Another unwanted spaces at the end of a line.

[prosody.git] / plugins / mod_saslauth.lua

diff --git a/plugins/mod_saslauth.lua b/plugins/mod_saslauth.lua
index 3f570e402ba1894929067628c3f625da499bfa2f..8d3b4ae40133be814cc6dbb7b2d408df7f161d46 100644 (file)
--- a/plugins/mod_saslauth.lua
+++ b/plugins/mod_saslauth.lua
@@ -1,7 +1,7 @@
--- Prosody IM v0.4
+-- Prosody IM
 -- Copyright (C) 2008-2009 Matthew Wild
 -- Copyright (C) 2008-2009 Waqas Hussain
--- 
+--
 -- This project is MIT/X11 licensed. Please see the
 -- COPYING file in the source package for more information.
 --
@@ -15,12 +15,17 @@ local base64 = require "util.encodings".base64;
 
 local datamanager_load = require "util.datamanager".load;
 local usermanager_validate_credentials = require "core.usermanager".validate_credentials;
+local usermanager_get_supported_methods = require "core.usermanager".get_supported_methods;
+local usermanager_user_exists = require "core.usermanager".user_exists;
+local usermanager_get_password = require "core.usermanager".get_password;
 local t_concat, t_insert = table.concat, table.insert;
 local tostring = tostring;
 local jid_split = require "util.jid".split
 local md5 = require "util.hashes".md5;
 local config = require "core.configmanager";
 
+local secure_auth_only = config.get(module:get_host(), "core", "require_encryption");
+
 local log = module._log;
 
 local xmlns_sasl ='urn:ietf:params:xml:ns:xmpp-sasl';
@@ -55,25 +60,35 @@ local function handle_status(session, status)
                        session.sasl_handler = nil;
                        session:reset_stream();
                        return;
-               end 
+               end
                sm_make_authenticated(session, session.sasl_handler.username);
                session.sasl_handler = nil;
                session:reset_stream();
        end
 end
 
-local function password_callback(node, host, mechanism, decoder)
-       local password = (datamanager_load(node, host, "accounts") or {}).password; -- FIXME handle hashed passwords
-       local func = function(x) return x; end;
-       if password then
-               if mechanism == "PLAIN" then
-                       return func, password;
-               elseif mechanism == "DIGEST-MD5" then
-                       if decoder then node, host, password = decoder(node), decoder(host), decoder(password); end
-                       return func, md5(node..":"..host..":"..password);
+local function credentials_callback(mechanism, ...)
+       if mechanism == "PLAIN" then
+               local username, hostname, password = ...;
+               local response = usermanager_validate_credentials(hostname, username, password, mechanism);
+               if response == nil then
+                       return false;
+               else
+                       return response;
+               end
+       elseif mechanism == "DIGEST-MD5" then
+               function func(x) return x; end
+               local node, domain, realm, decoder = ...;
+               local password = usermanager_get_password(node, domain);
+               if password then
+                       if decoder then
+                               node, realm, password = decoder(node), decoder(realm), decoder(password);
+                       end
+                       return func, md5(node..":"..realm..":"..password);
+               else
+                       return func, nil;
                end
        end
-       return func, nil;
 end
 
 local function sasl_handler(session, stanza)
@@ -86,7 +101,7 @@ local function sasl_handler(session, stanza)
                elseif stanza.attr.mechanism == "ANONYMOUS" then
                        return session.send(build_reply("failure", "mechanism-too-weak"));
                end
-               session.sasl_handler = new_sasl(stanza.attr.mechanism, session.host, password_callback);
+               session.sasl_handler = new_sasl(stanza.attr.mechanism, session.host, credentials_callback);
                if not session.sasl_handler then
                        return session.send(build_reply("failure", "invalid-mechanism"));
                end
@@ -105,7 +120,7 @@ local function sasl_handler(session, stanza)
        end
        local status, ret, err_msg = session.sasl_handler:feed(text);
        handle_status(session, status);
-       local s = build_reply(status, ret, err_msg); 
+       local s = build_reply(status, ret, err_msg);
        log("debug", "sasl reply: %s", tostring(s));
        session.send(s);
 end
@@ -117,16 +132,21 @@ module:add_handler("c2s_unauthed", "response", xmlns_sasl, sasl_handler);
 local mechanisms_attr = { xmlns='urn:ietf:params:xml:ns:xmpp-sasl' };
 local bind_attr = { xmlns='urn:ietf:params:xml:ns:xmpp-bind' };
 local xmpp_session_attr = { xmlns='urn:ietf:params:xml:ns:xmpp-session' };
-module:add_event_hook("stream-features", 
-               function (session, features)                                                                                            
+module:add_event_hook("stream-features",
+               function (session, features)
                        if not session.username then
+                               if secure_auth_only and not session.secure then
+                                       return;
+                               end
                                features:tag("mechanisms", mechanisms_attr);
                                -- TODO: Provide PLAIN only if TLS is active, this is a SHOULD from the introduction of RFC 4616. This behavior could be overridden via configuration but will issuing a warning or so.
                                        if config.get(session.host or "*", "core", "anonymous_login") then
                                                features:tag("mechanism"):text("ANONYMOUS"):up();
                                        else
-                                               features:tag("mechanism"):text("DIGEST-MD5"):up();
-                                               features:tag("mechanism"):text("PLAIN"):up();
+                                               mechanisms = usermanager_get_supported_methods(session.host or "*");
+                                               for k, v in pairs(mechanisms) do
+                                                       features:tag("mechanism"):text(k):up();
+                                               end
                                        end
                                features:up();
                        else
@@ -134,8 +154,8 @@ module:add_event_hook("stream-features",
                                features:tag("session", xmpp_session_attr):up();
                        end
                end);
-                                       
-module:add_iq_handler("c2s", "urn:ietf:params:xml:ns:xmpp-bind", 
+
+module:add_iq_handler("c2s", "urn:ietf:params:xml:ns:xmpp-bind",
                function (session, stanza)
                        log("debug", "Client requesting a resource bind");
                        local resource;
@@ -157,8 +177,8 @@ module:add_iq_handler("c2s", "urn:ietf:params:xml:ns:xmpp-bind",
                                        :tag("jid"):text(session.full_jid));
                        end
                end);
-               
-module:add_iq_handler("c2s", "urn:ietf:params:xml:ns:xmpp-session", 
+
+module:add_iq_handler("c2s", "urn:ietf:params:xml:ns:xmpp-session",
                function (session, stanza)
                        log("debug", "Client requesting a session");
                        session.send(st.reply(stanza));