http://hg.omfa.de/prosody-modules/ en-us prosody-modules: mod_sasl2_fast/mod_sasl2_fast.lua history mod_sasl2_fast/mod_sasl2_fast.lua revision history mod_sasl2_fast/mod_sasl2_fast.lua: fix luacheck warning too long line http://hg.omfa.de/prosody-modules/log/5364bdaa404d/mod_sasl2_fast/mod_sasl2_fast.lua Menel <menel@snikket.de> Fri, 13 Mar 2026 07:54:36 +0100 mod_sasl2_fast: Restore non-FAST SASL handler upon reset http://hg.omfa.de/prosody-modules/log/f77f5e408d6a/mod_sasl2_fast/mod_sasl2_fast.lua
This fixes an issue where, after failed FAST authentication, the FAST handler
was still used (even though the client now wants to try with a password or
other non-FAST credentials).

A little hacky perhaps, but probably the best we can do without baking FAST
support directly into mod_sasl2.]]> Matthew Wild <mwild1@gmail.com> Thu, 16 Jan 2025 15:46:15 +0000 mod_sasl2_fast: Only copy SASL handler internals from util.sasl instance http://hg.omfa.de/prosody-modules/log/c7c17fac41b3/mod_sasl2_fast/mod_sasl2_fast.lua
Prevents traceback in case the session sasl handler is missing the
profile table, as may be the case with non-core sasl handlers.

Thanks taba for reporting]]> Kim Alvefur <zash@zash.se> Sun, 24 Nov 2024 14:42:59 +0100 mod_sasl2_fast: Fix traceback when no cb_data is available (thanks riau) http://hg.omfa.de/prosody-modules/log/87441b567277/mod_sasl2_fast/mod_sasl2_fast.lua
We already verify (earlier in the process) that cb_data is present if we are
using a mechanism that requires it.]]> Matthew Wild <mwild1@gmail.com> Wed, 19 Jun 2024 13:53:12 +0100 mod_sasl2_fast: Fix malformed-request when using HT-*-NONE (thanks lnj!) http://hg.omfa.de/prosody-modules/log/e67fc7b66c13/mod_sasl2_fast/mod_sasl2_fast.lua
This crept into the previous commit which tried to fail early when CB was
requested but unavailable - that commit did not actually check that CB *was*
requested.]]> Matthew Wild <mwild1@gmail.com> Fri, 07 Jun 2024 16:26:54 +0100 mod_sasl2_fast: Improve handling when SASL profile unexpectedly lacks CB http://hg.omfa.de/prosody-modules/log/563c2c70cb9f/mod_sasl2_fast/mod_sasl2_fast.lua
This fixes a traceback reported by riau, but likely does not solve the
underlying cause, whatever that is.]]> Matthew Wild <mwild1@gmail.com> Tue, 16 Apr 2024 10:42:25 +0100 mod_sasl2_fast: Add API method to revoke FAST tokens for a given client http://hg.omfa.de/prosody-modules/log/b10a7082b3c3/mod_sasl2_fast/mod_sasl2_fast.lua Matthew Wild <mwild1@gmail.com> Wed, 05 Apr 2023 19:38:59 +0100 mod_sasl2_fast: Add an API that allows modules to check if a client has FAST http://hg.omfa.de/prosody-modules/log/4834eaf24fc1/mod_sasl2_fast/mod_sasl2_fast.lua Matthew Wild <mwild1@gmail.com> Wed, 29 Mar 2023 16:13:42 +0100 mod_sasl2_fast: Add flag to FAST sasl_handler for easier identification http://hg.omfa.de/prosody-modules/log/a91adc164566/mod_sasl2_fast/mod_sasl2_fast.lua
Other code that looks at session.sasl_handler can now detect if a client used
FAST to authenticate.]]> Matthew Wild <mwild1@gmail.com> Wed, 29 Mar 2023 16:13:00 +0100 mod_sasl2_fast: Fix harmless off-by-one error (invalidates existing tokens!) http://hg.omfa.de/prosody-modules/log/8e1f1eb00b58/mod_sasl2_fast/mod_sasl2_fast.lua
Problem:

This was causing the key to become "<token>--cur" instead of the expected
"<token>-cur". As the same key was used by the code to both set and get, it
still worked.

Rationale for change:

Although it worked, it's unintended, inconsistent and messy. It increases the
chances of future bugs due to the unexpected format.

Side-effects of change:

Existing '--cur' entries will not be checked after this change, and therefore
existing FAST clients will fail to authenticate until they attempt password
auth and obtain a new FAST token.

Existing '--cur' entries in storage will not be cleaned up by this commit, but
this is considered a minor issue, and okay for the relatively few FAST
deployments.]]> Matthew Wild <mwild1@gmail.com> Wed, 29 Mar 2023 16:12:15 +0100 mod_sasl2_fast: Invalidate tokens issued prior to last password change http://hg.omfa.de/prosody-modules/log/0566a71a7076/mod_sasl2_fast/mod_sasl2_fast.lua Matthew Wild <mwild1@gmail.com> Tue, 28 Mar 2023 12:43:05 +0100 mod_sasl2_fast: Add some comments http://hg.omfa.de/prosody-modules/log/471cbb583a1d/mod_sasl2_fast/mod_sasl2_fast.lua Matthew Wild <mwild1@gmail.com> Tue, 10 Jan 2023 15:45:25 +0000 mod_sasl2_fast: Add explicit dependency on mod_sasl2 http://hg.omfa.de/prosody-modules/log/745c7f4cca40/mod_sasl2_fast/mod_sasl2_fast.lua
Ensures mod_sasl2 is installed and loaded so it can fire the relevant
events.]]> Kim Alvefur <zash@zash.se> Mon, 28 Nov 2022 19:12:37 +0100 mod_sasl2_fast: Add more debug logging http://hg.omfa.de/prosody-modules/log/dda2af7ed02f/mod_sasl2_fast/mod_sasl2_fast.lua Matthew Wild <mwild1@gmail.com> Mon, 07 Nov 2022 10:21:42 +0000 mod_sasl2_fast: Fixes to make channel binding work again http://hg.omfa.de/prosody-modules/log/4837232474ca/mod_sasl2_fast/mod_sasl2_fast.lua
tls-endpoint isn't a thing that exists.

