Sat, 15 Nov 2008 23:22:27 +0000
Merge with myself (!)
38 | 1 | |
2 | local st = require "util.stanza"; | |
3 | local send = require "core.sessionmanager".send_to_session; | |
46
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
4 | local sm_bind_resource = require "core.sessionmanager".bind_resource; |
281
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
5 | local jid |
294
5d861d6e5bbd
Made SASL module fit the new interface.
Tobias Markmann <tm@ayena.de>
parents:
293
diff
changeset
|
6 | local base64 = require "base64" |
38 | 7 | |
8 | local usermanager_validate_credentials = require "core.usermanager".validate_credentials; | |
46
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
9 | local t_concat, t_insert = table.concat, table.insert; |
38 | 10 | local tostring = tostring; |
288
dc53343af9ac
Set username in a SASL object.
Tobias Markmann <tm@ayena.de>
parents:
286
diff
changeset
|
11 | local jid_split = require "util.jid".split |
38 | 12 | |
13 | local log = require "util.logger".init("mod_saslauth"); | |
14 | ||
15 | local xmlns_sasl ='urn:ietf:params:xml:ns:xmpp-sasl'; | |
46
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
16 | local xmlns_bind ='urn:ietf:params:xml:ns:xmpp-bind'; |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
17 | local xmlns_stanzas ='urn:ietf:params:xml:ns:xmpp-stanzas'; |
38 | 18 | |
19 | local new_sasl = require "util.sasl".new; | |
20 | ||
292
33175ad2f682
Started using realm in password hashing, and added support for error message replies from sasl
Waqas Hussain <waqas20@gmail.com>
parents:
291
diff
changeset
|
21 | local function build_reply(status, ret, err_msg) |
281
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
22 | local reply = st.stanza(status, {xmlns = xmlns_sasl}); |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
23 | if status == "challenge" then |
293
b446de4e258e
base64 encode the sasl responses
Waqas Hussain <waqas20@gmail.com>
parents:
292
diff
changeset
|
24 | reply:text(base64.encode(ret or "")); |
281
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
25 | elseif status == "failure" then |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
26 | reply:tag(ret):up(); |
293
b446de4e258e
base64 encode the sasl responses
Waqas Hussain <waqas20@gmail.com>
parents:
292
diff
changeset
|
27 | if err_msg then reply:tag("text"):text(err_msg); end |
281
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
28 | elseif status == "success" then |
293
b446de4e258e
base64 encode the sasl responses
Waqas Hussain <waqas20@gmail.com>
parents:
292
diff
changeset
|
29 | reply:text(base64.encode(ret or "")); |
281
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
30 | else |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
31 | error("Unknown sasl status: "..status); |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
32 | end |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
33 | return reply; |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
34 | end |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
35 | |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
36 | local function handle_status(session, status) |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
37 | if status == "failure" then |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
38 | session.sasl_handler = nil; |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
39 | elseif status == "success" then |
287
5c405d7b06bb
Set username on SASL success
Waqas Hussain <waqas20@gmail.com>
parents:
284
diff
changeset
|
40 | if not session.sasl_handler.username then error("SASL succeeded but we didn't get a username!"); end -- TODO move this to sessionmanager |
5c405d7b06bb
Set username on SASL success
Waqas Hussain <waqas20@gmail.com>
parents:
284
diff
changeset
|
41 | sessionmanager.make_authenticated(session, session.sasl_handler.username); |
281
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
42 | session.sasl_handler = nil; |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
43 | session:reset_stream(); |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
44 | end |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
45 | end |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
46 | |
292
33175ad2f682
Started using realm in password hashing, and added support for error message replies from sasl
Waqas Hussain <waqas20@gmail.com>
parents:
291
diff
changeset
|
47 | local function password_callback(node, host, mechanism) |
281
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
48 | local password = (datamanager.load(node, host, "accounts") or {}).password; -- FIXME handle hashed passwords |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
49 | local func = function(x) return x; end; |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
