aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorTobias Markmann <tm@ayena.de>2008-11-15 22:36:22 +0100
committerTobias Markmann <tm@ayena.de>2008-11-15 22:36:22 +0100
commitf2bca1da103f2c790fff5825c24381aa1e313153 (patch)
tree307b9ba67d49dbe9e3a05b88687a5fcd2544e5d2
parenta06fac33d5d45e318035e2d38c067281ce8eb419 (diff)
parentf2ffc8c3232ab0db6c0b7ba0a385a0f3584959f6 (diff)
downloadprosody-f2bca1da103f2c790fff5825c24381aa1e313153.tar.gz
prosody-f2bca1da103f2c790fff5825c24381aa1e313153.zip
Providing some human readable error messages and some fixes.
-rw-r--r--plugins/mod_saslauth.lua34
-rw-r--r--util/sasl.lua54
2 files changed, 38 insertions, 50 deletions
diff --git a/plugins/mod_saslauth.lua b/plugins/mod_saslauth.lua
index 05c581ca..2094867f 100644
--- a/plugins/mod_saslauth.lua
+++ b/plugins/mod_saslauth.lua
@@ -51,13 +51,19 @@ local function password_callback(node, host, mechanism)
if mechanism == "PLAIN" then
return func, password;
elseif mechanism == "DIGEST-MD5" then
- return func, require "hashes".md5(node..":"..host..":"..password);
+ return func, require "md5".sum(node..":"..host..":"..password);
end
end
return func, nil;
end
-function do_sasl(session, stanza)
+function sasl_handler(session, stanza)
+ if stanza.name == "auth" then
+ -- FIXME ignoring duplicates because ejabberd does
+ session.sasl_handler = new_sasl(stanza.attr.mechanism, session.host, password_callback);
+ elseif not session.sasl_handler then
+ return; -- FIXME ignoring out of order stanzas because ejabberd does
+ end
local text = stanza[1];
if text then
text = base64.decode(text);
@@ -74,27 +80,9 @@ function do_sasl(session, stanza)
session.send(s);
end
-add_handler("c2s_unauthed", "auth", xmlns_sasl,
- function (session, stanza)
- if not session.sasl_handler then
- session.sasl_handler = new_sasl(stanza.attr.mechanism, session.host, password_callback);
- do_sasl(session, stanza);
- else
- error("Client tried to negotiate SASL again", 0);
- end
- end);
-
-add_handler("c2s_unauthed", "abort", xmlns_sasl,
- function(session, stanza)
- if not session.sasl_handler then error("Attempt to abort when sasl has not started"); end
- do_sasl(session, stanza);
- end);
-
-add_handler("c2s_unauthed", "response", xmlns_sasl,
- function(session, stanza)
- if not session.sasl_handler then error("Attempt to respond when sasl has not started"); end
- do_sasl(session, stanza);
- end);
+add_handler("c2s_unauthed", "auth", xmlns_sasl, sasl_handler);
+add_handler("c2s_unauthed", "abort", xmlns_sasl, sasl_handler);
+add_handler("c2s_unauthed", "response", xmlns_sasl, sasl_handler);
add_event_hook("stream-features",
function (session, features)
diff --git a/util/sasl.lua b/util/sasl.lua
index de39a6d7..a5657c8c 100644
--- a/util/sasl.lua
+++ b/util/sasl.lua
@@ -16,30 +16,29 @@ module "sasl"
local function new_plain(realm, password_handler)
local object = { mechanism = "PLAIN", realm = realm, password_handler = password_handler}
- object.feed = function(self, message)
- --print(message:gsub("%W", function (c) return string.format("\\%d", string.byte(c)) end));
-
- if message == "" or message == nil then return "failure", "malformed-request" end
- local response = message
- local authorization = s_match(response, "([^&%z]+)")
- local authentication = s_match(response, "%z([^&%z]+)%z")
- local password = s_match(response, "%z[^&%z]+%z([^&%z]+)")
-
- local password_encoding, correct_password = self.password_handler(authentication, self.realm, "PLAIN")
-
- local claimed_password = ""
- if password_encoding == nil then claimed_password = password
- else claimed_password = password_encoding(password) end
-
- self.username = authentication
- if claimed_password == correct_password then
- log("debug", "success")
- return "success"
- else
- log("debug", "failure")
- return "failure", "not-authorized"
- end
- end
+ function object.feed(self, message)
+
+ if message == "" or message == nil then return "failure", "malformed-request" end
+ local response = message
+ local authorization = s_match(response, "([^&%z]+)")
+ local authentication = s_match(response, "%z([^&%z]+)%z")
+ local password = s_match(response, "%z[^&%z]+%z([^&%z]+)")
+
+ local password_encoding, correct_password = self.password_handler(authentication, self.realm, "PLAIN")
+
+ local claimed_password = ""
+ if password_encoding == nil then claimed_password = password
+ else claimed_password = password_encoding(password) end
+
+ self.username = authentication
+ if claimed_password == correct_password then
+ log("debug", "success")
+ return "success"
+ else
+ log("debug", "failure")
+ return "failure", "not-authorized"
+ end
+ end
return object
end
@@ -111,7 +110,7 @@ local function new_digest_md5(realm, password_handler)
if response["nonce"] ~= tostring(self.nonce) then return "failure", "malformed-request" end
end
- if not response["cnonce"] then return "failure", "malformed-request" end
+ if not response["cnonce"] then return "failure", "malformed-request", "Missing entry for cnonce in SASL message." end
if not response["qop"] then response["qop"] = "auth" end
if response["realm"] == nil then response["realm"] = "" end
@@ -147,13 +146,14 @@ local function new_digest_md5(realm, password_handler)
KD = HA1..":"..response["nonce"]..":"..response["nc"]..":"..response["cnonce"]..":"..response["qop"]..":"..HA2
local rspauth = md5.sumhexa(KD)
-
+ self.authenticated = true
return "challenge", serialize({rspauth = rspauth})
else
return "failure", "not-authorized", "The response provided by the client doesn't match the one we calculated."
end
elseif self.step == 3 then
- return "success"
+ if self.authenticated ~= nil then return "success"
+ else return "failure", "malformed-request" end
end
end
return object