aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--util/sasl.lua11
-rw-r--r--util/sasl/scram.lua5
2 files changed, 16 insertions, 0 deletions
diff --git a/util/sasl.lua b/util/sasl.lua
index 93b79a86..37a234c9 100644
--- a/util/sasl.lua
+++ b/util/sasl.lua
@@ -27,6 +27,17 @@ Authentication Backend Prototypes:
state = false : disabled
state = true : enabled
state = nil : non-existant
+
+Channel Binding:
+
+To enable support of channel binding in some mechanisms you need to provide appropriate callbacks in a table
+at profile.cb.
+
+Example:
+ profile.cb["tls-unique"] = function(self)
+ return self.user
+ end
+
]]
local method = {};
diff --git a/util/sasl/scram.lua b/util/sasl/scram.lua
index fbe3547b..76e9c152 100644
--- a/util/sasl/scram.lua
+++ b/util/sasl/scram.lua
@@ -137,6 +137,11 @@ local function scram_gen(hash_name, H_f, HMAC_f)
if string.sub(self.state.gs2_cbind_flag, 0, 1) == "y" then
return "failure", "malformed-request";
end
+
+ -- check whether we support the proposed channel binding type
+ if not self.profile.cb[self.state.gs2_cbind_name] then
+ return "failure", "malformed-request", "Proposed channel binding type isn't supported.";
+ end
else
if self.state.gs2_cbind_flag ~= "n" and self.state.gs2_cbind_flag ~= "y" then
return "failure", "malformed-request";