util/sasl.lua
author Waqas Hussain <waqas20@gmail.com>
Mon, 02 Aug 2010 18:47:33 +0500
changeset 3427 046a8cf304dd
parent 3373 cd6836586a6a
child 3441 d4f89802cf1e
permissions -rw-r--r--
util.sasl: Removed method:forbidden() and its side effects.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
896
2c0b9e3c11c3 0.3->0.4
Matthew Wild <mwild1@gmail.com>
parents: 801
diff changeset
     1
-- sasl.lua v0.4
2923
b7049746bd29 Update copyright headers for 2010
Matthew Wild <mwild1@gmail.com>
parents: 2873
diff changeset
     2
-- Copyright (C) 2008-2010 Tobias Markmann
1585
edc066730d11 Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents: 1518
diff changeset
     3
--
519
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 508
diff changeset
     4
--    All rights reserved.
1585
edc066730d11 Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents: 1518
diff changeset
     5
--
519
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 508
diff changeset
     6
--    Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1585
edc066730d11 Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents: 1518
diff changeset
     7
--
519
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 508
diff changeset
     8
--        * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 508
diff changeset
     9
--        * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 508
diff changeset
    10
--        * Neither the name of Tobias Markmann nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
1585
edc066730d11 Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents: 1518
diff changeset
    11
--
519
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 508
diff changeset
    12
--    THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 508
diff changeset
    13
15
c0d754774db2 adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
    14
449
c0a4a1e63d70 Completely switched to new hashes library from the old md5 library
Waqas Hussain <waqas20@gmail.com>
parents: 405
diff changeset
    15
local md5 = require "util.hashes".md5;
38
Matthew Wild <mwild1@gmail.com>
parents: 32
diff changeset
    16
local log = require "util.logger".init("sasl");
Matthew Wild <mwild1@gmail.com>
parents: 32
diff changeset
    17
local st = require "util.stanza";
2201
49e4838f9755 Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents: 2198
diff changeset
    18
local set = require "util.set";
49e4838f9755 Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents: 2198
diff changeset
    19
local array = require "util.array";
2202
c320517d6b47 Tidying up.
Tobias Markmann <tm@ayena.de>
parents: 2201
diff changeset
    20
local to_unicode = require "util.encodings".idna.to_unicode;
c320517d6b47 Tidying up.
Tobias Markmann <tm@ayena.de>
parents: 2201
diff changeset
    21
38
Matthew Wild <mwild1@gmail.com>
parents: 32
diff changeset
    22
local tostring = tostring;
2176
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
    23
local pairs, ipairs = pairs, ipairs;
504
efc5184effa1 Added function latin1toutf8 to sasl.lua, for processing non-utf8 responses
Waqas Hussain <waqas20@gmail.com>
parents: 496
diff changeset
    24
local t_insert, t_concat = table.insert, table.concat;
38
Matthew Wild <mwild1@gmail.com>
parents: 32
diff changeset
    25
local s_match = string.match;
276
30893439d5d1 Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents: 50
diff changeset
    26
local type = type
30893439d5d1 Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents: 50
diff changeset
    27
local error = error
2175
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
    28
local setmetatable = setmetatable;
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
    29
local assert = assert;
2187
f0a85d11823e Getting PLAIN mechanism work with the new API.
Tobias Markmann <tm@ayena.de>
parents: 2186
diff changeset
    30
local require = require;
276
30893439d5d1 Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents: 50
diff changeset
    31
2176
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
    32
require "util.iterators"
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
    33
local keys = keys
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
    34
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
    35
local array = require "util.array"
38
Matthew Wild <mwild1@gmail.com>
parents: 32
diff changeset
    36
module "sasl"
Matthew Wild <mwild1@gmail.com>
parents: 32
diff changeset
    37
2177
8505e1da5408 Adding some docu.
Tobias Markmann <tm@ayena.de>
parents: 2176
diff changeset
    38
--[[
8505e1da5408 Adding some docu.
Tobias Markmann <tm@ayena.de>
parents: 2176
diff changeset
    39
Authentication Backend Prototypes:
1585
edc066730d11 Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents: 1518
diff changeset
    40
2188
1fd38975addd Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents: 2187
diff changeset
    41
state = false : disabled
1fd38975addd Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents: 2187
diff changeset
    42
state = true : enabled
1fd38975addd Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents: 2187
diff changeset
    43
state = nil : non-existant
2177
8505e1da5408 Adding some docu.
