Commits

commits@gajim.org

17632 discussions

python-nbxmpp: Disable SCRAM-SHA-1-PLUS if channel binding is no...
by Fedor Brunner 27 Mar '14

27 Mar '14

changeset 74fbe875e750 in /home/hg/repos/python-nbxmpp details:http://hg.gajim.org/python-nbxmpp?cmd=changeset;node=74fbe875e750 description: Disable SCRAM-SHA-1-PLUS if channel binding is not supported. Fixes #20 diffstat: nbxmpp/auth_nb.py | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-) diffs (16 lines): diff -r 589f0e14b5c0 -r 74fbe875e750 nbxmpp/auth_nb.py --- a/nbxmpp/auth_nb.py Sat Mar 01 21:26:17 2014 +0100 +++ b/nbxmpp/auth_nb.py Tue Mar 04 17:46:08 2014 +0100 @@ -188,8 +188,10 @@ # Password based authentication mechanism ordered by strength. # If the server supports a mechanism disable all weaker mechanisms. - password_auth_mechs_strength = ('SCRAM-SHA-1-PLUS', 'SCRAM-SHA-1', - 'DIGEST-MD5', 'PLAIN', 'X-MESSENGER-OAUTH2') + password_auth_mechs_strength = ['SCRAM-SHA-1-PLUS', 'SCRAM-SHA-1', + 'DIGEST-MD5', 'PLAIN', 'X-MESSENGER-OAUTH2'] + if self.channel_binding == None: + password_auth_mechs_strength.remove('SCRAM-SHA-1-PLUS') for i in range(0, len(password_auth_mechs_strength)): if password_auth_mechs_strength[i] in self.mecs: for m in password_auth_mechs_strength[i + 1:]:

1 0

python-nbxmpp: Disable session resumption, protection against Tr...
by Fedor Brunner 27 Mar '14

27 Mar '14

changeset 53533c9fd19e in /home/hg/repos/python-nbxmpp details:http://hg.gajim.org/python-nbxmpp?cmd=changeset;node=53533c9fd19e description: Disable session resumption, protection against Triple Handshakes TLS attack. Session resumption is currently not supported in Gajim, because Connection.get_session, Connection.set_session are not used. But in case someone will try to use them in future disable session cache using Context.set_session_cache_mode(OpenSSL.SSL.SESS_CACHE_OFF) Fixes #21 diffstat: nbxmpp/tls_nb.py | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diffs (16 lines): diff -r 74fbe875e750 -r 53533c9fd19e nbxmpp/tls_nb.py --- a/nbxmpp/tls_nb.py Tue Mar 04 17:46:08 2014 +0100 +++ b/nbxmpp/tls_nb.py Tue Mar 04 17:58:52 2014 +0100 @@ -392,6 +392,12 @@ tcpsock._sslContext.set_options(flags) + try: # Supported only pyOpenSSL >= 0.14 + # Disable session resumption, protection against Triple Handshakes TLS attack + tcpsock._sslContext.set_session_cache_mode(OpenSSL.SSL.SESS_CACHE_OFF) + except AttributeError, e: + pass + # NonBlockingHTTPBOSH instance has no attribute _owner if hasattr(tcpsock, '_owner') and tcpsock._owner._caller.client_cert \ and os.path.exists(tcpsock._owner._caller.client_cert):

1 0

python-nbxmpp: prepare 0.4 release
by Yann Leboulanger 27 Mar '14

27 Mar '14

changeset 82883ceb3310 in /home/hg/repos/python-nbxmpp details:http://hg.gajim.org/python-nbxmpp?cmd=changeset;node=82883ceb3310 description: prepare 0.4 release diffstat: ChangeLog | 6 ++++++ setup.py | 2 +- 2 files changed, 7 insertions(+), 1 deletions(-) diffs (25 lines): diff -r 53533c9fd19e -r 82883ceb3310 ChangeLog --- a/ChangeLog Tue Mar 04 17:58:52 2014 +0100 +++ b/ChangeLog Sat Mar 15 20:39:59 2014 +0100 @@ -1,3 +1,9 @@ +python-nbxmpp 0.4 (15 March 2014) + + * Ability to configure TLS protocol version + * Add support for SCRAM-SHA-1-PLUS + * Security improvements + python-nbxmpp 0.3 (23 December 2013) * Improve security level diff -r 53533c9fd19e -r 82883ceb3310 setup.py --- a/setup.py Tue Mar 04 17:58:52 2014 +0100 +++ b/setup.py Sat Mar 15 20:39:59 2014 +0100 @@ -3,7 +3,7 @@ from distutils.core import setup setup(name='nbxmpp', - version='0.3', + version='0.4', description='Non blocking Jabber/XMPP module', author='Yann Leboulanger', author_email='asterix(a)lagaule.org',

