annotate mod_sasl_ssdp/mod_sasl_ssdp.lua @ 6319:04c3273cb81f

mod_auth_cyrus: Add empty 'profile' table to SASL handler objects This is for compatibility with Prosody's built-in util.sasl objects. A SASL profile table usually includes methods supported by the backend, which can be used by SASL mechanism handlers to perform operations (such as testing the password). It also optionally contains a 'cb' field with channel binding method handlers. The Cyrus backend doesn't support channel binding, and doesn't have the same concept of auth backend methods (it handles all that internally, and Prosody has no insight or control over it). Thus, we create an empty profile which informs Prosody that the SASL handler does not support any of the auth or channel binding methods. Some features will not work, but they didn't work anyway. This just makes it explicit. This fixes a traceback in mod_sasl2_fast, which expected SASL handlers to always contain a 'profile' field.
author Matthew Wild <mwild1@gmail.com>
date Thu, 04 Sep 2025 10:14:46 +0100
parents eedeed1bccf7
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
5773
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
1 local array = require "util.array";
6109
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
2 local set = require "util.set";
5773
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
3 local hashes = require "util.hashes";
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
4 local it = require "util.iterators";
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
5 local base64_enc = require "util.encodings".base64.encode;
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
6
6109
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
7 -- *** The following code is copy-pasted from mod_saslauth/mod_sasl2, like requested by Zash ***
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
8 -- *** Please update, if you modify mod_saslauth or mod_sasl2! ***
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
9 local allow_unencrypted_plain_auth = module:get_option_boolean("allow_unencrypted_plain_auth", false)
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
10 local insecure_mechanisms = module:get_option_set("insecure_sasl_mechanisms", allow_unencrypted_plain_auth and {} or {"PLAIN", "LOGIN"});
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
11 local disabled_mechanisms = module:get_option_set("disable_sasl_mechanisms", { "DIGEST-MD5" });
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
12 -- *** End of copy-pasted code ***
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
13
5773
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
14 local hash_functions = {
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
15 ["SCRAM-SHA-1"] = hashes.sha1;
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
16 ["SCRAM-SHA-1-PLUS"] = hashes.sha1;
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
17 ["SCRAM-SHA-256"] = hashes.sha256;
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
18 ["SCRAM-SHA-256-PLUS"] = hashes.sha256;
6135
eff78e2c7d22 mod_sasl_ssdp: Upgrade to version 0.4.0 with new delimiter
tmolitor <thilo@eightysoft.de>
parents: 6109
diff changeset
19 ["SCRAM-SHA-512"] = hashes.sha512;
eff78e2c7d22 mod_sasl_ssdp: Upgrade to version 0.4.0 with new delimiter
tmolitor <thilo@eightysoft.de>
parents: 6109
diff changeset
20 ["SCRAM-SHA-512-PLUS"] = hashes.sha512;
5773
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
21 };
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
22
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
23 function add_ssdp_info(event)
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
24 local sasl_handler = event.session.sasl_handler;
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
25 local hash = hash_functions[sasl_handler.selected];
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
26 if not hash then
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
27 module:log("debug", "Not enabling SSDP for unsupported mechanism: %s", sasl_handler.selected);
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
28 return;
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
29 end
6109
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
30
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
31 -- *** The following code is copy-pasted from mod_saslauth/mod_sasl2, like requested by Zash ***
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
32 -- *** Please update, if you modify mod_saslauth or mod_sasl2! ***
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
33 local usable_mechanisms = set.new();
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
34 local available_mechanisms = sasl_handler:mechanisms()
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
35 for mechanism in pairs(available_mechanisms) do
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
36 if disabled_mechanisms:contains(mechanism) then
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
37 module:log("debug", "Not offering disabled mechanism %s", mechanism);
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
38 elseif not event.session.secure and insecure_mechanisms:contains(mechanism) then
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
39 module:log("debug", "Not offering mechanism %s on insecure connection", mechanism);
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
40 else
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
41 module:log("debug", "Offering mechanism %s", mechanism);
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
42 usable_mechanisms:add(mechanism);
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
43 end
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
44 end
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
45 -- *** End of copy-pasted code ***
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
46
4cb1cad2badd mod_sasl_ssdp: Fix handling of disabled sasl mechanisms
tmolitor <thilo@eightysoft.de>
parents: 5819
diff changeset
47 local mechanism_list = array.collect(usable_mechanisms):sort();
5773
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
48 local cb = sasl_handler.profile.cb;
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
49 local cb_list = cb and array.collect(it.keys(cb)):sort();
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
50 local ssdp_string;
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
51 if cb_list then
6136
eedeed1bccf7 mod_sasl_ssdp: Fix delimiter ascii codes
tmolitor <thilo@eightysoft.de>
parents: 6135
diff changeset
52 ssdp_string = mechanism_list:concat("\30").."\31"..cb_list:concat("\30");
5773
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
53 else
6136
eedeed1bccf7 mod_sasl_ssdp: Fix delimiter ascii codes
tmolitor <thilo@eightysoft.de>
parents: 6135
diff changeset
54 ssdp_string = mechanism_list:concat("\30");
5773
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
55 end
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
56 module:log("debug", "Calculated SSDP string: %s", ssdp_string);
6135
eff78e2c7d22 mod_sasl_ssdp: Upgrade to version 0.4.0 with new delimiter
tmolitor <thilo@eightysoft.de>
parents: 6109
diff changeset
57 event.message = event.message..",h="..base64_enc(hash(ssdp_string));
5773
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
58 sasl_handler.state.server_first_message = event.message;
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
59 end
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
60
5819
bb51cf204dd4 mod_sasl_ssdp: Fix event name so legacy SASL works correctly (thanks Martin!)
Matthew Wild <mwild1@gmail.com>
parents: 5773
diff changeset
61 module:hook("sasl/c2s/challenge", add_ssdp_info, 1);
5773
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
62 module:hook("sasl2/c2s/challenge", add_ssdp_info, 1);
3a7349aa95c7 mod_sasl_ssdp: New module implementing XEP-0474 SASL SCRAM Downgrade Protection
Matthew Wild <mwild1@gmail.com>
parents:
diff changeset
63