diff options
| -rw-r--r-- | plugins/mod_saslauth.lua | 18 | ||||
| -rw-r--r-- | util/sasl.lua | 18 |
2 files changed, 24 insertions, 12 deletions
diff --git a/plugins/mod_saslauth.lua b/plugins/mod_saslauth.lua index 8d3b4ae4..ec3857b8 100644 --- a/plugins/mod_saslauth.lua +++ b/plugins/mod_saslauth.lua @@ -34,6 +34,12 @@ local xmlns_stanzas ='urn:ietf:params:xml:ns:xmpp-stanzas'; local new_sasl = require "util.sasl".new; +default_authentication_profile = { + plain = function(username, realm) + return usermanager_get_password(username, realm), true; + end +}; + local function build_reply(status, ret, err_msg) local reply = st.stanza(status, {xmlns = xmlns_sasl}); if status == "challenge" then @@ -101,8 +107,8 @@ local function sasl_handler(session, stanza) elseif stanza.attr.mechanism == "ANONYMOUS" then return session.send(build_reply("failure", "mechanism-too-weak")); end - session.sasl_handler = new_sasl(stanza.attr.mechanism, session.host, credentials_callback); - if not session.sasl_handler then + local valid_mechanism = session.sasl_handler:select(stanza.attr.mechanism); + if not valid_mechanism then return session.send(build_reply("failure", "invalid-mechanism")); end elseif not session.sasl_handler then @@ -118,7 +124,7 @@ local function sasl_handler(session, stanza) return; end end - local status, ret, err_msg = session.sasl_handler:feed(text); + local status, ret, err_msg = session.sasl_handler:process(text); handle_status(session, status); local s = build_reply(status, ret, err_msg); log("debug", "sasl reply: %s", tostring(s)); @@ -138,14 +144,14 @@ module:add_event_hook("stream-features", if secure_auth_only and not session.secure then return; end + session.sasl_handler = new_sasl(session.host, default_authentication_profile); features:tag("mechanisms", mechanisms_attr); -- TODO: Provide PLAIN only if TLS is active, this is a SHOULD from the introduction of RFC 4616. This behavior could be overridden via configuration but will issuing a warning or so. if config.get(session.host or "*", "core", "anonymous_login") then features:tag("mechanism"):text("ANONYMOUS"):up(); else - mechanisms = usermanager_get_supported_methods(session.host or "*"); - for k, v in pairs(mechanisms) do - features:tag("mechanism"):text(k):up(); + for k, v in pairs(session.sasl_handler:mechanisms()) do + features:tag("mechanism"):text(v):up(); end end features:up(); diff --git a/util/sasl.lua b/util/sasl.lua index 9f7bab20..687878c4 100644 --- a/util/sasl.lua +++ b/util/sasl.lua @@ -81,6 +81,7 @@ end -- create a new SASL object which can be used to authenticate clients function new(realm, profile) sasl_i = {profile = profile}; + sasl_i.realm = realm; return setmetatable(sasl_i, method); end @@ -92,7 +93,7 @@ function method:mechanisms() if backend_mechanism[backend] then for _, mechanism in ipairs(backend_mechanism[backend]) do mechanisms[mechanism] = true; - end + end end end self["possible_mechanisms"] = mechanisms; @@ -102,7 +103,9 @@ end -- select a mechanism to use function method:select(mechanism) self.mech_i = mechanisms[mechanism] - if self.mech_i == nil then return false; end + if self.mech_i == nil then + return false; + end return true; end @@ -120,13 +123,16 @@ local function sasl_mechanism_plain(self, message) local authentication = s_match(response, "%z([^&%z]+)%z") local password = s_match(response, "%z[^&%z]+%z([^&%z]+)") - if authentication == nil or password == nil then return "failure", "malformed-request" end + if authentication == nil or password == nil then + return "failure", "malformed-request"; + end - local correct, state = false, false, false; + local correct, state = false, false; if self.profile.plain then - local correct_password, state = self.profile.plain(authentication, self.realm); + local correct_password; + correct_password, state = self.profile.plain(authentication, self.realm); if correct_password == password then correct = true; else correct = false; end - else if self.profile.plain_test then + elseif self.profile.plain_test then correct, state = self.profile.plain_test(authentication, self.realm, password); end |