XEP-0198 SASL2 / Bind2 integration work

.github/actions/conversationstest-action/action.yml

@@ -32,7 +32,7 @@ runs:
         sudo udevadm trigger --name-match=kvm
 
     - name: Cache Conversations APK
-      uses: actions/cache@v5
+      uses: actions/cache@v6
       with:
         path: conversations.apk
         key: conversations-apk-4217303 # Update this number at the same time as the version in run-tests.sh

.github/workflows/continuous-integration-workflow.yml

@@ -340,9 +340,9 @@ jobs:
           - name: demoboot
             maestro-tags: demoboot
             config-file: '' # Use default demoboot config
-          #- name: sasl2
-          #  maestro-tags: sasl2
-          #  config-file: build/ci/conversations/configs/sasl2.xml
+          - name: sasl2
+            maestro-tags: sasl2
+            config-file: build/ci/conversations/configs/sasl2.xml
 
     steps:
       - name: Checkout local actions and test flows # Do this _before_ untarring the distribution, as the checkout will empty the directory prior to the checkout!
@@ -367,12 +367,19 @@ jobs:
         with:
           logLevel: debug
       - name: Run Conversations tests (${{ matrix.name }})
+        id: runConversationsTests
         uses: ./.github/actions/conversationstest-action
         with:
           includeTags: ${{ matrix.maestro-tags }}
       - name: Stop CI server
         if: ${{ always() && steps.startCIServer.conclusion == 'success' }}
         uses: ./.github/actions/stopserver-action
+      - name: Upload Openfire logs on test failure
+        if: ${{ failure() && steps.runConversationsTests.conclusion == 'failure' }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: Conversations Test (${{ matrix.name }}) Openfire logs
+          path: distribution/target/distribution-base/logs/openfire.log
 
 
   should-do-database-tests:

build/ci/conversations/configs/sasl2.xml

@@ -75,8 +75,10 @@
           </user3>
       </users>
   </autosetup>
-  <properties>
-    <!-- TODO: Add SASL2-enabling system properties here. -->
-    <!-- These are likely defined in the SASL2 plugin or as xmpp.auth.* core properties. -->
-  </properties>
+  <!-- Enable SASL2 (xmpp.auth.sasl2). TLS is required too, but is satisfied by the CI server's self-signed certificate. -->
+  <xmpp>
+    <auth>
+      <sasl2>true</sasl2>
+    </auth>
+  </xmpp>
 </jive>

build/ci/conversations/flows/sasl2.yaml

@@ -47,7 +47,20 @@ onFlowStart:
       - assertVisible: "Let app always run in background?"
       - tapOn: "Allow"
 
+# Using SASL2
 - runScript: 
     file: scripts/checkForLogs.js
     env:
         PATTERN: .*SASL 2.0 authorization identifier was jane@example.org
+
+# Using Channel Binding
+- runScript:
+      file: scripts/checkForLogs.js
+      env:
+          PATTERN: 'jane@example\.org.*Authenticating with SASL_2\/[A-Z0-9-]+-PLUS'
+
+# Authentication successful
+- runScript:
+      file: scripts/checkForLogs.js
+      env:
+          PATTERN: 'jane@example\.org.*logged in \(using SASL_2\)'

documentation/openfire.doap

@@ -417,6 +417,11 @@
                 <xmpp:version>1.0.0</xmpp:version>
             </xmpp:SupportedXep>
         </implements>
+        <implements>
+            <xmpp:SupportedXep>
+                <xmpp:xep rdf:resource="https://xmpp.org/extensions/xep-0388.html"/>
+            </xmpp:SupportedXep>
+        </implements>
         <implements>
             <xmpp:SupportedXep>
                 <xmpp:xep rdf:resource="https://xmpp.org/extensions/xep-0410.html"/>

i18n/src/main/resources/openfire_i18n.properties

@@ -1315,6 +1315,8 @@ system_property.xmpp.auth.anonymous=Set to true to allow anonymous login, otherw
 system_property.xmpp.auth.external.client.skip-cert-revalidation=Set to true to avoid validation of the client-provided PKIX certificate (for mutual authentication) other than the validation that happens when the TLS session is established.
 system_property.xmpp.auth.external.server.require-authzid=Require the peer to provide an authorization identity through SASL (typically in the Initial Response) when authenticating an inbound S2S connection that uses the EXTERNAL SASL mechanism. This is not required by the XMPP protocol specification, but it was required by Openfire versions prior to release 4.8.0. This configuration option is added to allow for backwards compatibility.
 system_property.xmpp.auth.external.server.skip-sending-authzid=Send an authorization identity in the Initial Response when attempting to authenticate using the SASL EXTERNAL mechanism with a remote XMPP domain. Sending the authzid in this manner is not required by the XMPP protocol specification, but is recommended in XEP-0178 for compatibility with older server implementations.
+system_property.xmpp.auth.sasl2=Enables support for SASL authentication (XEP-0388)
+system_property.xmpp.auth.sasl2.require-tls=Require TLS in order to authenticate with SASL2
 system_property.xmpp.auth.ssl.default-trustmanager-impl=The class to use as the default TLS TrustManager (which checks certificates from peers).
 system_property.xmpp.client.csi.enabled=Controls if Client State Indication (XEP-0352) functionality is supported by Openfire.
 system_property.xmpp.client.csi.delay.enabled=Determines if 'unimportant' stanzas are delayed for a client that is inactive.

