Mercurial > pidgin
annotate libpurple/protocols/jabber/auth_scram.c @ 28725:4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
This won't build with Cyrus support yet.
author | Paul Aurich <paul@darkrain42.org> |
---|---|
date | Tue, 01 Dec 2009 07:32:53 +0000 |
parents | 1c1910b17ae5 |
children | a6cd1db77aee |
rev | line source |
---|---|
28703
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
1 /* |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
2 * purple - Jabber Protocol Plugin |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
3 * |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
4 * Purple is the legal property of its developers, whose names are too numerous |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
5 * to list here. Please refer to the COPYRIGHT file distributed with this |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
6 * source distribution. |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
7 * |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
8 * This program is free software; you can redistribute it and/or modify |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
9 * it under the terms of the GNU General Public License as published by |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
10 * the Free Software Foundation; either version 2 of the License, or |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
11 * (at your option) any later version. |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
12 * |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
13 * This program is distributed in the hope that it will be useful, |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
16 * GNU General Public License for more details. |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
17 * |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
18 * You should have received a copy of the GNU General Public License |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
19 * along with this program; if not, write to the Free Software |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
20 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02111-1301 USA |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
21 * |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
22 */ |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
23 #include "internal.h" |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
24 |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
25 #include "auth.h" |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
26 #include "auth_scram.h" |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
27 |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
28 #include "cipher.h" |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
29 #include "debug.h" |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
30 |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
31 static const JabberScramHash hashes[] = { |
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
32 { "-SHA-1", "sha1", 20 }, |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
33 }; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
34 |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
35 static const JabberScramHash *mech_to_hash(const char *mech) |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
36 { |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
37 int i; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
38 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
39 g_return_val_if_fail(mech != NULL && *mech != '\0', NULL); |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
40 |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
41 for (i = 0; i < G_N_ELEMENTS(hashes); ++i) { |
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
42 if (strstr(mech, hashes[i].mech_substr)) |
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
43 return &(hashes[i]); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
44 } |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
45 |
28712
40a46992c728
jabber: Interop with Prosody (via Tobias' code). Hooray!
Paul Aurich <paul@darkrain42.org>
parents:
28711
diff
changeset
|
46 purple_debug_error("jabber", "Unknown SCRAM mechanism %s\n", mech); |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
47 g_return_val_if_reached(NULL); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
48 } |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
49 |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
50 guchar *jabber_scram_hi(const JabberScramHash *hash, const GString *str, |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
51 GString *salt, guint iterations) |
28703
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
52 { |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
53 PurpleCipherContext *context; |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
54 guchar *result; |
28703
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
55 guint i; |
28705
ec843b380a1d
How is it that there's no programmatic way to get the output size of the hash functions without resorting to a hardcoded table? Or did I miss something?
Paul Aurich <paul@darkrain42.org>
parents:
28704
diff
changeset
|
56 guchar *prev, *tmp; |
28703
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
57 |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
58 g_return_val_if_fail(hash != NULL, NULL); |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
59 g_return_val_if_fail(str != NULL && str->len > 0, NULL); |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
60 g_return_val_if_fail(salt != NULL && salt->len > 0, NULL); |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
61 g_return_val_if_fail(iterations > 0, NULL); |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
62 |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
63 prev = g_new0(guint8, hash->size); |
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
64 tmp = g_new0(guint8, hash->size); |
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
65 result = g_new0(guint8, hash->size); |
28705
ec843b380a1d
How is it that there's no programmatic way to get the output size of the hash functions without resorting to a hardcoded table? Or did I miss something?
Paul Aurich <paul@darkrain42.org>
parents:
28704
diff
changeset
|
66 |
28703
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
67 context = purple_cipher_context_new_by_name("hmac", NULL); |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
68 |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
69 /* Append INT(1), a four-octet encoding of the integer 1, most significant |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
70 * octet first. */ |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
71 g_string_append_len(salt, "\0\0\0\1", 4); |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
72 |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
73 /* Compute U0 */ |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
74 purple_cipher_context_set_option(context, "hash", (gpointer)hash->name); |
28703
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
75 purple_cipher_context_set_key_with_len(context, (guchar *)str->str, str->len); |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
76 purple_cipher_context_append(context, (guchar *)salt->str, salt->len); |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
77 purple_cipher_context_digest(context, hash->size, result, NULL); |
28703
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
78 |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
79 memcpy(prev, result, hash->size); |
28704
398ff52e7d62
Fix the Hi() function and actually 'mtn add' the test file.
