changeset b92ebcc55cb4 in /home/hg/repos/python-nbxmpp

details:http://hg.gajim.org/python-nbxmpp?cmd=changeset;node=b92ebcc55cb4 description: Check nonce returned from server during SCRAM-SHA-1 authentication.

The first part of server nonce muss be the nonce send by client.

Fixes #19

diffstat:

nbxmpp/auth_nb.py | 11 ++++++++--- 1 files changed, 8 insertions(+), 3 deletions(-)

diffs (35 lines):

diff -r 9954a0178fe8 -r b92ebcc55cb4 nbxmpp/auth_nb.py --- a/nbxmpp/auth_nb.py Tue Feb 25 10:38:31 2014 +0100 +++ b/nbxmpp/auth_nb.py Tue Feb 25 16:36:56 2014 +0100 @@ -358,7 +358,11 @@ self.scram_step = 1 self.scram_soup += ',' + data + ',' data = _scram_parse(data) - # TODO: Should check cnonce here. + # Check server nonce here. + # The first part of server nonce muss be the nonce send by client. + if (data['r'][:len(self.client_nonce)] != self.client_nonce): + on_auth_fail('Server nonce is incorrect') + raise NodeProcessed # TODO: Channel binding data goes in here too. r = 'c=' + scram_base64(self.scram_gs2) r += ',r=' + data['r'] @@ -389,6 +393,7 @@ self._owner.send(str(node)) raise NodeProcessed

+ # DIGEST-MD5 # magic foo... chal = _challenge_splitter(data) if not self.realm and 'realm' in chal: @@ -433,8 +438,8 @@ def set_password(self, password): self.password = '' if password is None else password if self.mechanism == 'SCRAM-SHA-1': - nonce = '%x' % rndg.getrandbits(196) - self.scram_soup = 'n=' + self.username + ',r=' + nonce + self.client_nonce = '%x' % rndg.getrandbits(196) + self.scram_soup = 'n=' + self.username + ',r=' + self.client_nonce self.scram_gs2 = 'n,,' # No CB yet. sasl_data = (self.scram_gs2 + self.scram_soup).encode('base64').\ replace('\n', '')