Software `/` code `/` prosody

Annotate

plugins/mod_saslauth.lua @ 5877:615a0774e4cc

util.timer: Updated to use util.indexedbheap to provide a more complete API. Timers can now be stopped or rescheduled. Callbacks are now pcall'd. Adding/removing timers from within timer callbacks works better. Optional parameter can be passed when creating timer which gets passed to callback, eliminating the need for closures in various timer uses. Timers are now much more lightweight.

author	Waqas Hussain <waqas20@gmail.com>
date	Wed, 30 Oct 2013 17:44:42 -0400
parent	5860:87e2fafba5df
child	6014:d61026bee038

rev	line source
1523 841d61be198f Remove version number from copyright headers Matthew Wild <mwild1@gmail.com> parents: 1486 diff changeset	1 -- Prosody IM
2923 b7049746bd29 Update copyright headers for 2010 Matthew Wild <mwild1@gmail.com> parents: 2877 diff changeset	2 -- Copyright (C) 2008-2010 Matthew Wild
b7049746bd29 Update copyright headers for 2010 Matthew Wild <mwild1@gmail.com> parents: 2877 diff changeset	3 -- Copyright (C) 2008-2010 Waqas Hussain
5776 bd0ff8ae98a8 Remove all trailing whitespace Florian Zeitz <florob@babelmonkeys.de> parents: 5535 diff changeset	4 --
758 b1885732e979 GPL->MIT! Matthew Wild <mwild1@gmail.com> parents: 724 diff changeset	5 -- This project is MIT/X11 licensed. Please see the
b1885732e979 GPL->MIT! Matthew Wild <mwild1@gmail.com> parents: 724 diff changeset	6 -- COPYING file in the source package for more information.
519 cccd610a0ef9 Insert copyright/license headers Matthew Wild <mwild1@gmail.com> parents: 449 diff changeset	7 --
cccd610a0ef9 Insert copyright/license headers Matthew Wild <mwild1@gmail.com> parents: 449 diff changeset	8
cccd610a0ef9 Insert copyright/license headers Matthew Wild <mwild1@gmail.com> parents: 449 diff changeset	9
38 3fdfd6e0cb4e SASL! Matthew Wild <mwild1@gmail.com> parents: diff changeset	10
3fdfd6e0cb4e SASL! Matthew Wild <mwild1@gmail.com> parents: diff changeset	11 local st = require "util.stanza";
46 d6b3f9dbb624 Resource binding, XMPP sessions (whatever they're for...) Matthew Wild <mwild1@gmail.com> parents: 38 diff changeset	12 local sm_bind_resource = require "core.sessionmanager".bind_resource;
1042 a3d77353c18a mod_: Fix a load of global accesses Matthew Wild <mwild1@gmail.com>* parents: 938 diff changeset	13 local sm_make_authenticated = require "core.sessionmanager".make_authenticated;
447 c0dae734d3bf Stopped using the lbase64 library Waqas Hussain <waqas20@gmail.com> parents: 438 diff changeset	14 local base64 = require "util.encodings".base64;
38 3fdfd6e0cb4e SASL! Matthew Wild <mwild1@gmail.com> parents: diff changeset	15
3733 26571a99f6e6 core.s2smanager, mod_console, mod_saslauth, util.certverification: rename util.certverification to util.x509 Kim Alvefur <zash@zash.se> parents: 3651 diff changeset	16 local cert_verify_identity = require "util.x509".verify_identity;
3651 337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	17
3188 c690e3c5105c mod_saslauth: Updated to use usermanager.get_sasl_handler. Waqas Hussain <waqas20@gmail.com> parents: 3178 diff changeset	18 local usermanager_get_sasl_handler = require "core.usermanager".get_sasl_handler;
38 3fdfd6e0cb4e SASL! Matthew Wild <mwild1@gmail.com> parents: diff changeset	19 local tostring = tostring;
3fdfd6e0cb4e SASL! Matthew Wild <mwild1@gmail.com> parents: diff changeset	20
2415 eb383f58624b mod_saslauth: Use module:get_option() Paul Aurich <paul@darkrain42.org> parents: 2414 diff changeset	21 local secure_auth_only = module:get_option("c2s_require_encryption") or module:get_option("require_encryption");
3417 53e854b52110 mod_saslauth: Check for unencrypted PLAIN auth in mod_saslauth instead of the SASL handler (makes it work for Cyrus SASL). Waqas Hussain <waqas20@gmail.com> parents: 3416 diff changeset	22 local allow_unencrypted_plain_auth = module:get_option("allow_unencrypted_plain_auth")
3066 5e5137057b5f mod_saslauth: Split out cyrus SASL config options into locals, and add support for cyrus_application_name (default: 'prosody') Matthew Wild <mwild1@gmail.com> parents: 3064 diff changeset	23
1071 216f9a9001f1 mod_saslauth: Use module logger instead of creating a new one Matthew Wild <mwild1@gmail.com> parents: 1042 diff changeset	24 local log = module._log;
38 3fdfd6e0cb4e SASL! Matthew Wild <mwild1@gmail.com> parents: diff changeset	25
3fdfd6e0cb4e SASL! Matthew Wild <mwild1@gmail.com> parents: diff changeset	26 local xmlns_sasl ='urn:ietf:params:xml:ns:xmpp-sasl';
46 d6b3f9dbb624 Resource binding, XMPP sessions (whatever they're for...) Matthew Wild <mwild1@gmail.com> parents: 38 diff changeset	27 local xmlns_bind ='urn:ietf:params:xml:ns:xmpp-bind';
38 3fdfd6e0cb4e SASL! Matthew Wild <mwild1@gmail.com> parents: diff changeset	28
292 33175ad2f682 Started using realm in password hashing, and added support for error message replies from sasl Waqas Hussain <waqas20@gmail.com> parents: 291 diff changeset	29 local function build_reply(status, ret, err_msg)
281 826308c07627 mod_saslauth updated for digest-md5 Waqas Hussain <waqas20@gmail.com> parents: 120 diff changeset	30 local reply = st.stanza(status, {xmlns = xmlns_sasl});
826308c07627 mod_saslauth updated for digest-md5 Waqas Hussain <waqas20@gmail.com> parents: 120 diff changeset	31 if status == "challenge" then
2860 ad534f89c758 mod_saslauth: Don't print raw SASL data to avoid logging passwords unnecessarily Matthew Wild <mwild1@gmail.com> parents: 2014 diff changeset	32 --log("debug", "CHALLENGE: %s", ret or "");
293 b446de4e258e base64 encode the sasl responses Waqas Hussain <waqas20@gmail.com> parents: 292 diff changeset	33 reply:text(base64.encode(ret or ""));
281 826308c07627 mod_saslauth updated for digest-md5 Waqas Hussain <waqas20@gmail.com> parents: 120 diff changeset	34 elseif status == "failure" then