Paul Aurich <paul@darkrain42.org>
parents:
28703
diff
changeset
|
80 |
28703
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
81 /* Compute U1...Ui */ |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
82 for (i = 1; i < iterations; ++i) { |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
83 guint j; |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
84 purple_cipher_context_set_option(context, "hash", (gpointer)hash->name); |
28703
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
85 purple_cipher_context_set_key_with_len(context, (guchar *)str->str, str->len); |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
86 purple_cipher_context_append(context, prev, hash->size); |
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
87 purple_cipher_context_digest(context, hash->size, tmp, NULL); |
28703
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
88 |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
89 for (j = 0; j < hash->size; ++j) |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
90 result[j] ^= tmp[j]; |
28704
398ff52e7d62
Fix the Hi() function and actually 'mtn add' the test file.
Paul Aurich <paul@darkrain42.org>
parents:
28703
diff
changeset
|
91 |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
92 memcpy(prev, tmp, hash->size); |
28703
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
93 } |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
94 |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
95 purple_cipher_context_destroy(context); |
28706
2b4465db73f1
Clean up the two temporary buffers.
Paul Aurich <paul@darkrain42.org>
parents:
28705
diff
changeset
|
96 g_free(tmp); |
2b4465db73f1
Clean up the two temporary buffers.
Paul Aurich <paul@darkrain42.org>
parents:
28705
diff
changeset
|
97 g_free(prev); |
28703
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
98 return result; |
338eeaf371e2
jabber: Add the Hi() function (PBKDF2).
Paul Aurich <paul@darkrain42.org>
parents:
diff
changeset
|
99 } |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
100 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
101 /* |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
102 * Helper functions for doing the SCRAM calculations. The first argument |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
103 * is the hash algorithm. All buffers must be of the appropriate size |
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
104 * according to the JabberScramHash. |
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
105 * |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
106 * "str" is a NULL-terminated string for hmac(). |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
107 * |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
108 * Needless to say, these are fragile. |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
109 */ |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
110 static void |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
111 hmac(const JabberScramHash *hash, guchar *out, const guchar *key, const gchar *str) |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
112 { |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
113 PurpleCipherContext *context; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
114 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
115 context = purple_cipher_context_new_by_name("hmac", NULL); |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
116 purple_cipher_context_set_option(context, "hash", (gpointer)hash->name); |
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
117 purple_cipher_context_set_key_with_len(context, key, hash->size); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
118 purple_cipher_context_append(context, (guchar *)str, strlen(str)); |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
119 purple_cipher_context_digest(context, hash->size, out, NULL); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
120 purple_cipher_context_destroy(context); |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
121 } |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
122 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
123 static void |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
124 hash(const JabberScramHash *hash, guchar *out, const guchar *data) |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
125 { |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
126 PurpleCipherContext *context; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
127 |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
128 context = purple_cipher_context_new_by_name(hash->name, NULL); |
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
129 purple_cipher_context_append(context, data, hash->size); |
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
130 purple_cipher_context_digest(context, hash->size, out, NULL); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
131 purple_cipher_context_destroy(context); |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
132 } |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
133 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
134 gboolean |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
135 jabber_scram_calc_proofs(JabberScramData *data, GString *salt, guint iterations) |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
136 { |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
137 guint hash_len = data->hash->size; |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
138 guint i; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
139 |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
140 GString *pass = g_string_new(data->password); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
141 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
142 guchar *salted_password; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
143 guchar client_key[hash_len]; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
144 guchar stored_key[hash_len]; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
145 guchar client_signature[hash_len]; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
146 guchar server_key[hash_len]; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
147 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
148 data->client_proof = g_string_sized_new(hash_len); |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
149 data->client_proof->len = hash_len; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
150 data->server_signature = g_string_sized_new(hash_len); |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
151 data->server_signature->len = hash_len; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
152 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
153 salted_password = jabber_scram_hi(data->hash, pass, salt, iterations); |
28717
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
154 |
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
155 memset(pass->str, 0, pass->allocated_len); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
156 g_string_free(pass, TRUE); |
28717
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
157 |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
158 if (!salted_password) |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
159 return FALSE; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
160 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
161 /* client_key = HMAC(salted_password, "Client Key") */ |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
162 hmac(data->hash, client_key, salted_password, "Client Key"); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
163 /* server_key = HMAC(salted_password, "Server Key") */ |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
164 hmac(data->hash, server_key, salted_password, "Server Key"); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
165 g_free(salted_password); |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
166 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
167 /* stored_key = HASH(client_key) */ |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
168 hash(data->hash, stored_key, client_key); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
169 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
170 /* client_signature = HMAC(stored_key, auth_message) */ |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
171 hmac(data->hash, client_signature, stored_key, data->auth_message->str); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
172 /* server_signature = HMAC(server_key, auth_message) */ |
28722
1c1910b17ae5
jabber: Clean up the SCRAM code a little.
Paul Aurich <paul@darkrain42.org>
parents:
28721
diff
changeset
|
173 hmac(data->hash, (guchar *)data->server_signature->str, server_key, data->auth_message->str); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
174 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
175 /* client_proof = client_key XOR client_signature */ |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
176 for (i = 0; i < hash_len; ++i) |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
177 data->client_proof->str[i] = client_key[i] ^ client_signature[i]; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
178 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
179 return TRUE; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
180 } |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
181 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
182 static gboolean |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
183 parse_server_step1(JabberScramData *data, const char *challenge, |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
184 gchar **out_nonce, GString **out_salt, guint *out_iterations) |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
185 { |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
186 char **tokens; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
187 char *token, *decoded, *tmp; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
188 gsize len; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
189 char *nonce = NULL; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
190 GString *salt = NULL; |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
191 guint iterations; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
192 |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
193 tokens = g_strsplit(challenge, ",", -1); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
194 if (tokens == NULL) |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
195 return FALSE; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
196 |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
197 token = tokens[0]; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
198 if (token[0] != 'r' || token[1] != '=') |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
199 goto err; |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
200 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
201 /* Ensure that the first cnonce_len bytes of the nonce are the original |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
202 * cnonce we sent to the server. |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
203 */ |
28711
65a34cce02e3
jabber: Fix up the remaining issues and add a test case that interoperates with gsasl. Woot.
Paul Aurich <paul@darkrain42.org>
parents:
28709
diff
changeset
|
204 if (0 != strncmp(data->cnonce, token + 2, strlen(data->cnonce))) |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
205 goto err; |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
206 |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
207 nonce = g_strdup(token + 2); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
208 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
209 /* The Salt, base64-encoded */ |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
210 token = tokens[1]; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
211 if (token[0] != 's' || token[1] != '=') |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
212 goto err; |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
213 |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
214 decoded = (gchar *)purple_base64_decode(token + 2, &len); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
215 if (!decoded || *decoded == '\0') { |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
216 g_free(decoded); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
217 goto err; |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
218 } |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
219 salt = g_string_new_len(decoded, len); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
220 g_free(decoded); |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
221 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
222 /* The iteration count */ |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
223 token = tokens[2]; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
224 if (token[0] != 'i' || token[1] != '=' || token[2] == '\0') |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
225 goto err; |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
226 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
227 /* Validate the string */ |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
228 for (tmp = token + 2; *tmp; ++tmp) |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
229 if (!g_ascii_isdigit(*tmp)) |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
230 goto err; |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
231 |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
232 iterations = strtoul(token + 2, NULL, 10); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
233 |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
234 g_strfreev(tokens); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
235 *out_nonce = nonce; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
236 *out_salt = salt; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
237 *out_iterations = iterations; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
238 return TRUE; |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
239 |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
240 err: |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
241 g_free(nonce); |
28711
65a34cce02e3
jabber: Fix up the remaining issues and add a test case that interoperates with gsasl. Woot.
Paul Aurich <paul@darkrain42.org>
parents:
28709
diff
changeset
|
242 if (salt) |
65a34cce02e3
jabber: Fix up the remaining issues and add a test case that interoperates with gsasl. Woot.
Paul Aurich <paul@darkrain42.org>
parents:
28709
diff
changeset
|
243 g_string_free(salt, TRUE); |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
244 g_strfreev(tokens); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
245 return FALSE; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
246 } |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
247 |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
248 static gboolean |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
249 parse_server_step2(JabberScramData *data, const char *challenge, gchar **out_verifier) |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
250 { |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
251 char **tokens; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
252 char *token; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
253 |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
254 tokens = g_strsplit(challenge, ",", -1); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
255 if (tokens == NULL) |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
256 return FALSE; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
257 |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
258 token = tokens[0]; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
259 if (token[0] != 'v' || token[1] != '=' || token[2] == '\0') { |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
260 g_strfreev(tokens); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
261 return FALSE; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
262 } |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
263 |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
264 *out_verifier = g_strdup(token + 2); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
265 g_strfreev(tokens); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
266 return TRUE; |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
267 } |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
268 |
28711
65a34cce02e3
jabber: Fix up the remaining issues and add a test case that interoperates with gsasl. Woot.
Paul Aurich <paul@darkrain42.org>
parents:
28709
diff
changeset
|
269 gboolean |
65a34cce02e3
jabber: Fix up the remaining issues and add a test case that interoperates with gsasl. Woot.
Paul Aurich <paul@darkrain42.org>
parents:
28709
diff
changeset
|
270 jabber_scram_feed_parser(JabberScramData *data, gchar *in, gchar **out) |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
271 { |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
272 gboolean ret; |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
273 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
274 g_return_val_if_fail(data != NULL, FALSE); |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
275 |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
276 g_string_append_c(data->auth_message, ','); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
277 g_string_append(data->auth_message, in); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
278 |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
279 if (data->step == 1) { |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
280 gchar *nonce, *proof; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
281 GString *salt; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
282 guint iterations; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
283 |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
284 ret = parse_server_step1(data, in, &nonce, &salt, &iterations); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
285 if (!ret) |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
286 return FALSE; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
287 |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
288 g_string_append_c(data->auth_message, ','); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
289 |
28711
65a34cce02e3
jabber: Fix up the remaining issues and add a test case that interoperates with gsasl. Woot.
Paul Aurich <paul@darkrain42.org>
parents:
28709
diff
changeset
|
290 /* "biws" is the base64 encoding of "n,,". I promise. */ |
65a34cce02e3
jabber: Fix up the remaining issues and add a test case that interoperates with gsasl. Woot.
Paul Aurich <paul@darkrain42.org>
parents:
28709
diff
changeset
|
291 g_string_append_printf(data->auth_message, "c=%s,r=%s", "biws", nonce); |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
292 #ifdef CHANNEL_BINDING |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
293 #error fix this |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
294 #endif |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
295 |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
296 ret = jabber_scram_calc_proofs(data, salt, iterations); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
297 if (!ret) |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
298 return FALSE; |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
299 |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
300 proof = purple_base64_encode((guchar *)data->client_proof->str, data->client_proof->len); |
28711
65a34cce02e3
jabber: Fix up the remaining issues and add a test case that interoperates with gsasl. Woot.
Paul Aurich <paul@darkrain42.org>
parents:
28709
diff
changeset
|
301 *out = g_strdup_printf("c=%s,r=%s,p=%s", "biws", nonce, proof); |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
302 g_free(proof); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
303 } else if (data->step == 2) { |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
304 gchar *server_sig, *enc_server_sig; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
305 gsize len; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
306 |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
307 ret = parse_server_step2(data, in, &enc_server_sig); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
308 if (!ret) |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
309 return FALSE; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
310 |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
311 server_sig = (gchar *)purple_base64_decode(enc_server_sig, &len); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
312 g_free(enc_server_sig); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
313 |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
314 if (server_sig == NULL || len != data->server_signature->len) { |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
315 g_free(server_sig); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
316 return FALSE; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
317 } |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
318 |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
319 if (0 != memcmp(server_sig, data->server_signature->str, len)) { |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
320 g_free(server_sig); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
321 return FALSE; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
322 } |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
323 g_free(server_sig); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
324 |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
325 *out = NULL; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
326 } else { |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
327 purple_debug_error("jabber", "SCRAM: There is no step %d\n", data->step); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
328 return FALSE; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
329 } |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
330 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
331 return TRUE; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
332 } |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
333 |
28717
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
334 static gchar *escape_username(const gchar *in) |
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
335 { |
28721
f10741a709a9
jabber: Should have looked for this function earlier.
Paul Aurich <paul@darkrain42.org>
parents:
28717
diff
changeset
|
336 gchar *tmp, *tmp2; |
28717
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
337 |
28721
f10741a709a9
jabber: Should have looked for this function earlier.
Paul Aurich <paul@darkrain42.org>
parents:
28717
diff
changeset
|
338 tmp = purple_strreplace(in, "=", "=3D"); |
f10741a709a9
jabber: Should have looked for this function earlier.
Paul Aurich <paul@darkrain42.org>
parents:
28717
diff
changeset
|
339 tmp2 = purple_strreplace(tmp, ",", "=2D"); |
f10741a709a9
jabber: Should have looked for this function earlier.
Paul Aurich <paul@darkrain42.org>
parents:
28717
diff
changeset
|
340 g_free(tmp); |
f10741a709a9
jabber: Should have looked for this function earlier.
Paul Aurich <paul@darkrain42.org>
parents:
28717
diff
changeset
|
341 return tmp2; |
28717
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
342 } |
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
343 |
28725
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
344 static JabberSaslState |
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
345 scram_start(JabberStream *js, xmlnode *mechanisms, xmlnode **out, const char **error) |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
346 { |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
347 xmlnode *reply; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
348 JabberScramData *data; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
349 guint64 cnonce; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
350 #ifdef CHANNEL_BINDING |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
351 gboolean binding_supported = TRUE; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
352 #endif |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
353 gchar *dec_out, *enc_out; |
28717
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
354 gchar *prepped_node, *tmp; |
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
355 gchar *prepped_pass; |
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
356 |
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
357 prepped_node = jabber_saslprep(js->user->node); |
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
358 if (!prepped_node) { |
28725
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
359 *error = _("Unable to canonicalize username"); |
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
360 return JABBER_SASL_STATE_FAIL; |
28717
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
361 } |
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
362 |
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
363 tmp = escape_username(prepped_node); |
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
364 g_free(prepped_node); |
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
365 prepped_node = tmp; |
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
366 |
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
367 prepped_pass = jabber_saslprep(purple_connection_get_password(js->gc)); |
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
368 if (!prepped_pass) { |
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
369 g_free(prepped_node); |
28725
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
370 *error = _("Unable to canonicalize password"); |
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
371 return JABBER_SASL_STATE_FAIL; |
28717
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
372 } |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
373 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
374 data = js->auth_mech_data = g_new0(JabberScramData, 1); |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
375 data->hash = mech_to_hash(js->auth_mech->name); |
28717
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
376 data->password = prepped_pass; |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
377 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
378 #ifdef CHANNEL_BINDING |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
379 if (strstr(js->auth_mech_name, "-PLUS")) |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
380 data->channel_binding = TRUE; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
381 #endif |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
382 cnonce = ((guint64)g_random_int() << 32) | g_random_int(); |
28712
40a46992c728
jabber: Interop with Prosody (via Tobias' code). Hooray!
Paul Aurich <paul@darkrain42.org>
parents:
28711
diff
changeset
|
383 data->cnonce = purple_base64_encode((guchar *)&cnonce, sizeof(cnonce)); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
384 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
385 data->auth_message = g_string_new(NULL); |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
386 g_string_printf(data->auth_message, "n=%s,r=%s", |
28717
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
387 prepped_node, data->cnonce); |
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
388 g_free(prepped_node); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
389 |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
390 data->step = 1; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
391 |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
392 reply = xmlnode_new("auth"); |
28715
cea22db36ffc
jabber: Use NS_XMPP_SASL
Paul Aurich <paul@darkrain42.org>
parents:
28712
diff
changeset
|
393 xmlnode_set_namespace(reply, NS_XMPP_SASL); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
394 xmlnode_set_attrib(reply, "mechanism", js->auth_mech->name); |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
395 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
396 /* TODO: Channel binding */ |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
397 dec_out = g_strdup_printf("%c,,%s", 'n', data->auth_message->str); |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
398 enc_out = purple_base64_encode((guchar *)dec_out, strlen(dec_out)); |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
399 purple_debug_misc("jabber", "initial SCRAM message '%s'\n", dec_out); |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
400 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
401 xmlnode_insert_data(reply, enc_out, -1); |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
402 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
403 g_free(enc_out); |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
404 g_free(dec_out); |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
405 |
28725
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
406 *out = reply; |
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
407 return JABBER_SASL_STATE_CONTINUE; |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
408 } |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
409 |
28725
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
410 static JabberSaslState |
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
411 scram_handle_challenge(JabberStream *js, xmlnode *challenge, xmlnode **out, const char **error) |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
412 { |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
413 JabberScramData *data = js->auth_mech_data; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
414 xmlnode *reply; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
415 gchar *enc_in, *dec_in; |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
416 gchar *enc_out = NULL, *dec_out = NULL; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
417 gsize len; |
28725
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
418 JabberSaslState state = JABBER_SASL_STATE_FAIL; |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
419 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
420 enc_in = xmlnode_get_data(challenge); |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
421 if (!enc_in || *enc_in == '\0') { |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
422 reply = xmlnode_new("abort"); |
28715
cea22db36ffc
jabber: Use NS_XMPP_SASL
Paul Aurich <paul@darkrain42.org>
parents:
28712
diff
changeset
|
423 xmlnode_set_namespace(reply, NS_XMPP_SASL); |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
424 data->step = -1; |
28725
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
425 *error = _("Invalid challenge from server"); |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
426 goto out; |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
427 } |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
428 |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
429 dec_in = (gchar *)purple_base64_decode(enc_in, &len); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
430 g_free(enc_in); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
431 if (!dec_in || len != strlen(dec_in)) { |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
432 /* Danger afoot; SCRAM shouldn't contain NUL bytes */ |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
433 reply = xmlnode_new("abort"); |
28715
cea22db36ffc
jabber: Use NS_XMPP_SASL
Paul Aurich <paul@darkrain42.org>
parents:
28712
diff
changeset
|
434 xmlnode_set_namespace(reply, NS_XMPP_SASL); |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
435 data->step = -1; |
28725
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
436 *error = _("Malicious challenge from server"); |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
437 goto out; |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
438 } |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
439 |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
440 purple_debug_misc("jabber", "decoded challenge: %s\n", dec_in); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
441 |
28711
65a34cce02e3
jabber: Fix up the remaining issues and add a test case that interoperates with gsasl. Woot.
Paul Aurich <paul@darkrain42.org>
parents:
28709
diff
changeset
|
442 if (!jabber_scram_feed_parser(data, dec_in, &dec_out)) { |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
443 reply = xmlnode_new("abort"); |
28715
cea22db36ffc
jabber: Use NS_XMPP_SASL
Paul Aurich <paul@darkrain42.org>
parents:
28712
diff
changeset
|
444 xmlnode_set_namespace(reply, NS_XMPP_SASL); |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
445 data->step = -1; |
28725
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
446 *error = _("Invalid challenge from server"); |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
447 goto out; |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
448 } |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
449 |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
450 data->step += 1; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
451 |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
452 reply = xmlnode_new("response"); |
28715
cea22db36ffc
jabber: Use NS_XMPP_SASL
Paul Aurich <paul@darkrain42.org>
parents:
28712
diff
changeset
|
453 xmlnode_set_namespace(reply, NS_XMPP_SASL); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
454 |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
455 purple_debug_misc("jabber", "decoded response: %s\n", dec_out ? dec_out : "(null)"); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
456 if (dec_out) { |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
457 enc_out = purple_base64_encode((guchar *)dec_out, strlen(dec_out)); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
458 xmlnode_insert_data(reply, enc_out, -1); |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
459 } |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
460 |
28725
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
461 state = JABBER_SASL_STATE_CONTINUE; |
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
462 |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
463 out: |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
464 g_free(enc_out); |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
465 g_free(dec_out); |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
466 |
28725
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
467 *out = reply; |
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
468 return state; |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
469 } |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
470 |
28725
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
471 static JabberSaslState |
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
472 scram_handle_success(JabberStream *js, xmlnode *packet, const char **error) |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
473 { |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
474 JabberScramData *data = js->auth_mech_data; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
475 char *enc_in, *dec_in; |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
476 char *dec_out = NULL; |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
477 gsize len; |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
478 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
479 enc_in = xmlnode_get_data(packet); |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
480 g_return_val_if_fail(enc_in != NULL && *enc_in != '\0', FALSE); |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
481 |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
482 if (data->step == 3) |
28725
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
483 return JABBER_SASL_STATE_OK; |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
484 |
28725
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
485 if (data->step != 2) { |
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
486 *error = _("Unexpected response from server"); |
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
487 return JABBER_SASL_STATE_FAIL; |
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
488 } |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
489 |
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
490 dec_in = (gchar *)purple_base64_decode(enc_in, &len); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
491 g_free(enc_in); |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
492 if (!dec_in || len != strlen(dec_in)) { |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
493 /* Danger afoot; SCRAM shouldn't contain NUL bytes */ |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
494 g_free(dec_in); |
28725
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
495 *error = _("Invalid challenge from server"); |
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
496 return JABBER_SASL_STATE_FAIL; |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
497 } |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
498 |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
499 purple_debug_misc("jabber", "decoded success: %s\n", dec_in); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
500 |
28711
65a34cce02e3
jabber: Fix up the remaining issues and add a test case that interoperates with gsasl. Woot.
Paul Aurich <paul@darkrain42.org>
parents:
28709
diff
changeset
|
501 if (!jabber_scram_feed_parser(data, dec_in, &dec_out) || dec_out != NULL) { |
28709
b0fb53868142
jabber: Handle the case where the server success-with-data is sent as a challenge/response pair.
Paul Aurich <paul@darkrain42.org>
parents:
28707
diff
changeset
|
502 g_free(dec_out); |
28725
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
503 *error = _("Invalid challenge from server"); |
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
504 return JABBER_SASL_STATE_FAIL; |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
505 } |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
506 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
507 /* Hooray */ |
28725
4f45aae3ace1
Let's try a more complex set of return states / values for auth mechs.
Paul Aurich <paul@darkrain42.org>
parents:
28722
diff
changeset
|
508 return JABBER_SASL_STATE_OK; |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
509 } |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
510 |
28711
65a34cce02e3
jabber: Fix up the remaining issues and add a test case that interoperates with gsasl. Woot.
Paul Aurich <paul@darkrain42.org>
parents:
28709
diff
changeset
|
511 void jabber_scram_data_destroy(JabberScramData *data) |
65a34cce02e3
jabber: Fix up the remaining issues and add a test case that interoperates with gsasl. Woot.
Paul Aurich <paul@darkrain42.org>
parents:
28709
diff
changeset
|
512 { |
65a34cce02e3
jabber: Fix up the remaining issues and add a test case that interoperates with gsasl. Woot.
Paul Aurich <paul@darkrain42.org>
parents:
28709
diff
changeset
|
513 g_free(data->cnonce); |
65a34cce02e3
jabber: Fix up the remaining issues and add a test case that interoperates with gsasl. Woot.
Paul Aurich <paul@darkrain42.org>
parents:
28709
diff
changeset
|
514 if (data->auth_message) |
65a34cce02e3
jabber: Fix up the remaining issues and add a test case that interoperates with gsasl. Woot.
