Mercurial > prosody-modules

annotate mod_bind2/mod_bind2.lua @ 5616:59d5fc50f602

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_http_oauth2: Implement refresh token rotation Makes refresh tokens one-time-use, handing out a new refresh token with each access token. Thus if a refresh token is stolen and used by an attacker, the next time the legitimate client tries to use the previous refresh token, it will not work and the attack will be noticed. If the attacker does not use the refresh token, it becomes invalid after the legitimate client uses it. This behavior is recommended by draft-ietf-oauth-security-topics
author Kim Alvefur <zash@zash.se>
date Sun, 23 Jul 2023 02:56:08 +0200
parents 1539ae696613
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
4793
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
1 local mm = require "core.modulemanager";
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
2 local sm = require "core.sessionmanager";
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
3
4795
8849b4f68534 mod_bind2: Add missing missing SASL2 namespace [luacheck]
Kim Alvefur <zash@zash.se>
parents: 4794
diff changeset
4 local xmlns_sasl2 --[[<const>]] = "urn:xmpp:sasl:1";
4793
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
5 local xmlns_bind2 --[[<const>]] = "urn:xmpp:bind2:0";
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
6 local xmlns_carbons --[[<const>]] = "urn:xmpp:carbons:2";
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
7
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
8 module:depends("sasl2");
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
9 module:depends("carbons");
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
10
4794
d17a1581ea30 mod_bind2: Advertise stream feature
Kim Alvefur <zash@zash.se>
parents: 4793
diff changeset
11 module:hook("stream-features", function(event)
d17a1581ea30 mod_bind2: Advertise stream feature
Kim Alvefur <zash@zash.se>
parents: 4793
diff changeset
12 local origin, features = event.origin, event.features;
d17a1581ea30 mod_bind2: Advertise stream feature
Kim Alvefur <zash@zash.se>
parents: 4793
diff changeset
13 if origin.type ~= "c2s_unauthed" then return end
d17a1581ea30 mod_bind2: Advertise stream feature
Kim Alvefur <zash@zash.se>
parents: 4793
diff changeset
14 features:tag("bind", xmlns_bind2):up();
d17a1581ea30 mod_bind2: Advertise stream feature
Kim Alvefur <zash@zash.se>
parents: 4793
diff changeset
15 end);
d17a1581ea30 mod_bind2: Advertise stream feature
Kim Alvefur <zash@zash.se>
parents: 4793
diff changeset
16
4793
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
17 module:hook_tag(xmlns_sasl2, "authenticate", function (session, auth)
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
18 session.bind2 = auth:get_child("bind", xmlns_bind2);
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
19 end, 1);
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
20
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
21 module:hook("sasl2/c2s/success", function (event)
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
22 local session = event.session;
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
23 if not session.bind2 then return end
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
24
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
25 -- When it receives a bind 2.0 on an authenticated not-yet-bound session, the
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
26 -- server MUST:
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
27
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
28 -- Clear the offline messages for this user, if any, without sending them (as
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
29 -- they will be provided by MAM).
4797
1539ae696613 mod_bind2: Silence [luacheck] warning
Kim Alvefur <zash@zash.se>
parents: 4795
diff changeset
30 if mm.is_loaded(module.host, "offline") then -- luacheck: ignore 542
4793
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
31 -- TODO
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
32 end
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
33
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
34 -- Perform resource binding to a random resource (see 6120)
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
35 if not sm.bind_resource(session, nil) then
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
36 -- FIXME How should this be handled even?
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
37 session:close("reset");
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
38 return true;
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
39 end
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
40
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
41 -- Work out which contacts have unread messages in the user's MAM archive,
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
42 -- how many, and what the id of the last read message is
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
43 -- XXX How do we know what the last read message was?
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
44 -- TODO archive:summary(session.username, { after = ??? });
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
45
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
46 -- Get the id of the newest stanza in the user's MAM archive
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
47 -- TODO archive:find(session.username, { reverse = true, limit = 1 });
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
48
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
49 -- Silently enable carbons for this session
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
50 session.carbons = xmlns_carbons;
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
51
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
52 -- After processing the bind stanza, as above, the server MUST respond with
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
53 -- an element of type 'bound' in the namespace 'urn:xmpp:bind2:0', as in the
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
54 -- below example
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
55 event.success:tag("bound", xmlns_bind2):text_tag("jid", session.full_jid):up();
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
56
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
57 session.bind2 = nil;
aaa6f412dce3 mod_bind2: Experimental implementation of XEP-0386: Bind 2.0
Kim Alvefur <zash@zash.se>
parents:
diff changeset
58 end);