xmppserver/src/main/java/org/jivesoftware/openfire/SessionManager.java

@@ -38,6 +38,9 @@
 import org.jivesoftware.openfire.session.*;
 import org.jivesoftware.openfire.spi.BasicStreamIDFactory;
 import org.jivesoftware.openfire.spi.ConnectionType;
+import org.jivesoftware.openfire.handler.Bind2StreamManagementHandler;
+import org.jivesoftware.openfire.net.Bind2Request;
+import org.jivesoftware.openfire.streammanagement.StreamManager;
 import org.jivesoftware.openfire.streammanagement.TerminationDelegate;
 import org.jivesoftware.util.*;
 import org.jivesoftware.util.cache.*;
@@ -1901,6 +1904,11 @@ public void start() throws IllegalStateException {
         super.start();
         localSessionManager.start();
 
+        // Register the XEP-0198 Stream Management handler for SASL2 Bind2 inline feature processing.
+        if (StreamManager.isStreamManagementActive()) {
+            Bind2Request.registerElementHandler(new Bind2StreamManagementHandler());
+        }
+
         // Run through the server sessions every 10% of the time of the maximum time that a session is allowed to be
         // detached, or every 3 minutes if the max time is outside the default boundaries.
         // TODO Reschedule task if getSessionDetachTime value changes.
@@ -1917,6 +1925,7 @@ public void start() throws IllegalStateException {
     @Override
     public void stop() {
         Log.debug("SessionManager: Stopping server");
+        Bind2Request.unregisterElementHandler(StreamManager.NAMESPACE_V3);
         // Stop threads that are sending packets to remote servers
         OutgoingSessionPromise.getInstance().shutdown();
         if (JiveGlobals.getBooleanProperty("shutdownMessage.enabled")) {

xmppserver/src/main/java/org/jivesoftware/openfire/SessionPacketRouter.java

@@ -59,7 +59,7 @@ public void route(Element wrappedElement)
             throws UnknownStanzaException {
         String tag = wrappedElement.getName();
         if ("auth".equals(tag) || "response".equals(tag)) {
-            SASLAuthentication.handle(session, wrappedElement);
+            SASLAuthentication.handle(session, wrappedElement, false);
         }
         else if ("iq".equals(tag)) {
             route(getIQ(wrappedElement));

xmppserver/src/main/java/org/jivesoftware/openfire/XMPPServer.java

@@ -34,6 +34,7 @@
 import org.jivesoftware.openfire.container.AdminConsolePlugin;
 import org.jivesoftware.openfire.container.Module;
 import org.jivesoftware.openfire.container.PluginManager;
+import org.jivesoftware.openfire.csi.CsiModule;
 import org.jivesoftware.openfire.disco.*;
 import org.jivesoftware.openfire.entitycaps.EntityCapabilitiesManager;
 import org.jivesoftware.openfire.filetransfer.DefaultFileTransferManager;
@@ -769,6 +770,7 @@ private void loadModules() {
         loadModule(OfflineMessageStore.class.getName());
         loadModule(VCardManager.class.getName());
         // Load standard modules
+        loadModule(CsiModule.class.getName());
         loadModule(IQBindHandler.class.getName());
         loadModule(IQSessionEstablishmentHandler.class.getName());
         loadModule(IQPingHandler.class.getName());

xmppserver/src/main/java/org/jivesoftware/openfire/auth/ScramUtils.java

@@ -36,8 +36,8 @@ public class ScramUtils {
 
     private ScramUtils() {}
 
-    public static byte[] createSaltedPassword(byte[] salt, String password, int iters) throws SaslException {
-        Mac mac = createSha1Hmac(password.getBytes(StandardCharsets.UTF_8));
+    public static byte[] createSaltedPassword(byte[] salt, String password, int iters, String algorithm) throws SaslException {
+        Mac mac = createHmac(password.getBytes(StandardCharsets.UTF_8), algorithm);
         mac.update(salt);
         mac.update(new byte[]{0, 0, 0, 1});
         byte[] result = mac.doFinal();
@@ -54,22 +54,40 @@ public static byte[] createSaltedPassword(byte[] salt, String password, int iter
         return result;
     }
 
