Provide SASL PLAIN mechanism only if TLS is active.

[prosody.git] / plugins / mod_saslauth.lua

diff --git a/plugins/mod_saslauth.lua b/plugins/mod_saslauth.lua
index 6051bf9d76284afc59bafd3f104aec4a3a5959a6..d595fd247eaf8ea8a24ea7913f98ef83fc93dc3b 100644 (file)
--- a/plugins/mod_saslauth.lua
+++ b/plugins/mod_saslauth.lua
@@ -1,7 +1,7 @@
 -- Prosody IM
 -- Copyright (C) 2008-2009 Matthew Wild
 -- Copyright (C) 2008-2009 Waqas Hussain
--- 
+--
 -- This project is MIT/X11 licensed. Please see the
 -- COPYING file in the source package for more information.
 --
@@ -25,7 +25,7 @@ local jid_split = require "util.jid".split
 local md5 = require "util.hashes".md5;
 local config = require "core.configmanager";
 
-local secure_auth_only = config.get(module:get_host(), "core", "require_encryption");
+local secure_auth_only = config.get(module:get_host(), "core", "c2s_require_encryption") or config.get(module:get_host(), "core", "require_encryption");
 
 local log = module._log;
 
@@ -35,6 +35,27 @@ local xmlns_stanzas ='urn:ietf:params:xml:ns:xmpp-stanzas';
 
 local new_sasl = require "util.sasl".new;
 
+default_authentication_profile = {
+       plain = function(username, realm)
+                       local prepped_username = nodeprep(username);
+                       if not prepped_username then
+                               log("debug", "NODEprep failed on username: %s", username);
+                               return "", nil;
+                       end
+                       local password = usermanager_get_password(prepped_username, realm);
+                       if not password then
+                               return "", nil;
+                       end
+                       return password, true;
+               end
+};
+
+anonymous_authentication_profile = {
+       anonymous = function(username, realm)
+                       return true; -- for normal usage you should always return true here
+               end
+}
+
 local function build_reply(status, ret, err_msg)
        local reply = st.stanza(status, {xmlns = xmlns_sasl});
        if status == "challenge" then
@@ -56,7 +77,8 @@ local function handle_status(session, status)
        if status == "failure" then
                session.sasl_handler = nil;
        elseif status == "success" then
-               if not session.sasl_handler.username then -- TODO move this to sessionmanager
+               local username = nodeprep(session.sasl_handler.username);
+               if not username then -- TODO move this to sessionmanager
                        module:log("warn", "SASL succeeded but we didn't get a username!");
                        session.sasl_handler = nil;
                        session:reset_stream();
@@ -68,38 +90,6 @@ local function handle_status(session, status)
        end
 end
 
-local function credentials_callback(mechanism, ...)
-       if mechanism == "PLAIN" then
-               local username, hostname, password = ...;
-               username = nodeprep(username);
-               if not username then
-                       return false;
-               end
-               local response = usermanager_validate_credentials(hostname, username, password, mechanism);
-               if response == nil then
-                       return false;
-               else
-                       return response;
-               end
-       elseif mechanism == "DIGEST-MD5" then
-               function func(x) return x; end
-               local node, domain, realm, decoder = ...;
-               local prepped_node = nodeprep(node);
-               if not prepped_node then
-                       return func, nil;
-               end
-               local password = usermanager_get_password(prepped_node, domain);
-               if password then
-                       if decoder then
-                               node, realm, password = decoder(node), decoder(realm), decoder(password);
-                       end
-                       return func, md5(node..":"..realm..":"..password);
-               else
-                       return func, nil;
-               end
-       end
-end
-
 local function sasl_handler(session, stanza)
        if stanza.name == "auth" then
                -- FIXME ignoring duplicates because ejabberd does
@@ -110,8 +100,8 @@ local function sasl_handler(session, stanza)
                elseif stanza.attr.mechanism == "ANONYMOUS" then
                        return session.send(build_reply("failure", "mechanism-too-weak"));
                end
-               session.sasl_handler = new_sasl(stanza.attr.mechanism, session.host, credentials_callback);
-               if not session.sasl_handler then
+               local valid_mechanism = session.sasl_handler:select(stanza.attr.mechanism);
+               if not valid_mechanism then
                        return session.send(build_reply("failure", "invalid-mechanism"));
                end
        elseif not session.sasl_handler then
@@ -127,7 +117,7 @@ local function sasl_handler(session, stanza)
                        return;
                end
        end
-       local status, ret, err_msg = session.sasl_handler:feed(text);
+       local status, ret, err_msg = session.sasl_handler:process(text);
        handle_status(session, status);
        local s = build_reply(status, ret, err_msg);
        log("debug", "sasl reply: %s", tostring(s));
@@ -147,20 +137,22 @@ module:add_event_hook("stream-features",
                                if secure_auth_only and not session.secure then
                                        return;
                                end
-                               features:tag("mechanisms", mechanisms_attr);
-                               -- TODO: Provide PLAIN only if TLS is active, this is a SHOULD from the introduction of RFC 4616. This behavior could be overridden via configuration but will issuing a warning or so.
-                                       if config.get(session.host or "*", "core", "anonymous_login") then
-                                               features:tag("mechanism"):text("ANONYMOUS"):up();
-                                       else
-                                               mechanisms = usermanager_get_supported_methods(session.host or "*");
-                                               for k, v in pairs(mechanisms) do
-                                                       features:tag("mechanism"):text(k):up();
-                                               end
+                               if config.get(session.host or "*", "core", "anonymous_login") then
+                                       session.sasl_handler = new_sasl(session.host, anonymous_authentication_profile);
+                               else
+                                       session.sasl_handler = new_sasl(session.host, default_authentication_profile);
+                                       if not session.secure then 
+                                               session.sasl_handler:forbidden({"PLAIN"});
                                        end
+                               end
+                               features:tag("mechanisms", mechanisms_attr);
+                               for k, v in pairs(session.sasl_handler:mechanisms()) do
+                                       features:tag("mechanism"):text(v):up();
+                               end
                                features:up();
                        else
                                features:tag("bind", bind_attr):tag("required"):up():up();
-                               features:tag("session", xmpp_session_attr):up();
+                               features:tag("session", xmpp_session_attr):tag("optional"):up():up();
                        end
                end);