Software /
code /
prosody
Annotate
util/sasl/plain.lua @ 9643:bb8486491b48 0.10.3
mod_proxy65: Check what port is used at the time of the query
Could have changed between startup and time of request
author | Kim Alvefur <zash@zash.se> |
---|---|
date | Sun, 25 Nov 2018 13:16:17 +0100 |
parent | 8095:57192cf193c7 |
child | 8555:4f0f5b49bb03 |
rev | line source |
---|---|
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
1 -- sasl.lua v0.4 |
2996
b0515ed4d9d7
util.sasl: 2009 -> 2010 in copyright header.
Tobias Markmann <tm@ayena.de>
parents:
2994
diff
changeset
|
2 -- Copyright (C) 2008-2010 Tobias Markmann |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
3 -- |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
4 -- All rights reserved. |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
5 -- |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
6 -- Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
7 -- |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
8 -- * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
9 -- * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
10 -- * Neither the name of Tobias Markmann nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
11 -- |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
12 -- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
13 |
2187
f0a85d11823e
Getting PLAIN mechanism work with the new API.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
14 local s_match = string.match; |
2200
dd0b250cb6c4
SASLprep authentication and password in SASL PLAIN implementation.
Tobias Markmann <tm@ayena.de>
parents:
2187
diff
changeset
|
15 local saslprep = require "util.encodings".stringprep.saslprep; |
5301
6279caf921f1
util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents:
5240
diff
changeset
|
16 local nodeprep = require "util.encodings".stringprep.nodeprep; |
2200
dd0b250cb6c4
SASLprep authentication and password in SASL PLAIN implementation.
Tobias Markmann <tm@ayena.de>
parents:
2187
diff
changeset
|
17 local log = require "util.logger".init("sasl"); |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
18 |
6777
5de6b93d0190
util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents:
5301
diff
changeset
|
19 local _ENV = nil; |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
20 |
2263
ff881b857c98
util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents:
2252
diff
changeset
|
21 -- ================================ |
ff881b857c98
util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents:
2252
diff
changeset
|
22 -- SASL PLAIN according to RFC 4616 |
2991
0fa3a7c885bd
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
23 |
0fa3a7c885bd
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
24 --[[ |
0fa3a7c885bd
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
25 Supported Authentication Backends |
0fa3a7c885bd
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
26 |
0fa3a7c885bd
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
27 plain: |
0fa3a7c885bd
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
28 function(username, realm) |
0fa3a7c885bd
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
29 return password, state; |
0fa3a7c885bd
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
30 end |
0fa3a7c885bd
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
31 |
3080 | 32 plain_test: |
3164
db9def53fe9c
Check in mod_hashpassauth -- works!
Jeff Mitchell <jeff@jefferai.org>
parents:
3080
diff
changeset
|
33 function(username, password, realm) |
2991
0fa3a7c885bd
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
34 return true or false, state; |
0fa3a7c885bd
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
35 end |
0fa3a7c885bd
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
36 ]] |
0fa3a7c885bd
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
37 |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
38 local function plain(self, message) |
2263
ff881b857c98
util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents:
2252
diff
changeset
|
39 if not message then |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
40 return "failure", "malformed-request"; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
41 end |
2263
ff881b857c98
util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents:
2252
diff
changeset
|
42 |
2314
c2e1bde4d84d
Redo merge with Waqas' PBKDF2 optimizations.
Tobias Markmann <tm@ayena.de>
parents:
2290
diff
changeset
|
43 local authorization, authentication, password = s_match(message, "^([^%z]*)%z([^%z]+)%z([^%z]+)"); |
2263
ff881b857c98
util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents:
2252
diff
changeset
|
44 |
ff881b857c98
util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents:
2252
diff
changeset
|
45 if not authorization then |
ff881b857c98
util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents:
2252
diff
changeset
|
46 return "failure", "malformed-request"; |
ff881b857c98
util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents:
2252
diff
changeset
|
47 end |
ff881b857c98
util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents:
2252
diff
changeset
|
48 |
2200
dd0b250cb6c4
SASLprep authentication and password in SASL PLAIN implementation.
Tobias Markmann <tm@ayena.de>
parents:
2187
diff
changeset
|
49 -- SASLprep password and authentication |
dd0b250cb6c4
SASLprep authentication and password in SASL PLAIN implementation.
Tobias Markmann <tm@ayena.de>
parents:
2187
diff
changeset
|
50 authentication = saslprep(authentication); |
dd0b250cb6c4
SASLprep authentication and password in SASL PLAIN implementation.
Tobias Markmann <tm@ayena.de>
parents:
2187
diff
changeset
|
51 password = saslprep(password); |
2263
ff881b857c98
util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents:
2252
diff
changeset
|
52 |
2200
dd0b250cb6c4
SASLprep authentication and password in SASL PLAIN implementation.
Tobias Markmann <tm@ayena.de>
parents:
2187
diff
changeset
|
53 if (not password) or (password == "") or (not authentication) or (authentication == "") then |
2209
adbedc32d41b
Fail if username or password don't pass SASLprep.