Tobias Markmann <tm@ayena.de>
parents: 2176
diff changeset
    44
]]
1585
edc066730d11 Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents: 1518
diff changeset
    45
2176
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
    46
local method = {};
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
    47
method.__index = method;
2175
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
    48
local mechanisms = {};
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
    49
local backend_mechanism = {};
1585
edc066730d11 Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents: 1518
diff changeset
    50
2175
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
    51
-- register a new SASL mechanims
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
    52
local function registerMechanism(name, backends, f)
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
    53
	assert(type(name) == "string", "Parameter name MUST be a string.");
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
    54
	assert(type(backends) == "string" or type(backends) == "table", "Parameter backends MUST be either a string or a table.");
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
    55
	assert(type(f) == "function", "Parameter f MUST be a function.");
2176
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
    56
	mechanisms[name] = f
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
    57
	for _, backend_name in ipairs(backends) do
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
    58
		if backend_mechanism[backend_name] == nil then backend_mechanism[backend_name] = {}; end
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
    59
		t_insert(backend_mechanism[backend_name], name);
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
    60
	end
15
c0d754774db2 adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
    61
end
1585
edc066730d11 Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents: 1518
diff changeset
    62
2175
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
    63
-- create a new SASL object which can be used to authenticate clients
3427
046a8cf304dd util.sasl: Removed method:forbidden() and its side effects.
Waqas Hussain <waqas20@gmail.com>
parents: 3373
diff changeset
    64
function new(realm, profile)
2254
f966c8699f5b util.sasl: Move some variables to local space. Fix a bug.
Tobias Markmann <tm@ayena.de>
parents: 2241
diff changeset
    65
	local sasl_i = {profile = profile};
2179
c985536d5452 Making mod_saslauth use the new SASL API.
Tobias Markmann <tm@ayena.de>
parents: 2178
diff changeset
    66
	sasl_i.realm = realm;
3427
046a8cf304dd util.sasl: Removed method:forbidden() and its side effects.
Waqas Hussain <waqas20@gmail.com>
parents: 3373
diff changeset
    67
	return setmetatable(sasl_i, method);
2201
49e4838f9755 Enable restriction of supported mechanisms in the SASL library.
Tobias Markmann <tm@ayena.de>
parents: 2198
diff changeset
    68
end
1585
edc066730d11 Switch to using a more generic credentials_callback/handler for SASL auth.
nick@lupine.me.uk
parents: 1518
diff changeset
    69
3427
046a8cf304dd util.sasl: Removed method:forbidden() and its side effects.
Waqas Hussain <waqas20@gmail.com>
parents: 3373
diff changeset
    70
-- get a fresh clone with the same realm and profile
2241
ac3bd7c42c8b util.sasl: Adding clean_clone() method.
Tobias Markmann <tm@ayena.de>
parents: 2212
diff changeset
    71
function method:clean_clone()
3427
046a8cf304dd util.sasl: Removed method:forbidden() and its side effects.
Waqas Hussain <waqas20@gmail.com>
parents: 3373
diff changeset
    72
	return new(self.realm, self.profile)
276
30893439d5d1 Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents: 50
diff changeset
    73
end
30893439d5d1 Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents: 50
diff changeset
    74
2175
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
    75
-- get a list of possible SASL mechanims to use
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
    76
function method:mechanisms()
3365
32dc830d976c util.sasl, util.sasl_cyrus: Updated method:mechanisms() to cache and re-use list of mechanisms.
Waqas Hussain <waqas20@gmail.com>
parents: 3364
diff changeset
    77
	local mechanisms = self.mechs;
32dc830d976c util.sasl, util.sasl_cyrus: Updated method:mechanisms() to cache and re-use list of mechanisms.
Waqas Hussain <waqas20@gmail.com>
parents: 3364
diff changeset
    78
	if not mechanisms then
32dc830d976c util.sasl, util.sasl_cyrus: Updated method:mechanisms() to cache and re-use list of mechanisms.
Waqas Hussain <waqas20@gmail.com>
parents: 3364
diff changeset
    79
		mechanisms = {}
32dc830d976c util.sasl, util.sasl_cyrus: Updated method:mechanisms() to cache and re-use list of mechanisms.
Waqas Hussain <waqas20@gmail.com>
parents: 3364
diff changeset
    80
		for backend, f in pairs(self.profile) do
32dc830d976c util.sasl, util.sasl_cyrus: Updated method:mechanisms() to cache and re-use list of mechanisms.
Waqas Hussain <waqas20@gmail.com>
parents: 3364
diff changeset
    81
			if backend_mechanism[backend] then
32dc830d976c util.sasl, util.sasl_cyrus: Updated method:mechanisms() to cache and re-use list of mechanisms.
Waqas Hussain <waqas20@gmail.com>
parents: 3364
diff changeset
    82
				for _, mechanism in ipairs(backend_mechanism[backend]) do
3427
046a8cf304dd util.sasl: Removed method:forbidden() and its side effects.
Waqas Hussain <waqas20@gmail.com>
parents: 3373
diff changeset
    83
					mechanisms[mechanism] = true;
1159
f81c8cec0e71 Adding minimal support for authorization identities to workaround buggy SASL implementations.
Tobias Markmann <tm@ayena.de>
parents: 1158
diff changeset
    84
				end
f81c8cec0e71 Adding minimal support for authorization identities to workaround buggy SASL implementations.
