Context Navigation

source: protocols/jabber/sasl.c @ a7b5925

Last change on this file since a7b5925 was 3b6eadc, checked in by Jelmer Vernooij <jelmer@…>, at 2007-07-07T17:19:28Z
Fix some warnings in storage.c.
Property mode set to `100644`
File size: 9.1 KB

Rev	Line
[5997488]	1	/***************************************************************************\
	2	* *
	3	* BitlBee - An IRC to IM gateway *
	4	* Jabber module - SASL authentication *
	5	* *
	6	* Copyright 2006 Wilmer van der Gaast <wilmer@gaast.net> *
	7	* *
	8	* This program is free software; you can redistribute it and/or modify *
	9	* it under the terms of the GNU General Public License as published by *
	10	* the Free Software Foundation; either version 2 of the License, or *
	11	* (at your option) any later version. *
	12	* *
	13	* This program is distributed in the hope that it will be useful, *
	14	* but WITHOUT ANY WARRANTY; without even the implied warranty of *
	15	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
	16	* GNU General Public License for more details. *
	17	* *
	18	* You should have received a copy of the GNU General Public License along *
	19	* with this program; if not, write to the Free Software Foundation, Inc., *
	20	* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. *
	21	* *
	22	\***************************************************************************/
	23
	24	#include "jabber.h"
	25	#include "base64.h"
	26
	27	xt_status sasl_pkt_mechanisms( struct xt_node *node, gpointer data )
	28	{
[0da65d5]	29	struct im_connection *ic = data;
	30	struct jabber_data *jd = ic->proto_data;
[5997488]	31	struct xt_node c, reply;
	32	char *s;
	33	int sup_plain = 0, sup_digest = 0;
	34
[0da65d5]	35	if( !sasl_supported( ic ) )
[8d74291]	36	{
	37	/* Should abort this now, since we should already be doing
	38	IQ authentication. Strange things happen when you try
	39	to do both... */
[84b045d]	40	imcb_log( ic, "XMPP 1.0 non-compliant server seems to support SASL, please report this as a BitlBee bug!" );
[8d74291]	41	return XT_HANDLED;
	42	}
	43
[5997488]	44	s = xt_find_attr( node, "xmlns" );
[47d3ac4]	45	if( !s \|\| strcmp( s, XMLNS_SASL ) != 0 )
[5997488]	46	{
[84b045d]	47	imcb_log( ic, "Stream error while authenticating" );
[c2fb3809]	48	imc_logout( ic, FALSE );
[5997488]	49	return XT_ABORT;
	50	}
	51
	52	c = node->children;
	53	while( ( c = xt_find_node( c, "mechanism" ) ) )
	54	{
	55	if( c->text && g_strcasecmp( c->text, "PLAIN" ) == 0 )
	56	sup_plain = 1;
	57	if( c->text && g_strcasecmp( c->text, "DIGEST-MD5" ) == 0 )
	58	sup_digest = 1;
	59
	60	c = c->next;
	61	}
	62
	63	if( !sup_plain && !sup_digest )
	64	{
[84b045d]	65	imcb_error( ic, "No known SASL authentication schemes supported" );
[c2fb3809]	66	imc_logout( ic, FALSE );
[5997488]	67	return XT_ABORT;
	68	}
	69
	70	reply = xt_new_node( "auth", NULL, NULL );
[47d3ac4]	71	xt_add_attr( reply, "xmlns", XMLNS_SASL );
[5997488]	72
[d8e0484]	73	if( sup_digest )
[fe7a554]	74	{
	75	xt_add_attr( reply, "mechanism", "DIGEST-MD5" );
	76
	77	/* The rest will be done later, when we receive a <challenge/>. */
	78	}
	79	else if( sup_plain )
[5997488]	80	{
	81	int len;
	82
	83	xt_add_attr( reply, "mechanism", "PLAIN" );
	84
	85	/* With SASL PLAIN in XMPP, the text should be b64(\0user\0pass) */
[0da65d5]	86	len = strlen( jd->username ) + strlen( ic->acc->pass ) + 2;
[5997488]	87	s = g_malloc( len + 1 );
	88	s[0] = 0;
	89	strcpy( s + 1, jd->username );
[0da65d5]	90	strcpy( s + 2 + strlen( jd->username ), ic->acc->pass );