1 0

python-nbxmpp: initialize ssl_errnum to 0
by Yann Leboulanger 27 Mar '14

27 Mar '14

changeset 3dec8187531c in /home/hg/repos/python-nbxmpp details:http://hg.gajim.org/python-nbxmpp?cmd=changeset;node=3dec8187531c description: initialize ssl_errnum to 0 py2 -> py3 diffstat: nbxmpp/bosh.py | 2 +- nbxmpp/tls_nb.py | 6 +++--- nbxmpp/transports_nb.py | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diffs (49 lines): diff -r 82883ceb3310 -r 3dec8187531c nbxmpp/bosh.py --- a/nbxmpp/bosh.py Sat Mar 15 20:39:59 2014 +0100 +++ b/nbxmpp/bosh.py Thu Mar 27 13:22:15 2014 +0100 @@ -94,7 +94,7 @@ # ssl variables self.ssl_certificate = None - self.ssl_errnum = None + self.ssl_errnum = 0 def connect(self, conn_5tuple, on_connect, on_connect_failure): diff -r 82883ceb3310 -r 3dec8187531c nbxmpp/tls_nb.py --- a/nbxmpp/tls_nb.py Sat Mar 15 20:39:59 2014 +0100 +++ b/nbxmpp/tls_nb.py Thu Mar 27 13:22:15 2014 +0100 @@ -383,10 +383,10 @@ if self.tls_version not in ('1.0', '1.1'): try: flags |= OpenSSL.SSL.OP_NO_TLSv1_1 - except AttributeError, e: + except AttributeError as e: # older py-OpenSSL flags |= 0x10000000 - except AttributeError, e: + except AttributeError as e: pass # much older py-OpenSSL @@ -395,7 +395,7 @@ try: # Supported only pyOpenSSL >= 0.14 # Disable session resumption, protection against Triple Handshakes TLS attack tcpsock._sslContext.set_session_cache_mode(OpenSSL.SSL.SESS_CACHE_OFF) - except AttributeError, e: + except AttributeError as e: pass # NonBlockingHTTPBOSH instance has no attribute _owner diff -r 82883ceb3310 -r 3dec8187531c nbxmpp/transports_nb.py --- a/nbxmpp/transports_nb.py Sat Mar 15 20:39:59 2014 +0100 +++ b/nbxmpp/transports_nb.py Thu Mar 27 13:22:15 2014 +0100 @@ -320,7 +320,7 @@ # ssl variables self.ssl_certificate = None - self.ssl_errnum = None + self.ssl_errnum = 0 # FIXME: transport should not be aware xmpp def start_disconnect(self):

1 0

python-nbxmpp: Add ability to configure TLS protocol version.
by Fedor Brunner 27 Mar '14