Tobias Markmann <tm@ayena.de>
parents:
2200
diff
changeset
|
54 log("debug", "Username or password violates SASLprep."); |
2210
78c9b5255b27
Adding some human readable error messages.
Tobias Markmann <tm@ayena.de>
parents:
2209
diff
changeset
|
55 return "failure", "malformed-request", "Invalid username or password."; |
2200
dd0b250cb6c4
SASLprep authentication and password in SASL PLAIN implementation.
Tobias Markmann <tm@ayena.de>
parents:
2187
diff
changeset
|
56 end |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
57 |
5301
6279caf921f1
util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents:
5240
diff
changeset
|
58 local _nodeprep = self.profile.nodeprep; |
6279caf921f1
util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents:
5240
diff
changeset
|
59 if _nodeprep ~= false then |
6279caf921f1
util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents:
5240
diff
changeset
|
60 authentication = (_nodeprep or nodeprep)(authentication); |
6279caf921f1
util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents:
5240
diff
changeset
|
61 if not authentication or authentication == "" then |
6279caf921f1
util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents:
5240
diff
changeset
|
62 return "failure", "malformed-request", "Invalid username or password." |
6279caf921f1
util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents:
5240
diff
changeset
|
63 end |
6279caf921f1
util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents:
5240
diff
changeset
|
64 end |
6279caf921f1
util.sasl.{plain,scram,digest-md5}: nodeprep username before passing to callbacks, so callbacks don't have to.
Waqas Hussain <waqas20@gmail.com>
parents:
5240
diff
changeset
|
65 |
8095
57192cf193c7
util.sasl.plain,scram: Record username in sasl state earlier
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
66 self.username = authentication |
57192cf193c7
util.sasl.plain,scram: Record username in sasl state earlier
Kim Alvefur <zash@zash.se>
parents:
6777
diff
changeset
|
67 |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
68 local correct, state = false, false; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
69 if self.profile.plain then |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
70 local correct_password; |
3981
2b0b8fe68df2
util.sasl.*, mod_auth_*, mod_saslauth: Pass SASL handler as first parameter to SASL profile callbacks.
Waqas Hussain <waqas20@gmail.com>
parents:
3179
diff
changeset
|
71 correct_password, state = self.profile.plain(self, authentication, self.realm); |
3155 | 72 correct = (correct_password == password); |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
73 elseif self.profile.plain_test then |
3981
2b0b8fe68df2
util.sasl.*, mod_auth_*, mod_saslauth: Pass SASL handler as first parameter to SASL profile callbacks.
Waqas Hussain <waqas20@gmail.com>
parents:
3179
diff
changeset
|
74 correct, state = self.profile.plain_test(self, authentication, password, self.realm); |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
75 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
76 |
4920
e27adbf4e743
util.sasl.plain: make it return "not-authorized" in case of non-existant accounts instead of "account-disabled" to avoid enumeration.
Marco Cirillo <maranda@lightwitch.org>
parents:
4113
diff
changeset
|
77 if state == false then |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
78 return "failure", "account-disabled"; |
5240
864b27ddaa10
util.sasl.plain: Reduce some code.
Waqas Hussain <waqas20@gmail.com>
parents:
4920
diff
changeset
|
79 elseif state == nil or not correct then |
4920
e27adbf4e743
util.sasl.plain: make it return "not-authorized" in case of non-existant accounts instead of "account-disabled" to avoid enumeration.
Marco Cirillo <maranda@lightwitch.org>
parents:
4113
diff
changeset
|
80 return "failure", "not-authorized", "Unable to authorize you with the authentication credentials you've sent."; |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
81 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
82 |
5240
864b27ddaa10
util.sasl.plain: Reduce some code.
Waqas Hussain <waqas20@gmail.com>
parents:
4920
diff
changeset
|
83 return "success"; |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
84 end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
85 |
6777
5de6b93d0190
util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents:
5301
diff
changeset
|
86 local function init(registerMechanism) |
3073
9a9fe2f3019d
util.sasl.plain: Removing plain_hashed authentication provider. Just do hashing and comparison yourself in a plain_test authentication provider.
Tobias Markmann <tm@ayena.de>
parents:
2996
diff
changeset
|
87 registerMechanism("PLAIN", {"plain", "plain_test"}, plain); |
2187
f0a85d11823e
Getting PLAIN mechanism work with the new API.
Tobias Markmann <tm@ayena.de>
parents:
2186
diff
changeset
|
88 end |
2186
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
89 |
6777
5de6b93d0190
util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents:
5301
diff
changeset
|
90 return { |
5de6b93d0190
util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents:
5301
diff
changeset
|
91 init = init; |
5de6b93d0190
util.*: Remove use of module() function, make all module functions local and return them in a table at the end
Kim Alvefur <zash@zash.se>
parents:
5301
diff
changeset
|
92 } |