if response.authzid == self.username or response.authzid == self.username.."@"..self.realm then |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
206 -- COMPAT |
2193 | 207 log("warn", "Client is violating RFC 3920 (section 6.1, point 7)."); |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
208 A1 = Y..":"..response["nonce"]..":"..response["cnonce"]..":"..response.authzid; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
209 else |
2193 | 210 return "failure", "invalid-authzid"; |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
211 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
212 else |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
213 A1 = Y..":"..response["nonce"]..":"..response["cnonce"]; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
214 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
215 local A2 = "AUTHENTICATE:"..protocol.."/"..domain; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
216 |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
217 local HA1 = md5(A1, true); |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
218 local HA2 = md5(A2, true); |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
219 |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
220 local KD = HA1..":"..response["nonce"]..":"..response["nc"]..":"..response["cnonce"]..":"..response["qop"]..":"..HA2; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
221 local response_value = md5(KD, true); |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
222 |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
223 if response_value == response["response"] then |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
224 -- calculate rspauth |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
225 A2 = ":"..protocol.."/"..domain; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
226 |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
227 HA1 = md5(A1, true); |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
228 HA2 = md5(A2, true); |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
229 |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
230 KD = HA1..":"..response["nonce"]..":"..response["nc"]..":"..response["cnonce"]..":"..response["qop"]..":"..HA2 |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
231 local rspauth = md5(KD, true); |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
232 self.authenticated = true; |
2568
25e1a544a096
util.sasl.digest-md5: Revert changeset 6094a4e2b6f3 as it breaks some clients, re-visit some time down the line
Matthew Wild <mwild1@gmail.com>
parents:
2211
diff
changeset
|
233 --TODO: considering sending the rspauth in a success node for saving one roundtrip; allowed according to http://tools.ietf.org/html/draft-saintandre-rfc3920bis-09#section-7.3.6 |
25e1a544a096
util.sasl.digest-md5: Revert changeset 6094a4e2b6f3 as it breaks some clients, re-visit some time down the line
Matthew Wild <mwild1@gmail.com>
parents:
2211
diff
changeset
|
234 return "challenge", serialize({rspauth = rspauth}); |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
235 else |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
236 return "failure", "not-authorized", "The response provided by the client doesn't match the one we calculated." |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
237 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
238 elseif self.step == 3 then |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
239 if self.authenticated ~= nil then return "success" |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
240 else return "failure", "malformed-request" end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
241 end |
2188
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
242 end |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
243 |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
244 function init(registerMechanism) |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
245 registerMechanism("DIGEST-MD5", {"plain"}, digest); |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
246 end |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
247 |
4113
65482a852c4d
util.sasl.*: Add 'sasl.' prefix to module names
Matthew Wild <mwild1@gmail.com>
parents:
3981
diff
changeset
|
248 return _M; |