Providing some human readable error messages and some fixes.

2 files changed, 38 insertions, 50 deletions

diff --git a/plugins/mod_saslauth.lua b/plugins/mod_saslauth.lua
index 05c581ca..2094867f 100644
--- a/plugins/mod_saslauth.lua
+++ b/plugins/mod_saslauth.lua
@@ -51,13 +51,19 @@ local function password_callback(node, host, mechanism)
 		if mechanism == "PLAIN" then
 			return func, password;
 		elseif mechanism == "DIGEST-MD5" then
-			return func, require "hashes".md5(node..":"..host..":"..password);
+			return func, require "md5".sum(node..":"..host..":"..password);
 		end
 	end
 	return func, nil;
 end
 
-function do_sasl(session, stanza)
+function sasl_handler(session, stanza)
+	if stanza.name == "auth" then
+		-- FIXME ignoring duplicates because ejabberd does
+		session.sasl_handler = new_sasl(stanza.attr.mechanism, session.host, password_callback);
+	elseif not session.sasl_handler then
+		return; -- FIXME ignoring out of order stanzas because ejabberd does
+	end
 	local text = stanza[1];
 	if text then
 		text = base64.decode(text);
@@ -74,27 +80,9 @@ function do_sasl(session, stanza)
 	session.send(s);
 end
 
-add_handler("c2s_unauthed", "auth", xmlns_sasl,
-		function (session, stanza)
-			if not session.sasl_handler then
-				session.sasl_handler = new_sasl(stanza.attr.mechanism, session.host, password_callback);
-				do_sasl(session, stanza);
-			else
-				error("Client tried to negotiate SASL again", 0);
-			end
-		end);
-
-add_handler("c2s_unauthed", "abort", xmlns_sasl,
-	function(session, stanza)
-		if not session.sasl_handler then error("Attempt to abort when sasl has not started"); end
-		do_sasl(session, stanza);
-	end);
-
-add_handler("c2s_unauthed", "response", xmlns_sasl,
-	function(session, stanza)
-		if not session.sasl_handler then error("Attempt to respond when sasl has not started"); end
-		do_sasl(session, stanza);
-	end);
+add_handler("c2s_unauthed", "auth", xmlns_sasl, sasl_handler);
+add_handler("c2s_unauthed", "abort", xmlns_sasl, sasl_handler);
+add_handler("c2s_unauthed", "response", xmlns_sasl, sasl_handler);
 
 add_event_hook("stream-features", 
 					function (session, features)												
diff --git a/util/sasl.lua b/util/sasl.lua
index de39a6d7..a5657c8c 100644
--- a/util/sasl.lua
+++ b/util/sasl.lua
@@ -16,30 +16,29 @@ module "sasl"
 
 local function new_plain(realm, password_handler)
 	local object = { mechanism = "PLAIN", realm = realm, password_handler = password_handler}
-	object.feed = 	function(self, message)
-						--print(message:gsub("%W", function (c) return string.format("\\%d", string.byte(c)) end));
-
-						if message == "" or message == nil then return "failure", "malformed-request" end
-						local response = message
-						local authorization = s_match(response, "([^&%z]+)")
-						local authentication = s_match(response, "%z([^&%z]+)%z")
-						local password = s_match(response, "%z[^&%z]+%z([^&%z]+)")
-						
-						local password_encoding, correct_password = self.password_handler(authentication, self.realm, "PLAIN")
-						
-						local claimed_password = ""
-						if password_encoding == nil then claimed_password = password
-						else claimed_password = password_encoding(password) end
-						
-						self.username = authentication
-						if claimed_password == correct_password then
-							log("debug", "success")
-							return "success"
-						else
-							log("debug", "failure")
-							return "failure", "not-authorized"
-						end
-					end
+	function object.feed(self, message)
+        
+		if message == "" or message == nil then return "failure", "malformed-request" end
+		local response = message
+		local authorization = s_match(response, "([^&%z]+)")
+		local authentication = s_match(response, "%z([^&%z]+)%z")
+		local password = s_match(response, "%z[^&%z]+%z([^&%z]+)")
+		
+		local password_encoding, correct_password = self.password_handler(authentication, self.realm, "PLAIN")
+		
+		local claimed_password = ""
+		if password_encoding == nil then claimed_password = password
+		else claimed_password = password_encoding(password) end
+		
+		self.username = authentication
+		if claimed_password == correct_password then
+			log("debug", "success")
+			return "success"
+		else
+			log("debug", "failure")
+			return "failure", "not-authorized"
+		end
+	end
 	return object
 end
 
@@ -111,7 +110,7 @@ local function new_digest_md5(realm, password_handler)
 				if response["nonce"] ~= tostring(self.nonce) then return "failure", "malformed-request" end
 			end
 			
-			if not response["cnonce"] then return "failure", "malformed-request" end
+			if not response["cnonce"] then return "failure", "malformed-request", "Missing entry for cnonce in SASL message." end
 			if not response["qop"] then response["qop"] = "auth" end
 			
 			if response["realm"] == nil then response["realm"] = "" end
@@ -147,13 +146,14 @@ local function new_digest_md5(realm, password_handler)
         
 				KD = HA1..":"..response["nonce"]..":"..response["nc"]..":"..response["cnonce"]..":"..response["qop"]..":"..HA2
 				local rspauth = md5.sumhexa(KD)
-				
+				self.authenticated = true
 				return "challenge", serialize({rspauth = rspauth})
 			else
 				return "failure", "not-authorized", "The response provided by the client doesn't match the one we calculated."
 			end							
 		elseif self.step == 3 then
-			return "success"
+			if self.authenticated ~= nil then return "success"
+			else return "failure", "malformed-request" end
 		end
 	end
 	return object