Fri, 23 Jul 2010 09:17:11 +0100
certmanager: Don't disable LuaSec and future cert loading on failure, and add error messages to the no LuaSec/config cases (thanks Jakob)
2182
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
1 | -- sasl.lua v0.4 |
3094
5f625411b463
util.sasl: 2009 -> 2010 in copyright header.
Tobias Markmann <tm@ayena.de>
parents:
3093
diff
changeset
|
2 | -- Copyright (C) 2008-2010 Tobias Markmann |
2182
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
3 | -- |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
4 | -- All rights reserved. |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
5 | -- |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
6 | -- Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
7 | -- |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
8 | -- * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
9 | -- * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
10 | -- * Neither the name of Tobias Markmann nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
11 | -- |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
12 | -- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
13 | |
2183
f0a85d11823e
Getting PLAIN mechanism work with the new API.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
14 | local s_match = string.match; |
2196
dd0b250cb6c4
SASLprep authentication and password in SASL PLAIN implementation.
Tobias Markmann <tm@ayena.de>
parents:
2183
diff
changeset
|
15 | local saslprep = require "util.encodings".stringprep.saslprep; |
dd0b250cb6c4
SASLprep authentication and password in SASL PLAIN implementation.
Tobias Markmann <tm@ayena.de>
parents:
2183
diff
changeset
|
16 | local log = require "util.logger".init("sasl"); |
2182
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
17 | |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
18 | module "plain" |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
19 | |
2263
ff881b857c98
util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents:
2252
diff
changeset
|
20 | -- ================================ |
ff881b857c98
util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents:
2252
diff
changeset
|
21 | -- SASL PLAIN according to RFC 4616 |
3092
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
22 | |
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
23 | --[[ |
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
24 | Supported Authentication Backends |
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
25 | |
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
26 | plain: |
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
27 | function(username, realm) |
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
28 | return password, state; |
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
29 | end |
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
30 | |
3105 | 31 | plain_test: |
3092
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
32 | function(username, realm, password) |
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
33 | return true or false, state; |
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
34 | end |
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
35 | ]] |
d32935878661
util.sasl: Moving SASL authentication backends documentation to the mechanism files.
Tobias Markmann <tm@ayena.de>
parents:
2314
diff
changeset
|
36 | |
2182
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
37 | local function plain(self, message) |
2263
ff881b857c98
util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents:
2252
diff
changeset
|
38 | if not message then |
2182
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
39 | return "failure", "malformed-request"; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
40 | end |
2263
ff881b857c98
util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents:
2252
diff
changeset
|
41 | |
2314
c2e1bde4d84d
Redo merge with Waqas' PBKDF2 optimizations.
Tobias Markmann <tm@ayena.de>
parents:
2288
diff
changeset
|
42 | local authorization, authentication, password = s_match(message, "^([^%z]*)%z([^%z]+)%z([^%z]+)"); |
2263
ff881b857c98
util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents:
2252
diff
changeset
|
43 | |
ff881b857c98
util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents:
2252
diff
changeset
|
44 | if not authorization then |
ff881b857c98
util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents:
2252
diff
changeset
|
45 | return "failure", "malformed-request"; |
ff881b857c98
util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents:
2252
diff
changeset
|
46 | end |
ff881b857c98
util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents:
2252
diff
changeset
|
47 | |
2196
dd0b250cb6c4
SASLprep authentication and password in SASL PLAIN implementation.
Tobias Markmann <tm@ayena.de>
parents:
2183
diff
changeset
|
48 | -- SASLprep password and authentication |
dd0b250cb6c4
SASLprep authentication and password in SASL PLAIN implementation.
Tobias Markmann <tm@ayena.de>
parents:
2183
diff
changeset
|
49 | authentication = saslprep(authentication); |
dd0b250cb6c4
SASLprep authentication and password in SASL PLAIN implementation.
Tobias Markmann <tm@ayena.de>
parents:
2183
diff
changeset
|
50 | password = saslprep(password); |
2263
ff881b857c98
util.sasl.plain: A little refactoring.
Waqas Hussain <waqas20@gmail.com>
parents:
2252
diff
changeset
|
51 | |
2196
dd0b250cb6c4
SASLprep authentication and password in SASL PLAIN implementation.
Tobias Markmann <tm@ayena.de>
parents:
2183
diff
changeset
|
52 | if (not password) or (password == "") or (not authentication) or (authentication == "") then |
2205
adbedc32d41b
Fail if username or password don't pass SASLprep.
Tobias Markmann <tm@ayena.de>
parents:
2196
diff
changeset
|
53 | log("debug", "Username or password violates SASLprep."); |
2206
78c9b5255b27
Adding some human readable error messages.
Tobias Markmann <tm@ayena.de>
parents:
2205
diff
changeset
|
54 | return "failure", "malformed-request", "Invalid username or password."; |
2196
dd0b250cb6c4
SASLprep authentication and password in SASL PLAIN implementation.
Tobias Markmann <tm@ayena.de>
parents:
2183
diff
changeset
|
55 | end |
2182
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
56 | |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
57 | local correct, state = false, false; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
58 | if self.profile.plain then |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
59 | local correct_password; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
60 | correct_password, state = self.profile.plain(authentication, self.realm); |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
61 | if correct_password == password then correct = true; else correct = false; end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
62 | elseif self.profile.plain_test then |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
63 | correct, state = self.profile.plain_test(authentication, self.realm, password); |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
64 | end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
65 | |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
66 | self.username = authentication |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
67 | if not state then |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
68 | return "failure", "account-disabled"; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
69 | end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
70 | |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
71 | if correct then |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
72 | return "success"; |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
73 | else |
2206
78c9b5255b27
Adding some human readable error messages.
Tobias Markmann <tm@ayena.de>
parents:
2205
diff
changeset
|
74 | return "failure", "not-authorized", "Unable to authorize you with the authentication credentials you've sent."; |
2182
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
75 | end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
76 | end |
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
77 | |
2183
f0a85d11823e
Getting PLAIN mechanism work with the new API.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
78 | function init(registerMechanism) |
3095
3e0d9ed57283
util.sasl.plain: Removing plain_hashed authentication provider. Just do hashing and comparison yourself in a plain_test authentication provider.
Tobias Markmann <tm@ayena.de>
parents:
3094
diff
changeset
|
79 | registerMechanism("PLAIN", {"plain", "plain_test"}, plain); |
2183
f0a85d11823e
Getting PLAIN mechanism work with the new API.
Tobias Markmann <tm@ayena.de>
parents:
2182
diff
changeset
|
80 | end |
2182
1112871916eb
Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents:
diff
changeset
|
81 | |
2252
98a2bc275e0e
util.sasl.plain: Fail gracefully on empty <auth/> tag
Matthew Wild <mwild1@gmail.com>
parents:
2206
diff
changeset
|
82 | return _M; |