Skip to content

Commit 46568fb

Browse files
author
Evgeniy Khramtsov
committed
Merge commit 'refs/pull/524/head' of github.com:processone/ejabberd into sasl-api-change
2 parents c7cf95b + 917d48f commit 46568fb

18 files changed

Lines changed: 157 additions & 116 deletions

‎src/cyrsasl.erl‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ register_mechanism(Mechanism, Module, PasswordType) ->
132132
%% end.
133133

134134
check_credentials(_State, Props) ->
135-
User = proplists:get_value(username, Props, <<>>),
135+
User = proplists:get_value(authzid, Props, <<>>),
136136
case jid:nodeprep(User) of
137137
error -> {error, <<"not-authorized">>};
138138
<<"">> -> {error, <<"not-authorized">>};

‎src/cyrsasl_digest.erl‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@
5050
username = <<"">> :: binary(),
5151
authzid = <<"">> :: binary(),
5252
get_password = fun(_) -> {false, <<>>} end :: get_password_fun(),
53-
check_password = fun(_, _, _, _) -> false end :: check_password_fun(),
53+
check_password = fun(_, _, _, _, _) -> false end :: check_password_fun(),
5454
auth_module :: atom(),
5555
host = <<"">> :: binary(),
5656
hostfqdn = <<"">> :: binary()}).
@@ -83,9 +83,7 @@ mech_step(#state{step = 3, nonce = Nonce} = State,
8383
bad -> {error, <<"bad-protocol">>};
8484
KeyVals ->
8585
DigestURI = proplists:get_value(<<"digest-uri">>, KeyVals, <<>>),
86-
%DigestURI = fxml:get_attr_s(<<"digest-uri">>, KeyVals),
8786
UserName = proplists:get_value(<<"username">>, KeyVals, <<>>),
88-
%UserName = fxml:get_attr_s(<<"username">>, KeyVals),
8987
case is_digesturi_valid(DigestURI, State#state.host,
9088
State#state.hostfqdn)
9189
of
@@ -97,13 +95,11 @@ mech_step(#state{step = 3, nonce = Nonce} = State,
9795
{error, <<"not-authorized">>, UserName};
9896
true ->
9997
AuthzId = proplists:get_value(<<"authzid">>, KeyVals, <<>>),
100-
%AuthzId = fxml:get_attr_s(<<"authzid">>, KeyVals),
10198
case (State#state.get_password)(UserName) of
10299
{false, _} -> {error, <<"not-authorized">>, UserName};
103100
{Passwd, AuthModule} ->
104-
case (State#state.check_password)(UserName, <<"">>,
101+
case (State#state.check_password)(UserName, UserName, <<"">>,
105102
proplists:get_value(<<"response">>, KeyVals, <<>>),
106-
%fxml:get_attr_s(<<"response">>, KeyVals),
107103
fun (PW) ->
108104
response(KeyVals,
109105
UserName,
@@ -130,7 +126,11 @@ mech_step(#state{step = 5, auth_module = AuthModule,
130126
username = UserName, authzid = AuthzId},
131127
<<"">>) ->
132128
{ok,
133-
[{username, UserName}, {authzid, AuthzId},
129+
[{username, UserName}, {authzid, case AuthzId of
130+
<<"">> -> UserName;
131+
_ -> AuthzId
132+
end
133+
},
134134
{auth_module, AuthModule}]};
135135
mech_step(A, B) ->
136136
?DEBUG("SASL DIGEST: A ~p B ~p", [A, B]),

‎src/cyrsasl_plain.erl‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ mech_new(_Host, _GetPassword, CheckPassword, _CheckPasswordDigest) ->
4545
mech_step(State, ClientIn) ->
4646
case prepare(ClientIn) of
4747
[AuthzId, User, Password] ->
48-
case (State#state.check_password)(User, Password) of
48+
case (State#state.check_password)(User, AuthzId, Password) of
4949
{true, AuthModule} ->
5050
{ok,
5151
[{username, User}, {authzid, AuthzId},
@@ -60,12 +60,17 @@ prepare(ClientIn) ->
6060
[<<"">>, UserMaybeDomain, Password] ->
6161
case parse_domain(UserMaybeDomain) of
6262
%% <NUL>login@domain<NUL>pwd
63-
[User, _Domain] -> [UserMaybeDomain, User, Password];
63+
[User, _Domain] -> [User, User, Password];
6464
%% <NUL>login<NUL>pwd
65-
[User] -> [<<"">>, User, Password]
65+
[User] -> [User, User, Password]
6666
end;
67+
[AuthzId, User, Password] ->
68+
case parse_domain(AuthzId) of
6769
%% login@domain<NUL>login<NUL>pwd
68-
[AuthzId, User, Password] -> [AuthzId, User, Password];
70+
[AuthzUser, _Domain] -> [AuthzUser, User, Password];
71+
%% login<NUL>login<NUL>pwd
72+
[AuthzUser] -> [AuthzUser, User, Password]
73+
end;
6974
_ -> error
7075
end.
7176