826308c07627 mod_saslauth updated for digest-md5 Waqas Hussain <waqas20@gmail.com> parents: 120 diff changeset	35 reply:tag(ret):up();
293 b446de4e258e base64 encode the sasl responses Waqas Hussain <waqas20@gmail.com> parents: 292 diff changeset	36 if err_msg then reply:tag("text"):text(err_msg); end
281 826308c07627 mod_saslauth updated for digest-md5 Waqas Hussain <waqas20@gmail.com> parents: 120 diff changeset	37 elseif status == "success" then
2860 ad534f89c758 mod_saslauth: Don't print raw SASL data to avoid logging passwords unnecessarily Matthew Wild <mwild1@gmail.com> parents: 2014 diff changeset	38 --log("debug", "SUCCESS: %s", ret or "");
293 b446de4e258e base64 encode the sasl responses Waqas Hussain <waqas20@gmail.com> parents: 292 diff changeset	39 reply:text(base64.encode(ret or ""));
281 826308c07627 mod_saslauth updated for digest-md5 Waqas Hussain <waqas20@gmail.com> parents: 120 diff changeset	40 else
1073 7c20373d4451 mod_saslauth: Remove 2 instances of raising errors and replacing with more graceful handling Matthew Wild <mwild1@gmail.com> parents: 1072 diff changeset	41 module:log("error", "Unknown sasl status: %s", status);
281 826308c07627 mod_saslauth updated for digest-md5 Waqas Hussain <waqas20@gmail.com> parents: 120 diff changeset	42 end
826308c07627 mod_saslauth updated for digest-md5 Waqas Hussain <waqas20@gmail.com> parents: 120 diff changeset	43 return reply;
826308c07627 mod_saslauth updated for digest-md5 Waqas Hussain <waqas20@gmail.com> parents: 120 diff changeset	44 end
826308c07627 mod_saslauth updated for digest-md5 Waqas Hussain <waqas20@gmail.com> parents: 120 diff changeset	45
3062 892c49869293 mod_saslauth: Add return value and error message to the Cyrus SASL handle_status callback Matthew Wild <mwild1@gmail.com> parents: 3061 diff changeset	46 local function handle_status(session, status, ret, err_msg)
281 826308c07627 mod_saslauth updated for digest-md5 Waqas Hussain <waqas20@gmail.com> parents: 120 diff changeset	47 if status == "failure" then
4361 605045b77bc6 mod_saslauth: Fire authentication-success and authentication-failure events (thanks scitor) Matthew Wild <mwild1@gmail.com> parents: 4078 diff changeset	48 module:fire_event("authentication-failure", { session = session, condition = ret, text = err_msg });
2251 18079ede5b62 mod_saslauth: Fix typo in variable name Matthew Wild <mwild1@gmail.com> parents: 2242 diff changeset	49 session.sasl_handler = session.sasl_handler:clean_clone();
281 826308c07627 mod_saslauth updated for digest-md5 Waqas Hussain <waqas20@gmail.com> parents: 120 diff changeset	50 elseif status == "success" then
3468 d50e2c937717 mod_saslauth, mod_auth_cyrus, util.sasl_cyrus: Moved cyrus account provisioning check out of mod_saslauth. Waqas Hussain <waqas20@gmail.com> parents: 3464 diff changeset	51 local ok, err = sm_make_authenticated(session, session.sasl_handler.username);
d50e2c937717 mod_saslauth, mod_auth_cyrus, util.sasl_cyrus: Moved cyrus account provisioning check out of mod_saslauth. Waqas Hussain <waqas20@gmail.com> parents: 3464 diff changeset	52 if ok then
4504 55b61221ecb8 mod_saslauth: Move authentication-success event to after session has been made authenticated. Kim Alvefur <zash@zash.se> parents: 4492 diff changeset	53 module:fire_event("authentication-success", { session = session });
3468 d50e2c937717 mod_saslauth, mod_auth_cyrus, util.sasl_cyrus: Moved cyrus account provisioning check out of mod_saslauth. Waqas Hussain <waqas20@gmail.com> parents: 3464 diff changeset	54 session.sasl_handler = nil;
d50e2c937717 mod_saslauth, mod_auth_cyrus, util.sasl_cyrus: Moved cyrus account provisioning check out of mod_saslauth. Waqas Hussain <waqas20@gmail.com> parents: 3464 diff changeset	55 session:reset_stream();
3064 596303990c7c usermanager, mod_saslauth: Make account provisioning for Cyrus SASL optional (default: not required) Matthew Wild <mwild1@gmail.com> parents: 3062 diff changeset	56 else
3468 d50e2c937717 mod_saslauth, mod_auth_cyrus, util.sasl_cyrus: Moved cyrus account provisioning check out of mod_saslauth. Waqas Hussain <waqas20@gmail.com> parents: 3464 diff changeset	57 module:log("warn", "SASL succeeded but username was invalid");
4505 b1e10c327d66 mod_saslauth: Fire authentication-failure if make_authenticated() failed. Kim Alvefur <zash@zash.se> parents: 4504 diff changeset	58 module:fire_event("authentication-failure", { session = session, condition = "not-authorized", text = err });
3064 596303990c7c usermanager, mod_saslauth: Make account provisioning for Cyrus SASL optional (default: not required) Matthew Wild <mwild1@gmail.com> parents: 3062 diff changeset	59 session.sasl_handler = session.sasl_handler:clean_clone();
3468 d50e2c937717 mod_saslauth, mod_auth_cyrus, util.sasl_cyrus: Moved cyrus account provisioning check out of mod_saslauth. Waqas Hussain <waqas20@gmail.com> parents: 3464 diff changeset	60 return "failure", "not-authorized", "User authenticated successfully, but username was invalid";
3064 596303990c7c usermanager, mod_saslauth: Make account provisioning for Cyrus SASL optional (default: not required) Matthew Wild <mwild1@gmail.com> parents: 3062 diff changeset	61 end
281 826308c07627 mod_saslauth updated for digest-md5 Waqas Hussain <waqas20@gmail.com> parents: 120 diff changeset	62 end
3062 892c49869293 mod_saslauth: Add return value and error message to the Cyrus SASL handle_status callback Matthew Wild <mwild1@gmail.com> parents: 3061 diff changeset	63 return status, ret, err_msg;
281 826308c07627 mod_saslauth updated for digest-md5 Waqas Hussain <waqas20@gmail.com> parents: 120 diff changeset	64 end
826308c07627 mod_saslauth updated for digest-md5 Waqas Hussain <waqas20@gmail.com> parents: 120 diff changeset	65
3551 4fba723ab235 mod_saslauth: Moved SASL mechanism selection and CDATA handling into separate functions. Waqas Hussain <waqas20@gmail.com> parents: 3548 diff changeset	66 local function sasl_process_cdata(session, stanza)