Tobias Markmann <tm@ayena.de>
parents: 1158
diff changeset
    85
			end
294
5d861d6e5bbd Made SASL module fit the new interface.
Tobias Markmann <tm@ayena.de>
parents: 292
diff changeset
    86
		end
3365
32dc830d976c util.sasl, util.sasl_cyrus: Updated method:mechanisms() to cache and re-use list of mechanisms.
Waqas Hussain <waqas20@gmail.com>
parents: 3364
diff changeset
    87
		self.mechs = mechanisms;
294
5d861d6e5bbd Made SASL module fit the new interface.
Tobias Markmann <tm@ayena.de>
parents: 292
diff changeset
    88
	end
3363
a4bb658d3fcb SASL: Simplified sasl_handler:mechanisms() to return a set, and not an array.
Waqas Hussain <waqas20@gmail.com>
parents: 3155
diff changeset
    89
	return mechanisms;
276
30893439d5d1 Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents: 50
diff changeset
    90
end
30893439d5d1 Some early attempts on DIGEST-MD5.
Tobias Markmann <tm@ayena.de>
parents: 50
diff changeset
    91
2175
3ca8755581a1 Initial commit of the SASL redesign.
Tobias Markmann <tm@ayena.de>
parents: 1585
diff changeset
    92
-- select a mechanism to use
2176
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
    93
function method:select(mechanism)
2185
e92339c48ee6 Fail if mechanism has already been selected.
Tobias Markmann <tm@ayena.de>
parents: 2184
diff changeset
    94
	if self.mech_i then
e92339c48ee6 Fail if mechanism has already been selected.
Tobias Markmann <tm@ayena.de>
parents: 2184
diff changeset
    95
		return false;
e92339c48ee6 Fail if mechanism has already been selected.
Tobias Markmann <tm@ayena.de>
parents: 2184
diff changeset
    96
	end
e92339c48ee6 Fail if mechanism has already been selected.
Tobias Markmann <tm@ayena.de>
parents: 2184
diff changeset
    97
	
3373
cd6836586a6a util.sasl, util.sasl_cyrus: s/self.mechanisms()/self:mechanisms()/ in method:select().
Waqas Hussain <waqas20@gmail.com>
parents: 3366
diff changeset
    98
	self.mech_i = mechanisms[self:mechanisms()[mechanism] and mechanism];
3155
c713fa2ba80c SASL: Minor cleanup.
Waqas Hussain <waqas20@gmail.com>
parents: 3116
diff changeset
    99
	return (self.mech_i ~= nil);
799
b7ea802f3527 Adding inital support for ANONYMOUS mechanism in SASL.
Tobias Markmann <tm@ayena.de>
parents: 760
diff changeset
   100
end
b7ea802f3527 Adding inital support for ANONYMOUS mechanism in SASL.
Tobias Markmann <tm@ayena.de>
parents: 760
diff changeset
   101
2176
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
   102
-- feed new messages to process into the library
aaf2b2df61f7 Mostly making the code run; includes fixing typos and so on.
Tobias Markmann <tm@ayena.de>
parents: 2175
diff changeset
   103
function method:process(message)
2188
1fd38975addd Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents: 2187
diff changeset
   104
	--if message == "" or message == nil then return "failure", "malformed-request" end
2178
28d841403a21 Adjust SASL PLAIN mechanism to the new API.
Tobias Markmann <tm@ayena.de>
parents: 2177
diff changeset
   105
	return self.mech_i(self, message);
15
c0d754774db2 adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
   106
end
799
b7ea802f3527 Adding inital support for ANONYMOUS mechanism in SASL.
Tobias Markmann <tm@ayena.de>
parents: 760
diff changeset
   107
2186
1112871916eb Move each mechanism in an own file.
Tobias Markmann <tm@ayena.de>
parents: 2185
diff changeset
   108
-- load the mechanisms
2735
65bbc4b67733 util.sasl: Fixed a nil global access.
Waqas Hussain <waqas20@gmail.com>
parents: 2254
diff changeset
   109
local load_mechs = {"plain", "digest-md5", "anonymous", "scram"}
2188
1fd38975addd Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents: 2187
diff changeset
   110
for _, mech in ipairs(load_mechs) do
1fd38975addd Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents: 2187
diff changeset
   111
	local name = "util.sasl."..mech;
1fd38975addd Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents: 2187
diff changeset
   112
	local m = require(name);
1fd38975addd Add support for plain profile in digest-md5 implementation.
Tobias Markmann <tm@ayena.de>
parents: 2187
diff changeset
   113
	m.init(registerMechanism)
15
c0d754774db2 adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
   114
end
c0d754774db2 adding SASL lib with PLAIN support, not tested yet
Tobias Markmann <tm@ayena.de>
parents:
diff changeset
   115
519
cccd610a0ef9 Insert copyright/license headers
Matthew Wild <mwild1@gmail.com>
parents: 508
diff changeset
   116
return _M;