prosody
b94bb1334029
util/sasl.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Comparison

util/sasl.lua @ 2218:b94bb1334029

Merge with trunk.
author Waqas Hussain <waqas20@gmail.com>
date Thu, 26 Nov 2009 00:05:18 +0500
parent 2212:7cb6460b18d8
child 2241:ac3bd7c42c8b
comparison
equal deleted inserted replaced
2217:838f6d546177 2218:b94bb1334029
12 -- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 12 -- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
13 13
14 14
15 local md5 = require "util.hashes".md5; 15 local md5 = require "util.hashes".md5;
16 local log = require "util.logger".init("sasl"); 16 local log = require "util.logger".init("sasl");
17 local st = require "util.stanza";
18 local set = require "util.set";
19 local array = require "util.array";
20 local to_unicode = require "util.encodings".idna.to_unicode;
21
17 local tostring = tostring; 22 local tostring = tostring;
18 local st = require "util.stanza"; 23 local pairs, ipairs = pairs, ipairs;
19 local generate_uuid = require "util.uuid".generate;
20 local t_insert, t_concat = table.insert, table.concat; 24 local t_insert, t_concat = table.insert, table.concat;
21 local to_byte, to_char = string.byte, string.char;
22 local to_unicode = require "util.encodings".idna.to_unicode;
23 local s_match = string.match; 25 local s_match = string.match;
24 local gmatch = string.gmatch
25 local string = string
26 local math = require "math"
27 local type = type 26 local type = type
28 local error = error 27 local error = error
29 local print = print 28 local setmetatable = setmetatable;
29 local assert = assert;
30 local require = require;
30 31
32 require "util.iterators"
33 local keys = keys
34
35 local array = require "util.array"
31 module "sasl" 36 module "sasl"
32 37
33 -- Credentials handler: 38 --[[
34 -- Arguments: ("PLAIN", user, host, password) 39 Authentication Backend Prototypes:
35 -- Returns: true (success) | false (fail) | nil (user unknown)
36 local function new_plain(realm, credentials_handler)
37 local object = { mechanism = "PLAIN", realm = realm, credentials_handler = credentials_handler}
38 function object.feed(self, message)
39 if message == "" or message == nil then return "failure", "malformed-request" end
40 local response = message
41 local authorization = s_match(response, "([^%z]+)")
42 local authentication = s_match(response, "%z([^%z]+)%z")
43 local password = s_match(response, "%z[^%z]+%z([^%z]+)")
44 40
45 if authentication == nil or password == nil then return "failure", "malformed-request" end 41 state = false : disabled
46 self.username = authentication 42 state = true : enabled
47 local auth_success = self.credentials_handler("PLAIN", self.username, self.realm, password) 43 state = nil : non-existant
48 44
49 if auth_success then 45 plain:
50 return "success" 46 function(username, realm)
51 elseif auth_success == nil then 47 return password, state;
52 return "failure", "account-disabled" 48 end
53 else 49
54 return "failure", "not-authorized" 50 plain-test:
55 end 51 function(username, realm, password)
56 end 52 return true or false, state;
57 return object 53 end
54
55 digest-md5:
56 function(username, domain, realm, encoding) -- domain and realm are usually the same; for some broken
57 -- implementations it's not
58 return digesthash, state;
59 end
60
61 digest-md5-test:
62 function(username, domain, realm, encoding, digesthash)
63 return true or false, state;
64 end
65 ]]
66
67 local method = {};
68 method.__index = method;
69 local mechanisms = {};
70 local backend_mechanism = {};
71
72 -- register a new SASL mechanims
73 local function registerMechanism(name, backends, f)
74 assert(type(name) == "string", "Parameter name MUST be a string.");
75 assert(type(backends) == "string" or type(backends) == "table", "Parameter backends MUST be either a string or a table.");
76 assert(type(f) == "function", "Parameter f MUST be a function.");
77 mechanisms[name] = f
78 for _, backend_name in ipairs(backends) do
79 if backend_mechanism[backend_name] == nil then backend_mechanism[backend_name] = {}; end
80 t_insert(backend_mechanism[backend_name], name);
81 end
58 end 82 end
59 83
60 -- credentials_handler: 84 -- create a new SASL object which can be used to authenticate clients
61 -- Arguments: (mechanism, node, domain, realm, decoder) 85 function new(realm, profile, forbidden)
62 -- Returns: Password encoding, (plaintext) password 86 sasl_i = {profile = profile};
63 -- implementing RFC 2831 87 sasl_i.realm = realm;
64 local function new_digest_md5(realm, credentials_handler) 88 s = setmetatable(sasl_i, method);
65 --TODO complete support for authzid 89 s:forbidden(sasl_i, forbidden)
90 return s;
91 end
66 92
67 local function serialize(message) 93 -- set the forbidden mechanisms
68 local data = "" 94 function method:forbidden( restrict )
95 if restrict then
96 -- set forbidden
97 self.restrict = set.new(restrict);
98 else
99 -- get forbidden
100 return array.collect(self.restrict:items());
101 end
102 end
69 103
70 if type(message) ~= "table" then error("serialize needs an argument of type table.") end 104 -- get a list of possible SASL mechanims to use
71 105 function method:mechanisms()
72 -- testing all possible values 106 local mechanisms = {}
73 if message["realm"] then data = data..[[realm="]]..message.realm..[[",]] end 107 for backend, f in pairs(self.profile) do
74 if message["nonce"] then data = data..[[nonce="]]..message.nonce..[[",]] end 108 if backend_mechanism[backend] then
75 if message["qop"] then data = data..[[qop="]]..message.qop..[[",]] end 109 for _, mechanism in ipairs(backend_mechanism[backend]) do
76 if message["charset"] then data = data..[[charset=]]..message.charset.."," end 110 if not sasl_i.restrict:contains(mechanism) then
77 if message["algorithm"] then data = data..[[algorithm=]]..message.algorithm.."," end 111 mechanisms[mechanism] = true;
78 if message["rspauth"] then data = data..[[rspauth=]]..message.rspauth.."," end
79 data = data:gsub(",$", "")
80 return data
81 end
82
83 local function utf8tolatin1ifpossible(passwd)
84 local i = 1;
85 while i <= #passwd do
86 local passwd_i = to_byte(passwd:sub(i, i));
87 if passwd_i > 0x7F then
88 if passwd_i < 0xC0 or passwd_i > 0xC3 then
89 return passwd;
90 end
91 i = i + 1;
92 passwd_i = to_byte(passwd:sub(i, i));
93 if passwd_i < 0x80 or passwd_i > 0xBF then
94 return passwd;
95 end 112 end
96 end 113 end
97 i = i + 1;
98 end
99
100 local p = {};
101 local j = 0;
102 i = 1;
103 while (i <= #passwd) do
104 local passwd_i = to_byte(passwd:sub(i, i));
105 if passwd_i > 0x7F then
106 i = i + 1;
107 local passwd_i_1 = to_byte(passwd:sub(i, i));
108 t_insert(p, to_char(passwd_i%4*64 + passwd_i_1%64)); -- I'm so clever
109 else
110 t_insert(p, to_char(passwd_i));
111 end
112 i = i + 1;
113 end
114 return t_concat(p);
115 end
116 local function latin1toutf8(str)
117 local p = {};
118 for ch in gmatch(str, ".") do
119 ch = to_byte(ch);
120 if (ch < 0x80) then
121 t_insert(p, to_char(ch));
122 elseif (ch < 0xC0) then
123 t_insert(p, to_char(0xC2, ch));
124 else
125 t_insert(p, to_char(0xC3, ch - 64));
126 end
127 end
128 return t_concat(p);
129 end
130 local function parse(data)
131 local message = {}
132 -- COMPAT: %z in the pattern to work around jwchat bug (sends "charset=utf-8\0")
133 for k, v in gmatch(data, [[([%w%-]+)="?([^",%z]*)"?,?]]) do -- FIXME The hacky regex makes me shudder
134 message[k] = v;
135 end
136 return message;
137 end
138
139 local object = { mechanism = "DIGEST-MD5", realm = realm, credentials_handler = credentials_handler};
140
141 object.nonce = generate_uuid();
142 object.step = 0;
143 object.nonce_count = {};
144
145 function object.feed(self, message)
146 self.step = self.step + 1;
147 if (self.step == 1) then
148 local challenge = serialize({ nonce = object.nonce,
149 qop = "auth",
150 charset = "utf-8",
151 algorithm = "md5-sess",
152 realm = self.realm});
153 return "challenge", challenge;
154 elseif (self.step == 2) then
155 local response = parse(message);
156 -- check for replay attack
157 if response["nc"] then
158 if self.nonce_count[response["nc"]] then return "failure", "not-authorized" end
159 end
160
161 -- check for username, it's REQUIRED by RFC 2831
162 if not response["username"] then
163 return "failure", "malformed-request";
164 end
165 self["username"] = response["username"];
166
167 -- check for nonce, ...
