mirrors/prosody
1
0
Fork 0
mirror of https://github.com/bjc/prosody.git synced 2025-04-03 21:27:38 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge 0.11->trunk

Browse source
This commit is contained in:
Kim Alvefur 2020-06-06 00:54:28 +02:00
commit e083756418
5 changed files with 30 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
plugins/mod_auth_insecure.lua
View file

@ -9,6 +9,7 @@
local datamanager = require "util.datamanager";
local new_sasl = require "util.sasl".new;
local saslprep = require "util.encodings".stringprep.saslprep;
local host = module.host;
local provider = { name = "insecure" };
@ -21,6 +22,10 @@ end
function provider.set_password(username, password)
local account = datamanager.load(username, host, "accounts");
password = saslprep(password);
if not password then
return nil, "Password fails SASLprep.";
end
if account then
account.password = password;
return datamanager.store(username, host, "accounts", account);

7
plugins/mod_auth_internal_hashed.lua
View file

@ -15,6 +15,7 @@ local generate_uuid = require "util.uuid".generate;
local new_sasl = require "util.sasl".new;
local hex = require"util.hex";
local to_hex, from_hex = hex.to, hex.from;
local saslprep = require "util.encodings".stringprep.saslprep;
local log = module._log;
local host = module.host;
@ -34,9 +35,13 @@ local provider = {};
function provider.test_password(username, password)
log("debug", "test password for user '%s'", username);
local credentials = accounts:get(username) or {};
password = saslprep(password);
if not password then
return nil, "Password fails SASLprep.";
end
if credentials.password ~= nil and string.len(credentials.password) ~= 0 then
if credentials.password ~= password then
if saslprep(credentials.password) ~= password then
return nil, "Auth failed. Provided password is incorrect.";
end

15
plugins/mod_auth_internal_plain.lua
View file

@ -8,6 +8,7 @@
local usermanager = require "core.usermanager";
local new_sasl = require "util.sasl".new;
local saslprep = require "util.encodings".stringprep.saslprep;
local log = module._log;
local host = module.host;
@ -20,8 +21,12 @@ local provider = {};
function provider.test_password(username, password)
log("debug", "test password for user '%s'", username);
local credentials = accounts:get(username) or {};
password = saslprep(password);
if not password then
return nil, "Password fails SASLprep.";
end
if password == credentials.password then
if password == saslprep(credentials.password) then
return true;
else
return nil, "Auth failed. Invalid username or password.";
@ -35,6 +40,10 @@ end
function provider.set_password(username, password)
log("debug", "set_password for username '%s'", username);
password = saslprep(password);
if not password then
return nil, "Password fails SASLprep.";
end
local account = accounts:get(username);
if account then
account.password = password;
@ -57,6 +66,10 @@ function provider.users()
end
function provider.create_user(username, password)
password = saslprep(password);
if not password then
return nil, "Password fails SASLprep.";
end
return accounts:set(username, {password = password});
end

2
util/sasl/plain.lua
View file

@ -70,7 +70,7 @@ local function plain(self, message)
if self.profile.plain then
local correct_password;
correct_password, state = self.profile.plain(self, authentication, self.realm);
correct = (correct_password == password);
correct = (saslprep(correct_password) == password);
elseif self.profile.plain_test then
correct, state = self.profile.plain_test(self, authentication, password, self.realm);
end

4
util/sasl/scram.lua
View file

@ -105,6 +105,10 @@ local function get_scram_hasher(H, HMAC, Hi)
if iteration_count < 4096 then
log("warn", "Iteration count < 4096 which is the suggested minimum according to RFC 5802.")
end
password = saslprep(password);
if not password then
return false, "password fails SASLprep";
end
local salted_password = Hi(password, salt, iteration_count);
local stored_key = H(HMAC(salted_password, "Client Key"))
local server_key = HMAC(salted_password, "Server Key");