Mercurial > prosody-hg

comparison plugins/mod_auth_internal_hashed.lua @ 10411:db2a06b9ff98

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Merge 0.11->trunk
author Kim Alvefur <zash@zash.se>
date Sat, 16 Nov 2019 16:52:31 +0100
parents d58925bb74ca
children e8db377a2983
comparison
equal deleted inserted replaced
10410:659b577f280c 10411:db2a06b9ff98
7 -- COPYING file in the source package for more information. 7 -- COPYING file in the source package for more information.
8 -- 8 --
9 9
10 local max = math.max; 10 local max = math.max;
11 11
12 local getAuthenticationDatabaseSHA1 = require "util.sasl.scram".getAuthenticationDatabaseSHA1; 12 local scram_hashers = require "util.sasl.scram".hashers;
13 local usermanager = require "core.usermanager"; 13 local usermanager = require "core.usermanager";
14 local generate_uuid = require "util.uuid".generate; 14 local generate_uuid = require "util.uuid".generate;
15 local new_sasl = require "util.sasl".new; 15 local new_sasl = require "util.sasl".new;
16 local hex = require"util.hex"; 16 local hex = require"util.hex";
17 local to_hex, from_hex = hex.to, hex.from; 17 local to_hex, from_hex = hex.to, hex.from;
19 local log = module._log; 19 local log = module._log;
20 local host = module.host; 20 local host = module.host;
21 21
22 local accounts = module:open_store("accounts"); 22 local accounts = module:open_store("accounts");
23 23
24 24 local hash_name = module:get_option_string("password_hash", "SHA-1");
25 local get_auth_db = assert(scram_hashers[hash_name], "SCRAM-"..hash_name.." not supported by SASL library");
26 local scram_name = "scram_"..hash_name:gsub("%-","_"):lower();
25 27
26 -- Default; can be set per-user 28 -- Default; can be set per-user
27 local default_iteration_count = 4096; 29 local default_iteration_count = 4096;
28 30
29 -- define auth provider 31 -- define auth provider
47 49
48 if credentials.iteration_count == nil or credentials.salt == nil or string.len(credentials.salt) == 0 then 50 if credentials.iteration_count == nil or credentials.salt == nil or string.len(credentials.salt) == 0 then
49 return nil, "Auth failed. Stored salt and iteration count information is not complete."; 51 return nil, "Auth failed. Stored salt and iteration count information is not complete.";
50 end 52 end
51 53
52 local valid, stored_key, server_key = getAuthenticationDatabaseSHA1(password, credentials.salt, credentials.iteration_count); 54 local valid, stored_key, server_key = get_auth_db(password, credentials.salt, credentials.iteration_count);
53 55
54 local stored_key_hex = to_hex(stored_key); 56 local stored_key_hex = to_hex(stored_key);
55 local server_key_hex = to_hex(server_key); 57 local server_key_hex = to_hex(server_key);
56 58
57 if valid and stored_key_hex == credentials.stored_key and server_key_hex == credentials.server_key then 59 if valid and stored_key_hex == credentials.stored_key and server_key_hex == credentials.server_key then
65 log("debug", "set_password for username '%s'", username); 67 log("debug", "set_password for username '%s'", username);
66 local account = accounts:get(username); 68 local account = accounts:get(username);
67 if account then 69 if account then
68 account.salt = generate_uuid(); 70 account.salt = generate_uuid();
69 account.iteration_count = max(account.iteration_count or 0, default_iteration_count); 71 account.iteration_count = max(account.iteration_count or 0, default_iteration_count);
70 local valid, stored_key, server_key = getAuthenticationDatabaseSHA1(password, account.salt, account.iteration_count); 72 local valid, stored_key, server_key = get_auth_db(password, account.salt, account.iteration_count);
71 local stored_key_hex = to_hex(stored_key); 73 local stored_key_hex = to_hex(stored_key);
72 local server_key_hex = to_hex(server_key); 74 local server_key_hex = to_hex(server_key);
73 75
74 account.stored_key = stored_key_hex 76 account.stored_key = stored_key_hex
75 account.server_key = server_key_hex 77 account.server_key = server_key_hex
96 function provider.create_user(username, password) 98 function provider.create_user(username, password)
97 if password == nil then 99 if password == nil then
98 return accounts:set(username, {}); 100 return accounts:set(username, {});
99 end 101 end
100 local salt = generate_uuid(); 102 local salt = generate_uuid();
101 local valid, stored_key, server_key = getAuthenticationDatabaseSHA1(password, salt, default_iteration_count); 103 local valid, stored_key, server_key = get_auth_db(password, salt, default_iteration_count);
102 local stored_key_hex = to_hex(stored_key); 104 local stored_key_hex = to_hex(stored_key);
103 local server_key_hex = to_hex(server_key); 105 local server_key_hex = to_hex(server_key);
104 return accounts:set(username, { 106 return accounts:set(username, {
105 stored_key = stored_key_hex, server_key = server_key_hex, 107 stored_key = stored_key_hex, server_key = server_key_hex,
106 salt = salt, iteration_count = default_iteration_count 108 salt = salt, iteration_count = default_iteration_count
114 function provider.get_sasl_handler() 116 function provider.get_sasl_handler()
115 local testpass_authentication_profile = { 117 local testpass_authentication_profile = {
116 plain_test = function(_, username, password, realm) 118 plain_test = function(_, username, password, realm)
117 return usermanager.test_password(username, realm, password), true; 119 return usermanager.test_password(username, realm, password), true;
118 end, 120 end,
119 scram_sha_1 = function(_, username) 121 [scram_name] = function(_, username)
120 local credentials = accounts:get(username); 122 local credentials = accounts:get(username);
121 if not credentials then return; end 123 if not credentials then return; end
122 if credentials.password then 124 if credentials.password then
123 if provider.set_password(username, credentials.password) == nil then 125 if provider.set_password(username, credentials.password) == nil then
124 return nil, "Auth failed. Could not set hashed password from plaintext."; 126 return nil, "Auth failed. Could not set hashed password from plaintext.";