projects
/
prosody.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
mod_dialback: Follow XEP-0185 and use HMAC
[prosody.git]
/
plugins
/
mod_dialback.lua
diff --git
a/plugins/mod_dialback.lua
b/plugins/mod_dialback.lua
index 67be15e33bda6ecb7ed17a7758ed7b6fbcd0ea55..dc3c3f10a7a06cf8a52ec9aa8463c2039ed62ab4 100644
(file)
--- a/
plugins/mod_dialback.lua
+++ b/
plugins/mod_dialback.lua
@@
-7,12
+7,12
@@
--
local hosts = _G.hosts;
--
local hosts = _G.hosts;
-local s2s_make_authenticated = require "core.s2smanager".make_authenticated;
local log = module._log;
local st = require "util.stanza";
local sha256_hash = require "util.hashes".sha256;
local log = module._log;
local st = require "util.stanza";
local sha256_hash = require "util.hashes".sha256;
+local sha256_hmac = require "util.hashes".hmac_sha256;
local nameprep = require "util.encodings".stringprep.nameprep;
local xmlns_stream = "http://etherx.jabber.org/streams";
local nameprep = require "util.encodings".stringprep.nameprep;
local xmlns_stream = "http://etherx.jabber.org/streams";
@@
-20,7
+20,7
@@
local xmlns_stream = "http://etherx.jabber.org/streams";
local dialback_requests = setmetatable({}, { __mode = 'v' });
function generate_dialback(id, to, from)
local dialback_requests = setmetatable({}, { __mode = 'v' });
function generate_dialback(id, to, from)
- return sha256_h
ash(id..to..from..hosts[from].dialback_secret
, true);
+ return sha256_h
mac(sha256_hash(hosts[from].dialback_secret), to .. ' ' .. from .. ' ' .. id
, true);
end
function initiate_dialback(session)
end
function initiate_dialback(session)
@@
-41,6
+41,11
@@
module:hook("stanza/jabber:server:dialback:verify", function(event)
-- We are being asked to verify the key, to ensure it was generated by us
origin.log("debug", "verifying that dialback key is ours...");
local attr = stanza.attr;
-- We are being asked to verify the key, to ensure it was generated by us
origin.log("debug", "verifying that dialback key is ours...");
local attr = stanza.attr;
+ if attr.type then
+ module:log("warn", "Ignoring incoming session from %s claiming a dialback key for %s is %s",
+ origin.from_host or "(unknown)", attr.from or "(unknown)", attr.type);
+ return true;
+ end
-- COMPAT: Grr, ejabberd breaks this one too?? it is black and white in XEP-220 example 34
--if attr.from ~= origin.to_host then error("invalid-from"); end
local type;
-- COMPAT: Grr, ejabberd breaks this one too?? it is black and white in XEP-220 example 34
--if attr.from ~= origin.to_host then error("invalid-from"); end
local type;
@@
-102,18
+107,17
@@
module:hook("stanza/jabber:server:dialback:verify", function(event)
if origin.type == "s2sout_unauthed" or origin.type == "s2sout" then
local attr = stanza.attr;
local dialback_verifying = dialback_requests[attr.from.."/"..(attr.id or "")];
if origin.type == "s2sout_unauthed" or origin.type == "s2sout" then
local attr = stanza.attr;
local dialback_verifying = dialback_requests[attr.from.."/"..(attr.id or "")];
- module:log("debug", tostring(dialback_verifying).." "..attr.from.." "..origin.to_host);
if dialback_verifying and attr.from == origin.to_host then
local valid;
if attr.type == "valid" then
if dialback_verifying and attr.from == origin.to_host then
local valid;
if attr.type == "valid" then
-
s2s_make_authenticated(dialback_verifying, attr.from
);
+
module:fire_event("s2s-authenticated", { session = dialback_verifying, host = attr.from }
);
valid = "valid";
else
-- Warn the original connection that is was not verified successfully
valid = "valid";
else
-- Warn the original connection that is was not verified successfully
- log("warn", "authoritative server for
"..(attr.from or "(unknown)").." denied the key
");
+ log("warn", "authoritative server for
%s denied the key", attr.from or "(unknown)
");
valid = "invalid";
end
valid = "invalid";
end
- if
not dialback_verifying.sends2s
then
+ if
dialback_verifying.destroyed
then
log("warn", "Incoming s2s session %s was closed in the meantime, so we can't notify it of the db result", tostring(dialback_verifying):match("%w+$"));
else
dialback_verifying.sends2s(
log("warn", "Incoming s2s session %s was closed in the meantime, so we can't notify it of the db result", tostring(dialback_verifying):match("%w+$"));
else
dialback_verifying.sends2s(
@@
-142,7
+146,7
@@
module:hook("stanza/jabber:server:dialback:result", function(event)
return true;
end
if stanza.attr.type == "valid" then
return true;
end
if stanza.attr.type == "valid" then
-
s2s_make_authenticated(origin, attr.from
);
+
module:fire_event("s2s-authenticated", { session = origin, host = attr.from }
);
else
origin:close("not-authorized", "dialback authentication failed");
end
else
origin:close("not-authorized", "dialback authentication failed");
end
@@
-166,7
+170,7
@@
module:hook_stanza(xmlns_stream, "features", function (origin, stanza)
end
end, 100);
end
end, 100);
-module:hook("s2s-authenticate-legacy", function (event)
+module:hook("s2s
out
-authenticate-legacy", function (event)
module:log("debug", "Initiating dialback...");
initiate_dialback(event.origin);
return true;
module:log("debug", "Initiating dialback...");
initiate_dialback(event.origin);
return true;