Also, we needed to copy more channel binding state from the primary
sasl_handler. Ideally we'd have a cleaner way to do this, but I think that's
part of more substantial changes that the SASL API deserves.]]> Matthew Wild <mwild1@gmail.com> Mon, 07 Nov 2022 10:21:18 +0000 mod_sasl2_fast: Clean up backend return values (fixes constant rotation) http://hg.omfa.de/prosody-modules/log/ddb1940b08e0/mod_sasl2_fast/mod_sasl2_fast.lua Matthew Wild <mwild1@gmail.com> Mon, 07 Nov 2022 10:19:10 +0000 mod_sasl2_fast: Implement rotation and invalidation http://hg.omfa.de/prosody-modules/log/36d3f11724c8/mod_sasl2_fast/mod_sasl2_fast.lua Matthew Wild <mwild1@gmail.com> Sat, 15 Oct 2022 21:01:04 +0100 mod_sasl2_fast: Remove X-TOKEN-PLAIN and related profile handler http://hg.omfa.de/prosody-modules/log/e900bbd2e70d/mod_sasl2_fast/mod_sasl2_fast.lua Matthew Wild <mwild1@gmail.com> Sat, 15 Oct 2022 20:26:25 +0100 mod_sasl2_fast: Improved logging http://hg.omfa.de/prosody-modules/log/eb46abc65dfd/mod_sasl2_fast/mod_sasl2_fast.lua Matthew Wild <mwild1@gmail.com> Sat, 15 Oct 2022 19:49:13 +0100 mod_sasl2_fast: Register HT-* mechanisms with the required channel binding http://hg.omfa.de/prosody-modules/log/ba2f1292d5fe/mod_sasl2_fast/mod_sasl2_fast.lua Matthew Wild <mwild1@gmail.com> Sat, 15 Oct 2022 19:47:05 +0100 mod_sasl2_fast: Fix field name for returned secret http://hg.omfa.de/prosody-modules/log/1726050e9a4b/mod_sasl2_fast/mod_sasl2_fast.lua Matthew Wild <mwild1@gmail.com> Sat, 15 Oct 2022 19:46:23 +0100 mod_sasl2_fast: Copy channel binding data state from original SASL handler http://hg.omfa.de/prosody-modules/log/f158f18704c0/mod_sasl2_fast/mod_sasl2_fast.lua Matthew Wild <mwild1@gmail.com> Sat, 15 Oct 2022 19:45:53 +0100 mod_sasl2_fast: Fixes for <authenticate> processing http://hg.omfa.de/prosody-modules/log/d41677929f68/mod_sasl2_fast/mod_sasl2_fast.lua Matthew Wild <mwild1@gmail.com> Sat, 15 Oct 2022 19:44:54 +0100 mod_sasl2_fast: Take username from SASL exchange rather than stream@from http://hg.omfa.de/prosody-modules/log/bc983da908e6/mod_sasl2_fast/mod_sasl2_fast.lua Matthew Wild <mwild1@gmail.com> Sat, 15 Oct 2022 19:42:55 +0100 mod_sasl2_fast: Fix make_token() to return appropriate result http://hg.omfa.de/prosody-modules/log/5cc6f3749376/mod_sasl2_fast/mod_sasl2_fast.lua Matthew Wild <mwild1@gmail.com> Sat, 15 Oct 2022 19:41:33 +0100 mod_sasl2_fast: Improve backend profile name and correctly use it everywhere http://hg.omfa.de/prosody-modules/log/e8342ae5ae12/mod_sasl2_fast/mod_sasl2_fast.lua
It didn't match before, and the mechanisms didn't show up.]]> Matthew Wild <mwild1@gmail.com> Fri, 14 Oct 2022 16:21:01 +0100 mod_sasl2_fast: More robust handling of stream@from and user-agent@id http://hg.omfa.de/prosody-modules/log/20e635eb4cdc/mod_sasl2_fast/mod_sasl2_fast.lua Matthew Wild <mwild1@gmail.com> Fri, 14 Oct 2022 15:44:00 +0100 mod_sasl2_fast: Implement most of FAST + SASL HT-SHA-256 http://hg.omfa.de/prosody-modules/log/74145faceba2/mod_sasl2_fast/mod_sasl2_fast.lua Matthew Wild <mwild1@gmail.com> Fri, 14 Oct 2022 14:44:27 +0100 mod_sasl2_fast: New module for SASL2 FAST authentication (WIP) http://hg.omfa.de/prosody-modules/log/38a0e3621181/mod_sasl2_fast/mod_sasl2_fast.lua Matthew Wild <mwild1@gmail.com> Thu, 13 Oct 2022 22:47:35 +0100