Swift
summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRemko Tronçon <git@el-tramo.be>2009-11-22 12:26:12 (GMT)
committerRemko Tronçon <git@el-tramo.be>2009-11-22 12:26:59 (GMT)
commit14fbc9a52ffad2573e1955f09b033c714b9f2ff4 (patch)
tree32823fc14819e8fe7840b3c7164b32225279738c
parent1621d7001dbc560df9d5e497db47cf315a2c83a9 (diff)
downloadswift-14fbc9a52ffad2573e1955f09b033c714b9f2ff4.zip
swift-14fbc9a52ffad2573e1955f09b033c714b9f2ff4.tar.bz2
Added SCRAM-SHA-1 unit test for final server message.
Diffstat
-rw-r--r--Swiften/SASL/ClientAuthenticator.h2
-rw-r--r--Swiften/SASL/PLAINClientAuthenticator.cpp2
-rw-r--r--Swiften/SASL/PLAINClientAuthenticator.h2
-rw-r--r--Swiften/SASL/SCRAMSHA1ClientAuthenticator.cpp20
-rw-r--r--Swiften/SASL/SCRAMSHA1ClientAuthenticator.h6
-rw-r--r--Swiften/SASL/UnitTest/SCRAMSHA1ClientAuthenticatorTest.cpp20
6 files changed, 37 insertions, 15 deletions
diff --git a/Swiften/SASL/ClientAuthenticator.h b/Swiften/SASL/ClientAuthenticator.h
index f93f44e..f42a51e 100644
--- a/Swiften/SASL/ClientAuthenticator.h
+++ b/Swiften/SASL/ClientAuthenticator.h
@@ -16,13 +16,13 @@ namespace Swift {
void setCredentials(const String& authcid, const String& password, const String& authzid = String()) {
this->authcid = authcid;
this->password = password;
this->authzid = authzid;
}
- virtual ByteArray getResponse() = 0;
+ virtual ByteArray getResponse() const = 0;
virtual bool setChallenge(const ByteArray&) = 0;
const String& getAuthenticationID() const {
return authcid;
}
diff --git a/Swiften/SASL/PLAINClientAuthenticator.cpp b/Swiften/SASL/PLAINClientAuthenticator.cpp
index f61f1a0..8f88c3c 100644
--- a/Swiften/SASL/PLAINClientAuthenticator.cpp
+++ b/Swiften/SASL/PLAINClientAuthenticator.cpp
@@ -2,13 +2,13 @@
namespace Swift {
PLAINClientAuthenticator::PLAINClientAuthenticator() : ClientAuthenticator("PLAIN") {
}
-ByteArray PLAINClientAuthenticator::getResponse() {
+ByteArray PLAINClientAuthenticator::getResponse() const {
return ByteArray(getAuthorizationID()) + '\0' + ByteArray(getAuthenticationID()) + '\0' + ByteArray(getPassword());
}
bool PLAINClientAuthenticator::setChallenge(const ByteArray&) {
return true;
}
diff --git a/Swiften/SASL/PLAINClientAuthenticator.h b/Swiften/SASL/PLAINClientAuthenticator.h
index bb24af7..854eb30 100644
--- a/Swiften/SASL/PLAINClientAuthenticator.h
+++ b/Swiften/SASL/PLAINClientAuthenticator.h
@@ -4,10 +4,10 @@
namespace Swift {
class PLAINClientAuthenticator : public ClientAuthenticator {
public:
PLAINClientAuthenticator();
- virtual ByteArray getResponse();
+ virtual ByteArray getResponse() const;
virtual bool setChallenge(const ByteArray&);
};
}
diff --git a/Swiften/SASL/SCRAMSHA1ClientAuthenticator.cpp b/Swiften/SASL/SCRAMSHA1ClientAuthenticator.cpp
index b0a9f96..16c938a 100644
--- a/Swiften/SASL/SCRAMSHA1ClientAuthenticator.cpp
+++ b/Swiften/SASL/SCRAMSHA1ClientAuthenticator.cpp
@@ -14,25 +14,20 @@ namespace Swift {
SCRAMSHA1ClientAuthenticator::SCRAMSHA1ClientAuthenticator(const String& nonce) : ClientAuthenticator("SCRAM-SHA-1"), step(Initial), clientnonce(nonce) {
// TODO: Normalize authentication id
// TODO: Normalize getPassword()
}
-ByteArray SCRAMSHA1ClientAuthenticator::getResponse() {
+ByteArray SCRAMSHA1ClientAuthenticator::getResponse() const {
if (step == Initial) {
return "n,," + getInitialBareClientMessage();
}
else {
- ByteArray saltedPassword = PBKDF2::encode(getPassword(), salt, iterations);
ByteArray clientKey = HMACSHA1::getResult(saltedPassword, "Client Key");
ByteArray storedKey = SHA1::getBinaryHash(clientKey);
- ByteArray serverKey = HMACSHA1::getResult(saltedPassword, "Server Key");
-
- ByteArray authMessage = getInitialBareClientMessage() + "," + initialServerMessage + "," + "c=biwsCg==," + "r=" + clientnonce + serverNonce;
ByteArray clientSignature = HMACSHA1::getResult(storedKey, authMessage);
- serverSignature = HMACSHA1::getResult(serverKey, authMessage);
ByteArray clientProof = clientKey;
for (unsigned int i = 0; i < clientProof.getSize(); ++i) {
clientProof[i] ^= clientSignature[i];
}
ByteArray result = ByteArray("c=biwsCg==,r=") + clientnonce + serverNonce + ",p=" + Base64::encode(clientProof);
return result;
@@ -42,22 +37,29 @@ ByteArray SCRAMSHA1ClientAuthenticator::getResponse() {
bool SCRAMSHA1ClientAuthenticator::setChallenge(const ByteArray& challenge) {
if (step == Initial) {
initialServerMessage = challenge;
// TODO: Check if these values are correct
std::map<char, String> keys = parseMap(String(initialServerMessage.getData(), initialServerMessage.getSize()));
- salt = Base64::decode(keys['s']);
+ ByteArray salt = Base64::decode(keys['s']);
String clientServerNonce = keys['r'];
serverNonce = clientServerNonce.getSubstring(clientnonce.getUTF8Size(), clientServerNonce.npos());
- iterations = boost::lexical_cast<int>(keys['i'].getUTF8String());
+ int iterations = boost::lexical_cast<int>(keys['i'].getUTF8String());
+
+ // Compute all the values needed for the server signature
+ saltedPassword = PBKDF2::encode(StringPrep::getPrepared(getPassword(), StringPrep::SASLPrep), salt, iterations);
+ authMessage = getInitialBareClientMessage() + "," + initialServerMessage + "," + "c=biwsCg==," + "r=" + clientnonce + serverNonce;
+ ByteArray serverKey = HMACSHA1::getResult(saltedPassword, "Server Key");
+ serverSignature = HMACSHA1::getResult(serverKey, authMessage);
step = Proof;
return true;
}
else {
- return challenge == Base64::encode(ByteArray("v=") + Base64::encode(serverSignature));
+ ByteArray result = ByteArray("v=") + ByteArray(Base64::encode(serverSignature));
+ return challenge == result;
}
}
std::map<char, String> SCRAMSHA1ClientAuthenticator::parseMap(const String& s) {
// TODO: Do some proper checking here
std::map<char, String> result;
diff --git a/Swiften/SASL/SCRAMSHA1ClientAuthenticator.h b/Swiften/SASL/SCRAMSHA1ClientAuthenticator.h
index 9504b35..108ac2e 100644
--- a/Swiften/SASL/SCRAMSHA1ClientAuthenticator.h
+++ b/Swiften/SASL/SCRAMSHA1ClientAuthenticator.h
@@ -8,13 +8,13 @@
namespace Swift {
class SCRAMSHA1ClientAuthenticator : public ClientAuthenticator {
public:
SCRAMSHA1ClientAuthenticator(const String& nonce);
- virtual ByteArray getResponse();
+ virtual ByteArray getResponse() const;
virtual bool setChallenge(const ByteArray&);
private:
ByteArray getInitialBareClientMessage() const;
static std::map<char, String> parseMap(const String&);
@@ -22,12 +22,12 @@ namespace Swift {
enum Step {
Initial,
Proof
} step;
String clientnonce;
ByteArray initialServerMessage;
- int iterations;
ByteArray serverNonce;
- ByteArray salt;
+ ByteArray authMessage;
+ ByteArray saltedPassword;
ByteArray serverSignature;
};
}
diff --git a/Swiften/SASL/UnitTest/SCRAMSHA1ClientAuthenticatorTest.cpp b/Swiften/SASL/UnitTest/SCRAMSHA1ClientAuthenticatorTest.cpp
index 9f18ff0..618a748 100644
--- a/Swiften/SASL/UnitTest/SCRAMSHA1ClientAuthenticatorTest.cpp
+++ b/Swiften/SASL/UnitTest/SCRAMSHA1ClientAuthenticatorTest.cpp
@@ -8,12 +8,14 @@ using namespace Swift;
class SCRAMSHA1ClientAuthenticatorTest : public CppUnit::TestFixture {
CPPUNIT_TEST_SUITE(SCRAMSHA1ClientAuthenticatorTest);
CPPUNIT_TEST(testGetInitialResponse);
CPPUNIT_TEST(testGetInitialResponse_UsernameHasSpecialChars);
CPPUNIT_TEST(testGetFinalResponse);
+ CPPUNIT_TEST(testSetFinalChallenge);
+ CPPUNIT_TEST(testSetFinalChallenge_InvalidChallenge);
CPPUNIT_TEST_SUITE_END();
public:
void setUp() {
}
@@ -41,9 +43,27 @@ class SCRAMSHA1ClientAuthenticatorTest : public CppUnit::TestFixture {
testling.setChallenge(ByteArray("r=abcdefghABCDEFGH,s=MTIzNDU2NzgK,i=4096"));
ByteArray response = testling.getResponse();
CPPUNIT_ASSERT_EQUAL(String("c=biwsCg==,r=abcdefghABCDEFGH,p=bVzb1EAf2hXw5Z+QIMYPTy5TOsU="), testling.getResponse().toString());
}
+
+ void testSetFinalChallenge() {
+ SCRAMSHA1ClientAuthenticator testling("abcdefgh");
+ testling.setCredentials("user", "pass", "");
+ testling.setChallenge(ByteArray("r=abcdefghABCDEFGH,s=MTIzNDU2NzgK,i=4096"));
+ bool result = testling.setChallenge(ByteArray("v=xWI/+vT8aAm0hKpqKIqctIDwtQE="));
+
+ CPPUNIT_ASSERT(result);
+ }
+
+ void testSetFinalChallenge_InvalidChallenge() {
+ SCRAMSHA1ClientAuthenticator testling("abcdefgh");
+ testling.setCredentials("user", "pass", "");
+ testling.setChallenge(ByteArray("r=abcdefghABCDEFGH,s=MTIzNDU2NzgK,i=4096"));
+ bool result = testling.setChallenge(ByteArray("v=e26kI69ICb6zosapLLxrER/631A="));
+
+ CPPUNIT_ASSERT(!result);
+ }
};
CPPUNIT_TEST_SUITE_REGISTRATION(SCRAMSHA1ClientAuthenticatorTest);