[3b6eadc]	91	reply->text = base64_encode( (unsigned char *)s, len );
[5997488]	92	reply->text_len = strlen( reply->text );
	93	g_free( s );
	94	}
	95
[0da65d5]	96	if( !jabber_write_packet( ic, reply ) )
[5997488]	97	{
	98	xt_free_node( reply );
	99	return XT_ABORT;
	100	}
	101	xt_free_node( reply );
	102
	103	/* To prevent classic authentication from happening. */
	104	jd->flags \|= JFLAG_STREAM_STARTED;
	105
	106	return XT_HANDLED;
	107	}
	108
[d8e0484]	109	static char sasl_get_part( char data, char *field )
	110	{
	111	int i, len;
	112
	113	len = strlen( field );
	114
	115	if( g_strncasecmp( data, field, len ) == 0 && data[len] == '=' )
	116	{
	117	i = strlen( field ) + 1;
	118	}
	119	else
	120	{
	121	for( i = 0; data[i]; i ++ )
	122	{
	123	/* If we have a ", skip until it's closed again. */
	124	if( data[i] == '"' )
	125	{
	126	i ++;
	127	while( data[i] != '"' \|\| data[i-1] == '\\' )
	128	i ++;
	129	}
	130
	131	/* If we got a comma, we got a new field. Check it. */
	132	if( data[i] == ',' &&
	133	g_strncasecmp( data + i + 1, field, len ) == 0 &&
	134	data[i+len+1] == '=' )
	135	{
	136	i += len + 2;
	137	break;
	138	}
	139	}
	140	}
	141
	142	if( data[i] == '"' )
	143	{
	144	int j;
	145	char *ret;
	146
	147	i ++;
	148	len = 0;
	149	while( data[i+len] != '"' \|\| data[i+len-1] == '\\' )
	150	len ++;
	151
	152	ret = g_strndup( data + i, len );
	153	for( i = j = 0; ret[i]; i ++ )
	154	{
	155	if( ret[i] == '\\' )
	156	{
	157	ret[j++] = ret[++i];
	158	}
	159	else
	160	{
	161	ret[j++] = ret[i];
	162	}
	163	}
	164	ret[j] = 0;
	165
	166	return ret;
	167	}
	168	else if( data[i] )
	169	{
	170	len = 0;
	171	while( data[i+len] && data[i+len] != ',' )
	172	len ++;
	173
	174	return g_strndup( data + i, len );
	175	}
	176	else
	177	{
	178	return NULL;
	179	}
	180	}
	181
[5997488]	182	xt_status sasl_pkt_challenge( struct xt_node *node, gpointer data )
	183	{
[0da65d5]	184	struct im_connection *ic = data;
	185	struct jabber_data *jd = ic->proto_data;
[d8e0484]	186	struct xt_node *reply = NULL;
[3b6eadc]	187	char nonce = NULL, realm = NULL, *cnonce = NULL;
	188	unsigned char cnonce_bin[30];
[d8e0484]	189	char *digest_uri = NULL;
	190	char *dec = NULL;
	191	char *s = NULL;
	192	xt_status ret = XT_ABORT;
	193
	194	if( node->text_len == 0 )
	195	goto error;
	196
	197	dec = frombase64( node->text );
	198
	199	if( !( s = sasl_get_part( dec, "rspauth" ) ) )
	200	{
	201	/* See RFC 2831 for for information. */
	202	md5_state_t A1, A2, H;
	203	md5_byte_t A1r[16], A2r[16], Hr[16];
	204	char A1h[33], A2h[33], Hh[33];
	205	int i;
	206
	207	nonce = sasl_get_part( dec, "nonce" );
	208	realm = sasl_get_part( dec, "realm" );
	209
[d9282b4]	210	if( !nonce )
[d8e0484]	211	goto error;
	212
[d9282b4]	213	/* Jabber.Org considers the realm part optional and doesn't
	214	specify one. Oh well, actually they're right, but still,
	215	don't know if this is right... */
	216	if( !realm )
	217	realm = g_strdup( jd->server );
	218
[3b6eadc]	219	random_bytes( cnonce_bin, sizeof( cnonce_bin ) );
[d8e0484]	220	cnonce = base64_encode( cnonce_bin, sizeof( cnonce_bin ) );
	221	digest_uri = g_strdup_printf( "%s/%s", "xmpp", jd->server );
	222
	223	/* Generate the MD5 hash of username:realm:password,
	224	I decided to call it H. */
	225	md5_init( &H );
[0da65d5]	226	s = g_strdup_printf( "%s:%s:%s", jd->username, realm, ic->acc->pass );
[d8e0484]	227	md5_append( &H, (unsigned char *) s, strlen( s ) );
	228	g_free( s );
	229	md5_finish( &H, Hr );
	230
	231	/* Now generate the hex. MD5 hash of H:nonce:cnonce, called A1. */
