jshiffer/slixmpp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

WIP: SCRAM: Restrict tls-unique to TLSv1.2

Browse Source 
Signed-off-by: Maxime “pep” Buquet <pep@bouah.net>
This commit is contained in:
Maxime “pep” Buquet 2024-01-26 22:58:00 +01:00
parent c25305e80f
commit ef02b3a596
2 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
slixmpp/features/feature_mechanisms/mechanisms.py
View File

@ -37,7 +37,8 @@ class FeatureMechanisms(BasePlugin):
'unencrypted_digest': False, 'unencrypted_digest': False,
'unencrypted_cram': False, 'unencrypted_cram': False,
'unencrypted_scram': True, 'unencrypted_scram': True,
'order': 100 'order': 100,
'tls_version': None,
} }
def plugin_init(self): def plugin_init(self):
@ -178,6 +179,9 @@ class FeatureMechanisms(BasePlugin):
log.exception("A credential value did not pass SASLprep.") log.exception("A credential value did not pass SASLprep.")
self.xmpp.disconnect() self.xmpp.disconnect()
if 'tls_version' in self.mech.security:
self.tls_version = self.xmpp.socket.version()
resp = stanza.Auth(self.xmpp) resp = stanza.Auth(self.xmpp)
resp['mechanism'] = self.mech.name resp['mechanism'] = self.mech.name
try: try:

6
slixmpp/util/sasl/mechanisms.py
View File

@ -181,12 +181,13 @@ class SCRAM(Mech):
channel_binding = True channel_binding = True
required_credentials = {'username', 'password'} required_credentials = {'username', 'password'}
optional_credentials = {'authzid', 'channel_binding'} optional_credentials = {'authzid', 'channel_binding'}
security = {'encrypted', 'unencrypted_scram'} security = {'tls_version', 'encrypted', 'unencrypted_scram'}
def setup(self, name): def setup(self, name):
self.use_channel_binding = False self.use_channel_binding = False
if name[-5:] == '-PLUS': if name[-5:] == '-PLUS':
name = name[:-5] name = name[:-5]
if self.security_settings['tls_version'] == 'TLSv1.2':
self.use_channel_binding = True self.use_channel_binding = True
self.hash_name = name[6:] self.hash_name = name[6:]
@ -244,7 +245,8 @@ class SCRAM(Mech):
self.cnonce = bytes(('%s' % random.random())[2:]) self.cnonce = bytes(('%s' % random.random())[2:])
gs2_cbind_flag = b'n' gs2_cbind_flag = b'n'
if self.credentials['channel_binding']: if self.credentials['channel_binding'] and \
self.security_settings['tls_version'] == 'TLSv1.2':
if self.use_channel_binding: if self.use_channel_binding:
gs2_cbind_flag = b'p=tls-unique' gs2_cbind_flag = b'p=tls-unique'
else: else: