From 651e936913ed884054500232e6df3a9a2ff6eddc Mon Sep 17 00:00:00 2001 From: Simon Ser Date: Mon, 16 Mar 2020 16:16:27 +0100 Subject: [PATCH] Add downstream SASL support --- downstream.go | 200 ++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 162 insertions(+), 38 deletions(-) diff --git a/downstream.go b/downstream.go index 9b2e6b1..543559f 100644 --- a/downstream.go +++ b/downstream.go @@ -2,6 +2,7 @@ package soju import ( "crypto/tls" + "encoding/base64" "fmt" "io" "net" @@ -10,6 +11,7 @@ import ( "sync" "time" + "github.com/emersion/go-sasl" "golang.org/x/crypto/bcrypt" "gopkg.in/irc.v3" ) @@ -76,6 +78,8 @@ type downstreamConn struct { capVersion int caps map[string]bool + saslServer sasl.Server + lock sync.Mutex ourMessages map[*irc.Message]struct{} } @@ -342,6 +346,101 @@ func (dc *downstreamConn) handleMessageUnregistered(msg *irc.Message) error { if err := dc.handleCapCommand(subCmd, msg.Params[1:]); err != nil { return err } + case "AUTHENTICATE": + if !dc.caps["sasl"] { + return ircError{&irc.Message{ + Command: err_saslfail, + Params: []string{"*", "AUTHENTICATE requires the \"sasl\" capability to be enabled"}, + }} + } + if len(msg.Params) == 0 { + return ircError{&irc.Message{ + Command: err_saslfail, + Params: []string{"*", "Missing AUTHENTICATE argument"}, + }} + } + if dc.nick == "" { + return ircError{&irc.Message{ + Command: err_saslfail, + Params: []string{"*", "Expected NICK command before AUTHENTICATE"}, + }} + } + + var resp []byte + if dc.saslServer == nil { + mech := strings.ToUpper(msg.Params[0]) + switch mech { + case "PLAIN": + dc.saslServer = sasl.NewPlainServer(sasl.PlainAuthenticator(func(identity, username, password string) error { + return dc.authenticate(username, password) + })) + default: + return ircError{&irc.Message{ + Command: err_saslfail, + Params: []string{"*", fmt.Sprintf("Unsupported SASL mechanism %q", mech)}, + }} + } + } else if msg.Params[0] == "*" { + dc.saslServer = nil + return ircError{&irc.Message{ + Command: err_saslaborted, + Params: []string{"*", "SASL authentication aborted"}, + }} + } else if msg.Params[0] == "+" { + resp = nil + } else { + // TODO: multi-line messages + var err error + resp, err = base64.StdEncoding.DecodeString(msg.Params[0]) + if err != nil { + dc.saslServer = nil + return ircError{&irc.Message{ + Command: err_saslfail, + Params: []string{"*", "Invalid base64-encoded response"}, + }} + } + } + + challenge, done, err := dc.saslServer.Next(resp) + if err != nil { + dc.saslServer = nil + if ircErr, ok := err.(ircError); ok && ircErr.Message.Command == irc.ERR_PASSWDMISMATCH { + return ircError{&irc.Message{ + Command: err_saslfail, + Params: []string{"*", ircErr.Message.Params[1]}, + }} + } + dc.SendMessage(&irc.Message{ + Prefix: dc.srv.prefix(), + Command: err_saslfail, + Params: []string{"*", "SASL error"}, + }) + return fmt.Errorf("SASL authentication failed: %v", err) + } else if done { + dc.saslServer = nil + dc.SendMessage(&irc.Message{ + Prefix: dc.srv.prefix(), + Command: rpl_loggedin, + Params: []string{dc.nick, dc.nick, dc.user.Username, "You are now logged in"}, + }) + dc.SendMessage(&irc.Message{ + Prefix: dc.srv.prefix(), + Command: rpl_saslsuccess, + Params: []string{dc.nick, "SASL authentication successful"}, + }) + } else { + challengeStr := "+" + if challenge != nil { + challengeStr = base64.StdEncoding.EncodeToString(challenge) + } + + // TODO: multi-line messages + dc.SendMessage(&irc.Message{ + Prefix: dc.srv.prefix(), + Command: "AUTHENTICATE", + Params: []string{challengeStr}, + }) + } default: dc.logger.Printf("unhandled message: %v", msg) return newUnknownCommandError(msg.Command) @@ -370,11 +469,11 @@ func (dc *downstreamConn) handleCapCommand(cmd string, args []string) error { } var caps []string - /*if dc.capVersion >= 302 { + if dc.capVersion >= 302 { caps = append(caps, "sasl=PLAIN") } else { caps = append(caps, "sasl") - }*/ + } // TODO: multi-line replies dc.SendMessage(&irc.Message{ @@ -421,8 +520,8 @@ func (dc *downstreamConn) handleCapCommand(cmd string, args []string) error { } switch name { - /*case "sasl": - dc.caps[name] = enable*/ + case "sasl": + dc.caps[name] = enable default: ack = false } @@ -457,19 +556,52 @@ func sanityCheckServer(addr string) error { return conn.Close() } -func (dc *downstreamConn) register() error { - username := dc.rawUsername - var networkName string +func unmarshalUsername(rawUsername string) (username, network string) { + username = rawUsername if i := strings.LastIndexAny(username, "/@"); i >= 0 { - networkName = username[i+1:] + network = username[i+1:] } if i := strings.IndexAny(username, "/@"); i >= 0 { username = username[:i] } - dc.username = "~" + username + return username, network +} - password := dc.password - dc.password = "" +func (dc *downstreamConn) setNetwork(networkName string) error { + if networkName == "" { + return nil + } + + network := dc.user.getNetwork(networkName) + if network == nil { + addr := networkName + if !strings.ContainsRune(addr, ':') { + addr = addr + ":6697" + } + + dc.logger.Printf("trying to connect to new network %q", addr) + if err := sanityCheckServer(addr); err != nil { + dc.logger.Printf("failed to connect to %q: %v", addr, err) + return ircError{&irc.Message{ + Command: irc.ERR_PASSWDMISMATCH, + Params: []string{"*", fmt.Sprintf("Failed to connect to %q", networkName)}, + }} + } + + dc.logger.Printf("auto-saving network %q", networkName) + var err error + network, err = dc.user.createNetwork(networkName, dc.nick) + if err != nil { + return err + } + } + + dc.network = network + return nil +} + +func (dc *downstreamConn) authenticate(username, password string) error { + username, networkName := unmarshalUsername(username) u := dc.srv.getUser(username) if u == nil { @@ -483,40 +615,32 @@ func (dc *downstreamConn) register() error { return errAuthFailed } - var network *network - if networkName != "" { - network = u.getNetwork(networkName) - if network == nil { - addr := networkName - if !strings.ContainsRune(addr, ':') { - addr = addr + ":6697" - } + dc.user = u - dc.logger.Printf("trying to connect to new network %q", addr) - if err := sanityCheckServer(addr); err != nil { - dc.logger.Printf("failed to connect to %q: %v", addr, err) - return ircError{&irc.Message{ - Command: irc.ERR_PASSWDMISMATCH, - Params: []string{"*", fmt.Sprintf("Failed to connect to %q", networkName)}, - }} - } + return dc.setNetwork(networkName) +} - dc.logger.Printf("auto-saving network %q", networkName) - network, err = u.createNetwork(networkName, dc.nick) - if err != nil { - return err - } +func (dc *downstreamConn) register() error { + password := dc.password + dc.password = "" + if dc.user == nil { + if err := dc.authenticate(dc.rawUsername, password); err != nil { + return err + } + } else if dc.network == nil { + _, networkName := unmarshalUsername(dc.rawUsername) + if err := dc.setNetwork(networkName); err != nil { + return err } } dc.registered = true - dc.user = u - dc.network = network + dc.username = dc.user.Username - u.lock.Lock() - firstDownstream := len(u.downstreamConns) == 0 - u.downstreamConns = append(u.downstreamConns, dc) - u.lock.Unlock() + dc.user.lock.Lock() + firstDownstream := len(dc.user.downstreamConns) == 0 + dc.user.downstreamConns = append(dc.user.downstreamConns, dc) + dc.user.lock.Unlock() dc.SendMessage(&irc.Message{ Prefix: dc.srv.prefix(),