devs/libstrophe-gh
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Disable weak authentication methods per default

Browse Source 
Signed-off-by: Steffen Jaeckel <jaeckel-floss@eyet-services.de>
This commit is contained in:
Steffen Jaeckel
2023-10-31 13:13:48 +01:00
parent 3f03de031c
commit fac1900c3f
4 changed files with 17 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/auth.c
View File

@@ -857,7 +857,8 @@ static void _auth(xmpp_conn_t *conn)
/* SASL algorithm was tried, unset flag */ /* SASL algorithm was tried, unset flag */
conn->sasl_support &= ~scram_ctx->alg->mask; conn->sasl_support &= ~scram_ctx->alg->mask;
} else if (conn->sasl_support & SASL_MASK_DIGESTMD5) { } else if ((conn->sasl_support & SASL_MASK_DIGESTMD5) &&
conn->weak_auth_enabled) {
auth = _make_sasl_auth(conn, "DIGEST-MD5"); auth = _make_sasl_auth(conn, "DIGEST-MD5");
if (!auth) { if (!auth) {
disconnect_mem_error(conn); disconnect_mem_error(conn);
@@ -871,7 +872,8 @@ static void _auth(xmpp_conn_t *conn)
/* SASL DIGEST-MD5 was tried, unset flag */ /* SASL DIGEST-MD5 was tried, unset flag */
conn->sasl_support &= ~SASL_MASK_DIGESTMD5; conn->sasl_support &= ~SASL_MASK_DIGESTMD5;
} else if (conn->sasl_support & SASL_MASK_PLAIN) { } else if ((conn->sasl_support & SASL_MASK_PLAIN) &&
conn->weak_auth_enabled) {
auth = _make_sasl_auth(conn, "PLAIN"); auth = _make_sasl_auth(conn, "PLAIN");
if (!auth) { if (!auth) {
disconnect_mem_error(conn); disconnect_mem_error(conn);

1
src/common.h
View File

@@ -259,6 +259,7 @@ struct _xmpp_conn_t {
int sasl_support; /* if true, field is a bitfield of supported int sasl_support; /* if true, field is a bitfield of supported
mechanisms */ mechanisms */
int auth_legacy_enabled; int auth_legacy_enabled;
int weak_auth_enabled;
int secured; /* set when stream is secured with TLS */ int secured; /* set when stream is secured with TLS */
xmpp_certfail_handler certfail_handler; xmpp_certfail_handler certfail_handler;
xmpp_password_callback password_callback; xmpp_password_callback password_callback;

13
src/conn.c
View File

@@ -1133,6 +1133,7 @@ long xmpp_conn_get_flags(const xmpp_conn_t *conn)
XMPP_CONN_FLAG_DISABLE_SM * conn->sm_disable | XMPP_CONN_FLAG_DISABLE_SM * conn->sm_disable |
XMPP_CONN_FLAG_ENABLE_COMPRESSION * conn->compression.allowed | XMPP_CONN_FLAG_ENABLE_COMPRESSION * conn->compression.allowed |
XMPP_CONN_FLAG_COMPRESSION_DONT_RESET * conn->compression.dont_reset | XMPP_CONN_FLAG_COMPRESSION_DONT_RESET * conn->compression.dont_reset |
XMPP_CONN_FLAG_WEAK_AUTH * conn->weak_auth_enabled |
XMPP_CONN_FLAG_LEGACY_AUTH * conn->auth_legacy_enabled; XMPP_CONN_FLAG_LEGACY_AUTH * conn->auth_legacy_enabled;
return flags; return flags;
@@ -1188,11 +1189,13 @@ int xmpp_conn_set_flags(xmpp_conn_t *conn, long flags)
(flags & XMPP_CONN_FLAG_ENABLE_COMPRESSION) ? 1 : 0; (flags & XMPP_CONN_FLAG_ENABLE_COMPRESSION) ? 1 : 0;
conn->compression.dont_reset = conn->compression.dont_reset =
(flags & XMPP_CONN_FLAG_COMPRESSION_DONT_RESET) ? 1 : 0; (flags & XMPP_CONN_FLAG_COMPRESSION_DONT_RESET) ? 1 : 0;
flags &= ~(XMPP_CONN_FLAG_DISABLE_TLS | XMPP_CONN_FLAG_MANDATORY_TLS | conn->weak_auth_enabled = (flags & XMPP_CONN_FLAG_WEAK_AUTH) ? 1 : 0;
XMPP_CONN_FLAG_LEGACY_SSL | XMPP_CONN_FLAG_TRUST_TLS | flags &=
XMPP_CONN_FLAG_LEGACY_AUTH | XMPP_CONN_FLAG_DISABLE_SM | ~(XMPP_CONN_FLAG_DISABLE_TLS | XMPP_CONN_FLAG_MANDATORY_TLS |
XMPP_CONN_FLAG_ENABLE_COMPRESSION | XMPP_CONN_FLAG_LEGACY_SSL | XMPP_CONN_FLAG_TRUST_TLS |
XMPP_CONN_FLAG_COMPRESSION_DONT_RESET); XMPP_CONN_FLAG_LEGACY_AUTH | XMPP_CONN_FLAG_DISABLE_SM |
XMPP_CONN_FLAG_ENABLE_COMPRESSION |
XMPP_CONN_FLAG_COMPRESSION_DONT_RESET | XMPP_CONN_FLAG_WEAK_AUTH);
if (flags) { if (flags) {
strophe_error(conn->ctx, "conn", "Flags 0x%04lx unknown", flags); strophe_error(conn->ctx, "conn", "Flags 0x%04lx unknown", flags);
return XMPP_EINVOP; return XMPP_EINVOP;

4
strophe.h
View File

@@ -208,6 +208,10 @@ typedef struct _xmpp_sm_t xmpp_sm_state_t;
* Only enable this flag if you know what you're doing. * Only enable this flag if you know what you're doing.
*/ */
#define XMPP_CONN_FLAG_COMPRESSION_DONT_RESET (1UL << 7) #define XMPP_CONN_FLAG_COMPRESSION_DONT_RESET (1UL << 7)
/** @def XMPP_CONN_FLAG_WEAK_AUTH
* Allow weak authentication methods (DIGEST-MD5 and PLAIN).
*/
#define XMPP_CONN_FLAG_WEAK_AUTH (1UL << 8)
/* connect callback */ /* connect callback */
typedef enum { typedef enum {