Context Navigation

source: protocols/jabber/sasl.c @ c7d0f41

Last change on this file since c7d0f41 was 47d3ac4, checked in by Wilmer van der Gaast <wilmer@…>, at 2006-10-31T08:25:41Z
Added #defines for XML namespaces.
Property mode set to `100644`
File size: 9.0 KB

Rev	Line
[5997488]	1	/***************************************************************************\
	2	* *
	3	* BitlBee - An IRC to IM gateway *
	4	* Jabber module - SASL authentication *
	5	* *
	6	* Copyright 2006 Wilmer van der Gaast <wilmer@gaast.net> *
	7	* *
	8	* This program is free software; you can redistribute it and/or modify *
	9	* it under the terms of the GNU General Public License as published by *
	10	* the Free Software Foundation; either version 2 of the License, or *
	11	* (at your option) any later version. *
	12	* *
	13	* This program is distributed in the hope that it will be useful, *
	14	* but WITHOUT ANY WARRANTY; without even the implied warranty of *
	15	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
	16	* GNU General Public License for more details. *
	17	* *
	18	* You should have received a copy of the GNU General Public License along *
	19	* with this program; if not, write to the Free Software Foundation, Inc., *
	20	* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. *
	21	* *
	22	\***************************************************************************/
	23
	24	#include "jabber.h"
	25	#include "base64.h"
	26
	27	xt_status sasl_pkt_mechanisms( struct xt_node *node, gpointer data )
	28	{
	29	struct gaim_connection *gc = data;
	30	struct jabber_data *jd = gc->proto_data;
	31	struct xt_node c, reply;
	32	char *s;
	33	int sup_plain = 0, sup_digest = 0;
	34
[8d74291]	35	if( !sasl_supported( gc ) )
	36	{
	37	/* Should abort this now, since we should already be doing
	38	IQ authentication. Strange things happen when you try
	39	to do both... */
	40	serv_got_crap( gc, "XMPP 1.0 non-compliant server seems to support SASL, please report this as a BitlBee bug!" );
	41	return XT_HANDLED;
	42	}
	43
[5997488]	44	s = xt_find_attr( node, "xmlns" );
[47d3ac4]	45	if( !s \|\| strcmp( s, XMLNS_SASL ) != 0 )
[5997488]	46	{
	47	signoff( gc );
	48	return XT_ABORT;
	49	}
	50
	51	c = node->children;
	52	while( ( c = xt_find_node( c, "mechanism" ) ) )
	53	{
	54	if( c->text && g_strcasecmp( c->text, "PLAIN" ) == 0 )
	55	sup_plain = 1;
	56	if( c->text && g_strcasecmp( c->text, "DIGEST-MD5" ) == 0 )
	57	sup_digest = 1;
	58
	59	c = c->next;
	60	}
	61
	62	if( !sup_plain && !sup_digest )
	63	{
[501b4e0]	64	hide_login_progress( gc, "No known SASL authentication schemes supported" );
[5997488]	65	signoff( gc );
	66	return XT_ABORT;
	67	}
	68
	69	reply = xt_new_node( "auth", NULL, NULL );
[47d3ac4]	70	xt_add_attr( reply, "xmlns", XMLNS_SASL );
[5997488]	71
[d8e0484]	72	if( sup_digest )
[fe7a554]	73	{
	74	xt_add_attr( reply, "mechanism", "DIGEST-MD5" );
	75
	76	/* The rest will be done later, when we receive a <challenge/>. */
	77	}
	78	else if( sup_plain )
[5997488]	79	{
	80	int len;
	81
	82	xt_add_attr( reply, "mechanism", "PLAIN" );
	83
	84	/* With SASL PLAIN in XMPP, the text should be b64(\0user\0pass) */
	85	len = strlen( jd->username ) + strlen( gc->acc->pass ) + 2;
	86	s = g_malloc( len + 1 );
	87	s[0] = 0;
	88	strcpy( s + 1, jd->username );
	89	strcpy( s + 2 + strlen( jd->username ), gc->acc->pass );
