plugins/mod_saslauth.lua

   1 -- Prosody IM
   2 -- Copyright (C) 2008-2010 Matthew Wild
   3 -- Copyright (C) 2008-2010 Waqas Hussain
   4 --
   5 -- This project is MIT/X11 licensed. Please see the
   6 -- COPYING file in the source package for more information.
   7 --
   8
   9
  10
  11 local st = require "util.stanza";
  12 local sm_bind_resource = require "core.sessionmanager".bind_resource;
  13 local sm_make_authenticated = require "core.sessionmanager".make_authenticated;
  14 local base64 = require "util.encodings".base64;
  15
  16 local nodeprep = require "util.encodings".stringprep.nodeprep;
  17 local usermanager_get_sasl_handler = require "core.usermanager".get_sasl_handler;
  18 local tostring = tostring;
  19
  20 local secure_auth_only = module:get_option("c2s_require_encryption") or module:get_option("require_encryption");
  21 local allow_unencrypted_plain_auth = module:get_option("allow_unencrypted_plain_auth")
  22
  23 local log = module._log;
  24
  25 local xmlns_sasl ='urn:ietf:params:xml:ns:xmpp-sasl';
  26 local xmlns_bind ='urn:ietf:params:xml:ns:xmpp-bind';
  27 local xmlns_stanzas ='urn:ietf:params:xml:ns:xmpp-stanzas';
  28
  29 local function build_reply(status, ret, err_msg)
  30         local reply = st.stanza(status, {xmlns = xmlns_sasl});
  31         if status == "challenge" then
  32                 --log("debug", "CHALLENGE: %s", ret or "");
  33                 reply:text(base64.encode(ret or ""));
  34         elseif status == "failure" then
  35                 reply:tag(ret):up();
  36                 if err_msg then reply:tag("text"):text(err_msg); end
  37         elseif status == "success" then
  38                 --log("debug", "SUCCESS: %s", ret or "");
  39                 reply:text(base64.encode(ret or ""));
  40         else
  41                 module:log("error", "Unknown sasl status: %s", status);
  42         end
  43         return reply;
  44 end
  45
  46 local function handle_status(session, status, ret, err_msg)
  47         if status == "failure" then
  48                 session.sasl_handler = session.sasl_handler:clean_clone();
  49         elseif status == "success" then
  50                 local username = nodeprep(session.sasl_handler.username);
  51
  52                 local ok, err = sm_make_authenticated(session, session.sasl_handler.username);
  53                 if ok then
  54                         session.sasl_handler = nil;
  55                         session:reset_stream();
  56                 else
  57                         module:log("warn", "SASL succeeded but username was invalid");
  58                         session.sasl_handler = session.sasl_handler:clean_clone();
  59                         return "failure", "not-authorized", "User authenticated successfully, but username was invalid";
  60                 end
  61         end
  62         return status, ret, err_msg;
  63 end
  64
  65 local function sasl_process_cdata(session, stanza)
  66         local text = stanza[1];
  67         if text then
  68                 text = base64.decode(text);
  69                 --log("debug", "AUTH: %s", text:gsub("[%z\001-\008\011\012\014-\031]", " "));
  70                 if not text then
  71                         session.sasl_handler = nil;
  72                         session.send(build_reply("failure", "incorrect-encoding"));
  73                         return true;
  74                 end
  75         end
  76         local status, ret, err_msg = session.sasl_handler:process(text);
  77         status, ret, err_msg = handle_status(session, status, ret, err_msg);
  78         local s = build_reply(status, ret, err_msg);
  79         log("debug", "sasl reply: %s", tostring(s));
  80         session.send(s);
  81         return true;
  82 end
  83
  84 module:hook("stanza/urn:ietf:params:xml:ns:xmpp-sasl:auth", function(event)
  85         local session, stanza = event.origin, event.stanza;
  86         if session.type ~= "c2s_unauthed" then return; end
  87
  88         if session.sasl_handler and session.sasl_handler.selected then
  89                 session.sasl_handler = nil; -- allow starting a new SASL negotiation before completing an old one
  90         end
  91         if not session.sasl_handler then
  92                 session.sasl_handler = usermanager_get_sasl_handler(module.host);
  93         end
  94         local mechanism = stanza.attr.mechanism;
  95         if not session.secure and (secure_auth_only or (mechanism == "PLAIN" and not allow_unencrypted_plain_auth)) then
  96                 session.send(build_reply("failure", "encryption-required"));
  97                 return true;
  98         end
  99         local valid_mechanism = session.sasl_handler:select(mechanism);
 100         if not valid_mechanism then
 101                 session.send(build_reply("failure", "invalid-mechanism"));
 102                 return true;
 103         end
 104         return sasl_process_cdata(session, stanza);
 105 end);
 106 module:hook("stanza/urn:ietf:params:xml:ns:xmpp-sasl:response", function(event)
 107         local session = event.origin;
 108         if not(session.sasl_handler and session.sasl_handler.selected) then
 109                 session.send(build_reply("failure", "not-authorized", "Out of order SASL element"));
 110                 return true;
 111         end
 112         return sasl_process_cdata(session, event.stanza);
 113 end);
 114 module:hook("stanza/urn:ietf:params:xml:ns:xmpp-sasl:abort", function(event)
 115         local session = event.origin;
 116         session.sasl_handler = nil;
 117         session.send(build_reply("failure", "aborted"));
 118         return true;
 119 end);
 120
 121 local mechanisms_attr = { xmlns='urn:ietf:params:xml:ns:xmpp-sasl' };
 122 local bind_attr = { xmlns='urn:ietf:params:xml:ns:xmpp-bind' };
 123 local xmpp_session_attr = { xmlns='urn:ietf:params:xml:ns:xmpp-session' };
 124 module:hook("stream-features", function(event)
 125         local origin, features = event.origin, event.features;
 126         if not origin.username then
 127                 if secure_auth_only and not origin.secure then
 128                         return;
 129                 end
 130                 origin.sasl_handler = usermanager_get_sasl_handler(module.host);
 131                 features:tag("mechanisms", mechanisms_attr);
 132                 for mechanism in pairs(origin.sasl_handler:mechanisms()) do
 133                         if mechanism ~= "PLAIN" or origin.secure or allow_unencrypted_plain_auth then
 134                                 features:tag("mechanism"):text(mechanism):up();
 135                         end
 136                 end
 137                 features:up();
 138         else
 139                 features:tag("bind", bind_attr):tag("required"):up():up();
 140                 features:tag("session", xmpp_session_attr):tag("optional"):up():up();
 141         end
 142 end);
 143
 144 module:hook("iq/self/urn:ietf:params:xml:ns:xmpp-bind:bind", function(event)
 145         local origin, stanza = event.origin, event.stanza;
 146         local resource;
 147         if stanza.attr.type == "set" then
 148                 local bind = stanza.tags[1];
 149                 resource = bind:child_with_name("resource");
 150                 resource = resource and #resource.tags == 0 and resource[1] or nil;
 151         end
 152         local success, err_type, err, err_msg = sm_bind_resource(origin, resource);
 153         if success then
 154                 origin.send(st.reply(stanza)
 155                         :tag("bind", { xmlns = xmlns_bind })
 156                         :tag("jid"):text(origin.full_jid));
 157                 origin.log("debug", "Resource bound: %s", origin.full_jid);
 158         else
 159                 origin.send(st.error_reply(stanza, err_type, err, err_msg));
 160                 origin.log("debug", "Resource bind failed: %s", err_msg or err);
 161         end
 162         return true;
 163 end);
 164
 165 local function handle_legacy_session(event)
 166         event.origin.send(st.reply(event.stanza));
 167         return true;
 168 end
 169
 170 module:hook("iq/self/urn:ietf:params:xml:ns:xmpp-session:session", handle_legacy_session);
 171 module:hook("iq/host/urn:ietf:params:xml:ns:xmpp-session:session", handle_legacy_session);