aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--plugins/mod_saslauth.lua18
-rw-r--r--util/sasl.lua18
2 files changed, 24 insertions, 12 deletions
diff --git a/plugins/mod_saslauth.lua b/plugins/mod_saslauth.lua
index 8d3b4ae4..ec3857b8 100644
--- a/plugins/mod_saslauth.lua
+++ b/plugins/mod_saslauth.lua
@@ -34,6 +34,12 @@ local xmlns_stanzas ='urn:ietf:params:xml:ns:xmpp-stanzas';
local new_sasl = require "util.sasl".new;
+default_authentication_profile = {
+ plain = function(username, realm)
+ return usermanager_get_password(username, realm), true;
+ end
+};
+
local function build_reply(status, ret, err_msg)
local reply = st.stanza(status, {xmlns = xmlns_sasl});
if status == "challenge" then
@@ -101,8 +107,8 @@ local function sasl_handler(session, stanza)
elseif stanza.attr.mechanism == "ANONYMOUS" then
return session.send(build_reply("failure", "mechanism-too-weak"));
end
- session.sasl_handler = new_sasl(stanza.attr.mechanism, session.host, credentials_callback);
- if not session.sasl_handler then
+ local valid_mechanism = session.sasl_handler:select(stanza.attr.mechanism);
+ if not valid_mechanism then
return session.send(build_reply("failure", "invalid-mechanism"));
end
elseif not session.sasl_handler then
@@ -118,7 +124,7 @@ local function sasl_handler(session, stanza)
return;
end
end
- local status, ret, err_msg = session.sasl_handler:feed(text);
+ local status, ret, err_msg = session.sasl_handler:process(text);
handle_status(session, status);
local s = build_reply(status, ret, err_msg);
log("debug", "sasl reply: %s", tostring(s));
@@ -138,14 +144,14 @@ module:add_event_hook("stream-features",
if secure_auth_only and not session.secure then
return;
end
+ session.sasl_handler = new_sasl(session.host, default_authentication_profile);
features:tag("mechanisms", mechanisms_attr);
-- TODO: Provide PLAIN only if TLS is active, this is a SHOULD from the introduction of RFC 4616. This behavior could be overridden via configuration but will issuing a warning or so.
if config.get(session.host or "*", "core", "anonymous_login") then
features:tag("mechanism"):text("ANONYMOUS"):up();
else
- mechanisms = usermanager_get_supported_methods(session.host or "*");
- for k, v in pairs(mechanisms) do
- features:tag("mechanism"):text(k):up();
+ for k, v in pairs(session.sasl_handler:mechanisms()) do
+ features:tag("mechanism"):text(v):up();
end
end
features:up();
diff --git a/util/sasl.lua b/util/sasl.lua
index 9f7bab20..687878c4 100644
--- a/util/sasl.lua
+++ b/util/sasl.lua
@@ -81,6 +81,7 @@ end
-- create a new SASL object which can be used to authenticate clients
function new(realm, profile)
sasl_i = {profile = profile};
+ sasl_i.realm = realm;
return setmetatable(sasl_i, method);
end
@@ -92,7 +93,7 @@ function method:mechanisms()
if backend_mechanism[backend] then
for _, mechanism in ipairs(backend_mechanism[backend]) do
mechanisms[mechanism] = true;
- end
+ end
end
end
self["possible_mechanisms"] = mechanisms;
@@ -102,7 +103,9 @@ end
-- select a mechanism to use
function method:select(mechanism)
self.mech_i = mechanisms[mechanism]
- if self.mech_i == nil then return false; end
+ if self.mech_i == nil then
+ return false;
+ end
return true;
end
@@ -120,13 +123,16 @@ local function sasl_mechanism_plain(self, message)
local authentication = s_match(response, "%z([^&%z]+)%z")
local password = s_match(response, "%z[^&%z]+%z([^&%z]+)")
- if authentication == nil or password == nil then return "failure", "malformed-request" end
+ if authentication == nil or password == nil then
+ return "failure", "malformed-request";
+ end
- local correct, state = false, false, false;
+ local correct, state = false, false;
if self.profile.plain then
- local correct_password, state = self.profile.plain(authentication, self.realm);
+ local correct_password;
+ correct_password, state = self.profile.plain(authentication, self.realm);
if correct_password == password then correct = true; else correct = false; end
- else if self.profile.plain_test then
+ elseif self.profile.plain_test then
correct, state = self.profile.plain_test(authentication, self.realm, password);
end