4fba723ab235 mod_saslauth: Moved SASL mechanism selection and CDATA handling into separate functions. Waqas Hussain <waqas20@gmail.com> parents: 3548 diff changeset	67 local text = stanza[1];
4fba723ab235 mod_saslauth: Moved SASL mechanism selection and CDATA handling into separate functions. Waqas Hussain <waqas20@gmail.com> parents: 3548 diff changeset	68 if text then
4fba723ab235 mod_saslauth: Moved SASL mechanism selection and CDATA handling into separate functions. Waqas Hussain <waqas20@gmail.com> parents: 3548 diff changeset	69 text = base64.decode(text);
4fba723ab235 mod_saslauth: Moved SASL mechanism selection and CDATA handling into separate functions. Waqas Hussain <waqas20@gmail.com> parents: 3548 diff changeset	70 --log("debug", "AUTH: %s", text:gsub("[%z\001-\008\011\012\014-\031]", " "));
4fba723ab235 mod_saslauth: Moved SASL mechanism selection and CDATA handling into separate functions. Waqas Hussain <waqas20@gmail.com> parents: 3548 diff changeset	71 if not text then
4fba723ab235 mod_saslauth: Moved SASL mechanism selection and CDATA handling into separate functions. Waqas Hussain <waqas20@gmail.com> parents: 3548 diff changeset	72 session.sasl_handler = nil;
4fba723ab235 mod_saslauth: Moved SASL mechanism selection and CDATA handling into separate functions. Waqas Hussain <waqas20@gmail.com> parents: 3548 diff changeset	73 session.send(build_reply("failure", "incorrect-encoding"));
4fba723ab235 mod_saslauth: Moved SASL mechanism selection and CDATA handling into separate functions. Waqas Hussain <waqas20@gmail.com> parents: 3548 diff changeset	74 return true;
4fba723ab235 mod_saslauth: Moved SASL mechanism selection and CDATA handling into separate functions. Waqas Hussain <waqas20@gmail.com> parents: 3548 diff changeset	75 end
4fba723ab235 mod_saslauth: Moved SASL mechanism selection and CDATA handling into separate functions. Waqas Hussain <waqas20@gmail.com> parents: 3548 diff changeset	76 end
4fba723ab235 mod_saslauth: Moved SASL mechanism selection and CDATA handling into separate functions. Waqas Hussain <waqas20@gmail.com> parents: 3548 diff changeset	77 local status, ret, err_msg = session.sasl_handler:process(text);
4fba723ab235 mod_saslauth: Moved SASL mechanism selection and CDATA handling into separate functions. Waqas Hussain <waqas20@gmail.com> parents: 3548 diff changeset	78 status, ret, err_msg = handle_status(session, status, ret, err_msg);
4fba723ab235 mod_saslauth: Moved SASL mechanism selection and CDATA handling into separate functions. Waqas Hussain <waqas20@gmail.com> parents: 3548 diff changeset	79 local s = build_reply(status, ret, err_msg);
4fba723ab235 mod_saslauth: Moved SASL mechanism selection and CDATA handling into separate functions. Waqas Hussain <waqas20@gmail.com> parents: 3548 diff changeset	80 log("debug", "sasl reply: %s", tostring(s));
4fba723ab235 mod_saslauth: Moved SASL mechanism selection and CDATA handling into separate functions. Waqas Hussain <waqas20@gmail.com> parents: 3548 diff changeset	81 session.send(s);
4fba723ab235 mod_saslauth: Moved SASL mechanism selection and CDATA handling into separate functions. Waqas Hussain <waqas20@gmail.com> parents: 3548 diff changeset	82 return true;
4fba723ab235 mod_saslauth: Moved SASL mechanism selection and CDATA handling into separate functions. Waqas Hussain <waqas20@gmail.com> parents: 3548 diff changeset	83 end
4fba723ab235 mod_saslauth: Moved SASL mechanism selection and CDATA handling into separate functions. Waqas Hussain <waqas20@gmail.com> parents: 3548 diff changeset	84
3651 337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	85 module:hook_stanza(xmlns_sasl, "success", function (session, stanza)
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	86 if session.type ~= "s2sout_unauthed" or session.external_auth ~= "attempting" then return; end
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	87 module:log("debug", "SASL EXTERNAL with %s succeeded", session.to_host);
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	88 session.external_auth = "succeeded"
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	89 session:reset_stream();
5535 0df0afc041d7 mod_saslauth, mod_compression: Fix some cases where open_stream() was not being passed to/from (see df3c78221f26 and issue #338) Matthew Wild <mwild1@gmail.com> parents: 5362 diff changeset	90 session:open_stream(session.from_host, session.to_host);
3651 337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	91
5362 612467e263af s2smanager, mod_s2s, mod_dialback, mod_saslauth: Move s2smanager.make_authenticated() to mod_s2s, and plugins now signal authentication via the s2s-authenticated event Matthew Wild <mwild1@gmail.com> parents: 5351 diff changeset	92 module:fire_event("s2s-authenticated", { session = session, host = session.to_host });
3651 337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	93 return true;
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	94 end)
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	95
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	96 module:hook_stanza(xmlns_sasl, "failure", function (session, stanza)
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	97 if session.type ~= "s2sout_unauthed" or session.external_auth ~= "attempting" then return; end
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	98
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	99 module:log("info", "SASL EXTERNAL with %s failed", session.to_host)
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	100 -- TODO: Log the failure reason
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	101 session.external_auth = "failed"
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	102 end, 500)
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	103
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	104 module:hook_stanza(xmlns_sasl, "failure", function (session, stanza)
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	105 -- TODO: Dialback wasn't loaded. Do something useful.
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	106 end, 90)
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	107
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	108 module:hook_stanza("http://etherx.jabber.org/streams", "features", function (session, stanza)
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	109 if session.type ~= "s2sout_unauthed" or not session.secure then return; end
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	110
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	111 local mechanisms = stanza:get_child("mechanisms", xmlns_sasl)
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	112 if mechanisms then
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	113 for mech in mechanisms:childtags() do
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	114 if mech[1] == "EXTERNAL" then
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	115 module:log("debug", "Initiating SASL EXTERNAL with %s", session.to_host);
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	116 local reply = st.stanza("auth", {xmlns = xmlns_sasl, mechanism = "EXTERNAL"});
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	117 reply:text(base64.encode(session.from_host))
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	118 session.sends2s(reply)
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	119 session.external_auth = "attempting"
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	120 return true
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	121 end
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	122 end
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	123 end
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	124 end, 150);
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	125
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	126 local function s2s_external_auth(session, stanza)
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	127 local mechanism = stanza.attr.mechanism;
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	128
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	129 if not session.secure then
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	130 if mechanism == "EXTERNAL" then
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	131 session.sends2s(build_reply("failure", "encryption-required"))
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	132 else
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	133 session.sends2s(build_reply("failure", "invalid-mechanism"))
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	134 end
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	135 return true;
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	136 end
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	137
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	138 if mechanism ~= "EXTERNAL" or session.cert_chain_status ~= "valid" then
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	139 session.sends2s(build_reply("failure", "invalid-mechanism"))
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	140 return true;
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	141 end
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	142
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	143 local text = stanza[1]
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	144 if not text then
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	145 session.sends2s(build_reply("failure", "malformed-request"))
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	146 return true
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	147 end
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	148
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	149 -- Either the value is "=" and we've already verified the external
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	150 -- cert identity, or the value is a string and either matches the
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	151 -- from_host (
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	152
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	153 text = base64.decode(text)
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	154 if not text then
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	155 session.sends2s(build_reply("failure", "incorrect-encoding"))
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	156 return true;
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	157 end
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	158
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	159 if session.cert_identity_status == "valid" then
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	160 if text ~= "" and text ~= session.from_host then
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	161 session.sends2s(build_reply("failure", "invalid-authzid"))
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	162 return true
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	163 end
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	164 else
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	165 if text == "" then
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	166 session.sends2s(build_reply("failure", "invalid-authzid"))
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	167 return true
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	168 end
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	169
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	170 local cert = session.conn:socket():getpeercertificate()
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	171 if (cert_verify_identity(text, "xmpp-server", cert)) then
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	172 session.cert_identity_status = "valid"
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	173 else
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	174 session.cert_identity_status = "invalid"
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	175 session.sends2s(build_reply("failure", "invalid-authzid"))
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	176 return true
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	177 end
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	178 end
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	179
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	180 session.external_auth = "succeeded"
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	181
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	182 if not session.from_host then
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	183 session.from_host = text;
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	184 end
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	185 session.sends2s(build_reply("success"))
4492 0a4781f165e3 mod_saslauth: "" ~= nil (thanks, Zash!) Paul Aurich <paul@darkrain42.org> parents: 4395 diff changeset	186
0a4781f165e3 mod_saslauth: "" ~= nil (thanks, Zash!) Paul Aurich <paul@darkrain42.org> parents: 4395 diff changeset	187 local domain = text ~= "" and text or session.from_host;
0a4781f165e3 mod_saslauth: "" ~= nil (thanks, Zash!) Paul Aurich <paul@darkrain42.org> parents: 4395 diff changeset	188 module:log("info", "Accepting SASL EXTERNAL identity from %s", domain);
5362 612467e263af s2smanager, mod_s2s, mod_dialback, mod_saslauth: Move s2smanager.make_authenticated() to mod_s2s, and plugins now signal authentication via the s2s-authenticated event Matthew Wild <mwild1@gmail.com> parents: 5351 diff changeset	189 module:fire_event("s2s-authenticated", { session = session, host = domain });
3651 337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	190 session:reset_stream();
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	191 return true
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	192 end
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	193
3552 8ad09efc19cc mod_saslauth: Separated processing of <auth/> and <response/> elements, and return proper error on out-of-order <response/> elements. Waqas Hussain <waqas20@gmail.com> parents: 3551 diff changeset	194 module:hook("stanza/urn:ietf:params:xml:ns:xmpp-sasl:auth", function(event)
3535 b953b0c0f203 mod_saslauth: Updated to use the new events API. Waqas Hussain <waqas20@gmail.com> parents: 3524 diff changeset	195 local session, stanza = event.origin, event.stanza;
3651 337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	196 if session.type == "s2sin_unauthed" then
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	197 return s2s_external_auth(session, stanza)
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	198 end
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	199
3535 b953b0c0f203 mod_saslauth: Updated to use the new events API. Waqas Hussain <waqas20@gmail.com> parents: 3524 diff changeset	200 if session.type ~= "c2s_unauthed" then return; end
b953b0c0f203 mod_saslauth: Updated to use the new events API. Waqas Hussain <waqas20@gmail.com> parents: 3524 diff changeset	201
3553 1f0af8572f15 mod_saslauth: Allow restarting SASL negotiation from scratch. Waqas Hussain <waqas20@gmail.com> parents: 3552 diff changeset	202 if session.sasl_handler and session.sasl_handler.selected then
1f0af8572f15 mod_saslauth: Allow restarting SASL negotiation from scratch. Waqas Hussain <waqas20@gmail.com> parents: 3552 diff changeset	203 session.sasl_handler = nil; -- allow starting a new SASL negotiation before completing an old one
1f0af8572f15 mod_saslauth: Allow restarting SASL negotiation from scratch. Waqas Hussain <waqas20@gmail.com> parents: 3552 diff changeset	204 end
1f0af8572f15 mod_saslauth: Allow restarting SASL negotiation from scratch. Waqas Hussain <waqas20@gmail.com> parents: 3552 diff changeset	205 if not session.sasl_handler then
4939 0545a574667b mod_saslauth: Pass session to usermanager.get_sasl_handler() Matthew Wild <mwild1@gmail.com> parents: 4754 diff changeset	206 session.sasl_handler = usermanager_get_sasl_handler(module.host, session);
3553 1f0af8572f15 mod_saslauth: Allow restarting SASL negotiation from scratch. Waqas Hussain <waqas20@gmail.com> parents: 3552 diff changeset	207 end
3552 8ad09efc19cc mod_saslauth: Separated processing of <auth/> and <response/> elements, and return proper error on out-of-order <response/> elements. Waqas Hussain <waqas20@gmail.com> parents: 3551 diff changeset	208 local mechanism = stanza.attr.mechanism;
8ad09efc19cc mod_saslauth: Separated processing of <auth/> and <response/> elements, and return proper error on out-of-order <response/> elements. Waqas Hussain <waqas20@gmail.com> parents: 3551 diff changeset	209 if not session.secure and (secure_auth_only or (mechanism == "PLAIN" and not allow_unencrypted_plain_auth)) then
8ad09efc19cc mod_saslauth: Separated processing of <auth/> and <response/> elements, and return proper error on out-of-order <response/> elements. Waqas Hussain <waqas20@gmail.com> parents: 3551 diff changeset	210 session.send(build_reply("failure", "encryption-required"));
8ad09efc19cc mod_saslauth: Separated processing of <auth/> and <response/> elements, and return proper error on out-of-order <response/> elements. Waqas Hussain <waqas20@gmail.com> parents: 3551 diff changeset	211 return true;
8ad09efc19cc mod_saslauth: Separated processing of <auth/> and <response/> elements, and return proper error on out-of-order <response/> elements. Waqas Hussain <waqas20@gmail.com> parents: 3551 diff changeset	212 end
8ad09efc19cc mod_saslauth: Separated processing of <auth/> and <response/> elements, and return proper error on out-of-order <response/> elements. Waqas Hussain <waqas20@gmail.com> parents: 3551 diff changeset	213 local valid_mechanism = session.sasl_handler:select(mechanism);
8ad09efc19cc mod_saslauth: Separated processing of <auth/> and <response/> elements, and return proper error on out-of-order <response/> elements. Waqas Hussain <waqas20@gmail.com> parents: 3551 diff changeset	214 if not valid_mechanism then
8ad09efc19cc mod_saslauth: Separated processing of <auth/> and <response/> elements, and return proper error on out-of-order <response/> elements. Waqas Hussain <waqas20@gmail.com> parents: 3551 diff changeset	215 session.send(build_reply("failure", "invalid-mechanism"));
8ad09efc19cc mod_saslauth: Separated processing of <auth/> and <response/> elements, and return proper error on out-of-order <response/> elements. Waqas Hussain <waqas20@gmail.com> parents: 3551 diff changeset	216 return true;
295 bb078eb1f1de mod_saslauth: Code cleanup Waqas Hussain <waqas20@gmail.com> parents: 293 diff changeset	217 end
3551 4fba723ab235 mod_saslauth: Moved SASL mechanism selection and CDATA handling into separate functions. Waqas Hussain <waqas20@gmail.com> parents: 3548 diff changeset	218 return sasl_process_cdata(session, stanza);
3552 8ad09efc19cc mod_saslauth: Separated processing of <auth/> and <response/> elements, and return proper error on out-of-order <response/> elements. Waqas Hussain <waqas20@gmail.com> parents: 3551 diff changeset	219 end);
8ad09efc19cc mod_saslauth: Separated processing of <auth/> and <response/> elements, and return proper error on out-of-order <response/> elements. Waqas Hussain <waqas20@gmail.com> parents: 3551 diff changeset	220 module:hook("stanza/urn:ietf:params:xml:ns:xmpp-sasl:response", function(event)
8ad09efc19cc mod_saslauth: Separated processing of <auth/> and <response/> elements, and return proper error on out-of-order <response/> elements. Waqas Hussain <waqas20@gmail.com> parents: 3551 diff changeset	221 local session = event.origin;
8ad09efc19cc mod_saslauth: Separated processing of <auth/> and <response/> elements, and return proper error on out-of-order <response/> elements. Waqas Hussain <waqas20@gmail.com> parents: 3551 diff changeset	222 if not(session.sasl_handler and session.sasl_handler.selected) then
8ad09efc19cc mod_saslauth: Separated processing of <auth/> and <response/> elements, and return proper error on out-of-order <response/> elements. Waqas Hussain <waqas20@gmail.com> parents: 3551 diff changeset	223 session.send(build_reply("failure", "not-authorized", "Out of order SASL element"));
8ad09efc19cc mod_saslauth: Separated processing of <auth/> and <response/> elements, and return proper error on out-of-order <response/> elements. Waqas Hussain <waqas20@gmail.com> parents: 3551 diff changeset	224 return true;
8ad09efc19cc mod_saslauth: Separated processing of <auth/> and <response/> elements, and return proper error on out-of-order <response/> elements. Waqas Hussain <waqas20@gmail.com> parents: 3551 diff changeset	225 end
8ad09efc19cc mod_saslauth: Separated processing of <auth/> and <response/> elements, and return proper error on out-of-order <response/> elements. Waqas Hussain <waqas20@gmail.com> parents: 3551 diff changeset	226 return sasl_process_cdata(session, event.stanza);
8ad09efc19cc mod_saslauth: Separated processing of <auth/> and <response/> elements, and return proper error on out-of-order <response/> elements. Waqas Hussain <waqas20@gmail.com> parents: 3551 diff changeset	227 end);
3548 cd8d1cacc65b mod_saslauth: Handle SASL <abort/> properly. Waqas Hussain <waqas20@gmail.com> parents: 3535 diff changeset	228 module:hook("stanza/urn:ietf:params:xml:ns:xmpp-sasl:abort", function(event)
cd8d1cacc65b mod_saslauth: Handle SASL <abort/> properly. Waqas Hussain <waqas20@gmail.com> parents: 3535 diff changeset	229 local session = event.origin;
cd8d1cacc65b mod_saslauth: Handle SASL <abort/> properly. Waqas Hussain <waqas20@gmail.com> parents: 3535 diff changeset	230 session.sasl_handler = nil;
cd8d1cacc65b mod_saslauth: Handle SASL <abort/> properly. Waqas Hussain <waqas20@gmail.com> parents: 3535 diff changeset	231 session.send(build_reply("failure", "aborted"));
cd8d1cacc65b mod_saslauth: Handle SASL <abort/> properly. Waqas Hussain <waqas20@gmail.com> parents: 3535 diff changeset	232 return true;
cd8d1cacc65b mod_saslauth: Handle SASL <abort/> properly. Waqas Hussain <waqas20@gmail.com> parents: 3535 diff changeset	233 end);
284 4f540755260c mod_saslauth: Added base64 decoding, encoding check, and cleaned the code up. Waqas Hussain <waqas20@gmail.com> parents: 281 diff changeset	234
357 17bcecb06420 Use a stanza for c2s stream features instead of an array of strings. Removes a FIXME. Matthew Wild <mwild1@gmail.com> parents: 313 diff changeset	235 local mechanisms_attr = { xmlns='urn:ietf:params:xml:ns:xmpp-sasl' };
17bcecb06420 Use a stanza for c2s stream features instead of an array of strings. Removes a FIXME. Matthew Wild <mwild1@gmail.com> parents: 313 diff changeset	236 local bind_attr = { xmlns='urn:ietf:params:xml:ns:xmpp-bind' };
17bcecb06420 Use a stanza for c2s stream features instead of an array of strings. Removes a FIXME. Matthew Wild <mwild1@gmail.com> parents: 313 diff changeset	237 local xmpp_session_attr = { xmlns='urn:ietf:params:xml:ns:xmpp-session' };
2612 475552b04151 mod_saslauth: Hook stream-features event using new events API. Waqas Hussain <waqas20@gmail.com> parents: 2451 diff changeset	238 module:hook("stream-features", function(event)
475552b04151 mod_saslauth: Hook stream-features event using new events API. Waqas Hussain <waqas20@gmail.com> parents: 2451 diff changeset	239 local origin, features = event.origin, event.features;
475552b04151 mod_saslauth: Hook stream-features event using new events API. Waqas Hussain <waqas20@gmail.com> parents: 2451 diff changeset	240 if not origin.username then
475552b04151 mod_saslauth: Hook stream-features event using new events API. Waqas Hussain <waqas20@gmail.com> parents: 2451 diff changeset	241 if secure_auth_only and not origin.secure then
2451 d2f747920eaf mod_saslauth: Fixed some indentation and added some semi-colons. Waqas Hussain <waqas20@gmail.com> parents: 2450 diff changeset	242 return;
d2f747920eaf mod_saslauth: Fixed some indentation and added some semi-colons. Waqas Hussain <waqas20@gmail.com> parents: 2450 diff changeset	243 end
4939 0545a574667b mod_saslauth: Pass session to usermanager.get_sasl_handler() Matthew Wild <mwild1@gmail.com> parents: 4754 diff changeset	244 origin.sasl_handler = usermanager_get_sasl_handler(module.host, origin);
5860 87e2fafba5df mod_saslauth: Collect data for channel binding only if we know for sure that the stream is encrypted Kim Alvefur <zash@zash.se> parents: 5843 diff changeset	245 if origin.encrypted then
5838 a2659baf8332 mod_saslauth: Check whether LuaSec supports getpeerfinished() binding. Tobias Markmann <tm@ayena.de> parents: 5834 diff changeset	246 -- check wether LuaSec has the nifty binding to the function needed for tls-unique
a2659baf8332 mod_saslauth: Check whether LuaSec supports getpeerfinished() binding. Tobias Markmann <tm@ayena.de> parents: 5834 diff changeset	247 -- FIXME: would be nice to have this check only once and not for every socket
a2659baf8332 mod_saslauth: Check whether LuaSec supports getpeerfinished() binding. Tobias Markmann <tm@ayena.de> parents: 5834 diff changeset	248 if origin.conn:socket().getpeerfinished then
a2659baf8332 mod_saslauth: Check whether LuaSec supports getpeerfinished() binding. Tobias Markmann <tm@ayena.de> parents: 5834 diff changeset	249 origin.sasl_handler:add_cb_handler("tls-unique", function(self)
a2659baf8332 mod_saslauth: Check whether LuaSec supports getpeerfinished() binding. Tobias Markmann <tm@ayena.de> parents: 5834 diff changeset	250 return self.userdata:getpeerfinished();
a2659baf8332 mod_saslauth: Check whether LuaSec supports getpeerfinished() binding. Tobias Markmann <tm@ayena.de> parents: 5834 diff changeset	251 end);
a2659baf8332 mod_saslauth: Check whether LuaSec supports getpeerfinished() binding. Tobias Markmann <tm@ayena.de> parents: 5834 diff changeset	252 origin.sasl_handler["userdata"] = origin.conn:socket();
a2659baf8332 mod_saslauth: Check whether LuaSec supports getpeerfinished() binding. Tobias Markmann <tm@ayena.de> parents: 5834 diff changeset	253 end
5832 7d100d917243 mod_saslauth: Set secure socket as SASL object user data for secure sessions. Tobias Markmann <tm@ayena.de> parents: 3983 diff changeset	254 end
4395 d322c4553f97 mod_saslauth: Never send empty <mechanisms/>, for real this time. Waqas Hussain <waqas20@gmail.com> parents: 4392 diff changeset	255 local mechanisms = st.stanza("mechanisms", mechanisms_attr);
3417 53e854b52110 mod_saslauth: Check for unencrypted PLAIN auth in mod_saslauth instead of the SASL handler (makes it work for Cyrus SASL). Waqas Hussain <waqas20@gmail.com> parents: 3416 diff changeset	256 for mechanism in pairs(origin.sasl_handler:mechanisms()) do
53e854b52110 mod_saslauth: Check for unencrypted PLAIN auth in mod_saslauth instead of the SASL handler (makes it work for Cyrus SASL). Waqas Hussain <waqas20@gmail.com> parents: 3416 diff changeset	257 if mechanism ~= "PLAIN" or origin.secure or allow_unencrypted_plain_auth then
4395 d322c4553f97 mod_saslauth: Never send empty <mechanisms/>, for real this time. Waqas Hussain <waqas20@gmail.com> parents: 4392 diff changeset	258 mechanisms:tag("mechanism"):text(mechanism):up();
3417 53e854b52110 mod_saslauth: Check for unencrypted PLAIN auth in mod_saslauth instead of the SASL handler (makes it work for Cyrus SASL). Waqas Hussain <waqas20@gmail.com> parents: 3416 diff changeset	259 end
2451 d2f747920eaf mod_saslauth: Fixed some indentation and added some semi-colons. Waqas Hussain <waqas20@gmail.com> parents: 2450 diff changeset	260 end
4395 d322c4553f97 mod_saslauth: Never send empty <mechanisms/>, for real this time. Waqas Hussain <waqas20@gmail.com> parents: 4392 diff changeset	261 if mechanisms[1] then features:add_child(mechanisms); end
2451 d2f747920eaf mod_saslauth: Fixed some indentation and added some semi-colons. Waqas Hussain <waqas20@gmail.com> parents: 2450 diff changeset	262 else
d2f747920eaf mod_saslauth: Fixed some indentation and added some semi-colons. Waqas Hussain <waqas20@gmail.com> parents: 2450 diff changeset	263 features:tag("bind", bind_attr):tag("required"):up():up();
d2f747920eaf mod_saslauth: Fixed some indentation and added some semi-colons. Waqas Hussain <waqas20@gmail.com> parents: 2450 diff changeset	264 features:tag("session", xmpp_session_attr):tag("optional"):up():up();
d2f747920eaf mod_saslauth: Fixed some indentation and added some semi-colons. Waqas Hussain <waqas20@gmail.com> parents: 2450 diff changeset	265 end
d2f747920eaf mod_saslauth: Fixed some indentation and added some semi-colons. Waqas Hussain <waqas20@gmail.com> parents: 2450 diff changeset	266 end);
1584 ffe8a9296e04 mod_saslauth, usermanager: Fetch list of mechanisms from usermanager Nick Thomas parents: 1523 diff changeset	267
3651 337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	268 module:hook("s2s-stream-features", function(event)
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	269 local origin, features = event.origin, event.features;
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	270 if origin.secure and origin.type == "s2sin_unauthed" then
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	271 -- Offer EXTERNAL if chain is valid and either we didn't validate
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	272 -- the identity or it passed.
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	273 if origin.cert_chain_status == "valid" and origin.cert_identity_status ~= "invalid" then --TODO: Configurable
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	274 module:log("debug", "Offering SASL EXTERNAL")
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	275 features:tag("mechanisms", { xmlns = xmlns_sasl })
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	276 :tag("mechanism"):text("EXTERNAL")
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	277 :up():up();
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	278 end
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	279 end
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	280 end);
337391d34b70 s2s: SASL EXTERNAL Paul Aurich <paul@darkrain42.org> parents: 3553 diff changeset	281
3523 32a0c3816d73 mod_saslauth: Updated to use the new events API. Waqas Hussain <waqas20@gmail.com> parents: 3468 diff changeset	282 module:hook("iq/self/urn:ietf:params:xml:ns:xmpp-bind:bind", function(event)
32a0c3816d73 mod_saslauth: Updated to use the new events API. Waqas Hussain <waqas20@gmail.com> parents: 3468 diff changeset	283 local origin, stanza = event.origin, event.stanza;
2451 d2f747920eaf mod_saslauth: Fixed some indentation and added some semi-colons. Waqas Hussain <waqas20@gmail.com> parents: 2450 diff changeset	284 local resource;
d2f747920eaf mod_saslauth: Fixed some indentation and added some semi-colons. Waqas Hussain <waqas20@gmail.com> parents: 2450 diff changeset	285 if stanza.attr.type == "set" then
d2f747920eaf mod_saslauth: Fixed some indentation and added some semi-colons. Waqas Hussain <waqas20@gmail.com> parents: 2450 diff changeset	286 local bind = stanza.tags[1];
3523 32a0c3816d73 mod_saslauth: Updated to use the new events API. Waqas Hussain <waqas20@gmail.com> parents: 3468 diff changeset	287 resource = bind:child_with_name("resource");
32a0c3816d73 mod_saslauth: Updated to use the new events API. Waqas Hussain <waqas20@gmail.com> parents: 3468 diff changeset	288 resource = resource and #resource.tags == 0 and resource[1] or nil;
2451 d2f747920eaf mod_saslauth: Fixed some indentation and added some semi-colons. Waqas Hussain <waqas20@gmail.com> parents: 2450 diff changeset	289 end
3523 32a0c3816d73 mod_saslauth: Updated to use the new events API. Waqas Hussain <waqas20@gmail.com> parents: 3468 diff changeset	290 local success, err_type, err, err_msg = sm_bind_resource(origin, resource);
32a0c3816d73 mod_saslauth: Updated to use the new events API. Waqas Hussain <waqas20@gmail.com> parents: 3468 diff changeset	291 if success then
32a0c3816d73 mod_saslauth: Updated to use the new events API. Waqas Hussain <waqas20@gmail.com> parents: 3468 diff changeset	292 origin.send(st.reply(stanza)
32a0c3816d73 mod_saslauth: Updated to use the new events API. Waqas Hussain <waqas20@gmail.com> parents: 3468 diff changeset	293 :tag("bind", { xmlns = xmlns_bind })
32a0c3816d73 mod_saslauth: Updated to use the new events API. Waqas Hussain <waqas20@gmail.com> parents: 3468 diff changeset	294 :tag("jid"):text(origin.full_jid));
3524 d206b4e0a9f3 mod_saslauth: Improved logging a bit. Waqas Hussain <waqas20@gmail.com> parents: 3523 diff changeset	295 origin.log("debug", "Resource bound: %s", origin.full_jid);
2451 d2f747920eaf mod_saslauth: Fixed some indentation and added some semi-colons. Waqas Hussain <waqas20@gmail.com> parents: 2450 diff changeset	296 else
3523 32a0c3816d73 mod_saslauth: Updated to use the new events API. Waqas Hussain <waqas20@gmail.com> parents: 3468 diff changeset	297 origin.send(st.error_reply(stanza, err_type, err, err_msg));
3524 d206b4e0a9f3 mod_saslauth: Improved logging a bit. Waqas Hussain <waqas20@gmail.com> parents: 3523 diff changeset	298 origin.log("debug", "Resource bind failed: %s", err_msg or err);
2451 d2f747920eaf mod_saslauth: Fixed some indentation and added some semi-colons. Waqas Hussain <waqas20@gmail.com> parents: 2450 diff changeset	299 end
3523 32a0c3816d73 mod_saslauth: Updated to use the new events API. Waqas Hussain <waqas20@gmail.com> parents: 3468 diff changeset	300 return true;
2451 d2f747920eaf mod_saslauth: Fixed some indentation and added some semi-colons. Waqas Hussain <waqas20@gmail.com> parents: 2450 diff changeset	301 end);
1584 ffe8a9296e04 mod_saslauth, usermanager: Fetch list of mechanisms from usermanager Nick Thomas parents: 1523 diff changeset	302
3961 94d9fb07c49c mod_saslauth: Handle session bind requests to the host, fixes OneTeam login Matthew Wild <mwild1@gmail.com> parents: 3733 diff changeset	303 local function handle_legacy_session(event)
3523 32a0c3816d73 mod_saslauth: Updated to use the new events API. Waqas Hussain <waqas20@gmail.com> parents: 3468 diff changeset	304 event.origin.send(st.reply(event.stanza));
32a0c3816d73 mod_saslauth: Updated to use the new events API. Waqas Hussain <waqas20@gmail.com> parents: 3468 diff changeset	305 return true;
3961 94d9fb07c49c mod_saslauth: Handle session bind requests to the host, fixes OneTeam login Matthew Wild <mwild1@gmail.com> parents: 3733 diff changeset	306 end
94d9fb07c49c mod_saslauth: Handle session bind requests to the host, fixes OneTeam login Matthew Wild <mwild1@gmail.com> parents: 3733 diff changeset	307
94d9fb07c49c mod_saslauth: Handle session bind requests to the host, fixes OneTeam login Matthew Wild <mwild1@gmail.com> parents: 3733 diff changeset	308 module:hook("iq/self/urn:ietf:params:xml:ns:xmpp-session:session", handle_legacy_session);
94d9fb07c49c mod_saslauth: Handle session bind requests to the host, fixes OneTeam login Matthew Wild <mwild1@gmail.com> parents: 3733 diff changeset	309 module:hook("iq/host/urn:ietf:params:xml:ns:xmpp-session:session", handle_legacy_session);

prosody

615a0774e4cc

plugins/mod_saslauth.lua

Software / code / prosody

Annotate

plugins/mod_saslauth.lua @ 5877:615a0774e4cc

Software `/` code `/` prosody