Software /
code /
prosody
Annotate
util/sasl.lua @ 2209:adbedc32d41b
Fail if username or password don't pass SASLprep.
author | Tobias Markmann <tm@ayena.de> |
---|---|
date | Thu, 19 Nov 2009 17:08:58 +0100 |
parent | 2203:812130099ab2 |
child | 2212:7cb6460b18d8 |
rev | line source |
---|---|
896 | 1 -- sasl.lua v0.4 |
760
90ce865eebd8
Update copyright notices for 2009
Matthew Wild <mwild1@gmail.com>
parents:
702
diff
changeset
|
2 -- Copyright (C) 2008-2009 Tobias Markmann |
1585
edc066730d11
Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents:
1518
diff
changeset
|
3 -- |
519
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
4 -- All rights reserved. |
1585
edc066730d11
Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents:
1518
diff
changeset
|
5 -- |
519
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
6 -- Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: |
1585
edc066730d11
Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents:
1518
diff
changeset
|
7 -- |
519
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
8 -- * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. |
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
9 -- * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. |
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
10 -- * Neither the name of Tobias Markmann nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. |
1585
edc066730d11
Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents:
1518
diff
changeset
|
11 -- |
519
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
12 -- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
13 |
15
c0d754774db2
adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
14 |
449
c0a4a1e63d70
Completely switched to new hashes library from the old md5 library
Waqas Hussain <waqas20@gmail.com>
parents:
405
diff
changeset
|
15 local md5 = require "util.hashes".md5; |
38 | 16 local log = require "util.logger".init("sasl"); |
17 local st = require "util.stanza"; | |
2201
49e4838f9755
Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents:
2198
diff
changeset
|
18 local set = require "util.set"; |
49e4838f9755
Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents:
2198
diff
changeset
|
19 local array = require "util.array"; |
2202 | 20 local to_unicode = require "util.encodings".idna.to_unicode; |
21 | |
22 local tostring = tostring; | |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
23 local pairs, ipairs = pairs, ipairs; |
504
efc5184effa1
Added function latin1toutf8 to sasl.lua, for processing non-utf8 responses
Waqas Hussain <waqas20@gmail.com>
parents:
496
diff
changeset
|
24 local t_insert, t_concat = table.insert, table.concat; |
38 | 25 local s_match = string.match; |
276
30893439d5d1
Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents:
50
diff
changeset
|
26 local type = type |
30893439d5d1
Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents:
50
diff
changeset
|
27 local error = error |
2175
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
28 local setmetatable = setmetatable; |
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
29 local assert = assert; |
2187
f0a85d11823e
Getting PLAIN mechanism work with the new API.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
30 local require = require; |
276
30893439d5d1
Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents:
50
diff
changeset
|
31 |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
32 require "util.iterators" |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
33 local keys = keys |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
34 |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
35 local array = require "util.array" |
38 | 36 module "sasl" |
37 | |
2177 | 38 --[[ |
39 Authentication Backend Prototypes: | |
40 | |
2188
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2187
diff
changeset
|
41 state = false : disabled |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2187
diff
changeset
|
42 state = true : enabled |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2187
diff
changeset
|
43 state = nil : non-existant |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2187
diff
changeset
|
44 |
2177 | 45 plain: |
46 function(username, realm) | |
47 return password, state; | |
48 end | |
49 | |
50 plain-test: | |
51 function(username, realm, password) | |
52 return true or false, state; | |
53 end | |
54 | |
55 digest-md5: | |
2190
9657276387af
Change of the digest-md5 profile.
Tobias Markmann <tm@ayena.de>
parents:
2188
diff
changeset
|
56 function(username, domain, realm, encoding) -- domain and realm are usually the same; for some broken |
9657276387af
Change of the digest-md5 profile.
