changeset 0d37fed94c68 in /home/hg/repos/python-nbxmpp

details:http://hg.gajim.org/python-nbxmpp?cmd=changeset;node=0d37fed94c68 description: Detect downgrade attacks from SCRAM-SHA-1-PLUS to SCRAM-SHA-1.

Fixes #16

diffstat:

nbxmpp/auth_nb.py | 7 ++++++- 1 files changed, 6 insertions(+), 1 deletions(-)

diffs (17 lines):

diff -r cbe73e43ed82 -r 0d37fed94c68 nbxmpp/auth_nb.py --- a/nbxmpp/auth_nb.py Wed Feb 26 10:18:08 2014 +0100 +++ b/nbxmpp/auth_nb.py Wed Feb 26 11:22:41 2014 +0100 @@ -463,7 +463,12 @@ self.client_nonce = '%x' % rndg.getrandbits(196) self.scram_soup = 'n=' + self.username + ',r=' + self.client_nonce if self.mechanism == 'SCRAM-SHA-1': - self.scram_gs2 = 'n,,' # No CB yet. + if self.channel_binding == None: + # Client doesn't support Channel Binding + self.scram_gs2 = 'n,,' # No CB yet. + else: + # Client supports CB, but server doesn't support CB + self.scram_gs2 = 'y,,' else: self.scram_gs2 = 'p=tls-unique,,' sasl_data = base64.b64encode((self.scram_gs2 + self.scram_soup).\