Mercurial > prosody-modules

comparison mod_sasl2_fast/mod_sasl2_fast.lua @ 5285:8e1f1eb00b58

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_sasl2_fast: Fix harmless off-by-one error (invalidates existing tokens!) Problem: This was causing the key to become "<token>--cur" instead of the expected "<token>-cur". As the same key was used by the code to both set and get, it still worked. Rationale for change: Although it worked, it's unintended, inconsistent and messy. It increases the chances of future bugs due to the unexpected format. Side-effects of change: Existing '--cur' entries will not be checked after this change, and therefore existing FAST clients will fail to authenticate until they attempt password auth and obtain a new FAST token. Existing '--cur' entries in storage will not be cleaned up by this commit, but this is considered a minor issue, and okay for the relatively few FAST deployments.
author Matthew Wild <mwild1@gmail.com>
date Wed, 29 Mar 2023 16:12:15 +0100
parents 0566a71a7076
children a91adc164566
comparison
equal deleted inserted replaced
5284:5178c13deb78 5285:8e1f1eb00b58
65 end 65 end
66 if not tried_current_token and not invalidate then 66 if not tried_current_token and not invalidate then
67 -- The new token is becoming the current token 67 -- The new token is becoming the current token
68 token_store:set_keys(username, { 68 token_store:set_keys(username, {
69 [key] = token_store.remove; 69 [key] = token_store.remove;
70 [key:sub(1, -4).."-cur"] = token; 70 [key:sub(1, -5).."-cur"] = token;
71 }); 71 });
72 end 72 end
73 local rotation_needed; 73 local rotation_needed;
74 if invalidate then 74 if invalidate then
75 token_store:set(username, key, nil); 75 token_store:set(username, key, nil);
82 end 82 end
83 if not tried_current_token then 83 if not tried_current_token then
84 log("debug", "Trying next token..."); 84 log("debug", "Trying next token...");
85 -- Try again with the current token instead 85 -- Try again with the current token instead
86 tried_current_token = true; 86 tried_current_token = true;
87 key = key:sub(1, -4).."-cur"; 87 key = key:sub(1, -5).."-cur";
88 else 88 else
89 log("debug", "No matching %s token found for %s/%s", mechanism, username, key); 89 log("debug", "No matching %s token found for %s/%s", mechanism, username, key);
90 return nil; 90 return nil;
91 end 91 end
92 until false; 92 until false;