Tobias Markmann <tm@ayena.de>
parents:
2188
diff
changeset
|
57 -- implementations it's not |
2177 | 58 return digesthash, state; |
59 end | |
60 | |
61 digest-md5-test: | |
2191
e79c0ce6cf54
Adding support for digest-md5 profile in DIGEST-MD5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2190
diff
changeset
|
62 function(username, domain, realm, encoding, digesthash) |
2177 | 63 return true or false, state; |
64 end | |
65 ]] | |
66 | |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
67 local method = {}; |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
68 method.__index = method; |
2175
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
69 local mechanisms = {}; |
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
70 local backend_mechanism = {}; |
1585
edc066730d11
Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents:
1518
diff
changeset
|
71 |
2175
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
72 -- register a new SASL mechanims |
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
73 local function registerMechanism(name, backends, f) |
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
74 assert(type(name) == "string", "Parameter name MUST be a string."); |
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
75 assert(type(backends) == "string" or type(backends) == "table", "Parameter backends MUST be either a string or a table."); |
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
76 assert(type(f) == "function", "Parameter f MUST be a function."); |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
77 mechanisms[name] = f |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
78 for _, backend_name in ipairs(backends) do |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
79 if backend_mechanism[backend_name] == nil then backend_mechanism[backend_name] = {}; end |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
80 t_insert(backend_mechanism[backend_name], name); |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
81 end |
15
c0d754774db2
adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
82 end |
c0d754774db2
adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
83 |
2175
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
84 -- create a new SASL object which can be used to authenticate clients |
2201
49e4838f9755
Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents:
2198
diff
changeset
|
85 function new(realm, profile, forbidden) |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
86 sasl_i = {profile = profile}; |
2179
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
87 sasl_i.realm = realm; |
2201
49e4838f9755
Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents:
2198
diff
changeset
|
88 s = setmetatable(sasl_i, method); |
49e4838f9755
Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents:
2198
diff
changeset
|
89 s:forbidden(sasl_i, forbidden) |
49e4838f9755
Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents:
2198
diff
changeset
|
90 return s; |
49e4838f9755
Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents:
2198
diff
changeset
|
91 end |
49e4838f9755
Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents:
2198
diff
changeset
|
92 |
49e4838f9755
Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents:
2198
diff
changeset
|
93 -- set the forbidden mechanisms |
2203 | 94 function method:forbidden( restrict ) |
95 if restrict then | |
2201
49e4838f9755
Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents:
2198
diff
changeset
|
96 -- set forbidden |
2203 | 97 self.restrict = set.new(restrict); |
2201
49e4838f9755
Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents:
2198
diff
changeset
|
98 else |
49e4838f9755
Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents:
2198
diff
changeset
|
99 -- get forbidden |
2203 | 100 return array.collect(self.restrict:items()); |
2201
49e4838f9755
Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents:
2198
diff
changeset
|
101 end |
276
30893439d5d1
Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents:
50
diff
changeset
|
102 end |
30893439d5d1
Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents:
50
diff
changeset
|
103 |
2175
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
104 -- get a list of possible SASL mechanims to use |
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
105 function method:mechanisms() |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
106 local mechanisms = {} |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
107 for backend, f in pairs(self.profile) do |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
108 if backend_mechanism[backend] then |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
109 for _, mechanism in ipairs(backend_mechanism[backend]) do |
2203 | 110 if not sasl_i.restrict:contains(mechanism) then |
2201
49e4838f9755
Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents:
2198
diff
changeset
|
111 mechanisms[mechanism] = true; |
49e4838f9755
Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents:
2198
diff
changeset
|
112 end |
2179
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
113 end |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
114 end |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
115 end |
2177 | 116 self["possible_mechanisms"] = mechanisms; |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
117 return array.collect(keys(mechanisms)); |
799
b7ea802f3527
Adding inital support for ANONYMOUS mechanism in SASL.
Tobias Markmann <tm@ayena.de>
parents:
760
diff
changeset
|
118 end |
b7ea802f3527
Adding inital support for ANONYMOUS mechanism in SASL.
Tobias Markmann <tm@ayena.de>
parents:
760
diff
changeset
|
119 |
2175
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
120 -- select a mechanism to use |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
121 function method:select(mechanism) |
2185
e92339c48ee6
Fail if mechanism has already been selected.
Tobias Markmann <tm@ayena.de>
parents:
2184
diff
changeset
|
122 if self.mech_i then |
e92339c48ee6
Fail if mechanism has already been selected.
Tobias Markmann <tm@ayena.de>
parents:
2184
diff
changeset
|
123 return false; |
e92339c48ee6
Fail if mechanism has already been selected.
Tobias Markmann <tm@ayena.de>
parents:
2184
diff
changeset
|
124 end |
e92339c48ee6
Fail if mechanism has already been selected.
Tobias Markmann <tm@ayena.de>
parents:
2184
diff
changeset
|
125 |
2178
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
126 self.mech_i = mechanisms[mechanism] |
2179
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
127 if self.mech_i == nil then |
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
128 return false; |
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
129 end |
2178
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
130 return true; |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
131 end |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
132 |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
133 -- feed new messages to process into the library |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
134 function method:process(message) |
2188
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2187
diff
changeset
|
135 --if message == "" or message == nil then return "failure", "malformed-request" end |
2178
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
136 return self.mech_i(self, message); |
15
c0d754774db2
adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
137 end |
c0d754774db2
adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
138 |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
2185
diff
changeset
|
139 -- load the mechanisms |
2198
d18b4d22b8da
Making interop with libpurple. (Thanks darkrain).
Tobias Markmann <tm@ayena.de>
parents:
2193
diff
changeset
|
140 load_mechs = {"plain", "digest-md5", "anonymous", "scram"} |
2188
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2187
diff
changeset
|
141 for _, mech in ipairs(load_mechs) do |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2187
diff
changeset
|
142 local name = "util.sasl."..mech; |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2187
diff
changeset
|
143 local m = require(name); |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2187
diff
changeset
|
144 m.init(registerMechanism) |
1fd38975addd
Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents:
2187
diff
changeset
|
145 end |
2183
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
146 |
519
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
147 return _M; |