Paul Aurich <paul@darkrain42.org>
parents:
28709
diff
changeset
|
515 g_string_free(data->auth_message, TRUE); |
65a34cce02e3
jabber: Fix up the remaining issues and add a test case that interoperates with gsasl. Woot.
Paul Aurich <paul@darkrain42.org>
parents:
28709
diff
changeset
|
516 if (data->client_proof) |
65a34cce02e3
jabber: Fix up the remaining issues and add a test case that interoperates with gsasl. Woot.
Paul Aurich <paul@darkrain42.org>
parents:
28709
diff
changeset
|
517 g_string_free(data->client_proof, TRUE); |
65a34cce02e3
jabber: Fix up the remaining issues and add a test case that interoperates with gsasl. Woot.
Paul Aurich <paul@darkrain42.org>
parents:
28709
diff
changeset
|
518 if (data->server_signature) |
65a34cce02e3
jabber: Fix up the remaining issues and add a test case that interoperates with gsasl. Woot.
Paul Aurich <paul@darkrain42.org>
parents:
28709
diff
changeset
|
519 g_string_free(data->server_signature, TRUE); |
28717
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
520 if (data->password) { |
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
521 memset(data->password, 0, strlen(data->password)); |
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
522 g_free(data->password); |
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
523 } |
464d022d7d6e
jabber: Add SASLprep and the username substitution called for in draft-ietf-sasl-scram-10 5.1.
Paul Aurich <paul@darkrain42.org>
parents:
28715
diff
changeset
|
524 |
28711
65a34cce02e3
jabber: Fix up the remaining issues and add a test case that interoperates with gsasl. Woot.
Paul Aurich <paul@darkrain42.org>
parents:
28709
diff
changeset
|
525 g_free(data); |
65a34cce02e3
jabber: Fix up the remaining issues and add a test case that interoperates with gsasl. Woot.
Paul Aurich <paul@darkrain42.org>
parents:
28709
diff
changeset
|
526 } |
65a34cce02e3
jabber: Fix up the remaining issues and add a test case that interoperates with gsasl. Woot.
Paul Aurich <paul@darkrain42.org>
parents:
28709
diff
changeset
|
527 |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
528 static void scram_dispose(JabberStream *js) |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
529 { |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
530 if (js->auth_mech_data) { |
28711
65a34cce02e3
jabber: Fix up the remaining issues and add a test case that interoperates with gsasl. Woot.
Paul Aurich <paul@darkrain42.org>
parents:
28709
diff
changeset
|
531 jabber_scram_data_destroy(js->auth_mech_data); |
28707
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
532 js->auth_mech_data = NULL; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
533 } |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
534 } |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
535 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
536 static JabberSaslMech scram_sha1_mech = { |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
537 50, /* priority */ |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
538 "SCRAM-SHA-1", /* name */ |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
539 scram_start, |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
540 scram_handle_challenge, |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
541 scram_handle_success, |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
542 NULL, /* handle_failure */ |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
543 scram_dispose |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
544 }; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
545 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
546 #ifdef CHANNEL_BINDING |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
547 /* With channel binding */ |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
548 static JabberSaslMech scram_sha1_plus_mech = { |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
549 scram_sha1_mech.priority + 1, /* priority */ |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
550 "SCRAM-SHA-1-PLUS", /* name */ |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
551 scram_start, |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
552 scram_handle_challenge, |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
553 scram_handle_success, |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
554 NULL, /* handle_failure */ |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
555 scram_dispose |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
556 }; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
557 #endif |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
558 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
559 JabberSaslMech **jabber_auth_get_scram_mechs(gint *count) |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
560 { |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
561 static JabberSaslMech *mechs[] = { |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
562 &scram_sha1_mech, |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
563 #ifdef CHANNEL_BINDING |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
564 &scram_sha1_plus_mech, |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
565 #endif |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
566 }; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
567 |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
568 *count = G_N_ELEMENTS(mechs); |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
569 return mechs; |
c1d41b7484ff
jabber: Complete (though untested) SCRAM implementation.
Paul Aurich <paul@darkrain42.org>
parents:
28706
diff
changeset
|
570 } |