27 Mar '14

changeset 900625d7869c in /home/hg/repos/python-nbxmpp details:http://hg.gajim.org/python-nbxmpp?cmd=changeset;node=900625d7869c description: Add ability to configure TLS protocol version. Add support for tls_version parameter. Fixes #17 diffstat: nbxmpp/bosh.py | 6 ++++-- nbxmpp/client_nb.py | 10 ++++++---- nbxmpp/tls_nb.py | 22 +++++++++++++++++++++- nbxmpp/transports_nb.py | 14 ++++++++------ 4 files changed, 39 insertions(+), 13 deletions(-) diffs (194 lines): diff -r 1196b6ac3d82 -r 900625d7869c nbxmpp/bosh.py --- a/nbxmpp/bosh.py Tue Feb 18 09:27:16 2014 +0100 +++ b/nbxmpp/bosh.py Mon Jan 27 16:28:32 2014 +0100 @@ -40,9 +40,9 @@ class NonBlockingBOSH(NonBlockingTransport): def __init__(self, raise_event, on_disconnect, idlequeue, estabilish_tls, - certs, cipher_list, xmpp_server, domain, bosh_dict, proxy_creds): + certs, tls_version, cipher_list, xmpp_server, domain, bosh_dict, proxy_creds): NonBlockingTransport.__init__(self, raise_event, on_disconnect, - idlequeue, estabilish_tls, certs, cipher_list) + idlequeue, estabilish_tls, certs, tls_version, cipher_list) self.bosh_sid = None if locale.getdefaultlocale()[0]: @@ -70,6 +70,7 @@ self.bosh_secure = 'true' else: self.bosh_secure = 'false' + self.tls_version = tls_version self.cipher_list = cipher_list self.use_proxy_auth = bosh_dict['useauth'] self.proxy_creds = proxy_creds @@ -451,6 +452,7 @@ on_disconnect=self.disconnect, idlequeue = self.idlequeue, estabilish_tls = self.estabilish_tls, + tls_version = self.tls_version, cipher_list = self.cipher_list, certs = self.certs, on_http_request_possible = self.on_http_request_possible, diff -r 1196b6ac3d82 -r 900625d7869c nbxmpp/client_nb.py --- a/nbxmpp/client_nb.py Tue Feb 18 09:27:16 2014 +0100 +++ b/nbxmpp/client_nb.py Mon Jan 27 16:28:32 2014 +0100 @@ -163,19 +163,19 @@ values for keys 'host' and 'port' - connection details for proxy serve and optionally keys 'user' and 'pass' as proxy credentials :param secure_tuple: tuple of (desired connection type, cacerts, - mycerts, cipher_list) + mycerts, tls_version, cipher_list) connection type can be 'ssl' - TLS established after TCP connection, 'tls' - TLS established after negotiation with starttls, or 'plain'. - cacerts, mycerts, cipher_list - see tls_nb.NonBlockingTLS + cacerts, mycerts, tls_version, cipher_list - see tls_nb.NonBlockingTLS constructor for more details """ self.on_connect = on_connect self.on_connect_failure=on_connect_failure self.on_proxy_failure = on_proxy_failure self.on_stream_error_cb = on_stream_error_cb - self.desired_security, self.cacerts, self.mycerts, self.cipher_list = \ - secure_tuple + self.desired_security, self.cacerts, self.mycerts, self.tls_version, \ + self.cipher_list = secure_tuple self.Connection = None self.Port = port self.proxy = proxy @@ -212,6 +212,7 @@ idlequeue=self.idlequeue, estabilish_tls=establish_tls, certs=certs, + tls_version = self.tls_version, cipher_list = self.cipher_list, proxy_creds=(proxy_user, proxy_pass), xmpp_server=(self.xmpp_hostname, self.Port), @@ -234,6 +235,7 @@ idlequeue=self.idlequeue, estabilish_tls=establish_tls, certs=certs, + tls_version = self.tls_version, cipher_list = self.cipher_list, proxy_dict=proxy_dict) diff -r 1196b6ac3d82 -r 900625d7869c nbxmpp/tls_nb.py --- a/nbxmpp/tls_nb.py Tue Feb 18 09:27:16 2014 +0100 +++ b/nbxmpp/tls_nb.py Mon Jan 27 16:28:32 2014 +0100 @@ -250,11 +250,14 @@ PyOpenSSLWrapper. """ - def __init__(self, cacerts, mycerts, cipher_list): + def __init__(self, cacerts, mycerts, tls_version, cipher_list): """ :param cacerts: path to pem file with certificates of known XMPP servers :param mycerts: path to pem file with certificates of user trusted