Context Navigation

source: protocols/jabber/sasl.c @ d9282b4

Last change on this file since d9282b4 was d9282b4, checked in by Wilmer van der Gaast <wilmer@…>, at 2006-10-02T13:46:33Z
The SASL DIGEST-MD5 handler now doesn't barf on challenges without a realm (jabber.org likes to do this).
Property mode set to `100644`
File size: 8.9 KB

Line
1	/***************************************************************************\
2	* *
3	* BitlBee - An IRC to IM gateway *
4	* Jabber module - SASL authentication *
5	* *
6	* Copyright 2006 Wilmer van der Gaast <wilmer@gaast.net> *
7	* *
8	* This program is free software; you can redistribute it and/or modify *
9	* it under the terms of the GNU General Public License as published by *
10	* the Free Software Foundation; either version 2 of the License, or *
11	* (at your option) any later version. *
12	* *
13	* This program is distributed in the hope that it will be useful, *
14	* but WITHOUT ANY WARRANTY; without even the implied warranty of *
15	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
16	* GNU General Public License for more details. *
17	* *
18	* You should have received a copy of the GNU General Public License along *
19	* with this program; if not, write to the Free Software Foundation, Inc., *
20	* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. *
21	* *
22	\***************************************************************************/
23
24	#include "jabber.h"
25	#include "base64.h"
26
27	#define SASL_NS "urn:ietf:params:xml:ns:xmpp-sasl"
28
29	xt_status sasl_pkt_mechanisms( struct xt_node *node, gpointer data )
30	{
31	struct gaim_connection *gc = data;
32	struct jabber_data *jd = gc->proto_data;
33	struct xt_node c, reply;
34	char *s;
35	int sup_plain = 0, sup_digest = 0;
36
37	if( !sasl_supported( gc ) )
38	{
39	/* Should abort this now, since we should already be doing
40	IQ authentication. Strange things happen when you try
41	to do both... */
42	serv_got_crap( gc, "XMPP 1.0 non-compliant server seems to support SASL, please report this as a BitlBee bug!" );
43	return XT_HANDLED;
44	}
45
46	s = xt_find_attr( node, "xmlns" );
47	if( !s \|\| strcmp( s, SASL_NS ) != 0 )
48	{
49	signoff( gc );
50	return XT_ABORT;
51	}
52
53	c = node->children;
54	while( ( c = xt_find_node( c, "mechanism" ) ) )
55	{
56	if( c->text && g_strcasecmp( c->text, "PLAIN" ) == 0 )
57	sup_plain = 1;
58	if( c->text && g_strcasecmp( c->text, "DIGEST-MD5" ) == 0 )
59	sup_digest = 1;
60
61	c = c->next;
62	}
63
64	if( !sup_plain && !sup_digest )
65	{
66	signoff( gc );
67	return XT_ABORT;
68	}
69
70	reply = xt_new_node( "auth", NULL, NULL );
71	xt_add_attr( reply, "xmlns", SASL_NS );
72
73	if( sup_digest )
74	{
75	xt_add_attr( reply, "mechanism", "DIGEST-MD5" );
76
77	/* The rest will be done later, when we receive a <challenge/>. */
78	}
79	else if( sup_plain )
80	{
81	int len;
82
83	xt_add_attr( reply, "mechanism", "PLAIN" );
84
85	/* With SASL PLAIN in XMPP, the text should be b64(\0user\0pass) */
86	len = strlen( jd->username ) + strlen( gc->acc->pass ) + 2;
87	s = g_malloc( len + 1 );
88	s[0] = 0;
89	strcpy( s + 1, jd->username );
90	strcpy( s + 2 + strlen( jd->username ), gc->acc->pass );
91	reply->text = base64_encode( s, len );
92	reply->text_len = strlen( reply->text );
93	g_free( s );
94	}
95
96	if( !jabber_write_packet( gc, reply ) )
97	{
98	xt_free_node( reply );
99	return XT_ABORT;
100	}
101	xt_free_node( reply );
102
103	/* To prevent classic authentication from happening. */
104	jd->flags \|= JFLAG_STREAM_STARTED;
105
106	return XT_HANDLED;
107	}
108
109	static char sasl_get_part( char data, char *field )
110	{
111	int i, len;
112
113	len = strlen( field );
114
115	if( g_strncasecmp( data, field, len ) == 0 && data[len] == '=' )
116	{
117	i = strlen( field ) + 1;
118	}
119	else
120	{
121	for( i = 0; data[i]; i ++ )
122	{
123	/* If we have a ", skip until it's closed again. */
124	if( data[i] == '"' )
125	{
126	i ++;
127	while( data[i] != '"' \|\| data[i-1] == '\\' )
128	i ++;
129	}
130
131	/* If we got a comma, we got a new field. Check it. */
132	if( data[i] == ',' &&
133	g_strncasecmp( data + i + 1, field, len ) == 0 &&
134	data[i+len+1] == '=' )
135	{
136	i += len + 2;
137	break;
138	}
139	}
140	}
141
142	if( data[i] == '"' )
143	{
144	int j;
145	char *ret;
146
147	i ++;
148	len = 0;
149	while( data[i+len] != '"' \|\| data[i+len-1] == '\\' )
150	len ++;
151
152	ret = g_strndup( data + i, len );
153	for( i = j = 0; ret[i]; i ++ )
154	{
155	if( ret[i] == '\\' )
156	{
157	ret[j++] = ret[++i];
158	}
159	else
160	{
161	ret[j++] = ret[i];
162	}
163	}
164	ret[j] = 0;
165
166	return ret;
167	}
168	else if( data[i] )
169	{
170	len = 0;
171	while( data[i+len] && data[i+len] != ',' )
172	len ++;
173
174	return g_strndup( data + i, len );
175	}
176	else
177	{
178	return NULL;
179	}
180	}
181
182	xt_status sasl_pkt_challenge( struct xt_node *node, gpointer data )
183	{
184	struct gaim_connection *gc = data;
185	struct jabber_data *jd = gc->proto_data;
186	struct xt_node *reply = NULL;
187	char nonce = NULL, realm = NULL, *cnonce = NULL, cnonce_bin[30];
188	char *digest_uri = NULL;
189	char *dec = NULL;
190	char *s = NULL;
191	xt_status ret = XT_ABORT;
192
193	if( node->text_len == 0 )
194	goto error;
195
196	dec = frombase64( node->text );
197
198	if( !( s = sasl_get_part( dec, "rspauth" ) ) )
199	{
200	/* See RFC 2831 for for information. */
201	md5_state_t A1, A2, H;
202	md5_byte_t A1r[16], A2r[16], Hr[16];
203	char A1h[33], A2h[33], Hh[33];
204	int i;
205
206	nonce = sasl_get_part( dec, "nonce" );
207	realm = sasl_get_part( dec, "realm" );
208
209	if( !nonce )
210	goto error;
211
212	/* Jabber.Org considers the realm part optional and doesn't
213	specify one. Oh well, actually they're right, but still,
214	don't know if this is right... */
215	if( !realm )
216	realm = g_strdup( jd->server );
217
218	random_bytes( (unsigned char *) cnonce_bin, sizeof( cnonce_bin ) );
219	cnonce = base64_encode( cnonce_bin, sizeof( cnonce_bin ) );
220	digest_uri = g_strdup_printf( "%s/%s", "xmpp", jd->server );
221
222	/* Generate the MD5 hash of username:realm:password,
223	I decided to call it H. */
224	md5_init( &H );
225	s = g_strdup_printf( "%s:%s:%s", jd->username, realm, gc->acc->pass );
226	md5_append( &H, (unsigned char *) s, strlen( s ) );
227	g_free( s );
228	md5_finish( &H, Hr );
229
230	/* Now generate the hex. MD5 hash of H:nonce:cnonce, called A1. */
231	md5_init( &A1 );
232	s = g_strdup_printf( ":%s:%s", nonce, cnonce );
233	md5_append( &A1, Hr, 16 );
234	md5_append( &A1, (unsigned char *) s, strlen( s ) );
235	g_free( s );
236	md5_finish( &A1, A1r );
237	for( i = 0; i < 16; i ++ )
238	sprintf( A1h + i * 2, "%02x", A1r[i] );
239
240	/* A2... */
241	md5_init( &A2 );
242	s = g_strdup_printf( "%s:%s", "AUTHENTICATE", digest_uri );
243	md5_append( &A2, (unsigned char *) s, strlen( s ) );
244	g_free( s );
245	md5_finish( &A2, A2r );
246	for( i = 0; i < 16; i ++ )
247	sprintf( A2h + i * 2, "%02x", A2r[i] );
248
249	/* Final result: A1:nonce:00000001:cnonce:auth:A2. Let's reuse H for it. */
250	md5_init( &H );
251	s = g_strdup_printf( "%s:%s:%s:%s:%s:%s", A1h, nonce, "00000001", cnonce, "auth", A2h );
252	md5_append( &H, (unsigned char *) s, strlen( s ) );
253	g_free( s );
254	md5_finish( &H, Hr );
255	for( i = 0; i < 16; i ++ )
256	sprintf( Hh + i * 2, "%02x", Hr[i] );
257
258	/* Now build the SASL response string: */
259	g_free( dec );
260	dec = g_strdup_printf( "username=\"%s\",realm=\"%s\",nonce=\"%s\",cnonce=\"%s\","
261	"nc=%08x,qop=auth,digest-uri=\"%s\",response=%s,charset=%s",
262	jd->username, realm, nonce, cnonce, 1, digest_uri, Hh, "utf-8" );
263	s = tobase64( dec );
264	}
265	else
266	{
267	/* We found rspauth, but don't really care... */
268	g_free( s );
269	s = NULL;
270	}
271
272	reply = xt_new_node( "response", s, NULL );
273	xt_add_attr( reply, "xmlns", SASL_NS );
274
275	if( !jabber_write_packet( gc, reply ) )
276	goto silent_error;
277
278	ret = XT_HANDLED;
279	goto silent_error;
280
281	error:
282	hide_login_progress( gc, "Incorrect SASL challenge received" );
283	signoff( gc );
284
285	silent_error:
286	g_free( digest_uri );
287	g_free( cnonce );
288	g_free( nonce );
289	g_free( realm );
290	g_free( dec );
291	g_free( s );
292	xt_free_node( reply );
293
294	return ret;
295	}
296
297	xt_status sasl_pkt_result( struct xt_node *node, gpointer data )
298	{
299	struct gaim_connection *gc = data;
300	struct jabber_data *jd = gc->proto_data;
301	char *s;
302
303	s = xt_find_attr( node, "xmlns" );
304	if( !s \|\| strcmp( s, SASL_NS ) != 0 )
305	{
306	signoff( gc );
307	return XT_ABORT;
308	}
309
310	if( strcmp( node->name, "success" ) == 0 )
311	{
312	set_login_progress( gc, 1, "Authentication finished" );
313	jd->flags \|= JFLAG_AUTHENTICATED \| JFLAG_STREAM_RESTART;
314	}
315	else if( strcmp( node->name, "failure" ) == 0 )
316	{
317	hide_login_progress( gc, "Authentication failure" );
318	signoff( gc );
319	return XT_ABORT;
320	}
321
322	return XT_HANDLED;
323	}
324
325	/* This one is needed to judge if we'll do authentication using IQ or SASL.
326	It's done by checking if the <stream:stream> from the server has a
327	version attribute. I don't know if this is the right way though... */
328	gboolean sasl_supported( struct gaim_connection *gc )
329	{
330	struct jabber_data *jd = gc->proto_data;
331
332	return ( (void*) ( jd->xt && jd->xt->root && xt_find_attr( jd->xt->root, "version" ) ) ) != NULL;
333	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: