mirrors/prosody
1
0
Fork 0
mirror of https://github.com/bjc/prosody.git synced 2025-04-05 22:27:38 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Making mod_saslauth use the new SASL API.

Browse source
This commit is contained in:
Tobias Markmann 2009-08-28 13:04:38 +02:00
parent 58d9ad4e7e
commit 1d2b8a073b
2 changed files with 24 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

18
plugins/mod_saslauth.lua
View file

@ -34,6 +34,12 @@ local xmlns_stanzas ='urn:ietf:params:xml:ns:xmpp-stanzas';
local new_sasl = require "util.sasl".new; local new_sasl = require "util.sasl".new;
default_authentication_profile = {
plain = function(username, realm)
return usermanager_get_password(username, realm), true;
end
};
local function build_reply(status, ret, err_msg) local function build_reply(status, ret, err_msg)
local reply = st.stanza(status, {xmlns = xmlns_sasl}); local reply = st.stanza(status, {xmlns = xmlns_sasl});
if status == "challenge" then if status == "challenge" then
@ -101,8 +107,8 @@ local function sasl_handler(session, stanza)
elseif stanza.attr.mechanism == "ANONYMOUS" then elseif stanza.attr.mechanism == "ANONYMOUS" then
return session.send(build_reply("failure", "mechanism-too-weak")); return session.send(build_reply("failure", "mechanism-too-weak"));
end end
session.sasl_handler = new_sasl(stanza.attr.mechanism, session.host, credentials_callback); local valid_mechanism = session.sasl_handler:select(stanza.attr.mechanism);
if not session.sasl_handler then if not valid_mechanism then
return session.send(build_reply("failure", "invalid-mechanism")); return session.send(build_reply("failure", "invalid-mechanism"));
end end
elseif not session.sasl_handler then elseif not session.sasl_handler then
@ -118,7 +124,7 @@ local function sasl_handler(session, stanza)
return; return;
end end
end end
local status, ret, err_msg = session.sasl_handler:feed(text); local status, ret, err_msg = session.sasl_handler:process(text);
handle_status(session, status); handle_status(session, status);
local s = build_reply(status, ret, err_msg); local s = build_reply(status, ret, err_msg);
log("debug", "sasl reply: %s", tostring(s)); log("debug", "sasl reply: %s", tostring(s));
@ -138,14 +144,14 @@ module:add_event_hook("stream-features",
if secure_auth_only and not session.secure then if secure_auth_only and not session.secure then
return; return;
end end
session.sasl_handler = new_sasl(session.host, default_authentication_profile);
features:tag("mechanisms", mechanisms_attr); features:tag("mechanisms", mechanisms_attr);
-- TODO: Provide PLAIN only if TLS is active, this is a SHOULD from the introduction of RFC 4616. This behavior could be overridden via configuration but will issuing a warning or so. -- TODO: Provide PLAIN only if TLS is active, this is a SHOULD from the introduction of RFC 4616. This behavior could be overridden via configuration but will issuing a warning or so.
if config.get(session.host or "*", "core", "anonymous_login") then if config.get(session.host or "*", "core", "anonymous_login") then
features:tag("mechanism"):text("ANONYMOUS"):up(); features:tag("mechanism"):text("ANONYMOUS"):up();
else else
mechanisms = usermanager_get_supported_methods(session.host or "*"); for k, v in pairs(session.sasl_handler:mechanisms()) do
for k, v in pairs(mechanisms) do features:tag("mechanism"):text(v):up();
features:tag("mechanism"):text(k):up();
end end
end end
features:up(); features:up();

18
util/sasl.lua
View file

@ -81,6 +81,7 @@ end
-- create a new SASL object which can be used to authenticate clients -- create a new SASL object which can be used to authenticate clients
function new(realm, profile) function new(realm, profile)
sasl_i = {profile = profile}; sasl_i = {profile = profile};
sasl_i.realm = realm;
return setmetatable(sasl_i, method); return setmetatable(sasl_i, method);
end end
@ -92,7 +93,7 @@ function method:mechanisms()
if backend_mechanism[backend] then if backend_mechanism[backend] then
for _, mechanism in ipairs(backend_mechanism[backend]) do for _, mechanism in ipairs(backend_mechanism[backend]) do
mechanisms[mechanism] = true; mechanisms[mechanism] = true;
end end
end end
end end
self["possible_mechanisms"] = mechanisms; self["possible_mechanisms"] = mechanisms;
@ -102,7 +103,9 @@ end
-- select a mechanism to use -- select a mechanism to use
function method:select(mechanism) function method:select(mechanism)
self.mech_i = mechanisms[mechanism] self.mech_i = mechanisms[mechanism]
if self.mech_i == nil then return false; end if self.mech_i == nil then
return false;
end
return true; return true;
end end
@ -120,13 +123,16 @@ local function sasl_mechanism_plain(self, message)
local authentication = s_match(response, "%z([^&%z]+)%z") local authentication = s_match(response, "%z([^&%z]+)%z")
local password = s_match(response, "%z[^&%z]+%z([^&%z]+)") local password = s_match(response, "%z[^&%z]+%z([^&%z]+)")
if authentication == nil or password == nil then return "failure", "malformed-request" end if authentication == nil or password == nil then
return "failure", "malformed-request";
end
local correct, state = false, false, false; local correct, state = false, false;
if self.profile.plain then if self.profile.plain then
local correct_password, state = self.profile.plain(authentication, self.realm); local correct_password;
correct_password, state = self.profile.plain(authentication, self.realm);
if correct_password == password then correct = true; else correct = false; end if correct_password == password then correct = true; else correct = false; end
else if self.profile.plain_test then elseif self.profile.plain_test then
correct, state = self.profile.plain_test(authentication, self.realm, password); correct, state = self.profile.plain_test(authentication, self.realm, password);
end end