Mercurial > prosody-modules
annotate mod_sasl_ssdp/mod_sasl_ssdp.lua @ 6319:04c3273cb81f
mod_auth_cyrus: Add empty 'profile' table to SASL handler objects
This is for compatibility with Prosody's built-in util.sasl objects.
A SASL profile table usually includes methods supported by the backend, which
can be used by SASL mechanism handlers to perform operations (such as testing
the password). It also optionally contains a 'cb' field with channel binding
method handlers.
The Cyrus backend doesn't support channel binding, and doesn't have the same
concept of auth backend methods (it handles all that internally, and Prosody
has no insight or control over it).
Thus, we create an empty profile which informs Prosody that the SASL handler
does not support any of the auth or channel binding methods. Some features
will not work, but they didn't work anyway. This just makes it explicit.
This fixes a traceback in mod_sasl2_fast, which expected SASL handlers to
always contain a 'profile' field.
| author | Matthew Wild <mwild1@gmail.com> |
|---|---|
| date | Thu, 04 Sep 2025 10:14:46 +0100 |
| parents | eedeed1bccf7 |
| children |
| rev | line source |
|---|---|
|
5773
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
1 local array = require "util.array"; |
|
6109
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
2 local set = require "util.set"; |
|
5773
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
3 local hashes = require "util.hashes"; |
|
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
4 local it = require "util.iterators"; |
|
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
5 local base64_enc = require "util.encodings".base64.encode; |
|
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
6 |
|
6109
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
7 -- *** The following code is copy-pasted from mod_saslauth/mod_sasl2, like requested by Zash *** |
|
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
8 -- *** Please update, if you modify mod_saslauth or mod_sasl2! *** |
|
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
9 local allow_unencrypted_plain_auth = module:get_option_boolean("allow_unencrypted_plain_auth", false) |
|
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
10 local insecure_mechanisms = module:get_option_set("insecure_sasl_mechanisms", allow_unencrypted_plain_auth and {} or {"PLAIN", "LOGIN"}); |
|
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
11 local disabled_mechanisms = module:get_option_set("disable_sasl_mechanisms", { "DIGEST-MD5" }); |
|
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
12 -- *** End of copy-pasted code *** |
|
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
13 |
|
5773
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
14 local hash_functions = { |
|
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
15 ["SCRAM-SHA-1"] = hashes.sha1; |
|
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
16 ["SCRAM-SHA-1-PLUS"] = hashes.sha1; |
|
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
17 ["SCRAM-SHA-256"] = hashes.sha256; |
|
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
18 ["SCRAM-SHA-256-PLUS"] = hashes.sha256; |
|
6135
eff78e2c7d22
mod_sasl_ssdp: Upgrade to version 0.4.0 with new delimiter
tmolitor <thilo@eightysoft.de>
parents:
6109
diff
changeset
|
19 ["SCRAM-SHA-512"] = hashes.sha512; |
|
eff78e2c7d22
mod_sasl_ssdp: Upgrade to version 0.4.0 with new delimiter
tmolitor <thilo@eightysoft.de>
parents:
6109
diff
changeset
|
20 ["SCRAM-SHA-512-PLUS"] = hashes.sha512; |
|
5773
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
21 }; |
|
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
22 |
|
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
23 function add_ssdp_info(event) |
|
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
24 local sasl_handler = event.session.sasl_handler; |
|
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
25 local hash = hash_functions[sasl_handler.selected]; |
|
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
26 if not hash then |
|
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
27 module:log("debug", "Not enabling SSDP for unsupported mechanism: %s", sasl_handler.selected); |
|
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
28 return; |
|
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
29 end |
|
6109
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
30 |
|
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
31 -- *** The following code is copy-pasted from mod_saslauth/mod_sasl2, like requested by Zash *** |
|
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
32 -- *** Please update, if you modify mod_saslauth or mod_sasl2! *** |
|
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
33 local usable_mechanisms = set.new(); |
|
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
34 local available_mechanisms = sasl_handler:mechanisms() |
|
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
35 for mechanism in pairs(available_mechanisms) do |
|
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
36 if disabled_mechanisms:contains(mechanism) then |
|
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
37 module:log("debug", "Not offering disabled mechanism %s", mechanism); |
|
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
38 elseif not event.session.secure and insecure_mechanisms:contains(mechanism) then |
|
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
39 module:log("debug", "Not offering mechanism %s on insecure connection", mechanism); |
|
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
40 else |
|
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
41 module:log("debug", "Offering mechanism %s", mechanism); |
|
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
42 usable_mechanisms:add(mechanism); |
|
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
43 end |
|
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
44 end |
|
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
45 -- *** End of copy-pasted code *** |
|
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
46 |
|
4cb1cad2badd
mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents:
5819
diff
changeset
|
47 local mechanism_list = array.collect(usable_mechanisms):sort(); |
|
5773
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
48 local cb = sasl_handler.profile.cb; |
|
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
49 local cb_list = cb and array.collect(it.keys(cb)):sort(); |
|
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
50 local ssdp_string; |
|
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
51 if cb_list then |
|
6136
eedeed1bccf7
mod_sasl_ssdp: Fix delimiter ascii codes
tmolitor <thilo@eightysoft.de>
parents:
6135
diff
changeset
|
52 ssdp_string = mechanism_list:concat("\30").."\31"..cb_list:concat("\30"); |
|
5773
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
53 else |
|
6136
eedeed1bccf7
mod_sasl_ssdp: Fix delimiter ascii codes
tmolitor <thilo@eightysoft.de>
parents:
6135
diff
changeset
|
54 ssdp_string = mechanism_list:concat("\30"); |
|
5773
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
55 end |
|
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
56 module:log("debug", "Calculated SSDP string: %s", ssdp_string); |
|
6135
eff78e2c7d22
mod_sasl_ssdp: Upgrade to version 0.4.0 with new delimiter
tmolitor <thilo@eightysoft.de>
parents:
6109
diff
changeset
|
57 event.message = event.message..",h="..base64_enc(hash(ssdp_string)); |
|
5773
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
58 sasl_handler.state.server_first_message = event.message; |
|
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
59 end |
|
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
60 |
|
5819
bb51cf204dd4
mod_sasl_ssdp: Fix event name so legacy SASL works correctly (thanks Martin!)
Matthew Wild <mwild1@gmail.com>
parents:
5773
diff
changeset
|
61 module:hook("sasl/c2s/challenge", add_ssdp_info, 1); |
|
5773
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
62 module:hook("sasl2/c2s/challenge", add_ssdp_info, 1); |
|
3a7349aa95c7
mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff
changeset
|
63 |
