Context Navigation

source: protocols/jabber/sasl.c @ 0fd8559

Last change on this file since 0fd8559 was 47d3ac4, checked in by Wilmer van der Gaast <wilmer@…>, at 2006-10-31T08:25:41Z
Added #defines for XML namespaces.
Property mode set to `100644`
File size: 9.0 KB

Line
1	/***************************************************************************\
2	* *
3	* BitlBee - An IRC to IM gateway *
4	* Jabber module - SASL authentication *
5	* *
6	* Copyright 2006 Wilmer van der Gaast <wilmer@gaast.net> *
7	* *
8	* This program is free software; you can redistribute it and/or modify *
9	* it under the terms of the GNU General Public License as published by *
10	* the Free Software Foundation; either version 2 of the License, or *
11	* (at your option) any later version. *
12	* *
13	* This program is distributed in the hope that it will be useful, *
14	* but WITHOUT ANY WARRANTY; without even the implied warranty of *
15	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the *
16	* GNU General Public License for more details. *
17	* *
18	* You should have received a copy of the GNU General Public License along *
19	* with this program; if not, write to the Free Software Foundation, Inc., *
20	* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. *
21	* *
22	\***************************************************************************/
23
24	#include "jabber.h"
25	#include "base64.h"
26
27	xt_status sasl_pkt_mechanisms( struct xt_node *node, gpointer data )
28	{
29	struct gaim_connection *gc = data;
30	struct jabber_data *jd = gc->proto_data;
31	struct xt_node c, reply;
32	char *s;
33	int sup_plain = 0, sup_digest = 0;
34
35	if( !sasl_supported( gc ) )
36	{
37	/* Should abort this now, since we should already be doing
38	IQ authentication. Strange things happen when you try
39	to do both... */
40	serv_got_crap( gc, "XMPP 1.0 non-compliant server seems to support SASL, please report this as a BitlBee bug!" );
41	return XT_HANDLED;
42	}
43
44	s = xt_find_attr( node, "xmlns" );
45	if( !s \|\| strcmp( s, XMLNS_SASL ) != 0 )
46	{
47	signoff( gc );
48	return XT_ABORT;
49	}
50
51	c = node->children;
52	while( ( c = xt_find_node( c, "mechanism" ) ) )
53	{
54	if( c->text && g_strcasecmp( c->text, "PLAIN" ) == 0 )
55	sup_plain = 1;
56	if( c->text && g_strcasecmp( c->text, "DIGEST-MD5" ) == 0 )
57	sup_digest = 1;
58
59	c = c->next;
60	}
61
62	if( !sup_plain && !sup_digest )
63	{
64	hide_login_progress( gc, "No known SASL authentication schemes supported" );
65	signoff( gc );
66	return XT_ABORT;
67	}
68
69	reply = xt_new_node( "auth", NULL, NULL );
70	xt_add_attr( reply, "xmlns", XMLNS_SASL );
71
72	if( sup_digest )
73	{
74	xt_add_attr( reply, "mechanism", "DIGEST-MD5" );
75
76	/* The rest will be done later, when we receive a <challenge/>. */
77	}
78	else if( sup_plain )
79	{
80	int len;
81
82	xt_add_attr( reply, "mechanism", "PLAIN" );
83
84	/* With SASL PLAIN in XMPP, the text should be b64(\0user\0pass) */
85	len = strlen( jd->username ) + strlen( gc->acc->pass ) + 2;
86	s = g_malloc( len + 1 );
87	s[0] = 0;
88	strcpy( s + 1, jd->username );
89	strcpy( s + 2 + strlen( jd->username ), gc->acc->pass );
90	reply->text = base64_encode( s, len );
91	reply->text_len = strlen( reply->text );
92	g_free( s );
93	}
94
95	if( !jabber_write_packet( gc, reply ) )
96	{
97	xt_free_node( reply );
98	return XT_ABORT;
99	}
100	xt_free_node( reply );
101
102	/* To prevent classic authentication from happening. */
103	jd->flags \|= JFLAG_STREAM_STARTED;
104
105	return XT_HANDLED;
106	}
107
108	static char sasl_get_part( char data, char *field )
109	{
110	int i, len;
111
112	len = strlen( field );
113
114	if( g_strncasecmp( data, field, len ) == 0 && data[len] == '=' )
115	{
116	i = strlen( field ) + 1;
117	}
118	else
119	{
120	for( i = 0; data[i]; i ++ )
121	{
122	/* If we have a ", skip until it's closed again. */
123	if( data[i] == '"' )
124	{
125	i ++;
126	while( data[i] != '"' \|\| data[i-1] == '\\' )
127	i ++;
128	}
129
130	/* If we got a comma, we got a new field. Check it. */
131	if( data[i] == ',' &&
132	g_strncasecmp( data + i + 1, field, len ) == 0 &&
133	data[i+len+1] == '=' )
134	{
135	i += len + 2;
136	break;
137	}
138	}
139	}
140
141	if( data[i] == '"' )
142	{
143	int j;
144	char *ret;
145
146	i ++;
147	len = 0;
148	while( data[i+len] != '"' \|\| data[i+len-1] == '\\' )
149	len ++;
150
151	ret = g_strndup( data + i, len );
152	for( i = j = 0; ret[i]; i ++ )
153	{
154	if( ret[i] == '\\' )
155	{
156	ret[j++] = ret[++i];
157	}
158	else
159	{
160	ret[j++] = ret[i];
161	}
162	}
163	ret[j] = 0;
164
165	return ret;
166	}
167	else if( data[i] )
168	{
169	len = 0;
170	while( data[i+len] && data[i+len] != ',' )
171	len ++;
172
173	return g_strndup( data + i, len );
174	}
175	else
176	{
177	return NULL;
178	}
179	}
180
181	xt_status sasl_pkt_challenge( struct xt_node *node, gpointer data )
182	{
183	struct gaim_connection *gc = data;
184	struct jabber_data *jd = gc->proto_data;
185	struct xt_node *reply = NULL;
186	char nonce = NULL, realm = NULL, *cnonce = NULL, cnonce_bin[30];
187	char *digest_uri = NULL;
188	char *dec = NULL;
189	char *s = NULL;
190	xt_status ret = XT_ABORT;
191
192	if( node->text_len == 0 )
193	goto error;
194
195	dec = frombase64( node->text );
196
197	if( !( s = sasl_get_part( dec, "rspauth" ) ) )
198	{
199	/* See RFC 2831 for for information. */
200	md5_state_t A1, A2, H;
201	md5_byte_t A1r[16], A2r[16], Hr[16];
202	char A1h[33], A2h[33], Hh[33];
203	int i;
204
205	nonce = sasl_get_part( dec, "nonce" );
206	realm = sasl_get_part( dec, "realm" );
207
208	if( !nonce )
209	goto error;
210
211	/* Jabber.Org considers the realm part optional and doesn't
212	specify one. Oh well, actually they're right, but still,
213	don't know if this is right... */
214	if( !realm )
215	realm = g_strdup( jd->server );
216
217	random_bytes( (unsigned char *) cnonce_bin, sizeof( cnonce_bin ) );
218	cnonce = base64_encode( cnonce_bin, sizeof( cnonce_bin ) );
219	digest_uri = g_strdup_printf( "%s/%s", "xmpp", jd->server );
220
221	/* Generate the MD5 hash of username:realm:password,
222	I decided to call it H. */
223	md5_init( &H );
224	s = g_strdup_printf( "%s:%s:%s", jd->username, realm, gc->acc->pass );
225	md5_append( &H, (unsigned char *) s, strlen( s ) );
226	g_free( s );
227	md5_finish( &H, Hr );
228
229	/* Now generate the hex. MD5 hash of H:nonce:cnonce, called A1. */
230	md5_init( &A1 );
231	s = g_strdup_printf( ":%s:%s", nonce, cnonce );
232	md5_append( &A1, Hr, 16 );
233	md5_append( &A1, (unsigned char *) s, strlen( s ) );
234	g_free( s );
235	md5_finish( &A1, A1r );
236	for( i = 0; i < 16; i ++ )
237	sprintf( A1h + i * 2, "%02x", A1r[i] );
238
239	/* A2... */
240	md5_init( &A2 );
241	s = g_strdup_printf( "%s:%s", "AUTHENTICATE", digest_uri );
242	md5_append( &A2, (unsigned char *) s, strlen( s ) );
243	g_free( s );
244	md5_finish( &A2, A2r );
245	for( i = 0; i < 16; i ++ )
246	sprintf( A2h + i * 2, "%02x", A2r[i] );
247
248	/* Final result: A1:nonce:00000001:cnonce:auth:A2. Let's reuse H for it. */
249	md5_init( &H );
250	s = g_strdup_printf( "%s:%s:%s:%s:%s:%s", A1h, nonce, "00000001", cnonce, "auth", A2h );
251	md5_append( &H, (unsigned char *) s, strlen( s ) );
252	g_free( s );
253	md5_finish( &H, Hr );
254	for( i = 0; i < 16; i ++ )
255	sprintf( Hh + i * 2, "%02x", Hr[i] );
256
257	/* Now build the SASL response string: */
258	g_free( dec );
259	dec = g_strdup_printf( "username=\"%s\",realm=\"%s\",nonce=\"%s\",cnonce=\"%s\","
260	"nc=%08x,qop=auth,digest-uri=\"%s\",response=%s,charset=%s",
261	jd->username, realm, nonce, cnonce, 1, digest_uri, Hh, "utf-8" );
262	s = tobase64( dec );
263	}
264	else
265	{
266	/* We found rspauth, but don't really care... */
267	g_free( s );
268	s = NULL;
269	}
270
271	reply = xt_new_node( "response", s, NULL );
272	xt_add_attr( reply, "xmlns", XMLNS_SASL );
273
274	if( !jabber_write_packet( gc, reply ) )
275	goto silent_error;
276
277	ret = XT_HANDLED;
278	goto silent_error;
279
280	error:
281	hide_login_progress( gc, "Incorrect SASL challenge received" );
282	signoff( gc );
283
284	silent_error:
285	g_free( digest_uri );
286	g_free( cnonce );
287	g_free( nonce );
288	g_free( realm );
289	g_free( dec );
290	g_free( s );
291	xt_free_node( reply );
292
293	return ret;
294	}
295
296	xt_status sasl_pkt_result( struct xt_node *node, gpointer data )
297	{
298	struct gaim_connection *gc = data;
299	struct jabber_data *jd = gc->proto_data;
300	char *s;
301
302	s = xt_find_attr( node, "xmlns" );
303	if( !s \|\| strcmp( s, XMLNS_SASL ) != 0 )
304	{
305	signoff( gc );
306	return XT_ABORT;
307	}
308
309	if( strcmp( node->name, "success" ) == 0 )
310	{
311	set_login_progress( gc, 1, "Authentication finished" );
312	jd->flags \|= JFLAG_AUTHENTICATED \| JFLAG_STREAM_RESTART;
313	}
314	else if( strcmp( node->name, "failure" ) == 0 )
315	{
316	hide_login_progress( gc, "Authentication failure" );
317	signoff( gc );
318	return XT_ABORT;
319	}
320
321	return XT_HANDLED;
322	}
323
324	/* This one is needed to judge if we'll do authentication using IQ or SASL.
325	It's done by checking if the <stream:stream> from the server has a
326	version attribute. I don't know if this is the right way though... */
327	gboolean sasl_supported( struct gaim_connection *gc )
328	{
329	struct jabber_data *jd = gc->proto_data;
330
331	return ( (void*) ( jd->xt && jd->xt->root && xt_find_attr( jd->xt->root, "version" ) ) ) != NULL;
332	}

Note: See TracBrowser for help on using the repository browser.

Download in other formats: