comparison libpurple/protocols/jabber/auth.c @ 20776:f3cfcbbac3d8

propagate from branch 'im.pidgin.pidgin' (head 294731552d0baf5f1f37a45e0c119b2188f34ba8) to branch 'im.pidgin.cpw.resiak.disconnectreason' (head 548e06334e7772c9583776ecbd80e8d2a68fcd79)

20775:d3443cb6a60f

		if(purple_ssl_is_supported()) {
			jabber_send_raw(js,
					"<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>", -1);
			return TRUE;
		} else if(xmlnode_get_child(starttls, "required")) {
			purple_connection_error(js->gc, _("Server requires TLS/SSL for login.  No TLS/SSL support found."));
			return TRUE;
		}
	}

	return FALSE;

	finish_plaintext_authentication(account->gc->proto_data);
}

static void disallow_plaintext_auth(PurpleAccount *account)
{
	purple_connection_error(account->gc, _("Server requires plaintext authentication over an unencrypted stream"));
}

#ifdef HAVE_CYRUS_SASL

static void jabber_auth_start_cyrus(JabberStream *);

				/* Everything else has failed, so fail the
				 * connection. Should probably have a better
				 * error here.
				 */
				} else {
					purple_connection_error(js->gc, _("Server does not use any supported authentication method"));
					return;
				}
				/* not reached */
				break;

			}
		}
		jabber_send(js, auth);
		xmlnode_free(auth);
	} else {
		purple_connection_error(js->gc, "SASL authentication failed\n");
	}
}

static int
jabber_sasl_cb_log(void *context, int level, const char *message)

	}

	mechs = xmlnode_get_child(packet, "mechanisms");

	if(!mechs) {
		purple_connection_error(js->gc, _("Invalid response from server."));
		return;
	}

#ifdef HAVE_CYRUS_SASL
	js->sasl_mechs = g_string_new("");

			g_free(msg);
			return;
		}
		finish_plaintext_authentication(js);
	} else {
		purple_connection_error(js->gc,
				_("Server does not use any supported authentication method"));
	}
#endif
}

			/* Clear the pasword if it isn't being saved */
			if (!purple_account_get_remember_password(js->gc->account))
				purple_account_set_password(js->gc->account, NULL);
		}

		purple_connection_error(js->gc, msg);
		g_free(msg);
	}
}

static void auth_old_cb(JabberStream *js, xmlnode *packet, gpointer data)

	xmlnode *query, *x;
	const char *type = xmlnode_get_attrib(packet, "type");
	const char *pw = purple_connection_get_password(js->gc);

	if(!type) {
		purple_connection_error(js->gc, _("Invalid response from server."));
		return;
	} else if(!strcmp(type, "error")) {
		char *msg = jabber_parse_error(js, packet);
		purple_connection_error(js->gc, msg);
		g_free(msg);
	} else if(!strcmp(type, "result")) {
		query = xmlnode_get_child(packet, "query");
		if(js->stream_id && xmlnode_get_child(query, "digest")) {
			unsigned char hashval[20];

						disallow_plaintext_auth);
				return;
			}
			finish_plaintext_authentication(js);
		} else {
			purple_connection_error(js->gc,
					_("Server does not use any supported authentication method"));
			return;
		}
	}
}

		char *dec_in;
		char *enc_out;
		GHashTable *parts;

		if(!enc_in) {
			purple_connection_error(js->gc, _("Invalid response from server."));
			return;
		}

		dec_in = (char *)purple_base64_decode(enc_in, NULL);
		purple_debug(PURPLE_DEBUG_MISC, "jabber", "decoded challenge (%d): %s\n",

					!strcmp(rspauth, js->expected_rspauth)) {
				jabber_send_raw(js,
						"<response xmlns='urn:ietf:params:xml:ns:xmpp-sasl' />",
						-1);
			} else {
				purple_connection_error(js->gc, _("Invalid challenge from server"));
			}
			g_free(js->expected_rspauth);
		} else {
			/* assemble a response, and send it */
			/* see RFC 2831 */

			realm = g_hash_table_lookup(parts, "realm");
			if(!realm)
				realm = js->user->domain;

			if (nonce == NULL || realm == NULL)
				purple_connection_error(js->gc, _("Invalid challenge from server"));
			else {
				GString *response = g_string_new("");
				char *a2;
				char *auth_resp;
				char *buf;

						  NULL, &c_out, &clen);
		g_free(enc_in);
		g_free(dec_in);
		if (js->sasl_state != SASL_CONTINUE && js->sasl_state != SASL_OK) {
			purple_debug_error("jabber", "Error is %d : %s\n",js->sasl_state,sasl_errdetail(js->sasl));
			purple_connection_error(js->gc, _("SASL error"));
			return;
		} else {
			response = xmlnode_new("response");
			xmlnode_set_namespace(response, "urn:ietf:params:xml:ns:xmpp-sasl");
			if (clen > 0) {

#ifdef HAVE_CYRUS_SASL
	const void *x;
#endif

	if(!ns || strcmp(ns, "urn:ietf:params:xml:ns:xmpp-sasl")) {
		purple_connection_error(js->gc, _("Invalid response from server."));
		return;
	}

#ifdef HAVE_CYRUS_SASL
	/* The SASL docs say that if the client hasn't returned OK yet, we

		g_free(enc_in);
		g_free(dec_in);

		if (js->sasl_state != SASL_OK) {
			/* This should never happen! */
			purple_connection_error(js->gc, _("Invalid response from server."));
		}
	}
	/* If we've negotiated a security layer, we need to enable it */
	sasl_getprop(js->sasl, SASL_SSF, &x);
	if (*(int *)x > 0) {

void jabber_auth_handle_failure(JabberStream *js, xmlnode *packet)
{
	char *msg = jabber_parse_error(js, packet);

	if(!msg) {
		purple_connection_error(js->gc, _("Invalid response from server."));
	} else {
		purple_connection_error(js->gc, msg);
		g_free(msg);
	}
}

20776:f3cfcbbac3d8

		if(purple_ssl_is_supported()) {
			jabber_send_raw(js,
					"<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>", -1);
			return TRUE;
		} else if(xmlnode_get_child(starttls, "required")) {
			purple_connection_error_reason (js->gc, PURPLE_REASON_ENCRYPTION_ERROR,
				_("Server requires TLS/SSL for login.  No TLS/SSL support found."));
			return TRUE;
		}
	}

	return FALSE;

	finish_plaintext_authentication(account->gc->proto_data);
}

static void disallow_plaintext_auth(PurpleAccount *account)
{
	purple_connection_error_reason (account->gc, PURPLE_REASON_ENCRYPTION_ERROR,
		_("Server requires plaintext authentication over an unencrypted stream"));
}

#ifdef HAVE_CYRUS_SASL

static void jabber_auth_start_cyrus(JabberStream *);

				/* Everything else has failed, so fail the
				 * connection. Should probably have a better
				 * error here.
				 */
				} else {
					purple_connection_error_reason (js->gc,
						PURPLE_REASON_AUTHENTICATION_IMPOSSIBLE,
						_("Server does not use any supported authentication method"));
					return;
				}
				/* not reached */
				break;

			}
		}
		jabber_send(js, auth);
		xmlnode_free(auth);
	} else {
		purple_connection_error_reason (js->gc,
			PURPLE_REASON_AUTHENTICATION_IMPOSSIBLE,
			"SASL authentication failed\n");
	}
}

static int
jabber_sasl_cb_log(void *context, int level, const char *message)

	}

	mechs = xmlnode_get_child(packet, "mechanisms");

	if(!mechs) {
		purple_connection_error_reason (js->gc, PURPLE_REASON_NETWORK_ERROR,
			_("Invalid response from server."));
		return;
	}

#ifdef HAVE_CYRUS_SASL
	js->sasl_mechs = g_string_new("");

			g_free(msg);
			return;
		}
		finish_plaintext_authentication(js);
	} else {
		purple_connection_error_reason (js->gc, PURPLE_REASON_AUTHENTICATION_IMPOSSIBLE,
				_("Server does not use any supported authentication method"));
	}
#endif
}

			/* Clear the pasword if it isn't being saved */
			if (!purple_account_get_remember_password(js->gc->account))
				purple_account_set_password(js->gc->account, NULL);
		}

		purple_connection_error_reason (js->gc, PURPLE_REASON_OTHER_ERROR, msg);
		g_free(msg);
	}
}

static void auth_old_cb(JabberStream *js, xmlnode *packet, gpointer data)

	xmlnode *query, *x;
	const char *type = xmlnode_get_attrib(packet, "type");
	const char *pw = purple_connection_get_password(js->gc);

	if(!type) {
		purple_connection_error_reason (js->gc, PURPLE_REASON_NETWORK_ERROR,
			_("Invalid response from server."));
		return;
	} else if(!strcmp(type, "error")) {
		char *msg = jabber_parse_error(js, packet);
		purple_connection_error_reason (js->gc, PURPLE_REASON_AUTHENTICATION_FAILED,
			msg);
		g_free(msg);
	} else if(!strcmp(type, "result")) {
		query = xmlnode_get_child(packet, "query");
		if(js->stream_id && xmlnode_get_child(query, "digest")) {
			unsigned char hashval[20];

						disallow_plaintext_auth);
				return;
			}
			finish_plaintext_authentication(js);
		} else {
			purple_connection_error_reason (js->gc,
				PURPLE_REASON_AUTHENTICATION_IMPOSSIBLE,
				_("Server does not use any supported authentication method"));
			return;
		}
	}
}

		char *dec_in;
		char *enc_out;
		GHashTable *parts;

		if(!enc_in) {
			purple_connection_error_reason (js->gc, PURPLE_REASON_NETWORK_ERROR,
				_("Invalid response from server."));
			return;
		}

		dec_in = (char *)purple_base64_decode(enc_in, NULL);
		purple_debug(PURPLE_DEBUG_MISC, "jabber", "decoded challenge (%d): %s\n",

					!strcmp(rspauth, js->expected_rspauth)) {
				jabber_send_raw(js,
						"<response xmlns='urn:ietf:params:xml:ns:xmpp-sasl' />",
						-1);
			} else {
				purple_connection_error_reason (js->gc, PURPLE_REASON_NETWORK_ERROR,
					_("Invalid challenge from server"));
			}
			g_free(js->expected_rspauth);
		} else {
			/* assemble a response, and send it */
			/* see RFC 2831 */

			realm = g_hash_table_lookup(parts, "realm");
			if(!realm)
				realm = js->user->domain;

			if (nonce == NULL || realm == NULL)
				purple_connection_error_reason (js->gc, PURPLE_REASON_NETWORK_ERROR,
					_("Invalid challenge from server"));
			else {
				GString *response = g_string_new("");
				char *a2;
				char *auth_resp;
				char *buf;

						  NULL, &c_out, &clen);
		g_free(enc_in);
		g_free(dec_in);
		if (js->sasl_state != SASL_CONTINUE && js->sasl_state != SASL_OK) {
			purple_debug_error("jabber", "Error is %d : %s\n",js->sasl_state,sasl_errdetail(js->sasl));
			purple_connection_error_reason (js->gc, PURPLE_REASON_NETWORK_ERROR,
				_("SASL error"));
			return;
		} else {
			response = xmlnode_new("response");
			xmlnode_set_namespace(response, "urn:ietf:params:xml:ns:xmpp-sasl");
			if (clen > 0) {

#ifdef HAVE_CYRUS_SASL
	const void *x;
#endif

	if(!ns || strcmp(ns, "urn:ietf:params:xml:ns:xmpp-sasl")) {
		purple_connection_error_reason (js->gc, PURPLE_REASON_NETWORK_ERROR,
			_("Invalid response from server."));
		return;
	}

#ifdef HAVE_CYRUS_SASL
	/* The SASL docs say that if the client hasn't returned OK yet, we

		g_free(enc_in);
		g_free(dec_in);

		if (js->sasl_state != SASL_OK) {
			/* This should never happen! */
			purple_connection_error_reason (js->gc, PURPLE_REASON_NETWORK_ERROR,
				_("Invalid response from server."));
		}
	}
	/* If we've negotiated a security layer, we need to enable it */
	sasl_getprop(js->sasl, SASL_SSF, &x);
	if (*(int *)x > 0) {

void jabber_auth_handle_failure(JabberStream *js, xmlnode *packet)
{
	char *msg = jabber_parse_error(js, packet);

	if(!msg) {
		purple_connection_error_reason (js->gc, PURPLE_REASON_NETWORK_ERROR,
			_("Invalid response from server."));
	} else {
		purple_connection_error_reason (js->gc, PURPLE_REASON_AUTHENTICATION_FAILED,
			msg);
		g_free(msg);
	}
}