50 | if password then |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
51 | if mechanism == "PLAIN" then |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
52 | return func, password; |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
53 | elseif mechanism == "DIGEST-MD5" then |
296
21835c4fc34f
Using md5.sum rather than hashes.md5 because we don't want hexadecimal
Waqas Hussain <waqas20@gmail.com>
parents:
295
diff
changeset
|
54 | return func, require "md5".sum(node..":"..host..":"..password); |
281
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
55 | end |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
56 | end |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
57 | return func, nil; |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
58 | end |
826308c07627
mod_saslauth updated for digest-md5
Waqas Hussain <waqas20@gmail.com>
parents:
120
diff
changeset
|
59 | |
295
bb078eb1f1de
mod_saslauth: Code cleanup
Waqas Hussain <waqas20@gmail.com>
parents:
293
diff
changeset
|
60 | function sasl_handler(session, stanza) |
bb078eb1f1de
mod_saslauth: Code cleanup
Waqas Hussain <waqas20@gmail.com>
parents:
293
diff
changeset
|
61 | if stanza.name == "auth" then |
bb078eb1f1de
mod_saslauth: Code cleanup
Waqas Hussain <waqas20@gmail.com>
parents:
293
diff
changeset
|
62 | -- FIXME ignoring duplicates because ejabberd does |
bb078eb1f1de
mod_saslauth: Code cleanup
Waqas Hussain <waqas20@gmail.com>
parents:
293
diff
changeset
|
63 | session.sasl_handler = new_sasl(stanza.attr.mechanism, session.host, password_callback); |
bb078eb1f1de
mod_saslauth: Code cleanup
Waqas Hussain <waqas20@gmail.com>
parents:
293
diff
changeset
|
64 | elseif not session.sasl_handler then |
bb078eb1f1de
mod_saslauth: Code cleanup
Waqas Hussain <waqas20@gmail.com>
parents:
293
diff
changeset
|
65 | return; -- FIXME ignoring out of order stanzas because ejabberd does |
bb078eb1f1de
mod_saslauth: Code cleanup
Waqas Hussain <waqas20@gmail.com>
parents:
293
diff
changeset
|
66 | end |
284
4f540755260c
mod_saslauth: Added base64 decoding, encoding check, and cleaned the code up.
Waqas Hussain <waqas20@gmail.com>
parents:
281
diff
changeset
|
67 | local text = stanza[1]; |
4f540755260c
mod_saslauth: Added base64 decoding, encoding check, and cleaned the code up.
Waqas Hussain <waqas20@gmail.com>
parents:
281
diff
changeset
|
68 | if text then |
4f540755260c
mod_saslauth: Added base64 decoding, encoding check, and cleaned the code up.
Waqas Hussain <waqas20@gmail.com>
parents:
281
diff
changeset
|
69 | text = base64.decode(text); |
4f540755260c
mod_saslauth: Added base64 decoding, encoding check, and cleaned the code up.
Waqas Hussain <waqas20@gmail.com>
parents:
281
diff
changeset
|
70 | if not text then |
4f540755260c
mod_saslauth: Added base64 decoding, encoding check, and cleaned the code up.
Waqas Hussain <waqas20@gmail.com>
parents:
281
diff
changeset
|
71 | session.sasl_handler = nil; |
4f540755260c
mod_saslauth: Added base64 decoding, encoding check, and cleaned the code up.
Waqas Hussain <waqas20@gmail.com>
parents:
281
diff
changeset
|
72 | session.send(build_reply("failure", "incorrect-encoding")); |
4f540755260c
mod_saslauth: Added base64 decoding, encoding check, and cleaned the code up.
Waqas Hussain <waqas20@gmail.com>
parents:
281
diff
changeset
|
73 | return; |
4f540755260c
mod_saslauth: Added base64 decoding, encoding check, and cleaned the code up.
Waqas Hussain <waqas20@gmail.com>
parents:
281
diff
changeset
|
74 | end |
4f540755260c
mod_saslauth: Added base64 decoding, encoding check, and cleaned the code up.
Waqas Hussain <waqas20@gmail.com>
parents:
281
diff
changeset
|
75 | end |
292
33175ad2f682
Started using realm in password hashing, and added support for error message replies from sasl
Waqas Hussain <waqas20@gmail.com>
parents:
291
diff
changeset
|
76 | local status, ret, err_msg = session.sasl_handler:feed(text); |
284
4f540755260c
mod_saslauth: Added base64 decoding, encoding check, and cleaned the code up.
Waqas Hussain <waqas20@gmail.com>
parents:
281
diff
changeset
|
77 | handle_status(session, status); |
292
33175ad2f682
Started using realm in password hashing, and added support for error message replies from sasl
Waqas Hussain <waqas20@gmail.com>
parents:
291
diff
changeset
|
78 | local s = build_reply(status, ret, err_msg); |
288
dc53343af9ac
Set username in a SASL object.
Tobias Markmann <tm@ayena.de>
parents:
286
diff
changeset
|
79 | log("debug", "sasl reply: "..tostring(s)); |
dc53343af9ac
Set username in a SASL object.
Tobias Markmann <tm@ayena.de>
parents:
286
diff
changeset
|
80 | session.send(s); |
284
4f540755260c
mod_saslauth: Added base64 decoding, encoding check, and cleaned the code up.
Waqas Hussain <waqas20@gmail.com>
parents:
281
diff
changeset
|
81 | end |
4f540755260c
mod_saslauth: Added base64 decoding, encoding check, and cleaned the code up.
Waqas Hussain <waqas20@gmail.com>
parents:
281
diff
changeset
|
82 | |
295
bb078eb1f1de
mod_saslauth: Code cleanup
Waqas Hussain <waqas20@gmail.com>
parents:
293
diff
changeset
|
83 | add_handler("c2s_unauthed", "auth", xmlns_sasl, sasl_handler); |
bb078eb1f1de
mod_saslauth: Code cleanup
Waqas Hussain <waqas20@gmail.com>
parents:
293
diff
changeset
|
84 | add_handler("c2s_unauthed", "abort", xmlns_sasl, sasl_handler); |
bb078eb1f1de
mod_saslauth: Code cleanup
Waqas Hussain <waqas20@gmail.com>
parents:
293
diff
changeset
|
85 | add_handler("c2s_unauthed", "response", xmlns_sasl, sasl_handler); |
284
4f540755260c
mod_saslauth: Added base64 decoding, encoding check, and cleaned the code up.
Waqas Hussain <waqas20@gmail.com>
parents:
281
diff
changeset
|
86 | |
46
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
87 | add_event_hook("stream-features", |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
88 | function (session, features) |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
89 | if not session.username then |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
90 | t_insert(features, "<mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>"); |
283
8e1fd8ff66ee
Adding some TODO for some security issue.
Tobias Markmann <tm@ayena.de>
parents:
282
diff
changeset
|
91 | -- TODO: Provide PLAIN only if TLS is active, this is a SHOULD from the introduction of RFC 4616. This behavior could be overridden via configuration but will issuing a warning or so. |
46
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
92 | t_insert(features, "<mechanism>PLAIN</mechanism>"); |
294
5d861d6e5bbd
Made SASL module fit the new interface.
Tobias Markmann <tm@ayena.de>
parents:
293
diff
changeset
|
93 | t_insert(features, "<mechanism>DIGEST-MD5</mechanism>"); |
46
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
94 | t_insert(features, "</mechanisms>"); |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
95 | else |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
96 | t_insert(features, "<bind xmlns='urn:ietf:params:xml:ns:xmpp-bind'><required/></bind>"); |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
97 | t_insert(features, "<session xmlns='urn:ietf:params:xml:ns:xmpp-session'/>"); |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
98 | end |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
99 | --send [[<register xmlns="http://jabber.org/features/iq-register"/> ]] |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
100 | end); |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
101 | |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
102 | add_iq_handler("c2s", "urn:ietf:params:xml:ns:xmpp-bind", |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
103 | function (session, stanza) |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
104 | log("debug", "Client tried to bind to a resource"); |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
105 | local resource; |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
106 | if stanza.attr.type == "set" then |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
107 | local bind = stanza.tags[1]; |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
108 | if bind and bind.attr.xmlns == xmlns_bind then |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
109 | resource = bind:child_with_name("resource"); |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
110 | if resource then |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
111 | resource = resource[1]; |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
112 | end |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
113 | end |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
114 | end |
304
7b28fa8bbfe5
Code cleanup for resource binding
Waqas Hussain <waqas20@gmail.com>
parents:
297
diff
changeset
|
115 | local success, err_type, err, err_msg = sm_bind_resource(session, resource); |
46
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
116 | if not success then |
304
7b28fa8bbfe5
Code cleanup for resource binding
Waqas Hussain <waqas20@gmail.com>
parents:
297
diff
changeset
|
117 | session.send(st.error_reply(stanza, err_type, err, err_msg)); |
46
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
118 | else |
304
7b28fa8bbfe5
Code cleanup for resource binding
Waqas Hussain <waqas20@gmail.com>
parents:
297
diff
changeset
|
119 | session.send(st.reply(stanza) |
7b28fa8bbfe5
Code cleanup for resource binding
Waqas Hussain <waqas20@gmail.com>
parents:
297
diff
changeset
|
120 | :tag("bind", { xmlns = xmlns_bind}) |
7b28fa8bbfe5
Code cleanup for resource binding
Waqas Hussain <waqas20@gmail.com>
parents:
297
diff
changeset
|
121 | :tag("jid"):text(session.full_jid)); |
46
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
122 | end |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
123 | end); |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
124 | |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
125 | add_iq_handler("c2s", "urn:ietf:params:xml:ns:xmpp-session", |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
126 | function (session, stanza) |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
127 | log("debug", "Client tried to bind to a resource"); |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
128 | send(session, st.reply(stanza)); |
d6b3f9dbb624
Resource binding, XMPP sessions (whatever they're for...)
Matthew Wild <mwild1@gmail.com>
parents:
38
diff
changeset
|
129 | end); |