diff options
| -rw-r--r-- | plugins/mod_saslauth.lua | 34 | ||||
| -rw-r--r-- | util/sasl.lua | 54 |
2 files changed, 38 insertions, 50 deletions
diff --git a/plugins/mod_saslauth.lua b/plugins/mod_saslauth.lua index 05c581ca..2094867f 100644 --- a/plugins/mod_saslauth.lua +++ b/plugins/mod_saslauth.lua @@ -51,13 +51,19 @@ local function password_callback(node, host, mechanism) if mechanism == "PLAIN" then return func, password; elseif mechanism == "DIGEST-MD5" then - return func, require "hashes".md5(node..":"..host..":"..password); + return func, require "md5".sum(node..":"..host..":"..password); end end return func, nil; end -function do_sasl(session, stanza) +function sasl_handler(session, stanza) + if stanza.name == "auth" then + -- FIXME ignoring duplicates because ejabberd does + session.sasl_handler = new_sasl(stanza.attr.mechanism, session.host, password_callback); + elseif not session.sasl_handler then + return; -- FIXME ignoring out of order stanzas because ejabberd does + end local text = stanza[1]; if text then text = base64.decode(text); @@ -74,27 +80,9 @@ function do_sasl(session, stanza) session.send(s); end -add_handler("c2s_unauthed", "auth", xmlns_sasl, - function (session, stanza) - if not session.sasl_handler then - session.sasl_handler = new_sasl(stanza.attr.mechanism, session.host, password_callback); - do_sasl(session, stanza); - else - error("Client tried to negotiate SASL again", 0); - end - end); - -add_handler("c2s_unauthed", "abort", xmlns_sasl, - function(session, stanza) - if not session.sasl_handler then error("Attempt to abort when sasl has not started"); end - do_sasl(session, stanza); - end); - -add_handler("c2s_unauthed", "response", xmlns_sasl, - function(session, stanza) - if not session.sasl_handler then error("Attempt to respond when sasl has not started"); end - do_sasl(session, stanza); - end); +add_handler("c2s_unauthed", "auth", xmlns_sasl, sasl_handler); +add_handler("c2s_unauthed", "abort", xmlns_sasl, sasl_handler); +add_handler("c2s_unauthed", "response", xmlns_sasl, sasl_handler); add_event_hook("stream-features", function (session, features) diff --git a/util/sasl.lua b/util/sasl.lua index de39a6d7..a5657c8c 100644 --- a/util/sasl.lua +++ b/util/sasl.lua @@ -16,30 +16,29 @@ module "sasl" local function new_plain(realm, password_handler) local object = { mechanism = "PLAIN", realm = realm, password_handler = password_handler} - object.feed = function(self, message) - --print(message:gsub("%W", function (c) return string.format("\\%d", string.byte(c)) end)); - - if message == "" or message == nil then return "failure", "malformed-request" end - local response = message - local authorization = s_match(response, "([^&%z]+)") - local authentication = s_match(response, "%z([^&%z]+)%z") - local password = s_match(response, "%z[^&%z]+%z([^&%z]+)") - - local password_encoding, correct_password = self.password_handler(authentication, self.realm, "PLAIN") - - local claimed_password = "" - if password_encoding == nil then claimed_password = password - else claimed_password = password_encoding(password) end - - self.username = authentication - if claimed_password == correct_password then - log("debug", "success") - return "success" - else - log("debug", "failure") - return "failure", "not-authorized" - end - end + function object.feed(self, message) + + if message == "" or message == nil then return "failure", "malformed-request" end + local response = message + local authorization = s_match(response, "([^&%z]+)") + local authentication = s_match(response, "%z([^&%z]+)%z") + local password = s_match(response, "%z[^&%z]+%z([^&%z]+)") + + local password_encoding, correct_password = self.password_handler(authentication, self.realm, "PLAIN") + + local claimed_password = "" + if password_encoding == nil then claimed_password = password + else claimed_password = password_encoding(password) end + + self.username = authentication + if claimed_password == correct_password then + log("debug", "success") + return "success" + else + log("debug", "failure") + return "failure", "not-authorized" + end + end return object end @@ -111,7 +110,7 @@ local function new_digest_md5(realm, password_handler) if response["nonce"] ~= tostring(self.nonce) then return "failure", "malformed-request" end end - if not response["cnonce"] then return "failure", "malformed-request" end + if not response["cnonce"] then return "failure", "malformed-request", "Missing entry for cnonce in SASL message." end if not response["qop"] then response["qop"] = "auth" end if response["realm"] == nil then response["realm"] = "" end @@ -147,13 +146,14 @@ local function new_digest_md5(realm, password_handler) KD = HA1..":"..response["nonce"]..":"..response["nc"]..":"..response["cnonce"]..":"..response["qop"]..":"..HA2 local rspauth = md5.sumhexa(KD) - + self.authenticated = true return "challenge", serialize({rspauth = rspauth}) else return "failure", "not-authorized", "The response provided by the client doesn't match the one we calculated." end elseif self.step == 3 then - return "success" + if self.authenticated ~= nil then return "success" + else return "failure", "malformed-request" end end end return object |