	90	reply->text = base64_encode( s, len );
	91	reply->text_len = strlen( reply->text );
	92	g_free( s );
	93	}
	94
	95	if( !jabber_write_packet( gc, reply ) )
	96	{
	97	xt_free_node( reply );
	98	return XT_ABORT;
	99	}
	100	xt_free_node( reply );
	101
	102	/* To prevent classic authentication from happening. */
	103	jd->flags \|= JFLAG_STREAM_STARTED;
	104
	105	return XT_HANDLED;
	106	}
	107
[d8e0484]	108	static char sasl_get_part( char data, char *field )
	109	{
	110	int i, len;
	111
	112	len = strlen( field );
	113
	114	if( g_strncasecmp( data, field, len ) == 0 && data[len] == '=' )
	115	{
	116	i = strlen( field ) + 1;
	117	}
	118	else
	119	{
	120	for( i = 0; data[i]; i ++ )
	121	{
	122	/* If we have a ", skip until it's closed again. */
	123	if( data[i] == '"' )
	124	{
	125	i ++;
	126	while( data[i] != '"' \|\| data[i-1] == '\\' )
	127	i ++;
	128	}
	129
	130	/* If we got a comma, we got a new field. Check it. */
	131	if( data[i] == ',' &&
	132	g_strncasecmp( data + i + 1, field, len ) == 0 &&
	133	data[i+len+1] == '=' )
	134	{
	135	i += len + 2;
	136	break;
	137	}
	138	}
	139	}
	140
	141	if( data[i] == '"' )
	142	{
	143	int j;
	144	char *ret;
	145
	146	i ++;
	147	len = 0;
	148	while( data[i+len] != '"' \|\| data[i+len-1] == '\\' )
	149	len ++;
	150
	151	ret = g_strndup( data + i, len );
	152	for( i = j = 0; ret[i]; i ++ )
	153	{
	154	if( ret[i] == '\\' )
	155	{
	156	ret[j++] = ret[++i];
	157	}
	158	else
	159	{
	160	ret[j++] = ret[i];
	161	}
	162	}
	163	ret[j] = 0;
	164
	165	return ret;
	166	}
	167	else if( data[i] )
	168	{
	169	len = 0;
	170	while( data[i+len] && data[i+len] != ',' )
	171	len ++;
	172
	173	return g_strndup( data + i, len );
	174	}
	175	else
	176	{
	177	return NULL;
	178	}
	179	}
	180
[5997488]	181	xt_status sasl_pkt_challenge( struct xt_node *node, gpointer data )
	182	{
[d8e0484]	183	struct gaim_connection *gc = data;
	184	struct jabber_data *jd = gc->proto_data;
	185	struct xt_node *reply = NULL;
	186	char nonce = NULL, realm = NULL, *cnonce = NULL, cnonce_bin[30];
	187	char *digest_uri = NULL;
	188	char *dec = NULL;
	189	char *s = NULL;
	190	xt_status ret = XT_ABORT;
	191
	192	if( node->text_len == 0 )
	193	goto error;
	194
	195	dec = frombase64( node->text );
	196
	197	if( !( s = sasl_get_part( dec, "rspauth" ) ) )
	198	{
	199	/* See RFC 2831 for for information. */
	200	md5_state_t A1, A2, H;
	201	md5_byte_t A1r[16], A2r[16], Hr[16];
	202	char A1h[33], A2h[33], Hh[33];
	203	int i;
	204
	205	nonce = sasl_get_part( dec, "nonce" );
	206	realm = sasl_get_part( dec, "realm" );
	207
[d9282b4]	208	if( !nonce )
[d8e0484]	209	goto error;
	210
[d9282b4]	211	/* Jabber.Org considers the realm part optional and doesn't
	212	specify one. Oh well, actually they're right, but still,
	213	don't know if this is right... */
	214	if( !realm )
	215	realm = g_strdup( jd->server );
	216
[d8e0484]	217	random_bytes( (unsigned char *) cnonce_bin, sizeof( cnonce_bin ) );
	218	cnonce = base64_encode( cnonce_bin, sizeof( cnonce_bin ) );
	219	digest_uri = g_strdup_printf( "%s/%s", "xmpp", jd->server );
	220
	221	/* Generate the MD5 hash of username:realm:password,
	222	I decided to call it H. */
	223	md5_init( &H );
	224	s = g_strdup_printf( "%s:%s:%s", jd->username, realm, gc->acc->pass );
	225	md5_append( &H, (unsigned char *) s, strlen( s ) );
	226	g_free( s );
	227	md5_finish( &H, Hr );
	228
	229	/* Now generate the hex. MD5 hash of H:nonce:cnonce, called A1. */
	230	md5_init( &A1 );
	231	s = g_strdup_printf( ":%s:%s", nonce, cnonce );
	232	md5_append( &A1, Hr, 16 );
	233	md5_append( &A1, (unsigned char *) s, strlen( s ) );
	234	g_free( s );
	235	md5_finish( &A1, A1r );
	236	for( i = 0; i < 16; i ++ )
	237	sprintf( A1h + i * 2, "%02x", A1r[i] );
	238
	239	/* A2... */
	240	md5_init( &A2 );
	241	s = g_strdup_printf( "%s:%s", "AUTHENTICATE", digest_uri );
	242	md5_append( &A2, (unsigned char *) s, strlen( s ) );
	243	g_free( s );
	244	md5_finish( &A2, A2r );
	245	for( i = 0; i < 16; i ++ )
	246	sprintf( A2h + i * 2, "%02x", A2r[i] );
	247
	248	/* Final result: A1:nonce:00000001:cnonce:auth:A2. Let's reuse H for it. */
	249	md5_init( &H );
	250	s = g_strdup_printf( "%s:%s:%s:%s:%s:%s", A1h, nonce, "00000001", cnonce, "auth", A2h );
	251	md5_append( &H, (unsigned char *) s, strlen( s ) );
	252	g_free( s );
	253	md5_finish( &H, Hr );
	254	for( i = 0; i < 16; i ++ )
	255	sprintf( Hh + i * 2, "%02x", Hr[i] );
	256
	257	/* Now build the SASL response string: */
	258	g_free( dec );
	259	dec = g_strdup_printf( "username=\"%s\",realm=\"%s\",nonce=\"%s\",cnonce=\"%s\","
	260	"nc=%08x,qop=auth,digest-uri=\"%s\",response=%s,charset=%s",
	261	jd->username, realm, nonce, cnonce, 1, digest_uri, Hh, "utf-8" );
	262	s = tobase64( dec );
	263	}
	264	else
	265	{
	266	/* We found rspauth, but don't really care... */
	267	g_free( s );
	268	s = NULL;
	269	}
	270
	271	reply = xt_new_node( "response", s, NULL );
[47d3ac4]	272	xt_add_attr( reply, "xmlns", XMLNS_SASL );
[d8e0484]	273
	274	if( !jabber_write_packet( gc, reply ) )
	275	goto silent_error;
	276
	277	ret = XT_HANDLED;
	278	goto silent_error;
	279
	280	error:
	281	hide_login_progress( gc, "Incorrect SASL challenge received" );
	282	signoff( gc );
	283
	284	silent_error:
	285	g_free( digest_uri );
	286	g_free( cnonce );
	287	g_free( nonce );
	288	g_free( realm );
	289	g_free( dec );
	290	g_free( s );
	291	xt_free_node( reply );
	292
	293	return ret;
[5997488]	294	}
	295
	296	xt_status sasl_pkt_result( struct xt_node *node, gpointer data )
	297	{
	298	struct gaim_connection *gc = data;
	299	struct jabber_data *jd = gc->proto_data;
	300	char *s;
	301
	302	s = xt_find_attr( node, "xmlns" );
[47d3ac4]	303	if( !s \|\| strcmp( s, XMLNS_SASL ) != 0 )
[5997488]	304	{
	305	signoff( gc );
	306	return XT_ABORT;
	307	}
	308
	309	if( strcmp( node->name, "success" ) == 0 )
	310	{
	311	set_login_progress( gc, 1, "Authentication finished" );
	312	jd->flags \|= JFLAG_AUTHENTICATED \| JFLAG_STREAM_RESTART;
	313	}
	314	else if( strcmp( node->name, "failure" ) == 0 )
	315	{
	316	hide_login_progress( gc, "Authentication failure" );
	317	signoff( gc );
	318	return XT_ABORT;
	319	}
	320
	321	return XT_HANDLED;
	322	}
[8d74291]	323
	324	/* This one is needed to judge if we'll do authentication using IQ or SASL.
	325	It's done by checking if the <stream:stream> from the server has a
	326	version attribute. I don't know if this is the right way though... */
	327	gboolean sasl_supported( struct gaim_connection *gc )
	328	{
	329	struct jabber_data *jd = gc->proto_data;
	330
[fe7a554]	331	return ( (void*) ( jd->xt && jd->xt->root && xt_find_attr( jd->xt->root, "version" ) ) ) != NULL;
[8d74291]	332	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: