prosody
54953b5a214b
util/sasl/plain.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

util/sasl/plain.lua @ 10913:54953b5a214b 0.11

util.sasl.plain: Apply saslprep to stored password Fixes something like #1560 here too. The password sent by the user already had saslprep applied.
author Kim Alvefur <zash@zash.se>
date Fri, 22 May 2020 21:05:45 +0200
parent 8555:4f0f5b49bb03
child 12945:d2c1c327a4d1
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
2186
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
1 -- sasl.lua v0.4
2996
b0515ed4d9d7 util.sasl: 2009 -> 2010 in copyright header.
Tobias Markmann <tm@ayena.de>
parents: 2994
diff changeset
2 -- Copyright (C) 2008-2010 Tobias Markmann
2186
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
3 --
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
4 -- All rights reserved.
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
5 --
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
6 -- Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
7 --
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
8 -- * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
9 -- * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
10 -- * Neither the name of Tobias Markmann nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
11 --
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
12 -- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
13
2187
f0a85d11823e Getting PLAIN mechanism work with the new API.
Tobias Markmann <tm@ayena.de>
parents: 2186
diff changeset
14 local s_match = string.match;
2200
dd0b250cb6c4 SASLprep authentication and password in SASL PLAIN implementation.
Tobias Markmann <tm@ayena.de>
parents: 2187
diff changeset
15 local saslprep = require "util.encodings".stringprep.saslprep;
5301
6279caf921f1 util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents: 5240
diff changeset
16 local nodeprep = require "util.encodings".stringprep.nodeprep;
2200
dd0b250cb6c4 SASLprep authentication and password in SASL PLAIN implementation.
Tobias Markmann <tm@ayena.de>
parents: 2187
diff changeset
17 local log = require "util.logger".init("sasl");
2186
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
18
6777
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 5301
diff changeset
19 local _ENV = nil;
8555
4f0f5b49bb03 vairious: Add annotation when an empty environment is set [luacheck]
Kim Alvefur <zash@zash.se>
parents: 8095
diff changeset
20 -- luacheck: std none
2186
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
21
2263
ff881b857c98 util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents: 2252
diff changeset
22 -- ================================
ff881b857c98 util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents: 2252
diff changeset
23 -- SASL PLAIN according to RFC 4616
2991
0fa3a7c885bd util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents: 2314
diff changeset
24
0fa3a7c885bd util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents: 2314
diff changeset
25 --[[
0fa3a7c885bd util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents: 2314
diff changeset
26 Supported Authentication Backends
0fa3a7c885bd util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents: 2314
diff changeset
27
0fa3a7c885bd util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents: 2314
diff changeset
28 plain:
0fa3a7c885bd util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents: 2314
diff changeset
29 function(username, realm)
0fa3a7c885bd util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents: 2314
diff changeset
30 return password, state;
0fa3a7c885bd util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents: 2314
diff changeset
31 end
0fa3a7c885bd util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents: 2314
diff changeset
32
3080
8e842989ced2 util.sasl.plain: Typo.
Tobias Markmann <tm@ayena.de>
parents: 3073
diff changeset
33 plain_test:
3164
db9def53fe9c Check in mod_hashpassauth -- works!
Jeff Mitchell <jeff@jefferai.org>
parents: 3080
diff changeset
34 function(username, password, realm)
2991
0fa3a7c885bd util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents: 2314
diff changeset
35 return true or false, state;
0fa3a7c885bd util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents: 2314
diff changeset
36 end
0fa3a7c885bd util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents: 2314
diff changeset
37 ]]
0fa3a7c885bd util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents: 2314
diff changeset
38
2186
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
39 local function plain(self, message)
2263
ff881b857c98 util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents: 2252
diff changeset
40 if not message then
2186
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
41 return "failure", "malformed-request";
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
42 end
2263
ff881b857c98 util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents: 2252
diff changeset
43
2314
c2e1bde4d84d Redo merge with Waqas' PBKDF2 optimizations.
Tobias Markmann <tm@ayena.de>
parents: 2290
diff changeset
44 local authorization, authentication, password = s_match(message, "^([^%z]*)%z([^%z]+)%z([^%z]+)");
2263
ff881b857c98 util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents: 2252
diff changeset
45
ff881b857c98 util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents: 2252
diff changeset
46 if not authorization then
ff881b857c98 util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents: 2252
diff changeset
47 return "failure", "malformed-request";
ff881b857c98 util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents: 2252
diff changeset
48 end
ff881b857c98 util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents: 2252
diff changeset
49
2200
dd0b250cb6c4 SASLprep authentication and password in SASL PLAIN implementation.
Tobias Markmann <tm@ayena.de>
parents: 2187
diff changeset
50 -- SASLprep password and authentication
dd0b250cb6c4 SASLprep authentication and password in SASL PLAIN implementation.
Tobias Markmann <tm@ayena.de>
parents: 2187
diff changeset
51 authentication = saslprep(authentication);
dd0b250cb6c4 SASLprep authentication and password in SASL PLAIN implementation.
Tobias Markmann <tm@ayena.de>
parents: 2187
diff changeset
52 password = saslprep(password);
2263
ff881b857c98 util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents: 2252
diff changeset
53
2200
dd0b250cb6c4 SASLprep authentication and password in SASL PLAIN implementation.
Tobias Markmann <tm@ayena.de>
parents: 2187
diff changeset
54 if (not password) or (password == "") or (not authentication) or (authentication == "") then
2209
adbedc32d41b Fail if username or password don't pass SASLprep.
Tobias Markmann <tm@ayena.de>
parents: 2200
diff changeset
55 log("debug", "Username or password violates SASLprep.");
2210
78c9b5255b27 Adding some human readable error messages.
Tobias Markmann <tm@ayena.de>
parents: 2209
diff changeset
56 return "failure", "malformed-request", "Invalid username or password.";
2200
dd0b250cb6c4 SASLprep authentication and password in SASL PLAIN implementation.
Tobias Markmann <tm@ayena.de>
parents: 2187
diff changeset
57 end
2186
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
58
5301
6279caf921f1 util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents: 5240
diff changeset
59 local _nodeprep = self.profile.nodeprep;
6279caf921f1 util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents: 5240
diff changeset
60 if _nodeprep ~= false then
6279caf921f1 util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents: 5240
diff changeset
61 authentication = (_nodeprep or nodeprep)(authentication);
6279caf921f1 util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents: 5240
diff changeset
62 if not authentication or authentication == "" then
6279caf921f1 util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents: 5240
diff changeset
63 return "failure", "malformed-request", "Invalid username or password."
6279caf921f1 util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents: 5240
diff changeset
64 end
6279caf921f1 util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents: 5240
diff changeset
65 end
6279caf921f1 util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents: 5240
diff changeset
66
8095
57192cf193c7 util.sasl.plain,scram: Record username in sasl state earlier
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
67 self.username = authentication
57192cf193c7 util.sasl.plain,scram: Record username in sasl state earlier
Kim Alvefur <zash@zash.se>
parents: 6777
diff changeset
68
2186
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
69 local correct, state = false, false;
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
70 if self.profile.plain then
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
71 local correct_password;
3981
2b0b8fe68df2 util.sasl.*, mod_auth_*, mod_saslauth: Pass SASL handler as first parameter to SASL profile callbacks.
Waqas Hussain <waqas20@gmail.com>
parents: 3179
diff changeset
72 correct_password, state = self.profile.plain(self, authentication, self.realm);
10913
54953b5a214b util.sasl.plain: Apply saslprep to stored password
Kim Alvefur <zash@zash.se>
parents: 8555
diff changeset
73 correct = (saslprep(correct_password) == password);
2186
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
74 elseif self.profile.plain_test then
3981
2b0b8fe68df2 util.sasl.*, mod_auth_*, mod_saslauth: Pass SASL handler as first parameter to SASL profile callbacks.
Waqas Hussain <waqas20@gmail.com>
parents: 3179
diff changeset
75 correct, state = self.profile.plain_test(self, authentication, password, self.realm);
2186
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
76 end
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
77
4920
e27adbf4e743 util.sasl.plain: make it return "not-authorized" in case of non-existant accounts instead of "account-disabled" to avoid enumeration.
Marco Cirillo <maranda@lightwitch.org>
parents: 4113
diff changeset
78 if state == false then
2186
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
79 return "failure", "account-disabled";
5240
864b27ddaa10 util.sasl.plain: Reduce some code.
Waqas Hussain <waqas20@gmail.com>
parents: 4920
diff changeset
80 elseif state == nil or not correct then
4920
e27adbf4e743 util.sasl.plain: make it return "not-authorized" in case of non-existant accounts instead of "account-disabled" to avoid enumeration.
Marco Cirillo <maranda@lightwitch.org>
parents: 4113
diff changeset
81 return "failure", "not-authorized", "Unable to authorize you with the authentication credentials you've sent.";
2186
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
82 end
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
83
5240
864b27ddaa10 util.sasl.plain: Reduce some code.
Waqas Hussain <waqas20@gmail.com>
parents: 4920
diff changeset
84 return "success";
2186
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
85 end
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
86
6777
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 5301
diff changeset
87 local function init(registerMechanism)
3073
9a9fe2f3019d util.sasl.plain: Removing plain_hashed authentication provider. Just do hashing and comparison yourself in a plain_test authentication provider.
Tobias Markmann <tm@ayena.de>
parents: 2996
diff changeset
88 registerMechanism("PLAIN", {"plain", "plain_test"}, plain);
2187
f0a85d11823e Getting PLAIN mechanism work with the new API.
Tobias Markmann <tm@ayena.de>
parents: 2186
diff changeset
89 end
2186
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
90
6777
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 5301
diff changeset
91 return {
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 5301
diff changeset
92 init = init;
5de6b93d0190 util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents: 5301
diff changeset
93 }