X-Git-Url: https://git.enpas.org/?a=blobdiff_plain;f=util%2Fsasl%2Fplain.lua;h=fb20cf97d45e0424afd7c7044c5062dc37d68b73;hb=0ba1be1015d883c8dc6d1eed2ec84114af09ef6f;hp=5c7ff68a770426ff01cead1c091963499ebcaf07;hpb=c9ce27b8168e7c1d9cfbeb3be43dd8b141409c76;p=prosody.git diff --git a/util/sasl/plain.lua b/util/sasl/plain.lua index 5c7ff68a..fb20cf97 100644 --- a/util/sasl/plain.lua +++ b/util/sasl/plain.lua @@ -1,5 +1,5 @@ -- sasl.lua v0.4 --- Copyright (C) 2008-2009 Tobias Markmann +-- Copyright (C) 2008-2010 Tobias Markmann -- -- All rights reserved. -- @@ -15,36 +15,52 @@ local s_match = string.match; local saslprep = require "util.encodings".stringprep.saslprep; local log = require "util.logger".init("sasl"); -module "plain" +module "sasl.plain" + +-- ================================ +-- SASL PLAIN according to RFC 4616 + +--[[ +Supported Authentication Backends + +plain: + function(username, realm) + return password, state; + end + +plain_test: + function(username, password, realm) + return true or false, state; + end +]] ---========================= ---SASL PLAIN according to RFC 4616 local function plain(self, message) - local response = message - local authorization = s_match(response, "([^%z]+)") - local authentication = s_match(response, "%z([^%z]+)%z") - local password = s_match(response, "%z[^%z]+%z([^%z]+)") + if not message then + return "failure", "malformed-request"; + end + + local authorization, authentication, password = s_match(message, "^([^%z]*)%z([^%z]+)%z([^%z]+)"); - if authentication == nil or password == nil then + if not authorization then return "failure", "malformed-request"; end - + -- SASLprep password and authentication authentication = saslprep(authentication); password = saslprep(password); - + if (not password) or (password == "") or (not authentication) or (authentication == "") then log("debug", "Username or password violates SASLprep."); - return "failure", "malformed-request"; + return "failure", "malformed-request", "Invalid username or password."; end local correct, state = false, false; if self.profile.plain then local correct_password; - correct_password, state = self.profile.plain(authentication, self.realm); - if correct_password == password then correct = true; else correct = false; end + correct_password, state = self.profile.plain(self, authentication, self.realm); + correct = (correct_password == password); elseif self.profile.plain_test then - correct, state = self.profile.plain_test(authentication, self.realm, password); + correct, state = self.profile.plain_test(self, authentication, password, self.realm); end self.username = authentication @@ -55,7 +71,7 @@ local function plain(self, message) if correct then return "success"; else - return "failure", "not-authorized"; + return "failure", "not-authorized", "Unable to authorize you with the authentication credentials you've sent."; end end @@ -63,4 +79,4 @@ function init(registerMechanism) registerMechanism("PLAIN", {"plain", "plain_test"}, plain); end -return _M; \ No newline at end of file +return _M;