prosody
8ad50989d79e
util/sasl.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

util/sasl.lua @ 3192:8ad50989d79e

mod_auth_cyrus: Auth provider with support for Cyrus SASL.
author Waqas Hussain <waqas20@gmail.com>
date Mon, 07 Jun 2010 04:23:08 +0500
parent 3155:c713fa2ba80c
child 3363:a4bb658d3fcb
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
896
2c0b9e3c11c3 0.3->0.4
Matthew Wild <mwild1@gmail.com>
parents: 801
diff changeset
1 -- sasl.lua v0.4
2923
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 2873
diff changeset
2 -- Copyright (C) 2008-2010 Tobias Markmann
1585
edc066730d11 Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents: 1518
diff changeset
3 --
519
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 508
diff changeset
4 -- All rights reserved.
1585
edc066730d11 Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents: 1518
diff changeset
5 --
519
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 508
diff changeset
6 -- Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1585
edc066730d11 Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents: 1518
diff changeset
7 --
519
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 508
diff changeset
8 -- * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 508
diff changeset
9 -- * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 508
diff changeset
10 -- * Neither the name of Tobias Markmann nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
1585
edc066730d11 Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents: 1518
diff changeset
11 --
519
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 508
diff changeset
12 -- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 508
diff changeset
13
15
c0d754774db2 adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
14
449
c0a4a1e63d70 Completely switched to new hashes library from the old md5 library
Waqas Hussain <waqas20@gmail.com>
parents: 405
diff changeset
15 local md5 = require "util.hashes".md5;
38
Matthew Wild <mwild1@gmail.com>
parents: 32
diff changeset
16 local log = require "util.logger".init("sasl");
Matthew Wild <mwild1@gmail.com>
parents: 32
diff changeset
17 local st = require "util.stanza";
2201
49e4838f9755 Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents: 2198
diff changeset
18 local set = require "util.set";
49e4838f9755 Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents: 2198
diff changeset
19 local array = require "util.array";
2202
c320517d6b47 Tidying up.
Tobias Markmann <tm@ayena.de>
parents: 2201
diff changeset
20 local to_unicode = require "util.encodings".idna.to_unicode;
c320517d6b47 Tidying up.
Tobias Markmann <tm@ayena.de>
parents: 2201
diff changeset
21
38
Matthew Wild <mwild1@gmail.com>
parents: 32
diff changeset
22 local tostring = tostring;
2176
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
23 local pairs, ipairs = pairs, ipairs;
504
efc5184effa1 Added function latin1toutf8 to sasl.lua, for processing non-utf8 responses
Waqas Hussain <waqas20@gmail.com>
parents: 496
diff changeset
24 local t_insert, t_concat = table.insert, table.concat;
38
Matthew Wild <mwild1@gmail.com>
parents: 32
diff changeset
25 local s_match = string.match;
276
30893439d5d1 Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents: 50
diff changeset
26 local type = type
30893439d5d1 Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents: 50
diff changeset
27 local error = error
2175
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
28 local setmetatable = setmetatable;
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
29 local assert = assert;
2187
f0a85d11823e Getting PLAIN mechanism work with the new API.
Tobias Markmann <tm@ayena.de>
parents: 2186
diff changeset
30 local require = require;
276
30893439d5d1 Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents: 50
diff changeset
31
2176
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
32 require "util.iterators"
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
33 local keys = keys
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
34
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
35 local array = require "util.array"
38
Matthew Wild <mwild1@gmail.com>
parents: 32
diff changeset
36 module "sasl"
Matthew Wild <mwild1@gmail.com>
parents: 32
diff changeset
37
2177
8505e1da5408 Adding some docu.
Tobias Markmann <tm@ayena.de>
parents: 2176
diff changeset
38 --[[
8505e1da5408 Adding some docu.
Tobias Markmann <tm@ayena.de>
parents: 2176
diff changeset
39 Authentication Backend Prototypes:
1585
edc066730d11 Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents: 1518
diff changeset
40
2188
1fd38975addd Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents: 2187
diff changeset
41 state = false : disabled
1fd38975addd Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents: 2187
diff changeset
42 state = true : enabled
1fd38975addd Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents: 2187
diff changeset
43 state = nil : non-existant
2177
8505e1da5408 Adding some docu.
Tobias Markmann <tm@ayena.de>
parents: 2176
diff changeset
44 ]]
1585
edc066730d11 Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents: 1518
diff changeset
45
2176
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
46 local method = {};
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
47 method.__index = method;
2175
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
48 local mechanisms = {};
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
49 local backend_mechanism = {};
1585
edc066730d11 Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents: 1518
diff changeset
50
2175
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
51 -- register a new SASL mechanims
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
52 local function registerMechanism(name, backends, f)
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
53 assert(type(name) == "string", "Parameter name MUST be a string.");
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
54 assert(type(backends) == "string" or type(backends) == "table", "Parameter backends MUST be either a string or a table.");
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
55 assert(type(f) == "function", "Parameter f MUST be a function.");
2176
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
56 mechanisms[name] = f
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
57 for _, backend_name in ipairs(backends) do
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
58 if backend_mechanism[backend_name] == nil then backend_mechanism[backend_name] = {}; end
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
59 t_insert(backend_mechanism[backend_name], name);
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
60 end
15
c0d754774db2 adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
61 end
1585
edc066730d11 Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents: 1518
diff changeset
62
2175
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
63 -- create a new SASL object which can be used to authenticate clients
2201
49e4838f9755 Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents: 2198
diff changeset
64 function new(realm, profile, forbidden)
2254
f966c8699f5b util.sasl: Move some variables to local space. Fix a bug.
Tobias Markmann <tm@ayena.de>
parents: 2241
diff changeset
65 local sasl_i = {profile = profile};
2179
c985536d5452 Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents: 2178
diff changeset
66 sasl_i.realm = realm;
2254
f966c8699f5b util.sasl: Move some variables to local space. Fix a bug.
Tobias Markmann <tm@ayena.de>
parents: 2241
diff changeset
67 local s = setmetatable(sasl_i, method);
f966c8699f5b util.sasl: Move some variables to local space. Fix a bug.
Tobias Markmann <tm@ayena.de>
parents: 2241
diff changeset
68 if forbidden == nil then forbidden = {} end
f966c8699f5b util.sasl: Move some variables to local space. Fix a bug.
Tobias Markmann <tm@ayena.de>
parents: 2241
diff changeset
69 s:forbidden(forbidden)
2201
49e4838f9755 Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents: 2198
diff changeset
70 return s;
49e4838f9755 Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents: 2198
diff changeset
71 end
1585
edc066730d11 Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents: 1518
diff changeset
72
2241
ac3bd7c42c8b util.sasl: Adding clean_clone() method.
Tobias Markmann <tm@ayena.de>
parents: 2212
diff changeset
73 -- get a fresh clone with the same realm, profiles and forbidden mechanisms
ac3bd7c42c8b util.sasl: Adding clean_clone() method.
Tobias Markmann <tm@ayena.de>
parents: 2212
diff changeset
74 function method:clean_clone()
ac3bd7c42c8b util.sasl: Adding clean_clone() method.
Tobias Markmann <tm@ayena.de>
parents: 2212
diff changeset
75 return new(self.realm, self.profile, self:forbidden())
ac3bd7c42c8b util.sasl: Adding clean_clone() method.
Tobias Markmann <tm@ayena.de>
parents: 2212
diff changeset
76 end
1585
edc066730d11 Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents: 1518
diff changeset
77
2201
49e4838f9755 Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents: 2198
diff changeset
78 -- set the forbidden mechanisms
2203
812130099ab2 Cleaning up.
Tobias Markmann <tm@ayena.de>
parents: 2202
diff changeset
79 function method:forbidden( restrict )
812130099ab2 Cleaning up.
Tobias Markmann <tm@ayena.de>
parents: 2202
diff changeset
80 if restrict then
2201
49e4838f9755 Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents: 2198
diff changeset
81 -- set forbidden
2203
812130099ab2 Cleaning up.
Tobias Markmann <tm@ayena.de>
parents: 2202
diff changeset
82 self.restrict = set.new(restrict);
2201
49e4838f9755 Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents: 2198
diff changeset
83 else
49e4838f9755 Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents: 2198
diff changeset
84 -- get forbidden
2203
812130099ab2 Cleaning up.
Tobias Markmann <tm@ayena.de>
parents: 2202
diff changeset
85 return array.collect(self.restrict:items());
2201
49e4838f9755 Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents: 2198
diff changeset
86 end
276
30893439d5d1 Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents: 50
diff changeset
87 end
30893439d5d1 Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents: 50
diff changeset
88
2175
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
89 -- get a list of possible SASL mechanims to use
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
90 function method:mechanisms()
2176
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
91 local mechanisms = {}
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
92 for backend, f in pairs(self.profile) do
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
93 if backend_mechanism[backend] then
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
94 for _, mechanism in ipairs(backend_mechanism[backend]) do
2254
f966c8699f5b util.sasl: Move some variables to local space. Fix a bug.
Tobias Markmann <tm@ayena.de>
parents: 2241
diff changeset
95 if not self.restrict:contains(mechanism) then
2201
49e4838f9755 Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents: 2198
diff changeset
96 mechanisms[mechanism] = true;
1159
f81c8cec0e71 Adding minimal support for authorization identities to workaround buggy SASL implementations.
Tobias Markmann <tm@ayena.de>
parents: 1158
diff changeset
97 end
f81c8cec0e71 Adding minimal support for authorization identities to workaround buggy SASL implementations.
Tobias Markmann <tm@ayena.de>
parents: 1158
diff changeset
98 end
294
5d861d6e5bbd Made SASL module fit the new interface.
Tobias Markmann <tm@ayena.de>
parents: 292
diff changeset
99 end
5d861d6e5bbd Made SASL module fit the new interface.
Tobias Markmann <tm@ayena.de>
parents: 292
diff changeset
100 end
2177
8505e1da5408 Adding some docu.
Tobias Markmann <tm@ayena.de>
parents: 2176
diff changeset
101 self["possible_mechanisms"] = mechanisms;
2176
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
102 return array.collect(keys(mechanisms));
276
30893439d5d1 Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents: 50
diff changeset
103 end
30893439d5d1 Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents: 50
diff changeset
104
2175
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
105 -- select a mechanism to use
2176
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
106 function method:select(mechanism)
2185
e92339c48ee6 Fail if mechanism has already been selected.
Tobias Markmann <tm@ayena.de>
parents: 2184
diff changeset
107 if self.mech_i then
e92339c48ee6 Fail if mechanism has already been selected.
Tobias Markmann <tm@ayena.de>
parents: 2184
diff changeset
108 return false;
e92339c48ee6 Fail if mechanism has already been selected.
Tobias Markmann <tm@ayena.de>
parents: 2184
diff changeset
109 end
e92339c48ee6 Fail if mechanism has already been selected.
Tobias Markmann <tm@ayena.de>
parents: 2184
diff changeset
110
3155
c713fa2ba80c SASL: Minor cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 3116
diff changeset
111 self.mech_i = mechanisms[mechanism];
c713fa2ba80c SASL: Minor cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 3116
diff changeset
112 return (self.mech_i ~= nil);
799
b7ea802f3527 Adding inital support for ANONYMOUS mechanism in SASL.
Tobias Markmann <tm@ayena.de>
parents: 760
diff changeset
113 end
b7ea802f3527 Adding inital support for ANONYMOUS mechanism in SASL.
Tobias Markmann <tm@ayena.de>
parents: 760
diff changeset
114
2176
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
115 -- feed new messages to process into the library
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
116 function method:process(message)
2188
1fd38975addd Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents: 2187
diff changeset
117 --if message == "" or message == nil then return "failure", "malformed-request" end
2178
28d841403a21 Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents: 2177
diff changeset
118 return self.mech_i(self, message);
15
c0d754774db2 adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
119 end
799
b7ea802f3527 Adding inital support for ANONYMOUS mechanism in SASL.
Tobias Markmann <tm@ayena.de>
parents: 760
diff changeset
120
2186
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents: 2185
diff changeset
121 -- load the mechanisms
2735
65bbc4b67733 util.sasl: Fixed a nil global access.
Waqas Hussain <waqas20@gmail.com>
parents: 2254
diff changeset
122 local load_mechs = {"plain", "digest-md5", "anonymous", "scram"}
2188
1fd38975addd Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents: 2187
diff changeset
123 for _, mech in ipairs(load_mechs) do
1fd38975addd Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents: 2187
diff changeset
124 local name = "util.sasl."..mech;
1fd38975addd Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents: 2187
diff changeset
125 local m = require(name);
1fd38975addd Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents: 2187
diff changeset
126 m.init(registerMechanism)
15
c0d754774db2 adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
127 end
c0d754774db2 adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
128
519
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 508
diff changeset
129 return _M;