jshiffer/slixmpp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

WIP: SCRAM: Restrict tls-unique to TLSv1.2

Browse Source 
Signed-off-by: Maxime “pep” Buquet <pep@bouah.net>
This commit is contained in:
Maxime “pep” Buquet 2024-01-26 22:58:00 +01:00
parent c25305e80f
commit ef02b3a596
2 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
slixmpp/features/feature_mechanisms/mechanisms.py
View File

@ -37,7 +37,8 @@ class FeatureMechanisms(BasePlugin):
'unencrypted_digest': False,
'unencrypted_cram': False,
'unencrypted_scram': True,
'order': 100
'order': 100,
'tls_version': None,
}
def plugin_init(self):
@ -178,6 +179,9 @@ class FeatureMechanisms(BasePlugin):
log.exception("A credential value did not pass SASLprep.")
self.xmpp.disconnect()
if 'tls_version' in self.mech.security:
self.tls_version = self.xmpp.socket.version()
resp = stanza.Auth(self.xmpp)
resp['mechanism'] = self.mech.name
try:

8
slixmpp/util/sasl/mechanisms.py
View File

@ -181,13 +181,14 @@ class SCRAM(Mech):
channel_binding = True
required_credentials = {'username', 'password'}
optional_credentials = {'authzid', 'channel_binding'}
security = {'encrypted', 'unencrypted_scram'}
security = {'tls_version', 'encrypted', 'unencrypted_scram'}
def setup(self, name):
self.use_channel_binding = False
if name[-5:] == '-PLUS':
name = name[:-5]
self.use_channel_binding = True
if self.security_settings['tls_version'] == 'TLSv1.2':
self.use_channel_binding = True
self.hash_name = name[6:]
self.hash = hash(self.hash_name)
@ -244,7 +245,8 @@ class SCRAM(Mech):
self.cnonce = bytes(('%s' % random.random())[2:])
gs2_cbind_flag = b'n'
if self.credentials['channel_binding']:
if self.credentials['channel_binding'] and \
self.security_settings['tls_version'] == 'TLSv1.2':
if self.use_channel_binding:
gs2_cbind_flag = b'p=tls-unique'
else: