aboutsummaryrefslogtreecommitdiffstats
path: root/tests/check_jabber_sasl.c
blob: 63118d3980b7d12ac1e21ef12db90d23f215a62d (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
#include <stdlib.h>
#include <glib.h>
#include <gmodule.h>
#include <check.h>
#include <string.h>
#include <stdio.h>

char *sasl_get_part( char *data, char *field );

#define challenge1 "nonce=\"1669585310\",qop=\"auth\",charset=utf-8,algorithm=md5-sess," \
                   "something=\"Not \\\"standardized\\\"\""
#define challenge2 "realm=\"quadpoint.org\", nonce=\"NPotlQpQf9RNYodOwierkQ==\", " \
                   "qop=\"auth, auth-int\", charset=utf-8, algorithm=md5-sess"
#define challenge3 ", realm=\"localhost\", nonce=\"LlBV2txnO8RbB5hgs3KgiQ==\", " \
                   "qop=\"auth, auth-int, \", ,\n, charset=utf-8, algorithm=md5-sess,"

struct
{
	char *challenge;
	char *key;
	char *value;
} get_part_tests[] = {
	{
		challenge1,
		"nonce",
		"1669585310"
	},
	{
		challenge1,
		"charset",
		"utf-8"
	},
	{
		challenge1,
		"harset",
		NULL
	},
	{
		challenge1,
		"something",
		"Not \"standardized\""
	},
	{
		challenge1,
		"something_else",
		NULL
	},
	{
		challenge2,
		"realm",
		"quadpoint.org",
	},
	{
		challenge2,
		"real",
		NULL
	},
	{
		challenge2,
		"qop",
		"auth, auth-int"
	},
	{
		challenge3,
		"realm",
		"localhost"
	},
	{
		challenge3,
		"qop",
		"auth, auth-int, "
	},
	{
		challenge3,
		"charset",
		"utf-8"
	},
	{ NULL, NULL, NULL }
};

static void check_get_part(int l)
{
	int i;
	
	for( i = 0; get_part_tests[i].key; i++ )
	{
  		tcase_fn_start( get_part_tests[i].key, __FILE__, i );
		char *res;
		int len;
		
		res = sasl_get_part( get_part_tests[i].challenge,
		                     get_part_tests[i].key );
		
		if( get_part_tests[i].value == NULL )
			fail_if( res != NULL, "Found key %s in %s while it shouldn't be there!",
			         get_part_tests[i].key, get_part_tests[i].challenge );
		else if( res )
			fail_unless( strcmp( res, get_part_tests[i].value ) == 0,
			             "Incorrect value for key %s in %s: %s",
			             get_part_tests[i].key, get_part_tests[i].challenge, res );
		else
			fail( "Could not find key %s in %s",
			      get_part_tests[i].key, get_part_tests[i].challenge );
		
		g_free( res );
	}
}

Suite *jabber_sasl_suite (void)
{
	Suite *s = suite_create("jabber/sasl");
	TCase *tc_core = tcase_create("Core");
	suite_add_tcase (s, tc_core);
	tcase_add_test (tc_core, check_get_part);
	return s;
}
lass="w"> ) != 0 ) { imcb_log( ic, "Stream error while authenticating" ); imc_logout( ic, FALSE ); return XT_ABORT; } c = node->children; while( ( c = xt_find_node( c, "mechanism" ) ) ) { if( c->text && g_strcasecmp( c->text, "PLAIN" ) == 0 ) sup_plain = 1; if( c->text && g_strcasecmp( c->text, "DIGEST-MD5" ) == 0 ) sup_digest = 1; c = c->next; } if( !sup_plain && !sup_digest ) { imcb_error( ic, "No known SASL authentication schemes supported" ); imc_logout( ic, FALSE ); return XT_ABORT; } reply = xt_new_node( "auth", NULL, NULL ); xt_add_attr( reply, "xmlns", XMLNS_SASL ); if( sup_digest ) { xt_add_attr( reply, "mechanism", "DIGEST-MD5" ); /* The rest will be done later, when we receive a <challenge/>. */ } else if( sup_plain ) { int len; xt_add_attr( reply, "mechanism", "PLAIN" ); /* With SASL PLAIN in XMPP, the text should be b64(\0user\0pass) */ len = strlen( jd->username ) + strlen( ic->acc->pass ) + 2; s = g_malloc( len + 1 ); s[0] = 0; strcpy( s + 1, jd->username ); strcpy( s + 2 + strlen( jd->username ), ic->acc->pass ); reply->text = base64_encode( (unsigned char *)s, len ); reply->text_len = strlen( reply->text ); g_free( s ); } if( !jabber_write_packet( ic, reply ) ) { xt_free_node( reply ); return XT_ABORT; } xt_free_node( reply ); /* To prevent classic authentication from happening. */ jd->flags |= JFLAG_STREAM_STARTED; return XT_HANDLED; } /* Non-static function, but not mentioned in jabber.h because it's for internal use, just that the unittest should be able to reach it... */ char *sasl_get_part( char *data, char *field ) { int i, len; len = strlen( field ); while( isspace( *data ) || *data == ',' ) data ++; if( g_strncasecmp( data, field, len ) == 0 && data[len] == '=' ) { i = strlen( field ) + 1; } else { for( i = 0; data[i]; i ++ ) { /* If we have a ", skip until it's closed again. */ if( data[i] == '"' ) { i ++; while( data[i] != '"' || data[i-1] == '\\' ) i ++; } /* If we got a comma, we got a new field. Check it, find the next key after it. */ if( data[i] == ',' ) { while( isspace( data[i] ) || data[i] == ',' ) i ++; if( g_strncasecmp( data + i, field, len ) == 0 && data[i+len] == '=' ) { i += len + 1; break; } } } } if( data[i] == '"' ) { int j; char *ret; i ++; len = 0; while( data[i+len] != '"' || data[i+len-1] == '\\' ) len ++; ret = g_strndup( data + i, len ); for( i = j = 0; ret[i]; i ++ ) { if( ret[i] == '\\' ) { ret[j++] = ret[++i]; } else { ret[j++] = ret[i]; } } ret[j] = 0; return ret; } else if( data[i] ) { len = 0; while( data[i+len] && data[i+len] != ',' ) len ++; return g_strndup( data + i, len ); } else { return NULL; } } xt_status sasl_pkt_challenge( struct xt_node *node, gpointer data ) { struct im_connection *ic = data; struct jabber_data *jd = ic->proto_data; struct xt_node *reply = NULL; char *nonce = NULL, *realm = NULL, *cnonce = NULL; unsigned char cnonce_bin[30]; char *digest_uri = NULL; char *dec = NULL; char *s = NULL; xt_status ret = XT_ABORT; if( node->text_len == 0 ) goto error; dec = frombase64( node->text ); if( !( s = sasl_get_part( dec, "rspauth" ) ) ) { /* See RFC 2831 for for information. */ md5_state_t A1, A2, H; md5_byte_t A1r[16], A2r[16], Hr[16]; char A1h[33], A2h[33], Hh[33]; int i; nonce = sasl_get_part( dec, "nonce" ); realm = sasl_get_part( dec, "realm" ); if( !nonce ) goto error; /* Jabber.Org considers the realm part optional and doesn't specify one. Oh well, actually they're right, but still, don't know if this is right... */ if( !realm ) realm = g_strdup( jd->server ); random_bytes( cnonce_bin, sizeof( cnonce_bin ) ); cnonce = base64_encode( cnonce_bin, sizeof( cnonce_bin ) ); digest_uri = g_strdup_printf( "%s/%s", "xmpp", jd->server ); /* Generate the MD5 hash of username:realm:password, I decided to call it H. */ md5_init( &H ); s = g_strdup_printf( "%s:%s:%s", jd->username, realm, ic->acc->pass ); md5_append( &H, (unsigned char *) s, strlen( s ) ); g_free( s ); md5_finish( &H, Hr ); /* Now generate the hex. MD5 hash of H:nonce:cnonce, called A1. */ md5_init( &A1 ); s = g_strdup_printf( ":%s:%s", nonce, cnonce ); md5_append( &A1, Hr, 16 ); md5_append( &A1, (unsigned char *) s, strlen( s ) ); g_free( s ); md5_finish( &A1, A1r ); for( i = 0; i < 16; i ++ ) sprintf( A1h + i * 2, "%02x", A1r[i] ); /* A2... */ md5_init( &A2 ); s = g_strdup_printf( "%s:%s", "AUTHENTICATE", digest_uri ); md5_append( &A2, (unsigned char *) s, strlen( s ) ); g_free( s ); md5_finish( &A2, A2r ); for( i = 0; i < 16; i ++ ) sprintf( A2h + i * 2, "%02x", A2r[i] ); /* Final result: A1:nonce:00000001:cnonce:auth:A2. Let's reuse H for it. */ md5_init( &H ); s = g_strdup_printf( "%s:%s:%s:%s:%s:%s", A1h, nonce, "00000001", cnonce, "auth", A2h ); md5_append( &H, (unsigned char *) s, strlen( s ) ); g_free( s ); md5_finish( &H, Hr ); for( i = 0; i < 16; i ++ ) sprintf( Hh + i * 2, "%02x", Hr[i] ); /* Now build the SASL response string: */ g_free( dec ); dec = g_strdup_printf( "username=\"%s\",realm=\"%s\",nonce=\"%s\",cnonce=\"%s\"," "nc=%08x,qop=auth,digest-uri=\"%s\",response=%s,charset=%s", jd->username, realm, nonce, cnonce, 1, digest_uri, Hh, "utf-8" ); s = tobase64( dec ); } else { /* We found rspauth, but don't really care... */ g_free( s ); s = NULL; } reply = xt_new_node( "response", s, NULL ); xt_add_attr( reply, "xmlns", XMLNS_SASL ); if( !jabber_write_packet( ic, reply ) ) goto silent_error; ret = XT_HANDLED; goto silent_error; error: imcb_error( ic, "Incorrect SASL challenge received" ); imc_logout( ic, FALSE ); silent_error: g_free( digest_uri ); g_free( cnonce ); g_free( nonce ); g_free( realm ); g_free( dec ); g_free( s ); xt_free_node( reply ); return ret; } xt_status sasl_pkt_result( struct xt_node *node, gpointer data ) { struct im_connection *ic = data; struct jabber_data *jd = ic->proto_data; char *s; s = xt_find_attr( node, "xmlns" ); if( !s || strcmp( s, XMLNS_SASL ) != 0 ) { imcb_log( ic, "Stream error while authenticating" ); imc_logout( ic, FALSE ); return XT_ABORT; } if( strcmp( node->name, "success" ) == 0 ) { imcb_log( ic, "Authentication finished" ); jd->flags |= JFLAG_AUTHENTICATED | JFLAG_STREAM_RESTART; } else if( strcmp( node->name, "failure" ) == 0 ) { imcb_error( ic, "Authentication failure" ); imc_logout( ic, FALSE ); return XT_ABORT; } return XT_HANDLED; } /* This one is needed to judge if we'll do authentication using IQ or SASL. It's done by checking if the <stream:stream> from the server has a version attribute. I don't know if this is the right way though... */ gboolean sasl_supported( struct im_connection *ic ) { struct jabber_data *jd = ic->proto_data; return ( jd->xt && jd->xt->root && xt_find_attr( jd->xt->root, "version" ) ) != 0; }