diff options
| -rw-r--r-- | core/usermanager.lua | 17 | ||||
| -rw-r--r-- | plugins/mod_hashpassauth.lua | 127 | ||||
| -rw-r--r-- | plugins/mod_register.lua | 4 | ||||
| -rw-r--r-- | plugins/mod_saslauth.lua | 21 | ||||
| -rw-r--r-- | util/sasl/plain.lua | 4 |
5 files changed, 160 insertions, 13 deletions
diff --git a/core/usermanager.lua b/core/usermanager.lua index 74e8fd6e..0920eb62 100644 --- a/core/usermanager.lua +++ b/core/usermanager.lua @@ -26,7 +26,7 @@ module "usermanager" function new_null_provider() local function dummy() end; - return setmetatable({}, { __index = function() return dummy; end }); + return setmetatable({name = "dummyauth"}, { __index = function() return dummy; end }); end local function host_handler(host) @@ -39,15 +39,18 @@ local function host_handler(host) else log("debug", "auth provider is not nil"); end + if provider.name == nil then + log("debug", "authentication provider name is nil"); + else + log("debug", "authentication provider name = '%s'", provider.name); + end if config.get(host, "core", "authentication") == nil and provider.name == "default" then host_session.users = provider; elseif config.get(host, "core", "authentication") == provider.name then host_session.users = provider; end - if provider.name == nil then - log("debug", "authentication provider name is nil"); - else - log("debug", "authentication provider name = '%s'", provider.name); + if host_session.users ~= nil and host_session.users.name ~= nil then + log("debug", "host_session.users.name for host '%s' now '%s'", host, host_session.users.name); end end); host_session.events.add_handler("item-removed/auth-provider", function (event) @@ -62,7 +65,7 @@ prosody.events.add_handler("component-activated", host_handler, 100); function is_cyrus(host) return config.get(host, "core", "sasl_backend") == "cyrus"; end -function validate_credentials(host, username, password, method) +function test_password(username, password, host) return hosts[host].users.test_password(username, password); end @@ -70,7 +73,7 @@ function get_password(username, host) return hosts[host].users.get_password(username); end -function set_password(username, host, password) +function set_password(username, password, host) return hosts[host].users.set_password(username, password); end diff --git a/plugins/mod_hashpassauth.lua b/plugins/mod_hashpassauth.lua new file mode 100644 index 00000000..3c5cd291 --- /dev/null +++ b/plugins/mod_hashpassauth.lua @@ -0,0 +1,127 @@ +-- Prosody IM +-- Copyright (C) 2008-2010 Matthew Wild +-- Copyright (C) 2008-2010 Waqas Hussain +-- Copyright (C) 2010 Jeff Mitchell +-- +-- This project is MIT/X11 licensed. Please see the +-- COPYING file in the source package for more information. +-- + +local datamanager = require "util.datamanager"; +local log = require "util.logger".init("usermanager"); +local type = type; +local error = error; +local ipairs = ipairs; +local hashes = require "util.hashes"; +local jid_bare = require "util.jid".bare; +local saltedPasswordSHA1 = require "util.sasl.scram".saltedPasswordSHA1; +local config = require "core.configmanager"; +local usermanager = require "core.usermanager"; +local generate_uuid = require "util.uuid".generate; +local hosts = hosts; + +local prosody = _G.prosody; + +local is_cyrus = usermanager.is_cyrus; + +-- Default; can be set per-user +local iteration_count = 4096; + +function new_hashpass_provider(host) + local provider = { name = "hashpass" }; + log("debug", "initializing hashpass authentication provider for host '%s'", host); + + function provider.test_password(username, password) + log("debug", "test password for user %s at host %s", username, module.host); + if is_cyrus(host) then return nil, "Legacy auth not supported with Cyrus SASL."; end + local credentials = datamanager.load(username, host, "accounts") or {}; + + if credentials.hashpass == nil or credentials.iteration_count == nil or credentials.salt == nil then + return nil, "Auth failed. Stored credential information is not complete."; + end + + local valid, binpass = saltedPasswordSHA1(password, credentials.salt, credentials.iteration_count); + local hexpass = binpass:gsub(".", function (c) return ("%02x"):format(c:byte()); end); + if valid then + log("debug", "salted password returned valid"); + else + log("debug", "salted password returned not valid"); + end + log("debug", "hexpass is '%s', stored pass is '%s'", hexpass, credentials.hashpass); + if valid and hexpass == credentials.hashpass then + return true; + else + return nil, "Auth failed. Invalid username, password, or password hash information."; + end + end + + function provider.get_password(username) + log("debug", "get_password for username '%s' at host '%s'", username, module.host); + if is_cyrus(host) then return nil, "Passwords unavailable for Cyrus SASL."; end + return (datamanager.load(username, host, "accounts") or {}).hashpass; + end + + function provider.set_password(username, password) + if is_cyrus(host) then return nil, "Passwords unavailable for Cyrus SASL."; end + local account = datamanager.load(username, host, "accounts"); + if account then + if account.iteration_count == nil then + account.iteration_count = iteration_count; + end + + if account.salt == nil then + account.salt = generate_uuid(); + end + + local valid, binpass = saltedPasswordSHA1(password, account.salt, account.iteration_count); + local hexpass = binpass:gsub(".", function (c) return ("%02x"):format(c:byte()); end); + account.hashpass = hexpass; + + return datamanager.store(username, host, "accounts", account); + end + return nil, "Account not available."; + end + + function provider.user_exists(username) + if is_cyrus(host) then return true; end + local account = datamanager.load(username, host, "accounts"); + if not account then + log("debug", "account not found for username '%s' at host '%s'", username, module.host); + return nil, "Auth failed. Invalid username"; + end + if account.hashpass == nil or string.len(account.hashpass) == 0 then + log("debug", "account password not set or zero-length for username '%s' at host '%s'", username, module.host); + return nil, "Auth failed. Password invalid."; + end + return true; + end + + function provider.create_user(username, password) + if is_cyrus(host) then return nil, "Account creation/modification not available with Cyrus SASL."; end + local salt = generate_uuid(); + local valid, binpass = saltedPasswordSHA1(password, salt, iteration_count); + local hexpass = binpass:gsub(".", function (c) return ("%02x"):format(c:byte()); end); + return datamanager.store(username, host, "accounts", {hashpass = hexpass, salt = salt, iteration_count = iteration_count}); + end + + function provider.get_supported_methods() + return {["PLAIN"] = true}; -- TODO this should be taken from the config + end + + function provider.is_admin(jid) + local admins = config.get(host, "core", "admins"); + if admins ~= config.get("*", "core", "admins") and type(admins) == "table" then + jid = jid_bare(jid); + for _,admin in ipairs(admins) do + if admin == jid then return true; end + end + elseif admins then + log("error", "Option 'admins' for host '%s' is not a table", host); + end + return is_admin(jid); -- Test whether it's a global admin instead + end + return provider; +end + +module:add_item("auth-provider", new_hashpass_provider(module.host)); + diff --git a/plugins/mod_register.lua b/plugins/mod_register.lua index b8d142f7..7e150ac7 100644 --- a/plugins/mod_register.lua +++ b/plugins/mod_register.lua @@ -35,7 +35,7 @@ module:add_iq_handler("c2s", "jabber:iq:register", function (session, stanza) local username, host = session.username, session.host; --session.send(st.error_reply(stanza, "cancel", "not-allowed")); --return; - usermanager_set_password(username, host, nil); -- Disable account + usermanager_set_password(username, nil, host); -- Disable account -- FIXME the disabling currently allows a different user to recreate the account -- we should add an in-memory account block mode when we have threading session.send(st.reply(stanza)); @@ -70,7 +70,7 @@ module:add_iq_handler("c2s", "jabber:iq:register", function (session, stanza) username = nodeprep(table.concat(username)); password = table.concat(password); if username == session.username then - if usermanager_set_password(username, session.host, password) then + if usermanager_set_password(username, password, session.host) then session.send(st.reply(stanza)); else -- TODO unable to write file, file may be locked, etc, what's the correct error? diff --git a/plugins/mod_saslauth.lua b/plugins/mod_saslauth.lua index 9f940c37..4ba0f1fd 100644 --- a/plugins/mod_saslauth.lua +++ b/plugins/mod_saslauth.lua @@ -15,10 +15,10 @@ local base64 = require "util.encodings".base64; local nodeprep = require "util.encodings".stringprep.nodeprep; local datamanager_load = require "util.datamanager".load; -local usermanager_validate_credentials = require "core.usermanager".validate_credentials; local usermanager_get_supported_methods = require "core.usermanager".get_supported_methods; local usermanager_user_exists = require "core.usermanager".user_exists; local usermanager_get_password = require "core.usermanager".get_password; +local usermanager_test_password = require "core.usermanager".test_password; local t_concat, t_insert = table.concat, table.insert; local tostring = tostring; local jid_split = require "util.jid".split; @@ -81,6 +81,17 @@ local default_authentication_profile = { end }; +local hashpass_authentication_profile = { + plain_test = function(username, password, realm) + local prepped_username = nodeprep(username); + if not prepped_username then + log("debug", "NODEprep failed on username: %s", username); + return "", nil; + end + return usermanager_test_password(prepped_username, password, realm), true; + end +}; + local anonymous_authentication_profile = { anonymous = function(username, realm) return true; -- for normal usage you should always return true here @@ -183,7 +194,13 @@ module:hook("stream-features", function(event) if module:get_option("anonymous_login") then origin.sasl_handler = new_sasl(realm, anonymous_authentication_profile); else - origin.sasl_handler = new_sasl(realm, default_authentication_profile); + local authentication = module:get_option("authentication"); + log("debug", "AUTH: creating handler for '%s' type", authentication); + if authentication == nil or authentication == "default" then + origin.sasl_handler = new_sasl(realm, default_authentication_profile); + elseif authentication == "hashpass" then + origin.sasl_handler = new_sasl(realm, hashpass_authentication_profile); + end if not (module:get_option("allow_unencrypted_plain_auth")) and not origin.secure then origin.sasl_handler:forbidden({"PLAIN"}); end diff --git a/util/sasl/plain.lua b/util/sasl/plain.lua index 39821182..4359bb3f 100644 --- a/util/sasl/plain.lua +++ b/util/sasl/plain.lua @@ -29,7 +29,7 @@ plain: end plain_test: - function(username, realm, password) + function(username, password, realm) return true or false, state; end ]] @@ -60,7 +60,7 @@ local function plain(self, message) correct_password, state = self.profile.plain(authentication, self.realm); if correct_password == password then correct = true; else correct = false; end elseif self.profile.plain_test then - correct, state = self.profile.plain_test(authentication, self.realm, password); + correct, state = self.profile.plain_test(authentication, password, self.realm); end self.username = authentication |