Merge Tobias's fancy SASL branch->trunk

[prosody.git] / util / sasl.lua

diff --git a/util/sasl.lua b/util/sasl.lua
index 772e2dd5e9dbfa27b09b60b7b5c76530594e20e3..306acc0c590998be8eb151e3ddc7cdf13ad12058 100644 (file)
--- a/util/sasl.lua
+++ b/util/sasl.lua
@@ -1,5 +1,5 @@
 -- sasl.lua v0.4
--- Copyright (C) 2008-2009 Tobias Markmann
+-- Copyright (C) 2008-2010 Tobias Markmann
 --
 --    All rights reserved.
 --
@@ -14,22 +14,20 @@
 
 local md5 = require "util.hashes".md5;
 local log = require "util.logger".init("sasl");
-local tostring = tostring;
 local st = require "util.stanza";
-local generate_uuid = require "util.uuid".generate;
+local set = require "util.set";
+local array = require "util.array";
+local to_unicode = require "util.encodings".idna.to_unicode;
+
+local tostring = tostring;
 local pairs, ipairs = pairs, ipairs;
 local t_insert, t_concat = table.insert, table.concat;
-local to_byte, to_char = string.byte, string.char;
-local to_unicode = require "util.encodings".idna.to_unicode;
 local s_match = string.match;
-local gmatch = string.gmatch
-local string = string
-local math = require "math"
 local type = type
 local error = error
-local print = print
 local setmetatable = setmetatable;
 local assert = assert;
+local require = require;
 
 require "util.iterators"
 local keys = keys
@@ -40,25 +38,9 @@ module "sasl"
 --[[
 Authentication Backend Prototypes:
 
-plain:
-       function(username, realm)
-               return password, state;
-       end
-
-plain-test:
-       function(username, realm, password)
-               return true or false, state;
-       end
-
-digest-md5:
-       function(username, realm, encoding)
-               return digesthash, state;
-       end
-
-digest-md5-test:
-       function(username, realm, encoding, digesthash)
-               return true or false, state;
-       end
+state = false : disabled
+state = true : enabled
+state = nil : non-existant
 ]]
 
 local method = {};
@@ -79,20 +61,41 @@ local function registerMechanism(name, backends, f)
 end
 
 -- create a new SASL object which can be used to authenticate clients
-function new(realm, profile)
-       sasl_i = {profile = profile};
-       return setmetatable(sasl_i, method);
+function new(realm, profile, forbidden)
+       local sasl_i = {profile = profile};
+       sasl_i.realm = realm;
+       local s = setmetatable(sasl_i, method);
+       if forbidden == nil then forbidden = {} end
+       s:forbidden(forbidden)
+       return s;
+end
+
+-- get a fresh clone with the same realm, profiles and forbidden mechanisms
+function method:clean_clone()
+       return new(self.realm, self.profile, self:forbidden())
+end
+
+-- set the forbidden mechanisms
+function method:forbidden( restrict )
+       if restrict then
+               -- set forbidden
+               self.restrict = set.new(restrict);
+       else
+               -- get forbidden
+               return array.collect(self.restrict:items());
+       end
 end
 
 -- get a list of possible SASL mechanims to use
 function method:mechanisms()
        local mechanisms = {}
        for backend, f in pairs(self.profile) do
-               print(backend)
                if backend_mechanism[backend] then
                        for _, mechanism in ipairs(backend_mechanism[backend]) do
-                               mechanisms[mechanism] = true;
+                               if not self.restrict:contains(mechanism) then
+                                       mechanisms[mechanism] = true;
                                end
+                       end
                end
        end
        self["possible_mechanisms"] = mechanisms;
@@ -101,39 +104,29 @@ end
 
 -- select a mechanism to use
 function method:select(mechanism)
-
+       if self.mech_i then
+               return false;
+       end
+       
+       self.mech_i = mechanisms[mechanism]
+       if self.mech_i == nil then 
+               return false;
+       end
+       return true;
 end
 
 -- feed new messages to process into the library
 function method:process(message)
-
+       --if message == "" or message == nil then return "failure", "malformed-request" end
+       return self.mech_i(self, message);
 end
 
---=========================
---SASL PLAIN
-local function sasl_mechanism_plain(realm, credentials_handler)
-       local object = { mechanism = "PLAIN", realm = realm, credentials_handler = credentials_handler}
-       function object.feed(self, message)
-               if message == "" or message == nil then return "failure", "malformed-request" end
-               local response = message
-               local authorization = s_match(response, "([^&%z]+)")
-               local authentication = s_match(response, "%z([^&%z]+)%z")
-               local password = s_match(response, "%z[^&%z]+%z([^&%z]+)")
-
-               if authentication == nil or password == nil then return "failure", "malformed-request" end
-               self.username = authentication
-               local auth_success = self.credentials_handler("PLAIN", self.username, self.realm, password)
-
-               if auth_success then
-                       return "success"
-               elseif auth_success == nil then
-                       return "failure", "account-disabled"
-               else
-                       return "failure", "not-authorized"
-               end
-       end
-       return object
+-- load the mechanisms
+local load_mechs = {"plain", "digest-md5", "anonymous", "scram"}
+for _, mech in ipairs(load_mechs) do
+       local name = "util.sasl."..mech;
+       local m = require(name);
+       m.init(registerMechanism)
 end
-registerMechanism("PLAIN", {"plain", "plain_test"}, sasl_mechanism_plain);
 
 return _M;