Software /
code /
prosody
Annotate
util/sasl.lua @ 2185:e92339c48ee6 sasl
Fail if mechanism has already been selected.
author | Tobias Markmann <tm@ayena.de> |
---|---|
date | Fri, 28 Aug 2009 22:03:11 +0200 |
parent | 2184:0d1740f7b6e8 |
child | 2186:1112871916eb |
rev | line source |
---|---|
896 | 1 -- sasl.lua v0.4 |
760
90ce865eebd8
Update copyright notices for 2009
Matthew Wild <mwild1@gmail.com>
parents:
702
diff
changeset
|
2 -- Copyright (C) 2008-2009 Tobias Markmann |
1585
edc066730d11
Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents:
1518
diff
changeset
|
3 -- |
519
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
4 -- All rights reserved. |
1585
edc066730d11
Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents:
1518
diff
changeset
|
5 -- |
519
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
6 -- Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: |
1585
edc066730d11
Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents:
1518
diff
changeset
|
7 -- |
519
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
8 -- * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. |
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
9 -- * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. |
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
10 -- * Neither the name of Tobias Markmann nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. |
1585
edc066730d11
Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents:
1518
diff
changeset
|
11 -- |
519
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
12 -- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
13 |
15
c0d754774db2
adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
14 |
449
c0a4a1e63d70
Completely switched to new hashes library from the old md5 library
Waqas Hussain <waqas20@gmail.com>
parents:
405
diff
changeset
|
15 local md5 = require "util.hashes".md5; |
38 | 16 local log = require "util.logger".init("sasl"); |
17 local tostring = tostring; | |
18 local st = require "util.stanza"; | |
276
30893439d5d1
Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents:
50
diff
changeset
|
19 local generate_uuid = require "util.uuid".generate; |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
20 local pairs, ipairs = pairs, ipairs; |
504
efc5184effa1
Added function latin1toutf8 to sasl.lua, for processing non-utf8 responses
Waqas Hussain <waqas20@gmail.com>
parents:
496
diff
changeset
|
21 local t_insert, t_concat = table.insert, table.concat; |
efc5184effa1
Added function latin1toutf8 to sasl.lua, for processing non-utf8 responses
Waqas Hussain <waqas20@gmail.com>
parents:
496
diff
changeset
|
22 local to_byte, to_char = string.byte, string.char; |
1485
fbefd16d2955
Move to-unicode conversion from mod_saslauth.lua to sasl.lua.
Tobias Markmann <tm@ayena.de>
parents:
1376
diff
changeset
|
23 local to_unicode = require "util.encodings".idna.to_unicode; |
38 | 24 local s_match = string.match; |
277
00c2fc751f50
Fixing some parsing and some other stuff.
Tobias Markmann <tm@ayena.de>
parents:
276
diff
changeset
|
25 local gmatch = string.gmatch |
280
516f4c901991
Rewrote SASL Digest-MD5 responce generating code, fixed some realm related issue and tested it successfully with Psi. Thanks to dwd, remko and jake.
Tobias Markmann <tm@ayena.de>
parents:
278
diff
changeset
|
26 local string = string |
276
30893439d5d1
Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents:
50
diff
changeset
|
27 local math = require "math" |
30893439d5d1
Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents:
50
diff
changeset
|
28 local type = type |
30893439d5d1
Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents:
50
diff
changeset
|
29 local error = error |
30893439d5d1
Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents:
50
diff
changeset
|
30 local print = print |
2175
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
31 local setmetatable = setmetatable; |
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
32 local assert = assert; |
276
30893439d5d1
Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents:
50
diff
changeset
|
33 |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
34 require "util.iterators" |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
35 local keys = keys |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
36 |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
37 local array = require "util.array" |
38 | 38 module "sasl" |
39 | |
2177 | 40 --[[ |
41 Authentication Backend Prototypes: | |
42 | |
43 plain: | |
44 function(username, realm) | |
45 return password, state; | |
46 end | |
47 | |
48 plain-test: | |
49 function(username, realm, password) | |
50 return true or false, state; | |
51 end | |
52 | |
53 digest-md5: | |
54 function(username, realm, encoding) | |
55 return digesthash, state; | |
56 end | |
57 | |
58 digest-md5-test: | |
59 function(username, realm, encoding, digesthash) | |
60 return true or false, state; | |
61 end | |
62 ]] | |
63 | |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
64 local method = {}; |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
65 method.__index = method; |
2175
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
66 local mechanisms = {}; |
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
67 local backend_mechanism = {}; |
1585
edc066730d11
Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents:
1518
diff
changeset
|
68 |
2175
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
69 -- register a new SASL mechanims |
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
70 local function registerMechanism(name, backends, f) |
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
71 assert(type(name) == "string", "Parameter name MUST be a string."); |
