Software / code / prosody
Changeset
5869:35780ef2d689
util.sasl.scram: Rewrite patterns and capture client-first-message-bare, client-final-message-without-proof
| author | Kim Alvefur <zash@zash.se> |
|---|---|
| date | Sun, 13 Oct 2013 01:14:21 +0200 |
| parents | 5868:bc37c6758f3a |
| children | 5870:61f748d363e1 |
| files | util/sasl/scram.lua |
| diffstat | 1 files changed, 6 insertions(+), 5 deletions(-) [+] |
line wrap: on
line diff
--- a/util/sasl/scram.lua Sun Oct 13 00:29:47 2013 +0200 +++ b/util/sasl/scram.lua Sun Oct 13 01:14:21 2013 +0200 @@ -112,8 +112,8 @@ local client_first_message = message; -- TODO: fail if authzid is provided, since we don't support them yet - local gs2_header, gs2_cbind_flag, gs2_cbind_name, authzid, name, clientnonce - = client_first_message:match("^(([ynp])=?([%a%-]*),(.*),)n=(.*),r=([^,]*).*"); + local gs2_header, gs2_cbind_flag, gs2_cbind_name, authzid, client_first_message_bare, name, clientnonce + = s_match(client_first_message, "^(([pny])=?([^,]*),([^,]*),)(m?=?[^,]*,?n=([^,]*),r=([^,]*),?.*)$"); if not gs2_cbind_flag then return "failure", "malformed-request"; @@ -185,7 +185,7 @@ server_key = server_key; stored_key = stored_key; - client_first_message = client_first_message; + client_first_message_bare = client_first_message_bare; server_first_message = server_first_message; } return "challenge", server_first_message @@ -193,7 +193,8 @@ -- we are processing client_final_message local client_final_message = message; - local channelbinding, nonce, proof = client_final_message:match("^c=(.*),r=(.*),.*p=(.*)"); + local client_final_message_without_proof, channelbinding, nonce, proof + = s_match(client_final_message, "(c=([^,]*),r=([^,]*),?.-),p=(.*)$"); if not proof or not nonce or not channelbinding then return "failure", "malformed-request", "Missing an attribute(p, r or c) in SASL message."; @@ -216,7 +217,7 @@ local ServerKey = state.server_key; local StoredKey = state.stored_key; - local AuthMessage = "n=" .. s_match(state.client_first_message,"n=(.+)") .. "," .. state.server_first_message .. "," .. s_match(client_final_message, "(.+),p=.+") + local AuthMessage = state.client_first_message_bare .. "," .. state.server_first_message .. "," .. client_final_message_without_proof local ClientSignature = HMAC_f(StoredKey, AuthMessage) local ClientKey = binaryXOR(ClientSignature, base64.decode(proof)) local ServerSignature = HMAC_f(ServerKey, AuthMessage)