‎src/ejabberd_auth.erl‎

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,9 @@
3232
-author('alexey@process-one.net').
3333

3434
%% External exports
35-
-export([start/0, set_password/3, check_password/3,
36-
check_password/5, check_password_with_authmodule/3,
37-
check_password_with_authmodule/5, try_register/3,
35+
-export([start/0, set_password/3, check_password/4,
36+
check_password/6, check_password_with_authmodule/4,
37+
check_password_with_authmodule/6, try_register/3,
3838
dirty_get_registered_users/0, get_vh_registered_users/1,
3939
get_vh_registered_users/2, export/1, import/1,
4040
get_vh_registered_users_number/1, import/3,
@@ -63,8 +63,8 @@
6363
-callback remove_user(binary(), binary()) -> any().
6464
-callback remove_user(binary(), binary(), binary()) -> any().
6565
-callback is_user_exists(binary(), binary()) -> boolean() | {error, atom()}.
66-
-callback check_password(binary(), binary(), binary()) -> boolean().
67-
-callback check_password(binary(), binary(), binary(), binary(),
66+
-callback check_password(binary(), binary(), binary(), binary()) -> boolean().
67+
-callback check_password(binary(), binary(), binary(), binary(), binary(),
6868
fun((binary()) -> binary())) -> boolean().
6969
-callback try_register(binary(), binary(), binary()) -> {atomic, atom()} |
7070
{error, atom()}.
@@ -102,26 +102,26 @@ store_type(Server) ->
102102
end,
103103
plain, auth_modules(Server)).
104104

105-
-spec check_password(binary(), binary(), binary()) -> boolean().
105+
-spec check_password(binary(), binary(), binary(), binary()) -> boolean().
106106

107-
check_password(User, Server, Password) ->
108-
case check_password_with_authmodule(User, Server,
107+
check_password(User, AuthzId, Server, Password) ->
108+
case check_password_with_authmodule(User, AuthzId, Server,
109109
Password)
110110
of
111111
{true, _AuthModule} -> true;
112112
false -> false
113113
end.
114114

115115
%% @doc Check if the user and password can login in server.
116-
%% @spec (User::string(), Server::string(), Password::string(),
116+
%% @spec (User::string(), AuthzId::string(), Server::string(), Password::string(),
117117
%% Digest::string(), DigestGen::function()) ->
118118
%% true | false
119-
-spec check_password(binary(), binary(), binary(), binary(),
119+
-spec check_password(binary(), binary(), binary(), binary(), binary(),
120120
fun((binary()) -> binary())) -> boolean().
121121

122-
check_password(User, Server, Password, Digest,
122+
check_password(User, AuthzId, Server, Password, Digest,
123123
DigestGen) ->
124-
case check_password_with_authmodule(User, Server,
124+
case check_password_with_authmodule(User, AuthzId, Server,
125125
Password, Digest, DigestGen)
126126
of
127127
{true, _AuthModule} -> true;
@@ -132,28 +132,28 @@ check_password(User, Server, Password, Digest,
132132
%% The user can login if at least an authentication method accepts the user
133133
%% and the password.
134134
%% The first authentication method that accepts the credentials is returned.
135-
%% @spec (User::string(), Server::string(), Password::string()) ->
135+
%% @spec (User::string(), AuthzId::string(), Server::string(), Password::string()) ->
136136
%% {true, AuthModule} | false
137137
%% where
138138
%% AuthModule = ejabberd_auth_anonymous | ejabberd_auth_external
139139
%% | ejabberd_auth_internal | ejabberd_auth_ldap
140-
%% | ejabberd_auth_odbc | ejabberd_auth_pam
141-
-spec check_password_with_authmodule(binary(), binary(), binary()) -> false |
140+
%% | ejabberd_auth_odbc | ejabberd_auth_pam | ejabberd_auth_riak
141+
-spec check_password_with_authmodule(binary(), binary(), binary(), binary()) -> false |
142142
{true, atom()}.
143143

144-
check_password_with_authmodule(User, Server,
144+
check_password_with_authmodule(User, AuthzId, Server,
145145
Password) ->
146146
check_password_loop(auth_modules(Server),
147-
[User, Server, Password]).
147+
[User, AuthzId, Server, Password]).
148148

149-
-spec check_password_with_authmodule(binary(), binary(), binary(), binary(),
149+
-spec check_password_with_authmodule(binary(), binary(), binary(), binary(), binary(),
150150
fun((binary()) -> binary())) -> false |
151151
{true, atom()}.
152152