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
72 assert(type(backends) == "string" or type(backends) == "table", "Parameter backends MUST be either a string or a table."); |
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
73 assert(type(f) == "function", "Parameter f MUST be a function."); |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
74 mechanisms[name] = f |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
75 for _, backend_name in ipairs(backends) do |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
76 if backend_mechanism[backend_name] == nil then backend_mechanism[backend_name] = {}; end |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
77 t_insert(backend_mechanism[backend_name], name); |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
78 end |
15
c0d754774db2
adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
79 end |
c0d754774db2
adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
80 |
2175
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
81 -- create a new SASL object which can be used to authenticate clients |
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
82 function new(realm, profile) |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
83 sasl_i = {profile = profile}; |
2179
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
84 sasl_i.realm = realm; |
2175
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
85 return setmetatable(sasl_i, method); |
276
30893439d5d1
Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents:
50
diff
changeset
|
86 end |
30893439d5d1
Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents:
50
diff
changeset
|
87 |
2175
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
88 -- get a list of possible SASL mechanims to use |
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
89 function method:mechanisms() |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
90 local mechanisms = {} |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
91 for backend, f in pairs(self.profile) do |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
92 print(backend) |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
93 if backend_mechanism[backend] then |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
94 for _, mechanism in ipairs(backend_mechanism[backend]) do |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
95 mechanisms[mechanism] = true; |
2179
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
96 end |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
97 end |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
98 end |
2177 | 99 self["possible_mechanisms"] = mechanisms; |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
100 return array.collect(keys(mechanisms)); |
799
b7ea802f3527
Adding inital support for ANONYMOUS mechanism in SASL.
Tobias Markmann <tm@ayena.de>
parents:
760
diff
changeset
|
101 end |
b7ea802f3527
Adding inital support for ANONYMOUS mechanism in SASL.
Tobias Markmann <tm@ayena.de>
parents:
760
diff
changeset
|
102 |
2175
3ca8755581a1
Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents:
1585
diff
changeset
|
103 -- select a mechanism to use |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
104 function method:select(mechanism) |
2185
e92339c48ee6
Fail if mechanism has already been selected.
Tobias Markmann <tm@ayena.de>
parents:
2184
diff
changeset
|
105 if self.mech_i then |
e92339c48ee6
Fail if mechanism has already been selected.
Tobias Markmann <tm@ayena.de>
parents:
2184
diff
changeset
|
106 return false; |
e92339c48ee6
Fail if mechanism has already been selected.
Tobias Markmann <tm@ayena.de>
parents:
2184
diff
changeset
|
107 end |
e92339c48ee6
Fail if mechanism has already been selected.
Tobias Markmann <tm@ayena.de>
parents:
2184
diff
changeset
|
108 |
2178
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
109 self.mech_i = mechanisms[mechanism] |
2179
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
110 if self.mech_i == nil then |
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
111 return false; |
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
112 end |
2178
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
113 return true; |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
114 end |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
115 |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
116 -- feed new messages to process into the library |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
117 function method:process(message) |
2178
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
118 if message == "" or message == nil then return "failure", "malformed-request" end |
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
119 return self.mech_i(self, message); |
15
c0d754774db2
adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
120 end |
c0d754774db2
adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
121 |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
122 --========================= |
2181 | 123 --SASL PLAIN according to RFC 4616 |
2178
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
124 local function sasl_mechanism_plain(self, message) |
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
125 local response = message |
2180
8de2f7f5b870
Allow ampersands in passwords for SASL PLAIN mechanism.
Tobias Markmann <tm@ayena.de>
parents:
2179
diff
changeset
|
126 local authorization = s_match(response, "([^%z]+)") |
8de2f7f5b870
Allow ampersands in passwords for SASL PLAIN mechanism.
Tobias Markmann <tm@ayena.de>
parents:
2179
diff
changeset
|
127 local authentication = s_match(response, "%z([^%z]+)%z") |
8de2f7f5b870
Allow ampersands in passwords for SASL PLAIN mechanism.
Tobias Markmann <tm@ayena.de>
parents:
2179
diff
changeset
|
128 local password = s_match(response, "%z[^%z]+%z([^%z]+)") |
2178
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
129 |
2179
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
130 if authentication == nil or password == nil then |
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
131 return "failure", "malformed-request"; |
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
132 end |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
133 |
2179
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
134 local correct, state = false, false; |
2178
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
135 if self.profile.plain then |
2179
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
136 local correct_password; |
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
137 correct_password, state = self.profile.plain(authentication, self.realm); |
2178
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
138 if correct_password == password then correct = true; else correct = false; end |
2179
c985536d5452
Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents:
2178
diff
changeset
|
139 elseif self.profile.plain_test then |
2178
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
140 correct, state = self.profile.plain_test(authentication, self.realm, password); |
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
141 end |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
142 |
2178
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
143 self.username = authentication |
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
144 if not state then |
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
145 return "failure", "account-disabled"; |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
146 end |
2178
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
147 |
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
148 if correct then |
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
149 return "success"; |
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
150 else |
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
151 return "failure", "not-authorized"; |
28d841403a21
Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents:
2177
diff
changeset
|
152 end |
2176
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
153 end |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
154 registerMechanism("PLAIN", {"plain", "plain_test"}, sasl_mechanism_plain); |
aaf2b2df61f7
Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents:
2175
diff
changeset
|
155 |
2181 | 156 --========================= |
2182
27c7d287345e
Importing SASL Digest-MD5 code.
Tobias Markmann <tm@ayena.de>
parents:
2181
diff
changeset
|
157 --SASL DIGEST-MD5 according to RFC 2831 |
2184 | 158 local function sasl_mechanism_digest_md5(self, message) |
2183
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
159 --TODO complete support for authzid |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
160 |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
161 local function serialize(message) |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
162 local data = "" |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
163 |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
164 if type(message) ~= "table" then error("serialize needs an argument of type table.") end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
165 |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
166 -- testing all possible values |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
167 if message["realm"] then data = data..[[realm="]]..message.realm..[[",]] end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
168 if message["nonce"] then data = data..[[nonce="]]..message.nonce..[[",]] end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
169 if message["qop"] then data = data..[[qop="]]..message.qop..[[",]] end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
170 if message["charset"] then data = data..[[charset=]]..message.charset.."," end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
171 if message["algorithm"] then data = data..[[algorithm=]]..message.algorithm.."," end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
172 if message["rspauth"] then data = data..[[rspauth=]]..message.rspauth.."," end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
173 data = data:gsub(",$", "") |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
174 return data |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
175 end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
176 |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
177 local function utf8tolatin1ifpossible(passwd) |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
178 local i = 1; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
179 while i <= #passwd do |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
180 local passwd_i = to_byte(passwd:sub(i, i)); |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
181 if passwd_i > 0x7F then |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
182 if passwd_i < 0xC0 or passwd_i > 0xC3 then |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
183 return passwd; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
184 end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
185 i = i + 1; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
186 passwd_i = to_byte(passwd:sub(i, i)); |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
187 if passwd_i < 0x80 or passwd_i > 0xBF then |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
188 return passwd; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
189 end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
190 end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
191 i = i + 1; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
192 end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
193 |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
194 local p = {}; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
195 local j = 0; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
196 i = 1; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
197 while (i <= #passwd) do |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
198 local passwd_i = to_byte(passwd:sub(i, i)); |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
199 if passwd_i > 0x7F then |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
200 i = i + 1; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
201 local passwd_i_1 = to_byte(passwd:sub(i, i)); |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
202 t_insert(p, to_char(passwd_i%4*64 + passwd_i_1%64)); -- I'm so clever |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
203 else |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
204 t_insert(p, to_char(passwd_i)); |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
205 end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
206 i = i + 1; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
207 end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
208 return t_concat(p); |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