-    public static byte[] computeHmac(final byte[] key, final String string)
+    public static byte[] computeHmac(final byte[] key, final String string, String algorithm)
             throws SaslException {
-        Mac mac = createSha1Hmac(key);
+        Mac mac = createHmac(key, algorithm);
         mac.update(string.getBytes(StandardCharsets.UTF_8));
         return mac.doFinal();
     }
 
-    public static Mac createSha1Hmac(final byte[] keyBytes)
+    public static Mac createHmac(final byte[] keyBytes, String algorithm)
             throws SaslException {
         try {
-            SecretKeySpec key = new SecretKeySpec(keyBytes, "HmacSHA1");
-            Mac mac = Mac.getInstance("HmacSHA1");
+            String hmacAlgorithm = getHmacAlgorithm(algorithm);
+            SecretKeySpec key = new SecretKeySpec(keyBytes, hmacAlgorithm);
+            Mac mac = Mac.getInstance(hmacAlgorithm);
             mac.init(key);
             return mac;
         } catch (NoSuchAlgorithmException | InvalidKeyException e) {
             throw new SaslException(e.getMessage(), e);
         }
     }
+
+    private static String getHmacAlgorithm(String hashAlgorithm) {
+        return "Hmac" + hashAlgorithm.toUpperCase().replace("-", "");
+    }
+
+    // Keep backward compatibility methods for existing SHA-1 usage
+    public static byte[] createSaltedPassword(byte[] salt, String password, int iters) throws SaslException {
+        return createSaltedPassword(salt, password, iters, "SHA-1");
+    }
+
+    public static byte[] computeHmac(final byte[] key, final String string) throws SaslException {
+        return computeHmac(key, string, "SHA-1");
+    }
+
+    public static Mac createSha1Hmac(final byte[] keyBytes) throws SaslException {
+        return createHmac(keyBytes, "SHA-1");
+    }
 }

xmppserver/src/main/java/org/jivesoftware/openfire/csi/CsiModule.java

@@ -0,0 +1,46 @@
+package org.jivesoftware.openfire.csi;
+
+import org.dom4j.Element;
+import org.jivesoftware.openfire.container.BasicModule;
+import org.jivesoftware.openfire.net.Bind2InlineHandler;
+import org.jivesoftware.openfire.net.Bind2Request;
+import org.jivesoftware.openfire.session.LocalClientSession;
+
+public class CsiModule extends BasicModule {
+    static class Bind2CSIHandler implements Bind2InlineHandler {
+
+        @Override
+        public String getNamespace() {
+            return CsiManager.NAMESPACE;
+        }
+
+        @Override
+        public boolean handleElement(LocalClientSession session, Element bound, Element element) {
+            if (element.getName().equals("active")) {
+                session.getCsiManager().activate();
+            }
+            return true;
+        }
+    }
+    private static final Bind2CSIHandler handler = new Bind2CSIHandler();
+    /**
+     * <p>Create a basic module with the given name.</p>
+     *
+     * @param moduleName The name for the module or null to use the default
+     */
+    public CsiModule(String moduleName) {
+        super(moduleName);
+    }
+
+    @Override
+    public void start() throws IllegalStateException {
+        super.start();
+        Bind2Request.registerElementHandler(handler);
+    }
+
+    @Override
+    public void stop() {
+        Bind2Request.unregisterElementHandler(handler.getNamespace());
+        super.stop();
+    }
+}

xmppserver/src/main/java/org/jivesoftware/openfire/handler/Bind2CarbonsHandler.java

@@ -0,0 +1,18 @@
+package org.jivesoftware.openfire.handler;
+
+import org.dom4j.Element;
+import org.jivesoftware.openfire.net.Bind2InlineHandler;
+import org.jivesoftware.openfire.session.LocalClientSession;
+
+public class Bind2CarbonsHandler implements Bind2InlineHandler {
+    @Override
+    public String getNamespace() {
+        return "urn:xmpp:carbons:2";
+    }
+
+    @Override
+    public boolean handleElement(LocalClientSession session, Element bound, Element element) {
+        session.setMessageCarbonsEnabled(element.getName().equals("enable"));
+        return true;
+    }
+}

xmppserver/src/main/java/org/jivesoftware/openfire/handler/Bind2StreamManagementHandler.java

@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2024-2026 Ignite Realtime Foundation. All rights reserved.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.jivesoftware.openfire.handler;
+
+import org.dom4j.Element;
+import org.jivesoftware.openfire.net.Bind2InlineHandler;
+import org.jivesoftware.openfire.session.LocalClientSession;
+import org.jivesoftware.openfire.streammanagement.StreamManager;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * A {@link Bind2InlineHandler} that processes XEP-0198 Stream Management {@code <enable/>} elements
+ * sent inline within a SASL2 Bind2 request (XEP-0388 / XEP-0386).
+ *
+ * <p>When a client includes an {@code <enable/>} element in the {@code urn:xmpp:sm:3} namespace
+ * inside its Bind2 {@code <bind/>} element, this handler delegates to the session's
+ * {@link StreamManager} to enable stream management (and optionally resumption) immediately
+ * after resource binding, without requiring a separate round-trip.</p>
+ *
+ * <p>The {@code <enabled/>} response from the server is added as a child of the {@code <bound/>}
+ * element in the SASL2 {@code <success/>} stanza.</p>
+ *
+ * @see <a href="https://xmpp.org/extensions/xep-0198.html">XEP-0198: Stream Management</a>
+ * @see <a href="https://xmpp.org/extensions/xep-0388.html">XEP-0388: Extensible SASL Profile</a>
+ */
+public class Bind2StreamManagementHandler implements Bind2InlineHandler {
+
+    private static final Logger Log = LoggerFactory.getLogger(Bind2StreamManagementHandler.class);
+
+    @Override
+    public String getNamespace() {
+        return StreamManager.NAMESPACE_V3;
+    }
+
+    /**
+     * Handles an {@code <enable/>} element from a Bind2 inline feature request by enabling
+     * XEP-0198 stream management on the session. The {@code <enabled/>} response element
+     * produced by the stream manager is added as a child of the provided {@code bound} element.
+     *
+     * <p>Only {@code <enable/>} elements are processed; any other element name is ignored.</p>
+     *
+     * @param session the client session on which stream management should be enabled
+     * @param bound   the {@code <bound/>} element to which the {@code <enabled/>} response is added
+     * @param element the inline element from the Bind2 request (expected to be {@code <enable/>})
+     * @return {@code true} if the element was an {@code <enable/>} and was processed;
+     *         {@code false} if the element was not an {@code <enable/>} or processing failed
+     */
+    @Override
+    public boolean handleElement(LocalClientSession session, Element bound, Element element) {
+        if (!"enable".equals(element.getName())) {
+            Log.debug("Bind2StreamManagementHandler received unexpected element '{}'; ignoring.", element.getName());
+            return false;
+        }
+        Log.debug("Processing inline SM <enable/> for session {}", session.getAddress());
+        final String namespace = element.getNamespaceURI();
+        final String resumeAttr = element.attributeValue("resume");
+        final boolean resume = "true".equalsIgnoreCase(resumeAttr) || "1".equals(resumeAttr) || "yes".equalsIgnoreCase(resumeAttr);
+        final Element enabled = session.getStreamManager().enableAndBuildElement(namespace, resume);
+        if (enabled != null) {
+            bound.add(enabled);
+            return true;
+        }
+        return false;
+    }
+}

xmppserver/src/main/java/org/jivesoftware/openfire/handler/IQMessageCarbonsHandler.java

@@ -20,6 +20,7 @@
 import org.jivesoftware.openfire.IQHandlerInfo;
 import org.jivesoftware.openfire.XMPPServer;
 import org.jivesoftware.openfire.disco.ServerFeaturesProvider;
+import org.jivesoftware.openfire.net.Bind2Request;
 import org.jivesoftware.openfire.session.ClientSession;
 import org.xmpp.packet.IQ;
 import org.xmpp.packet.PacketError;
@@ -78,4 +79,16 @@ public IQHandlerInfo getInfo() {
     public Iterator<String> getFeatures() {
         return Collections.singleton(NAMESPACE).iterator();
     }
+
+    @Override
+    public void start() throws IllegalStateException {
+        super.start();
+        Bind2Request.registerElementHandler(new Bind2CarbonsHandler());
+    }
+
+    @Override
+    public void stop() {
+        super.stop();
+        Bind2Request.unregisterElementHandler("urn:xmpp:carbons:2");
+    }
 }

xmppserver/src/main/java/org/jivesoftware/openfire/http/HttpSession.java

@@ -227,9 +227,9 @@ public List<Element> getAvailableStreamFeatures() {
 
         // If authentication has not happened yet, include available authentication mechanisms.
         if (getAuthToken() == null) {
-            final Element sasl = SASLAuthentication.getSASLMechanismsElement(this);
-            if (sasl != null) {
-                elements.add(sasl);
+            final List<Element> mechanisms = SASLAuthentication.getSASLMechanisms(this);
+            for (Element mechanism : mechanisms) {
+                elements.add(mechanism);
             }
         }