153-
check_password_with_authmodule(User, Server, Password,
153+
check_password_with_authmodule(User, AuthzId, Server, Password,
154154
Digest, DigestGen) ->
155155
check_password_loop(auth_modules(Server),
156-
[User, Server, Password, Digest, DigestGen]).
156+
[User, AuthzId, Server, Password, Digest, DigestGen]).
157157

158158
check_password_loop([], _Args) -> false;
159159
check_password_loop([AuthModule | AuthModules], Args) ->

‎src/ejabberd_auth_anonymous.erl‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,8 @@
3838
unregister_connection/3
3939
]).
4040

41-
-export([login/2, set_password/3, check_password/3,
42-
check_password/5, try_register/3,
41+
-export([login/2, set_password/3, check_password/4,
42+
check_password/6, try_register/3,
4343
dirty_get_registered_users/0, get_vh_registered_users/1,
4444
get_vh_registered_users/2,
4545
get_vh_registered_users_number/1,
@@ -175,11 +175,11 @@ purge_hook(true, LUser, LServer) ->
175175

176176
%% When anonymous login is enabled, check the password for permenant users
177177
%% before allowing access
178-
check_password(User, Server, Password) ->
179-
check_password(User, Server, Password, undefined,
178+
check_password(User, AuthzId, Server, Password) ->
179+
check_password(User, AuthzId, Server, Password, undefined,
180180
undefined).
181181

182-
check_password(User, Server, _Password, _Digest,
182+
check_password(User, _AuthzId, Server, _Password, _Digest,
183183
_DigestGen) ->
184184
case
185185
ejabberd_auth:is_user_exists_in_other_modules(?MODULE,

‎src/ejabberd_auth_external.erl‎

Lines changed: 27 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,8 @@
3131

3232
-behaviour(ejabberd_auth).
3333

34-
-export([start/1, set_password/3, check_password/3,
35-
check_password/5, try_register/3,
34+
-export([start/1, set_password/3, check_password/4,
35+
check_password/6, try_register/3,
3636
dirty_get_registered_users/0, get_vh_registered_users/1,
3737
get_vh_registered_users/2,
3838
get_vh_registered_users_number/1,
@@ -76,16 +76,20 @@ plain_password_required() -> true.
7676

7777
store_type() -> external.
7878

79-
check_password(User, Server, Password) ->
79+
check_password(User, AuthzId, Server, Password) ->
80+
if AuthzId /= <<>> andalso AuthzId /= User ->
81+
false;
82+
true ->
8083
case get_cache_option(Server) of
81-
false -> check_password_extauth(User, Server, Password);
84+
false -> check_password_extauth(User, AuthzId, Server, Password);
8285
{true, CacheTime} ->
83-
check_password_cache(User, Server, Password, CacheTime)
86+
check_password_cache(User, AuthzId, Server, Password, CacheTime)
87+
end
8488
end.
8589

86-
check_password(User, Server, Password, _Digest,
90+
check_password(User, AuthzId, Server, Password, _Digest,
8791
_DigestGen) ->
88-
check_password(User, Server, Password).
92+
check_password(User, AuthzId, Server, Password).
8993

9094
set_password(User, Server, Password) ->
9195
case extauth:set_password(User, Server, Password) of
@@ -178,44 +182,44 @@ get_cache_option(Host) ->
178182
CacheTime -> {true, CacheTime}
179183
end.
180184

181-
%% @spec (User, Server, Password) -> true | false
182-
check_password_extauth(User, Server, Password) ->
185+
%% @spec (User, AuthzId, Server, Password) -> true | false
186+
check_password_extauth(User, _AuthzId, Server, Password) ->
183187
extauth:check_password(User, Server, Password) andalso
184188
Password /= <<"">>.
185189

186190
%% @spec (User, Server, Password) -> true | false
187191
try_register_extauth(User, Server, Password) ->
188192
extauth:try_register(User, Server, Password).
189193

190-
check_password_cache(User, Server, Password, 0) ->
191-
check_password_external_cache(User, Server, Password);
192-
check_password_cache(User, Server, Password,
194+
check_password_cache(User, AuthzId, Server, Password, 0) ->
195+
check_password_external_cache(User, AuthzId, Server, Password);
196+
check_password_cache(User, AuthzId, Server, Password,
193197
CacheTime) ->
194198
case get_last_access(User, Server) of
195199
online ->
196-
check_password_internal(User, Server, Password);
200+
check_password_internal(User, AuthzId, Server, Password);
197201
never ->
198-
check_password_external_cache(User, Server, Password);
202+
check_password_external_cache(User, AuthzId, Server, Password);
199203
mod_last_required ->
200204
?ERROR_MSG("extauth is used, extauth_cache is enabled "
201205
"but mod_last is not enabled in that "
202206
"host",
203207
[]),
204-
check_password_external_cache(User, Server, Password);
208+
check_password_external_cache(User, AuthzId, Server, Password);
205209
TimeStamp ->
206210
case is_fresh_enough(TimeStamp, CacheTime) of
207211
%% If no need to refresh, check password against Mnesia
208212
true ->
209-
case check_password_internal(User, Server, Password) of
213+
case check_password_internal(User, AuthzId, Server, Password) of
210214
%% If password valid in Mnesia, accept it
211215
true -> true;
212216
%% Else (password nonvalid in Mnesia), check in extauth and cache result
213217
false ->
214-
check_password_external_cache(User, Server, Password)
218+
check_password_external_cache(User, AuthzId, Server, Password)
215219
end;
216220
%% Else (need to refresh), check in extauth and cache result
217221
false ->
218-
check_password_external_cache(User, Server, Password)
222+
check_password_external_cache(User, AuthzId, Server, Password)
219223
end
220224
end.
221225

@@ -241,8 +245,8 @@ get_password_cache(User, Server, CacheTime) ->
241245
end.
242246

243247
%% Check the password using extauth; if success then cache it
244-
check_password_external_cache(User, Server, Password) ->
245-
case check_password_extauth(User, Server, Password) of
248+
check_password_external_cache(User, AuthzId, Server, Password) ->
249+
case check_password_extauth(User, AuthzId, Server, Password) of
246250
true ->
247251
set_password_internal(User, Server, Password), true;
248252
false -> false
@@ -256,9 +260,9 @@ try_register_external_cache(User, Server, Password) ->
256260
_ -> {error, not_allowed}
257261
end.
258262

259-
%% @spec (User, Server, Password) -> true | false
260-
check_password_internal(User, Server, Password) ->
261-
ejabberd_auth_internal:check_password(User, Server,
263+
%% @spec (User, AuthzId, Server, Password) -> true | false
264+
check_password_internal(User, AuthzId, Server, Password) ->
265+
ejabberd_auth_internal:check_password(User, AuthzId, Server,
262266
Password).
263267

264268
%% @spec (User, Server, Password) -> ok | {error, invalid_jid}

‎src/ejabberd_auth_internal.erl‎

Lines changed: 16 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,8 @@
3131

3232
-behaviour(ejabberd_auth).
3333

34-
-export([start/1, set_password/3, check_password/3,
35-
check_password/5, try_register/3,
34+
-export([start/1, set_password/3, check_password/4,
35+
check_password/6, try_register/3,
3636
dirty_get_registered_users/0, get_vh_registered_users/1,
3737
get_vh_registered_users/2,
3838
get_vh_registered_users_number/1,
@@ -86,9 +86,12 @@ store_type() ->
8686
true -> scram %% allows: PLAIN SCRAM
8787
end.
8888

89-
check_password(User, Server, Password) ->
90-
LUser = jid:nodeprep(User),
91-
LServer = jid:nameprep(Server),
89+
check_password(User, AuthzId, Server, Password) ->
90+
if AuthzId /= <<>> andalso AuthzId /= User ->
91+
false;
92+
true ->
93+
LUser = jid:nodeprep(User),
94+
LServer = jid:nameprep(Server),
9295
US = {LUser, LServer},
9396
case catch mnesia:dirty_read({passwd, US}) of
9497
[#passwd{password = Password}]
@@ -98,12 +101,16 @@ check_password(User, Server, Password) ->
98101
when is_record(Scram, scram) ->
99102
is_password_scram_valid(Password, Scram);
100103
_ -> false
104+
end
101105
end.
102106

103-
check_password(User, Server, Password, Digest,
107+
check_password(User, AuthzId, Server, Password, Digest,
104108
DigestGen) ->
105-
LUser = jid:nodeprep(User),
106-
LServer = jid:nameprep(Server),
109+
if AuthzId /= <<>> andalso AuthzId /= User ->
110+
false;
111+
true ->
112+
LUser = jid:nodeprep(User),
113+
LServer = jid:nameprep(Server),
107114
US = {LUser, LServer},
108115
case catch mnesia:dirty_read({passwd, US}) of
109116
[#passwd{password = Passwd}] when is_binary(Passwd) ->
@@ -125,6 +132,7 @@ check_password(User, Server, Password, Digest,
125132
true -> (Passwd == Password) and (Password /= <<"">>)
126133
end;
127134
_ -> false
135+
end
128136
end.
129137

130138
%% @spec (User::string(), Server::string(), Password::string()) ->

0 commit comments

Comments
 (0)