209 end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
210 local function latin1toutf8(str) |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
211 local p = {}; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
212 for ch in gmatch(str, ".") do |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
213 ch = to_byte(ch); |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
214 if (ch < 0x80) then |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
215 t_insert(p, to_char(ch)); |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
216 elseif (ch < 0xC0) then |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
217 t_insert(p, to_char(0xC2, ch)); |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
218 else |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
219 t_insert(p, to_char(0xC3, ch - 64)); |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
220 end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
221 end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
222 return t_concat(p); |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
223 end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
224 local function parse(data) |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
225 local message = {} |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
226 for k, v in gmatch(data, [[([%w%-]+)="?([^",]*)"?,?]]) do -- FIXME The hacky regex makes me shudder |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
227 message[k] = v; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
228 end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
229 return message; |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
230 end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
231 |
2184 | 232 if not self.nonce then |
233 self.nonce = generate_uuid(); | |
234 self.step = 0; | |
235 self.nonce_count = {}; | |
236 end | |
2183
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
237 |
2184 | 238 self.step = self.step + 1; |
239 if (self.step == 1) then | |
240 local challenge = serialize({ nonce = object.nonce, | |
241 qop = "auth", | |
242 charset = "utf-8", | |
243 algorithm = "md5-sess", | |
244 realm = self.realm}); | |
245 return "challenge", challenge; | |
246 elseif (self.step == 2) then | |
247 local response = parse(message); | |
248 -- check for replay attack | |
249 if response["nc"] then | |
250 if self.nonce_count[response["nc"]] then return "failure", "not-authorized" end | |
251 end | |
2183
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
252 |
2184 | 253 -- check for username, it's REQUIRED by RFC 2831 |
254 if not response["username"] then | |
255 return "failure", "malformed-request"; | |
256 end | |
257 self["username"] = response["username"]; | |
2183
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
258 |
2184 | 259 -- check for nonce, ... |
260 if not response["nonce"] then | |
261 return "failure", "malformed-request"; | |
262 else | |
263 -- check if it's the right nonce | |
264 if response["nonce"] ~= tostring(self.nonce) then return "failure", "malformed-request" end | |
265 end | |
2183
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
266 |
2184 | 267 if not response["cnonce"] then return "failure", "malformed-request", "Missing entry for cnonce in SASL message." end |
268 if not response["qop"] then response["qop"] = "auth" end | |
2183
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
269 |
2184 | 270 if response["realm"] == nil or response["realm"] == "" then |
271 response["realm"] = ""; | |
272 elseif response["realm"] ~= self.realm then | |
273 return "failure", "not-authorized", "Incorrect realm value"; | |
274 end | |
2183
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
275 |
2184 | 276 local decoder; |
277 if response["charset"] == nil then | |
278 decoder = utf8tolatin1ifpossible; | |
279 elseif response["charset"] ~= "utf-8" then | |
280 return "failure", "incorrect-encoding", "The client's response uses "..response["charset"].." for encoding with isn't supported by sasl.lua. Supported encodings are latin or utf-8."; | |
281 end | |
2183
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
282 |
2184 | 283 local domain = ""; |
284 local protocol = ""; | |
285 if response["digest-uri"] then | |
286 protocol, domain = response["digest-uri"]:match("(%w+)/(.*)$"); | |
287 if protocol == nil or domain == nil then return "failure", "malformed-request" end | |
288 else | |
289 return "failure", "malformed-request", "Missing entry for digest-uri in SASL message." | |
290 end | |
2183
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
291 |
2184 | 292 --TODO maybe realm support |
293 self.username = response["username"]; | |
294 local password_encoding, Y = self.credentials_handler("DIGEST-MD5", response["username"], self.realm, response["realm"], decoder); | |
295 if Y == nil then return "failure", "not-authorized" | |
296 elseif Y == false then return "failure", "account-disabled" end | |
297 local A1 = ""; | |
298 if response.authzid then | |
299 if response.authzid == self.username.."@"..self.realm then | |
300 -- COMPAT | |
301 log("warn", "Client is violating XMPP RFC. See section 6.1 of RFC 3920."); | |
302 A1 = Y..":"..response["nonce"]..":"..response["cnonce"]..":"..response.authzid; | |
2183
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
303 else |
2184 | 304 A1 = "?"; |
2183
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
305 end |
2184 | 306 else |
307 A1 = Y..":"..response["nonce"]..":"..response["cnonce"]; | |
308 end | |
309 local A2 = "AUTHENTICATE:"..protocol.."/"..domain; | |
2183
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
310 |
2184 | 311 local HA1 = md5(A1, true); |
312 local HA2 = md5(A2, true); | |
2183
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
313 |
2184 | 314 local KD = HA1..":"..response["nonce"]..":"..response["nc"]..":"..response["cnonce"]..":"..response["qop"]..":"..HA2; |
315 local response_value = md5(KD, true); | |
316 | |
317 if response_value == response["response"] then | |
318 -- calculate rspauth | |
319 A2 = ":"..protocol.."/"..domain; | |
2183
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
320 |
2184 | 321 HA1 = md5(A1, true); |
322 HA2 = md5(A2, true); | |
2183
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
323 |
2184 | 324 KD = HA1..":"..response["nonce"]..":"..response["nc"]..":"..response["cnonce"]..":"..response["qop"]..":"..HA2 |
325 local rspauth = md5(KD, true); | |
326 self.authenticated = true; | |
327 return "challenge", serialize({rspauth = rspauth}); | |
328 else | |
329 return "failure", "not-authorized", "The response provided by the client doesn't match the one we calculated." | |
2183
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
330 end |
2184 | 331 elseif self.step == 3 then |
332 if self.authenticated ~= nil then return "success" | |
333 else return "failure", "malformed-request" end | |
2183
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
334 end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
335 end |
44e71e65da86
Importing SASL Digest-MD5 code. Now for real.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
336 |
519
cccd610a0ef9
Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents:
508
diff
changeset
|
337 return _M; |