Swiftdiff options
| author | Remko Tronçon <git@el-tramo.be> | 2010-12-11 12:43:08 (GMT) |
|---|---|---|
| committer | Remko Tronçon <git@el-tramo.be> | 2010-12-11 12:43:35 (GMT) |
| commit | aaf38fe2e6804bd87ea5e99a05ed57070cbe1c57 (patch) | |
| tree | 358ff7b5022e0c192e22f746e285f673bf5def9b /Swiften/SASL | |
| parent | d9ce3491e818d96f3dc0154e9e5d30228420483c (diff) | |
| download | swift-contrib-aaf38fe2e6804bd87ea5e99a05ed57070cbe1c57.zip swift-contrib-aaf38fe2e6804bd87ea5e99a05ed57070cbe1c57.tar.bz2 | |
Added SCRAM-SHA-1-PLUS support.
Release-Notes: Swift now supports SCRAM-SHA-1-PLUS authentication.
Diffstat (limited to 'Swiften/SASL')
| -rw-r--r-- | Swiften/SASL/SCRAMSHA1ClientAuthenticator.cpp | 26 | ||||
| -rw-r--r-- | Swiften/SASL/SCRAMSHA1ClientAuthenticator.h | 1 | ||||
| -rw-r--r-- | Swiften/SASL/UnitTest/SCRAMSHA1ClientAuthenticatorTest.cpp | 4 |
3 files changed, 21 insertions, 10 deletions
diff --git a/Swiften/SASL/SCRAMSHA1ClientAuthenticator.cpp b/Swiften/SASL/SCRAMSHA1ClientAuthenticator.cpp index 4e00397..2cc7cea 100644 --- a/Swiften/SASL/SCRAMSHA1ClientAuthenticator.cpp +++ b/Swiften/SASL/SCRAMSHA1ClientAuthenticator.cpp @@ -35,7 +35,7 @@ static String escape(const String& s) { } -SCRAMSHA1ClientAuthenticator::SCRAMSHA1ClientAuthenticator(const String& nonce, bool useChannelBinding) : ClientAuthenticator("SCRAM-SHA-1"), step(Initial), clientnonce(nonce), useChannelBinding(useChannelBinding) { +SCRAMSHA1ClientAuthenticator::SCRAMSHA1ClientAuthenticator(const String& nonce, bool useChannelBinding) : ClientAuthenticator(useChannelBinding ? "SCRAM-SHA-1-PLUS" : "SCRAM-SHA-1"), step(Initial), clientnonce(nonce), useChannelBinding(useChannelBinding) { } boost::optional<ByteArray> SCRAMSHA1ClientAuthenticator::getResponse() const { @@ -50,11 +50,7 @@ boost::optional<ByteArray> SCRAMSHA1ClientAuthenticator::getResponse() const { for (unsigned int i = 0; i < clientProof.getSize(); ++i) { clientProof[i] ^= clientSignature[i]; } - ByteArray channelBindData; - if (useChannelBinding && tlsChannelBindingData) { - channelBindData = *tlsChannelBindingData; - } - ByteArray result = ByteArray("c=") + Base64::encode(getGS2Header() + channelBindData) + ",r=" + clientnonce + serverNonce + ",p=" + Base64::encode(clientProof); + ByteArray result = getFinalMessageWithoutProof() + ",p=" + Base64::encode(clientProof); return result; } else { @@ -97,9 +93,14 @@ bool SCRAMSHA1ClientAuthenticator::setChallenge(const boost::optional<ByteArray> return false; } + ByteArray channelBindData; + if (useChannelBinding && tlsChannelBindingData) { + channelBindData = *tlsChannelBindingData; + } + // Compute all the values needed for the server signature saltedPassword = PBKDF2::encode(StringPrep::getPrepared(getPassword(), StringPrep::SASLPrep), salt, iterations); - authMessage = getInitialBareClientMessage() + "," + initialServerMessage + "," + "c=" + Base64::encode(getGS2Header()) + ",r=" + clientnonce + serverNonce; + authMessage = getInitialBareClientMessage() + "," + initialServerMessage + "," + getFinalMessageWithoutProof(); ByteArray serverKey = HMACSHA1::getResult(saltedPassword, "Server Key"); serverSignature = HMACSHA1::getResult(serverKey, authMessage); @@ -153,7 +154,7 @@ ByteArray SCRAMSHA1ClientAuthenticator::getGS2Header() const { ByteArray channelBindingHeader("n"); if (tlsChannelBindingData) { if (useChannelBinding) { - channelBindingHeader = ByteArray("p=tls-server-end-point"); + channelBindingHeader = ByteArray("p=tls-unique"); } else { channelBindingHeader = ByteArray("y"); @@ -166,4 +167,13 @@ void SCRAMSHA1ClientAuthenticator::setTLSChannelBindingData(const ByteArray& cha this->tlsChannelBindingData = channelBindingData; } +ByteArray SCRAMSHA1ClientAuthenticator::getFinalMessageWithoutProof() const { + ByteArray channelBindData; + if (useChannelBinding && tlsChannelBindingData) { + channelBindData = *tlsChannelBindingData; + } + return ByteArray("c=") + Base64::encode(getGS2Header() + channelBindData) + ",r=" + clientnonce + serverNonce; +} + + } diff --git a/Swiften/SASL/SCRAMSHA1ClientAuthenticator.h b/Swiften/SASL/SCRAMSHA1ClientAuthenticator.h index b44e6b7..2cf3cc7 100644 --- a/Swiften/SASL/SCRAMSHA1ClientAuthenticator.h +++ b/Swiften/SASL/SCRAMSHA1ClientAuthenticator.h @@ -26,6 +26,7 @@ namespace Swift { private: ByteArray getInitialBareClientMessage() const; ByteArray getGS2Header() const; + ByteArray getFinalMessageWithoutProof() const; static std::map<char, String> parseMap(const String&); diff --git a/Swiften/SASL/UnitTest/SCRAMSHA1ClientAuthenticatorTest.cpp b/Swiften/SASL/UnitTest/SCRAMSHA1ClientAuthenticatorTest.cpp index 0d12bd3..0e42f38 100644 --- a/Swiften/SASL/UnitTest/SCRAMSHA1ClientAuthenticatorTest.cpp +++ b/Swiften/SASL/UnitTest/SCRAMSHA1ClientAuthenticatorTest.cpp @@ -92,7 +92,7 @@ class SCRAMSHA1ClientAuthenticatorTest : public CppUnit::TestFixture { ByteArray response = *testling.getResponse(); - CPPUNIT_ASSERT_EQUAL(String("p=tls-server-end-point,,n=user,r=abcdefghABCDEFGH"), response.toString()); + CPPUNIT_ASSERT_EQUAL(String("p=tls-unique,,n=user,r=abcdefghABCDEFGH"), response.toString()); } void testGetFinalResponse() { @@ -124,7 +124,7 @@ class SCRAMSHA1ClientAuthenticatorTest : public CppUnit::TestFixture { ByteArray response = *testling.getResponse(); - CPPUNIT_ASSERT_EQUAL(String("c=cD10bHMtc2VydmVyLWVuZC1wb2ludCwseHl6YQ==,r=abcdefghABCDEFGH,p=ycZyNs03w1HlRzFmXl8dlKx3NAU="), response.toString()); + CPPUNIT_ASSERT_EQUAL(String("c=cD10bHMtdW5pcXVlLCx4eXph,r=abcdefghABCDEFGH,p=i6Rghite81P1ype8XxaVAa5l7v0="), response.toString()); } void testSetFinalChallenge() { |