From c4d2deffc64a4d955e52d7e8b2dce3af444872c7 Mon Sep 17 00:00:00 2001 From: Tobias Markmann Date: Mon, 10 Nov 2008 16:28:15 +0100 Subject: Forward response stanzas to sasl.lua and some other stuff. --- plugins/mod_saslauth.lua | 79 +++++++++++++++++++++++++----------------------- 1 file changed, 42 insertions(+), 37 deletions(-) (limited to 'plugins') diff --git a/plugins/mod_saslauth.lua b/plugins/mod_saslauth.lua index 24c82a1c..4f4f29d4 100644 --- a/plugins/mod_saslauth.lua +++ b/plugins/mod_saslauth.lua @@ -15,50 +15,55 @@ local xmlns_stanzas ='urn:ietf:params:xml:ns:xmpp-stanzas'; local new_sasl = require "util.sasl".new; -add_handler("c2s_unauthed", "auth", xmlns_sasl, - function (session, stanza) - if not session.sasl_handler then - session.sasl_handler = new_sasl(stanza.attr.mechanism, - function (username, password) - -- onAuth - require "core.usermanager" - if usermanager_validate_credentials(session.host, username, password) then - return true; - end - return false; - end, - function (username) - -- onSuccess - local success, err = sessionmanager.make_authenticated(session, username); - if not success then - sessionmanager.destroy_session(session); - return; - end - session.sasl_handler = nil; - session:reset_stream(); - end, - function (reason) - -- onFail - log("debug", "SASL failure, reason: %s", reason); - end, - function (stanza) - -- onWrite - log("debug", "SASL writes: %s", tostring(stanza)); - send(session, stanza); - end - ); - session.sasl_handler:feed(stanza); - else - error("Client tried to negotiate SASL again", 0); +add_handler("c2s_unauthed", "auth", xmlns_sasl, function (session, stanza) + if not session.sasl_handler then + session.sasl_handler = new_sasl(stanza.attr.mechanism, + function (username, password) + -- onAuth + require "core.usermanager" + if usermanager_validate_credentials(session.host, username, password) then + return true; + end + return false; + end, + function (username) + -- onSuccess + local success, err = sessionmanager.make_authenticated(session, username); + if not success then + sessionmanager.destroy_session(session); + return; + end + session.sasl_handler = nil; + session:reset_stream(); + end, + function (reason) + -- onFail + log("debug", "SASL failure, reason: %s", reason); + end, + function (stanza) + -- onWrite + log("debug", "SASL writes: %s", tostring(stanza)); + send(session, stanza); end - - end); + ); + session.sasl_handler:feed(stanza); + else + error("Client tried to negotiate SASL again", 0); + end +end); + +add_handler("c2s_unauthed", "response", xmlns_sasl, function (session, stanza) + if session.sasl_handler then + session.sasl_handler:feed(stanza); + end +end); add_event_hook("stream-features", function (session, features) if not session.username then t_insert(features, ""); t_insert(features, "PLAIN"); + t_insert(features, "DIGEST-MD5"); t_insert(features, ""); else t_insert(features, ""); -- cgit v1.2.3 From aefcb845c34c7bf15a370812b28b5da27fbc983b Mon Sep 17 00:00:00 2001 From: Waqas Hussain Date: Sat, 15 Nov 2008 12:21:04 +0500 Subject: mod_saslauth updated for digest-md5 --- plugins/mod_saslauth.lua | 63 +++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 60 insertions(+), 3 deletions(-) (limited to 'plugins') diff --git a/plugins/mod_saslauth.lua b/plugins/mod_saslauth.lua index 24c82a1c..d8e27c4f 100644 --- a/plugins/mod_saslauth.lua +++ b/plugins/mod_saslauth.lua @@ -2,6 +2,7 @@ local st = require "util.stanza"; local send = require "core.sessionmanager".send_to_session; local sm_bind_resource = require "core.sessionmanager".bind_resource; +local jid local usermanager_validate_credentials = require "core.usermanager".validate_credentials; local t_concat, t_insert = table.concat, table.insert; @@ -15,10 +16,51 @@ local xmlns_stanzas ='urn:ietf:params:xml:ns:xmpp-stanzas'; local new_sasl = require "util.sasl".new; +local function build_reply(status, ret) + local reply = st.stanza(status, {xmlns = xmlns_sasl}); + if status == "challenge" then + reply:text(ret or ""); + elseif status == "failure" then + reply:tag(ret):up(); + elseif status == "success" then + reply:text(ret or ""); + else + error("Unknown sasl status: "..status); + end + return reply; +end + +local function handle_status(session, status) + if status == "failure" then + session.sasl_handler = nil; + elseif status == "success" then + session.sasl_handler = nil; + session:reset_stream(); + end +end + +local function password_callback(jid, mechanism) + local node, host = jid_split(jid); + local password = (datamanager.load(node, host, "accounts") or {}).password; -- FIXME handle hashed passwords + local func = function(x) return x; end; + if password then + if mechanism == "PLAIN" then + return func, password; + elseif mechanism == "DIGEST-MD5" then + return func, require "hashes".md5(node.."::"..password); + end + end + return func, nil; +end + add_handler("c2s_unauthed", "auth", xmlns_sasl, function (session, stanza) if not session.sasl_handler then - session.sasl_handler = new_sasl(stanza.attr.mechanism, + session.sasl_handler = new_sasl(stanza.attr.mechanism, session.host, password_callback); + local status, ret = session.sasl_handler:feed(stanza[1]); + handle_status(session, status); + session.send(build_reply(status, ret)); + --[[session.sasl_handler = new_sasl(stanza.attr.mechanism, function (username, password) -- onAuth require "core.usermanager" @@ -47,12 +89,27 @@ add_handler("c2s_unauthed", "auth", xmlns_sasl, send(session, stanza); end ); - session.sasl_handler:feed(stanza); + session.sasl_handler:feed(stanza); ]] else error("Client tried to negotiate SASL again", 0); end - end); + +add_handler("c2s_unauthed", "abort", xmlns_sasl, + function(session, stanza) + if not session.sasl_handler then error("Attempt to abort when sasl has not started"); end + local status, ret = session.sasl_handler:feed(stanza[1]); + handle_status(session, status); + session.send(build_reply(status, ret)); + end); + +add_handler("c2s_unauthed", "response", xmlns_sasl, + function(session, stanza) + if not session.sasl_handler then error("Attempt to respond when sasl has not started"); end + local status, ret = session.sasl_handler:feed(stanza[1]); + handle_status(session, status); + session.send(build_reply(status, ret)); + end); add_event_hook("stream-features", function (session, features) -- cgit v1.2.3 From 72e415f8233f2a67f2296b6061618ca5269df593 Mon Sep 17 00:00:00 2001 From: Tobias Markmann Date: Sat, 15 Nov 2008 19:12:05 +0100 Subject: Adding some TODO for some security issue. --- plugins/mod_saslauth.lua | 1 + 1 file changed, 1 insertion(+) (limited to 'plugins') diff --git a/plugins/mod_saslauth.lua b/plugins/mod_saslauth.lua index dd268555..6b945bfc 100644 --- a/plugins/mod_saslauth.lua +++ b/plugins/mod_saslauth.lua @@ -115,6 +115,7 @@ add_event_hook("stream-features", function (session, features) if not session.username then t_insert(features, ""); + -- TODO: Provide PLAIN only if TLS is active, this is a SHOULD from the introduction of RFC 4616. This behavior could be overridden via configuration but will issuing a warning or so. t_insert(features, "PLAIN"); t_insert(features, "DIGEST-MD5"); t_insert(features, ""); -- cgit v1.2.3 From 9245e20027736cfdd2d53fa78502f25fe4205eb8 Mon Sep 17 00:00:00 2001 From: Waqas Hussain Date: Sat, 15 Nov 2008 23:20:07 +0500 Subject: mod_saslauth: Added base64 decoding, encoding check, and cleaned the code up. --- plugins/mod_saslauth.lua | 59 ++++++++++++++++-------------------------------- 1 file changed, 19 insertions(+), 40 deletions(-) (limited to 'plugins') diff --git a/plugins/mod_saslauth.lua b/plugins/mod_saslauth.lua index d8e27c4f..75af5eb6 100644 --- a/plugins/mod_saslauth.lua +++ b/plugins/mod_saslauth.lua @@ -53,43 +53,26 @@ local function password_callback(jid, mechanism) return func, nil; end +function do_sasl(session, stanza) + local text = stanza[1]; + if text then + text = base64.decode(text); + if not text then + session.sasl_handler = nil; + session.send(build_reply("failure", "incorrect-encoding")); + return; + end + end + local status, ret = session.sasl_handler:feed(text); + handle_status(session, status); + session.send(build_reply(status, ret)); +end + add_handler("c2s_unauthed", "auth", xmlns_sasl, function (session, stanza) if not session.sasl_handler then session.sasl_handler = new_sasl(stanza.attr.mechanism, session.host, password_callback); - local status, ret = session.sasl_handler:feed(stanza[1]); - handle_status(session, status); - session.send(build_reply(status, ret)); - --[[session.sasl_handler = new_sasl(stanza.attr.mechanism, - function (username, password) - -- onAuth - require "core.usermanager" - if usermanager_validate_credentials(session.host, username, password) then - return true; - end - return false; - end, - function (username) - -- onSuccess - local success, err = sessionmanager.make_authenticated(session, username); - if not success then - sessionmanager.destroy_session(session); - return; - end - session.sasl_handler = nil; - session:reset_stream(); - end, - function (reason) - -- onFail - log("debug", "SASL failure, reason: %s", reason); - end, - function (stanza) - -- onWrite - log("debug", "SASL writes: %s", tostring(stanza)); - send(session, stanza); - end - ); - session.sasl_handler:feed(stanza); ]] + do_sasl(session, stanza); else error("Client tried to negotiate SASL again", 0); end @@ -98,19 +81,15 @@ add_handler("c2s_unauthed", "auth", xmlns_sasl, add_handler("c2s_unauthed", "abort", xmlns_sasl, function(session, stanza) if not session.sasl_handler then error("Attempt to abort when sasl has not started"); end - local status, ret = session.sasl_handler:feed(stanza[1]); - handle_status(session, status); - session.send(build_reply(status, ret)); + do_sasl(session, stanza); end); add_handler("c2s_unauthed", "response", xmlns_sasl, function(session, stanza) if not session.sasl_handler then error("Attempt to respond when sasl has not started"); end - local status, ret = session.sasl_handler:feed(stanza[1]); - handle_status(session, status); - session.send(build_reply(status, ret)); + do_sasl(session, stanza); end); - + add_event_hook("stream-features", function (session, features) if not session.username then -- cgit v1.2.3 From 1b6b09a27d981017e4678235f54b6871a6dde7ca Mon Sep 17 00:00:00 2001 From: Waqas Hussain Date: Sun, 16 Nov 2008 00:25:28 +0500 Subject: Set username on SASL success --- plugins/mod_saslauth.lua | 2 ++ 1 file changed, 2 insertions(+) (limited to 'plugins') diff --git a/plugins/mod_saslauth.lua b/plugins/mod_saslauth.lua index 75af5eb6..24b19cfb 100644 --- a/plugins/mod_saslauth.lua +++ b/plugins/mod_saslauth.lua @@ -34,6 +34,8 @@ local function handle_status(session, status) if status == "failure" then session.sasl_handler = nil; elseif status == "success" then + if not session.sasl_handler.username then error("SASL succeeded but we didn't get a username!"); end -- TODO move this to sessionmanager + sessionmanager.make_authenticated(session, session.sasl_handler.username); session.sasl_handler = nil; session:reset_stream(); end -- cgit v1.2.3 From 0d8a36b732987a9cf82437acd513280c9faa4b08 Mon Sep 17 00:00:00 2001 From: Tobias Markmann Date: Sat, 15 Nov 2008 20:28:09 +0100 Subject: Set username in a SASL object. --- plugins/mod_saslauth.lua | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'plugins') diff --git a/plugins/mod_saslauth.lua b/plugins/mod_saslauth.lua index b95d160d..314d2502 100644 --- a/plugins/mod_saslauth.lua +++ b/plugins/mod_saslauth.lua @@ -7,6 +7,7 @@ local jid local usermanager_validate_credentials = require "core.usermanager".validate_credentials; local t_concat, t_insert = table.concat, table.insert; local tostring = tostring; +local jid_split = require "util.jid".split local log = require "util.logger".init("mod_saslauth"); @@ -65,7 +66,9 @@ function do_sasl(session, stanza) end local status, ret = session.sasl_handler:feed(text); handle_status(session, status); - session.send(build_reply(status, ret)); + local s = build_reply(status, ret); + log("debug", "sasl reply: "..tostring(s)); + session.send(s); end add_handler("c2s_unauthed", "auth", xmlns_sasl, -- cgit v1.2.3