From 71c6728e69c98d7a70ec4ae4ffacb08ae683803f Mon Sep 17 00:00:00 2001
From: Kim Alvefur <zash@zash.se>
Date: Sat, 23 May 2020 14:17:04 +0200
Subject: mod_auth_internal_*: Apply saslprep to passwords
Related to #1560
---
plugins/mod_auth_insecure.lua | 5 +++++
plugins/mod_auth_internal_hashed.lua | 7 ++++++-
plugins/mod_auth_internal_plain.lua | 15 ++++++++++++++-
3 files changed, 25 insertions(+), 2 deletions(-)
(limited to 'plugins')
diff --git a/plugins/mod_auth_insecure.lua b/plugins/mod_auth_insecure.lua
index 9e23c29f..dc5ee616 100644
--- a/plugins/mod_auth_insecure.lua
+++ b/plugins/mod_auth_insecure.lua
@@ -9,6 +9,7 @@
local datamanager = require "util.datamanager";
local new_sasl = require "util.sasl".new;
+local saslprep = require "util.encodings".stringprep.saslprep;
local host = module.host;
local provider = { name = "insecure" };
@@ -21,6 +22,10 @@ end
function provider.set_password(username, password)
local account = datamanager.load(username, host, "accounts");
+ password = saslprep(password);
+ if not password then
+ return nil, "Password fails SASLprep.";
+ end
if account then
account.password = password;
return datamanager.store(username, host, "accounts", account);
diff --git a/plugins/mod_auth_internal_hashed.lua b/plugins/mod_auth_internal_hashed.lua
index 083f648b..15058098 100644
--- a/plugins/mod_auth_internal_hashed.lua
+++ b/plugins/mod_auth_internal_hashed.lua
@@ -15,6 +15,7 @@ local generate_uuid = require "util.uuid".generate;
local new_sasl = require "util.sasl".new;
local hex = require"util.hex";
local to_hex, from_hex = hex.to, hex.from;
+local saslprep = require "util.encodings".stringprep.saslprep;
local log = module._log;
local host = module.host;
@@ -32,9 +33,13 @@ local provider = {};
function provider.test_password(username, password)
log("debug", "test password for user '%s'", username);
local credentials = accounts:get(username) or {};
+ password = saslprep(password);
+ if not password then
+ return nil, "Password fails SASLprep.";
+ end
if credentials.password ~= nil and string.len(credentials.password) ~= 0 then
- if credentials.password ~= password then
+ if saslprep(credentials.password) ~= password then
return nil, "Auth failed. Provided password is incorrect.";
end
diff --git a/plugins/mod_auth_internal_plain.lua b/plugins/mod_auth_internal_plain.lua
index 276efb64..56ef52d5 100644
--- a/plugins/mod_auth_internal_plain.lua
+++ b/plugins/mod_auth_internal_plain.lua
@@ -8,6 +8,7 @@
local usermanager = require "core.usermanager";
local new_sasl = require "util.sasl".new;
+local saslprep = require "util.encodings".stringprep.saslprep;
local log = module._log;
local host = module.host;
@@ -20,8 +21,12 @@ local provider = {};
function provider.test_password(username, password)
log("debug", "test password for user '%s'", username);
local credentials = accounts:get(username) or {};
+ password = saslprep(password);
+ if not password then
+ return nil, "Password fails SASLprep.";
+ end
- if password == credentials.password then
+ if password == saslprep(credentials.password) then
return true;
else
return nil, "Auth failed. Invalid username or password.";
@@ -35,6 +40,10 @@ end
function provider.set_password(username, password)
log("debug", "set_password for username '%s'", username);
+ password = saslprep(password);
+ if not password then
+ return nil, "Password fails SASLprep.";
+ end
local account = accounts:get(username);
if account then
account.password = password;
@@ -57,6 +66,10 @@ function provider.users()
end
function provider.create_user(username, password)
+ password = saslprep(password);
+ if not password then
+ return nil, "Password fails SASLprep.";
+ end
return accounts:set(username, {password = password});
end
--
cgit v1.2.3