servers + :param tls_version: The lowest supported TLS version. If None is + provided, version 1.0 is used. For example setting to 1.1 will + enable TLS 1.1, TLS 1.2 and all further protocols :param cipher_list: list of ciphers to use when connection to server. If None is provided, a default list is used: HIGH:!aNULL:RC4-SHA """ @@ -265,6 +268,10 @@ self.cipher_list = 'HIGH:!aNULL:RC4-SHA' else: self.cipher_list = cipher_list + if tls_version is None: + self.tls_version = '1.0' + else: + self.tls_version = tls_version def plugin(self, owner): """ @@ -366,6 +373,19 @@ except AttributeError as e: # py-OpenSSL < 0.9 or old OpenSSL flags |= 16384 + + # OpenSSL 1.0.1d supports TLS 1.1 and TLS 1.2 and + # fixes renegotiation in TLS 1.1, 1.2 by using the correct TLS version. + if OpenSSL.SSL.OPENSSL_VERSION_NUMBER >= 0x1000104f: + if self.tls_version != '1.0': + flags |= OpenSSL.SSL.OP_NO_TLSv1 + if self.tls_version not in ('1.0', '1.1'): + try: + flags |= OpenSSL.SSL.OP_NO_TLSv1_1 + except AttributeError, e: + # older py-OpenSSL + flags |= 0x10000000 + tcpsock._sslContext.set_options(flags) # NonBlockingHTTPBOSH instance has no attribute _owner diff -r 1196b6ac3d82 -r 900625d7869c nbxmpp/transports_nb.py --- a/nbxmpp/transports_nb.py Tue Feb 18 09:27:16 2014 +0100 +++ b/nbxmpp/transports_nb.py Mon Jan 27 16:28:32 2014 +0100 @@ -109,7 +109,7 @@ """ def __init__(self, raise_event, on_disconnect, idlequeue, estabilish_tls, - certs, cipher_list): + certs, tls_version, cipher_list): """ Each trasport class can have different constructor but it has to have at least all the arguments of NonBlockingTransport constructor @@ -121,6 +121,7 @@ after TCP connection is done :param certs: tuple of (cacerts, mycerts) see constructor of tls_nb.NonBlockingTLS for more details + :param tls_version: The lowest supported TLS version. :param cipher_list: list of ciphers used to connect to server """ PlugIn.__init__(self) @@ -136,6 +137,7 @@ self.set_state(DISCONNECTED) self.estabilish_tls = estabilish_tls self.certs = certs + self.tls_version = tls_version self.cipher_list = cipher_list # type of used ssl lib (if any) will be assigned to this member var self.ssl_lib = None @@ -295,12 +297,12 @@ estabilish TLS connection. """ def __init__(self, raise_event, on_disconnect, idlequeue, estabilish_tls, - certs, cipher_list, proxy_dict=None): + certs, tls_version, cipher_list, proxy_dict=None): """ :param proxy_dict: dictionary with proxy data as loaded from config file """ NonBlockingTransport.__init__(self, raise_event, on_disconnect, - idlequeue, estabilish_tls, certs, cipher_list) + idlequeue, estabilish_tls, certs, tls_version, cipher_list) IdleObject.__init__(self) # queue with messages to be send @@ -410,7 +412,7 @@ """ cacerts, mycerts = self.certs result = tls_nb.NonBlockingTLS.get_instance(cacerts, mycerts, - self.cipher_list).PlugIn(self) + self.tls_version, self.cipher_list).PlugIn(self) if result: on_succ() else: @@ -664,7 +666,7 @@ """ def __init__(self, raise_event, on_disconnect, idlequeue, estabilish_tls, - certs, cipher_list, on_http_request_possible, on_persistent_fallback, + certs, tls_version, cipher_list, on_http_request_possible, on_persistent_fallback, http_dict, proxy_dict=None): """ :param on_http_request_possible: method to call when HTTP request to @@ -674,7 +676,7 @@ :param http_dict: dictionary with data for HTTP request and headers """ NonBlockingTCP.__init__(self, raise_event, on_disconnect, idlequeue, - estabilish_tls, certs, cipher_list, proxy_dict) + estabilish_tls, certs, tls_version, cipher_list, proxy_dict) self.http_protocol, self.http_host, self.http_port, self.http_path = \ urisplit(http_dict['http_uri'])

1 0

python-nbxmpp: update version number
by Yann Leboulanger 27 Mar '14

27 Mar '14

changeset d3089cb1164e in /home/hg/repos/python-nbxmpp details:http://hg.gajim.org/python-nbxmpp?cmd=changeset;node=d3089cb1164e description: update version number diffstat: nbxmpp/__init__.py | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diffs (9 lines): diff -r 900625d7869c -r d3089cb1164e nbxmpp/__init__.py --- a/nbxmpp/__init__.py Mon Jan 27 16:28:32 2014 +0100 +++ b/nbxmpp/__init__.py Mon Jan 27 20:18:13 2014 +0100 @@ -17,4 +17,4 @@ from .plugin import PlugIn from .smacks import Smacks -__version__ = "0.3" +__version__ = "0.3.1"

1 0

python-nbxmpp: Ubuntu 12.04.4 package python-openssl (0.12-1ubun...
by Fedor Brunner 27 Mar '14

27 Mar '14

changeset 7adb303d4839 in /home/hg/repos/python-nbxmpp details:http://hg.gajim.org/python-nbxmpp?cmd=changeset;node=7adb303d4839 description: Ubuntu 12.04.4 package python-openssl (0.12-1ubuntu2.1) is based on an older version of pyOpenSSL. In this version of pyOpenSSL OpenSSL.SSL.OPENSSL_VERSION_NUMBER is not defined. Fixes: #18 diffstat: nbxmpp/tls_nb.py | 26 +++++++++++++++----------- 1 files changed, 15 insertions(+), 11 deletions(-) diffs (36 lines): diff -r d3089cb1164e -r 7adb303d4839 nbxmpp/tls_nb.py --- a/nbxmpp/tls_nb.py Mon Jan 27 20:18:13 2014 +0100 +++ b/nbxmpp/tls_nb.py Wed Jan 29 16:47:10 2014 +0100 @@ -374,17 +374,21 @@ # py-OpenSSL < 0.9 or old OpenSSL flags |= 16384 - # OpenSSL 1.0.1d supports TLS 1.1 and TLS 1.2 and - # fixes renegotiation in TLS 1.1, 1.2 by using the correct TLS version. - if OpenSSL.SSL.OPENSSL_VERSION_NUMBER >= 0x1000104f: - if self.tls_version != '1.0': - flags |= OpenSSL.SSL.OP_NO_TLSv1 - if self.tls_version not in ('1.0', '1.1'): - try: - flags |= OpenSSL.SSL.OP_NO_TLSv1_1 - except AttributeError, e: - # older py-OpenSSL - flags |= 0x10000000 + try: + # OpenSSL 1.0.1d supports TLS 1.1 and TLS 1.2 and + # fixes renegotiation in TLS 1.1, 1.2 by using the correct TLS version. + if OpenSSL.SSL.OPENSSL_VERSION_NUMBER >= 0x1000104f: + if self.tls_version != '1.0': + flags |= OpenSSL.SSL.OP_NO_TLSv1 + if self.tls_version not in ('1.0', '1.1'): + try: + flags |= OpenSSL.SSL.OP_NO_TLSv1_1 + except AttributeError, e: + # older py-OpenSSL + flags |= 0x10000000 + except AttributeError, e: + pass # much older py-OpenSSL + tcpsock._sslContext.set_options(flags)

1 0

python-nbxmpp: add NS_MSG_HINTS
by Yann Leboulanger 27 Mar '14

27 Mar '14

changeset f66e38242da5 in /home/hg/repos/python-nbxmpp details:http://hg.gajim.org/python-nbxmpp?cmd=changeset;node=f66e38242da5 description: add NS_MSG_HINTS diffstat: nbxmpp/__init__.py | 2 +- nbxmpp/protocol.py | 1 + 2 files changed, 2 insertions(+), 1 deletions(-) diffs (20 lines): diff -r 7adb303d4839 -r f66e38242da5 nbxmpp/__init__.py --- a/nbxmpp/__init__.py Wed Jan 29 16:47:10 2014 +0100 +++ b/nbxmpp/__init__.py Wed Feb 19 10:30:13 2014 +0100 @@ -17,4 +17,4 @@ from .plugin import PlugIn from .smacks import Smacks -__version__ = "0.3.1" +__version__ = "0.3.2" diff -r 7adb303d4839 -r f66e38242da5 nbxmpp/protocol.py --- a/nbxmpp/protocol.py Wed Jan 29 16:47:10 2014 +0100 +++ b/nbxmpp/protocol.py Wed Feb 19 10:30:13 2014 +0100 @@ -81,6 +81,7 @@ NS_GATEWAY = 'jabber:iq:gateway' # XEP-0100 NS_GEOLOC = 'http://jabber.org/protocol/geoloc' # XEP-0080 NS_GROUPCHAT = 'gc-1.0' +NS_MSG_HINTS = 'urn:xmpp:hints' # XEP-0280 NS_HTTP_AUTH = 'http://jabber.org/protocol/http-auth' # XEP-0070 NS_HTTP_BIND = 'http://jabber.org/protocol/httpbind' # XEP-0124 NS_IBB = 'http://jabber.org/protocol/ibb'

1 0

python-nbxmpp: Fix typos
by Fedor Brunner 27 Mar '14

27 Mar '14

changeset 7ae3ec7d4e3f in /home/hg/repos/python-nbxmpp details:http://hg.gajim.org/python-nbxmpp?cmd=changeset;node=7ae3ec7d4e3f description: Fix typos diffstat: nbxmpp/client_nb.py | 12 ++++++------ 1 files changed, 6 insertions(+), 6 deletions(-) diffs (52 lines): diff -r f66e38242da5 -r 7ae3ec7d4e3f nbxmpp/client_nb.py --- a/nbxmpp/client_nb.py Wed Feb 19 10:30:13 2014 +0100 +++ b/nbxmpp/client_nb.py Tue Feb 25 10:38:31 2014 +0100 @@ -17,7 +17,7 @@ # $Id: client.py,v 1.52 2006/01/02 19:40:55 normanr Exp $ """ -Client class establishs connection to XMPP Server and handles authentication +Client class establishes connection to XMPP Server and handles authentication """ import socket @@ -32,7 +32,7 @@ """ Client class is XMPP connection mountpoint. Objects for authentication, network communication, roster, xml parsing ... are plugged to client object. - Client implements the abstract behavior - mostly negotioation and callbacks + Client implements the abstract behavior - mostly negotiation and callbacks handling, whereas underlying modules take care of feature-specific logic """ @@ -154,10 +154,10 @@ Open XMPP connection (open XML streams in both directions) :param on_connect: called after stream is successfully opened - :param on_connect_failure: called when error occures during connection + :param on_connect_failure: called when error occurs during connection :param hostname: hostname of XMPP server from SRV request :param port: port number of XMPP server - :param on_proxy_failure: called if error occurres during TCP connection + :param on_proxy_failure: called if error occurs during TCP connection to proxy server or during proxy connecting process :param proxy: dictionary with proxy data. It should contain at least values for keys 'host' and 'port' - connection details for proxy @@ -425,7 +425,7 @@ def _tls_negotiation_handler(self, con=None, tag=None): """ - Take care of TLS negotioation with <starttls> + Take care of TLS negotiation with <starttls> """ log.info('-------------tls_negotiaton_handler() >> tag: %s' % tag) if not con and not tag: @@ -449,7 +449,7 @@ # because <starttls> negotiation with BOSH is forbidden self.Connection.tls_init( on_succ = lambda: self._xmpp_connect(socket_type='tls'), - on_fail = lambda: self.disconnect('error while etabilishing TLS')) + on_fail = lambda: self.disconnect('error while establishing TLS')) def _on_connect(self): """

1 0

python-nbxmpp: Check nonce returned from server during SCRAM-SHA...
by Fedor Brunner 27 Mar '14

27 Mar '14

changeset c814c6f856f6 in /home/hg/repos/python-nbxmpp details:http://hg.gajim.org/python-nbxmpp?cmd=changeset;node=c814c6f856f6 description: Check nonce returned from server during SCRAM-SHA-1 authentication. The first part of server nonce muss be the nonce send by client. Fixes #19 diffstat: nbxmpp/auth_nb.py | 11 ++++++++--- 1 files changed, 8 insertions(+), 3 deletions(-) diffs (35 lines): diff -r 7ae3ec7d4e3f -r c814c6f856f6 nbxmpp/auth_nb.py --- a/nbxmpp/auth_nb.py Tue Feb 25 10:38:31 2014 +0100 +++ b/nbxmpp/auth_nb.py Tue Feb 25 16:36:56 2014 +0100 @@ -391,7 +391,11 @@ self.scram_step = 1 self.scram_soup += ',' + data + ',' data = scram_parse(data) - # TODO: Should check cnonce here. + # Check server nonce here. + # The first part of server nonce muss be the nonce send by client. + if (data['r'][:len(self.client_nonce)] != self.client_nonce): + on_auth_fail('Server nonce is incorrect') + raise NodeProcessed # TODO: Channel binding data goes in here too. r = 'c=' + scram_base64(self.scram_gs2) r += ',r=' + data['r'] @@ -424,6 +428,7 @@ self._owner.send(str(node)) raise NodeProcessed + # DIGEST-MD5 # magic foo... chal = challenge_splitter(data) if not self.realm and 'realm' in chal: @@ -468,8 +473,8 @@ def set_password(self, password): self.password = '' if password is None else password if self.mechanism == 'SCRAM-SHA-1': - nonce = '%x' % rndg.getrandbits(196) - self.scram_soup = 'n=' + self.username + ',r=' + nonce + self.client_nonce = '%x' % rndg.getrandbits(196) + self.scram_soup = 'n=' + self.username + ',r=' + self.client_nonce self.scram_gs2 = 'n,,' # No CB yet. sasl_data = base64.b64encode((self.scram_gs2 + self.scram_soup).\ encode('utf-8')).decode('utf-8').replace('\n', '')

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

Commits