G1ng3r
/
lavina
forked from lavina/lavina
1
0
Fork 0
Code Pull Requests Activity

send ERR_SASLFAIL reply for auth fails

This commit is contained in:
G1ng3r 2024-01-28 20:44:13 +03:00
parent 614be92be3
commit 75ac0a3369
4 changed files with 207 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
crates/projection-irc/src/lib.rs
View File

@ -180,16 +180,22 @@ async fn handle_registration<'a>(
writer.flush().await?;
}
CapabilitySubcommand::End => {
let Some((username, realname)) = future_username else {
todo!()
let Some((ref username, ref realname)) = future_username else {
sasl_fail_message(config.server_name.clone()).write_async(writer).await?;
writer.flush().await?;
continue;
};
let Some(nickname) = future_nickname.clone() else {
todo!()
sasl_fail_message(config.server_name.clone()).write_async(writer).await?;
writer.flush().await?;
continue;
};
let username = username.clone();
let realname = realname.clone();
let candidate_user = RegisteredUser {
nickname,
username,
realname,
realname
};
if enabled_capabilities.contains(Capabilities::Sasl)
&& validated_user.as_ref() == Some(&candidate_user.nickname)
@ -197,7 +203,9 @@ async fn handle_registration<'a>(
break Ok(candidate_user);
} else {
let Some(candidate_password) = pass else {
todo!();
sasl_fail_message(config.server_name.clone()).write_async(writer).await?;
writer.flush().await?;
continue;
};
auth_user(storage, &*candidate_user.nickname, &*candidate_password).await?;
break Ok(candidate_user);
@ -214,7 +222,9 @@ async fn handle_registration<'a>(
realname,
};
let Some(candidate_password) = pass else {
todo!();
sasl_fail_message(config.server_name.clone()).write_async(writer).await?;
writer.flush().await?;
continue;
};
auth_user(storage, &*candidate_user.nickname, &*candidate_password).await?;
break Ok(candidate_user);
@ -232,7 +242,9 @@ async fn handle_registration<'a>(
realname,
};
let Some(candidate_password) = pass else {
todo!();
sasl_fail_message(config.server_name.clone()).write_async(writer).await?;
writer.flush().await?;
continue;
};
auth_user(storage, &*candidate_user.nickname, &*candidate_password).await?;
break Ok(candidate_user);
@ -255,12 +267,18 @@ async fn handle_registration<'a>(
.await?;
writer.flush().await?;
} else {
// TODO respond with 904
todo!();
sasl_fail_message(config.server_name.clone()).write_async(writer).await?;
writer.flush().await?;
}
} else {
let body = AuthBody::from_str(body.as_bytes())?;
auth_user(storage, &body.login, &body.password).await?;
match auth_user(storage, &body.login, &body.password).await {
Err(e) => {
tracing::warn!("Authentication failed: {:?}", e);
sasl_fail_message(config.server_name.clone()).write_async(writer).await?;
writer.flush().await?;
}
Ok(_) => {
let login: Str = body.login.into();
validated_user = Some(login.clone());
ServerMessage {
@ -287,6 +305,8 @@ async fn handle_registration<'a>(
.await?;
writer.flush().await?;
}
}
}
// TODO handle abortion of authentication
}
_ => {}
@ -297,6 +317,14 @@ async fn handle_registration<'a>(
Ok(user)
}
fn sasl_fail_message(sender: Str) -> ServerMessage {
ServerMessage {
tags: vec![],
sender: Some(sender),
body: ServerMessageBody::N904SaslFail
}
}
async fn auth_user(storage: &mut Storage, login: &str, plain_password: &str) -> Result<()> {
let stored_user = storage.retrieve_user_by_name(login).await?;

46
crates/projection-irc/tests/lib.rs
View File

@ -218,3 +218,49 @@ async fn scenario_cap_short_negotiation() -> Result<()> {
server.server.terminate().await?;
Ok(())
}
#[tokio::test]
async fn scenario_cap_sasl_fail() -> Result<()> {
let mut server = TestServer::start().await?;
// test scenario
server.storage.create_user("tester").await?;
server.storage.set_password("tester", "password").await?;
let mut stream = TcpStream::connect(server.server.addr).await?;
let mut s = TestScope::new(&mut stream);
s.send("CAP LS 302").await?;
s.send("NICK tester").await?;
s.send("USER UserName 0 * :Real Name").await?;
s.expect(":testserver CAP * LS :sasl=PLAIN").await?;
s.send("CAP REQ :sasl").await?;
s.expect(":testserver CAP tester ACK :sasl").await?;
s.send("AUTHENTICATE SHA256").await?;
s.expect(":testserver 904").await?;
s.send("AUTHENTICATE PLAIN").await?;
s.expect(":testserver AUTHENTICATE +").await?;
s.send("AUTHENTICATE dGVzdGVyAHRlc3RlcgBwYXNzd29yZA==").await?; // base64-encoded 'tester\x00tester\x00password'
s.expect(":testserver 900 tester tester tester :You are now logged in as tester").await?;
s.expect(":testserver 903 tester :SASL authentication successful").await?;
s.send("CAP END").await?;
s.expect(":testserver 001 tester :Welcome to Kek Server").await?;
s.expect(":testserver 002 tester :Welcome to Kek Server").await?;
s.expect(":testserver 003 tester :Welcome to Kek Server").await?;
s.expect(":testserver 004 tester testserver kek-0.1.alpha.3 r CFILPQbcefgijklmnopqrstvz").await?;
s.expect(":testserver 005 tester CHANTYPES=# :are supported by this server").await?;
s.expect_nothing().await?;
s.send("QUIT :Leaving").await?;
s.expect(":testserver ERROR :Leaving the server").await?;
s.expect_eof().await?;
stream.shutdown().await?;
// wrap up
server.server.terminate().await?;
Ok(())
}

4
crates/proto-irc/src/lib.rs
View File

@ -30,6 +30,10 @@ fn token(input: &str) -> IResult<&str, &str> {
take_while(|i| i != '\n' && i != '\r')(input)
}
fn params(input: &str) -> IResult<&str, &str> {
take_while(|i| i != '\n' && i != '\r' && i != ':')(input)
}
#[derive(Clone, Debug, PartialEq, Eq)]
pub enum Chan {
/// #<name> — network-global channel, available from any server in the network.

96
crates/proto-irc/src/server.rs
View File

@ -1,3 +1,5 @@
use std::sync::Arc;
use nonempty::NonEmpty;
use tokio::io::AsyncWrite;
use tokio::io::AsyncWriteExt;
@ -50,6 +52,12 @@ pub enum ServerMessageBody {
rest_targets: Vec<Str>,
text: Str,
},
Fail {
command: Str,
code: Str,
params: Option<Str>,
text: Str
},
Ping {
token: Str,
},
@ -152,7 +160,8 @@ pub enum ServerMessageBody {
N903SaslSuccess {
nick: Str,
message: Str,
}
},
N904SaslFail
}
impl ServerMessageBody {
@ -168,6 +177,21 @@ impl ServerMessageBody {
writer.write_all(b" :").await?;
writer.write_all(text.as_bytes()).await?;
}
ServerMessageBody::Fail { command, code, params, text } =>
{
writer.write_all(b"FAIL ").await?;
writer.write_all(command.as_bytes()).await?;
writer.write_all(b" ").await?;
writer.write_all(code.as_bytes()).await?;
if let Some(p) = params.clone() {
writer.write_all(b" ").await?;
writer.write_all(p.as_bytes()).await?;
} else {
();
}
writer.write_all(b" :").await?;
writer.write_all(text.as_bytes()).await?;
}
ServerMessageBody::Ping { token } => {
writer.write_all(b"PING ").await?;
writer.write_all(token.as_bytes()).await?;
@ -369,6 +393,9 @@ impl ServerMessageBody {
writer.write_all(b" :").await?;
writer.write_all(message.as_bytes()).await?;
}
ServerMessageBody::N904SaslFail => {
writer.write_all(b"904").await?;
}
}
Ok(())
}
@ -392,6 +419,7 @@ fn server_message_body(input: &str) -> IResult<&str, ServerMessageBody> {
server_message_body_ping,
server_message_body_pong,
server_message_body_cap,
server_message_body_fail,
))(input)
}
@ -413,6 +441,28 @@ fn server_message_body_notice(input: &str) -> IResult<&str, ServerMessageBody> {
))
}
fn server_message_body_fail(input: &str) -> IResult<&str, ServerMessageBody> {
let (input, _) = tag("FAIL ")(input)?;
let (input, command) = receiver(input)?;
let (input, _) = tag(" ")(input)?;
let (input, code) = receiver(input)?;
let (input, _) = tag(" ")(input)?;
let (input, params) = params(input)?;
let (input, _) = tag(":")(input)?;
let (input, text) = token(input)?;
let command = command.into();
let code = code.into();
let params: Arc<str> = params.trim().into();
let params = if params.is_empty() { None } else { Some(params) };
let text = text.into();
Ok((
input,
ServerMessageBody::Fail { command, code, params, text }
))
}
fn server_message_body_ping(input: &str) -> IResult<&str, ServerMessageBody> {
let (input, _) = tag("PING ")(input)?;
let (input, token) = token(input)?;
@ -517,4 +567,48 @@ mod test {
sync_future(expected.write_async(&mut bytes)).unwrap().unwrap();
assert_eq!(bytes, input.as_bytes());
}
#[test]
fn test_server_message_fail() {
let input = "FAIL BOX BOXES_INVALID STACK CLOCKWISE :Given boxes are not supported\r\n";
let expected = ServerMessage {
tags: vec![],
sender: None,
body: ServerMessageBody::Fail {
command: "BOX".into(),
code: "BOXES_INVALID".into(),
params: Some("STACK CLOCKWISE".into()),
text: "Given boxes are not supported".into(),
},
};
let result = server_message(input);
assert_matches!(result, Ok((_, result)) => assert_eq!(expected, result));
let mut bytes = vec![];
sync_future(expected.write_async(&mut bytes)).unwrap().unwrap();
assert_eq!(bytes, input.as_bytes());
}
#[test]
fn test_server_short_message_fail() {
let input = "FAIL REHASH CONFIG_BAD :Could not reload config from disk\r\n";
let expected = ServerMessage {
tags: vec![],
sender: None,
body: ServerMessageBody::Fail {
command: "REHASH".into(),
code: "CONFIG_BAD".into(),
params: None,
text: "Could not reload config from disk".into(),
},
};
let result = server_message(input);
assert_matches!(result, Ok((_, result)) => assert_eq!(expected, result));
let mut bytes = vec![];
sync_future(expected.write_async(&mut bytes)).unwrap().unwrap();
assert_eq!(bytes, input.as_bytes());
}
}