168 if not response["nonce"] then
169 return "failure", "malformed-request";
170 else
171 -- check if it's the right nonce
172 if response["nonce"] ~= tostring(self.nonce) then return "failure", "malformed-request" end
173 end
174
175 if not response["cnonce"] then return "failure", "malformed-request", "Missing entry for cnonce in SASL message." end
176 if not response["qop"] then response["qop"] = "auth" end
177
178 if response["realm"] == nil or response["realm"] == "" then
179 response["realm"] = "";
180 elseif response["realm"] ~= self.realm then
181 return "failure", "not-authorized", "Incorrect realm value";
182 end
183
184 local decoder;
185 if response["charset"] == nil then
186 decoder = utf8tolatin1ifpossible;
187 elseif response["charset"] ~= "utf-8" then
188 return "failure", "incorrect-encoding", "The client's response uses "..response["charset"].." for encoding with isn't supported by sasl.lua. Supported encodings are latin or utf-8.";
189 end
190
191 local domain = "";
192 local protocol = "";
193 if response["digest-uri"] then
194 protocol, domain = response["digest-uri"]:match("(%w+)/(.*)$");
195 if protocol == nil or domain == nil then return "failure", "malformed-request" end
196 else
197 return "failure", "malformed-request", "Missing entry for digest-uri in SASL message."
198 end
199
200 --TODO maybe realm support
201 self.username = response["username"];
202 local password_encoding, Y = self.credentials_handler("DIGEST-MD5", response["username"], self.realm, response["realm"], decoder);
203 if Y == nil then return "failure", "not-authorized"
204 elseif Y == false then return "failure", "account-disabled" end
205 local A1 = "";
206 if response.authzid then
207 if response.authzid == self.username or response.authzid == self.username.."@"..self.realm then
208 -- COMPAT
209 log("warn", "Client is violating RFC 3920 (section 6.1, point 7).");
210 A1 = Y..":"..response["nonce"]..":"..response["cnonce"]..":"..response.authzid;
211 else
212 return "failure", "invalid-authzid";
213 end
214 else
215 A1 = Y..":"..response["nonce"]..":"..response["cnonce"];
216 end
217 local A2 = "AUTHENTICATE:"..protocol.."/"..domain;
218
219 local HA1 = md5(A1, true);
220 local HA2 = md5(A2, true);
221
222 local KD = HA1..":"..response["nonce"]..":"..response["nc"]..":"..response["cnonce"]..":"..response["qop"]..":"..HA2;
223 local response_value = md5(KD, true);
224
225 if response_value == response["response"] then
226 -- calculate rspauth
227 A2 = ":"..protocol.."/"..domain;
228
229 HA1 = md5(A1, true);
230 HA2 = md5(A2, true);
231
232 KD = HA1..":"..response["nonce"]..":"..response["nc"]..":"..response["cnonce"]..":"..response["qop"]..":"..HA2
233 local rspauth = md5(KD, true);
234 self.authenticated = true;
235 return "challenge", serialize({rspauth = rspauth});
236 else
237 return "failure", "not-authorized", "The response provided by the client doesn't match the one we calculated."
238 end
239 elseif self.step == 3 then
240 if self.authenticated ~= nil then return "success"
241 else return "failure", "malformed-request" end
242 end 114 end
243 end 115 end
244 return object; 116 self["possible_mechanisms"] = mechanisms;
117 return array.collect(keys(mechanisms));
245 end 118 end
246 119
247 -- Credentials handler: Can be nil. If specified, should take the mechanism as 120 -- select a mechanism to use
248 -- the only argument, and return true for OK, or false for not-OK (TODO) 121 function method:select(mechanism)
249 local function new_anonymous(realm, credentials_handler) 122 if self.mech_i then
250 local object = { mechanism = "ANONYMOUS", realm = realm, credentials_handler = credentials_handler} 123 return false;
251 function object.feed(self, message) 124 end
252 return "success" 125
253 end 126 self.mech_i = mechanisms[mechanism]
254 object["username"] = generate_uuid() 127 if self.mech_i == nil then
255 return object 128 return false;
129 end
130 return true;
256 end 131 end
257 132
133 -- feed new messages to process into the library
134 function method:process(message)
135 --if message == "" or message == nil then return "failure", "malformed-request" end
136 return self.mech_i(self, message);
137 end
258 138
259 function new(mechanism, realm, credentials_handler) 139 -- load the mechanisms
260 local object 140 load_mechs = {"plain", "digest-md5", "anonymous", "scram"}
261 if mechanism == "PLAIN" then object = new_plain(realm, credentials_handler) 141 for _, mech in ipairs(load_mechs) do
262 elseif mechanism == "DIGEST-MD5" then object = new_digest_md5(realm, credentials_handler) 142 local name = "util.sasl."..mech;
263 elseif mechanism == "ANONYMOUS" then object = new_anonymous(realm, credentials_handler) 143 local m = require(name);
264 else 144 m.init(registerMechanism)
265 log("debug", "Unsupported SASL mechanism: "..tostring(mechanism));
266 return nil
267 end
268 return object
269 end 145 end
270 146
271 return _M; 147 return _M;