	232	md5_init( &A1 );
	233	s = g_strdup_printf( ":%s:%s", nonce, cnonce );
	234	md5_append( &A1, Hr, 16 );
	235	md5_append( &A1, (unsigned char *) s, strlen( s ) );
	236	g_free( s );
	237	md5_finish( &A1, A1r );
	238	for( i = 0; i < 16; i ++ )
	239	sprintf( A1h + i * 2, "%02x", A1r[i] );
	240
	241	/* A2... */
	242	md5_init( &A2 );
	243	s = g_strdup_printf( "%s:%s", "AUTHENTICATE", digest_uri );
	244	md5_append( &A2, (unsigned char *) s, strlen( s ) );
	245	g_free( s );
	246	md5_finish( &A2, A2r );
	247	for( i = 0; i < 16; i ++ )
	248	sprintf( A2h + i * 2, "%02x", A2r[i] );
	249
	250	/* Final result: A1:nonce:00000001:cnonce:auth:A2. Let's reuse H for it. */
	251	md5_init( &H );
	252	s = g_strdup_printf( "%s:%s:%s:%s:%s:%s", A1h, nonce, "00000001", cnonce, "auth", A2h );
	253	md5_append( &H, (unsigned char *) s, strlen( s ) );
	254	g_free( s );
	255	md5_finish( &H, Hr );
	256	for( i = 0; i < 16; i ++ )
	257	sprintf( Hh + i * 2, "%02x", Hr[i] );
	258
	259	/* Now build the SASL response string: */
	260	g_free( dec );
	261	dec = g_strdup_printf( "username=\"%s\",realm=\"%s\",nonce=\"%s\",cnonce=\"%s\","
	262	"nc=%08x,qop=auth,digest-uri=\"%s\",response=%s,charset=%s",
	263	jd->username, realm, nonce, cnonce, 1, digest_uri, Hh, "utf-8" );
	264	s = tobase64( dec );
	265	}
	266	else
	267	{
	268	/* We found rspauth, but don't really care... */
	269	g_free( s );
	270	s = NULL;
	271	}
	272
	273	reply = xt_new_node( "response", s, NULL );
[47d3ac4]	274	xt_add_attr( reply, "xmlns", XMLNS_SASL );
[d8e0484]	275
[0da65d5]	276	if( !jabber_write_packet( ic, reply ) )
[d8e0484]	277	goto silent_error;
	278
	279	ret = XT_HANDLED;
	280	goto silent_error;
	281
	282	error:
[84b045d]	283	imcb_error( ic, "Incorrect SASL challenge received" );
[c2fb3809]	284	imc_logout( ic, FALSE );
[d8e0484]	285
	286	silent_error:
	287	g_free( digest_uri );
	288	g_free( cnonce );
	289	g_free( nonce );
	290	g_free( realm );
	291	g_free( dec );
	292	g_free( s );
	293	xt_free_node( reply );
	294
	295	return ret;
[5997488]	296	}
	297
	298	xt_status sasl_pkt_result( struct xt_node *node, gpointer data )
	299	{
[0da65d5]	300	struct im_connection *ic = data;
	301	struct jabber_data *jd = ic->proto_data;
[5997488]	302	char *s;
	303
	304	s = xt_find_attr( node, "xmlns" );
[47d3ac4]	305	if( !s \|\| strcmp( s, XMLNS_SASL ) != 0 )
[5997488]	306	{
[84b045d]	307	imcb_log( ic, "Stream error while authenticating" );
[c2fb3809]	308	imc_logout( ic, FALSE );
[5997488]	309	return XT_ABORT;
	310	}
	311
	312	if( strcmp( node->name, "success" ) == 0 )
	313	{
[84b045d]	314	imcb_log( ic, "Authentication finished" );
[5997488]	315	jd->flags \|= JFLAG_AUTHENTICATED \| JFLAG_STREAM_RESTART;
	316	}
	317	else if( strcmp( node->name, "failure" ) == 0 )
	318	{
[84b045d]	319	imcb_error( ic, "Authentication failure" );
[c2fb3809]	320	imc_logout( ic, FALSE );
[5997488]	321	return XT_ABORT;
	322	}
	323
	324	return XT_HANDLED;
	325	}
[8d74291]	326
	327	/* This one is needed to judge if we'll do authentication using IQ or SASL.
	328	It's done by checking if the <stream:stream> from the server has a
	329	version attribute. I don't know if this is the right way though... */
[0da65d5]	330	gboolean sasl_supported( struct im_connection *ic )
[8d74291]	331	{
[0da65d5]	332	struct jabber_data *jd = ic->proto_data;
[8d74291]	333
[fe7a554]	334	return ( (void*) ( jd->xt && jd->xt->root && xt_find_attr( jd->xt->root, "version" ) ) ) != NULL;
[8d74291]	335	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: