Implement SASL2, BIND2, and FAST #1006

singpolyma · 2023-11-21T20:20:50Z

Depends on #1030

As reccomended by the RFC

sonnyp · 2023-12-16T23:38:22Z

Thanks! I will get around to fixing CI and reviewing once I have a bit of time.

singpolyma · 2024-06-19T14:54:20Z

Not to be a pain, but any chance to get this looked at? Thanks :)

sonnyp

Hey thanks for this!

could you add tests? check the other similar modules

e2e tests would be needed as well

CI is broken but I can have a look eventually - let me know if you have troubles running tests locally but a fix would be awesome

singpolyma · 2024-07-04T02:58:27Z

@sonnyp tests added

FAIL ./packages/client/dist/xmpp.min.js: 45.01KB > maxSize 16KB (gzip)

sonnyp

I fixed CI and merged main into this. Plus a couple of minor changes, please see my commits

Please add end2end tests. See test/

You'll need to enable sasl2, bind2, fast in our Prosody (see server/) somehow so that tests that make use of it can be added.

End to end tests can be run with make ci

packages/sasl-ht-sha-256-none/index.js

packages/sasl2/index.js

sonnyp · 2024-12-12T13:34:57Z

packages/sasl2/lib/SASLError.js

+  }
+}
+
+module.exports = SASLError;


either this is different from SASLError or it uses the one from the @xmpp/saslerror package

I don't see such a package?

sorry I meant form the @xmpp/sasl package

sonnyp · 2024-12-12T13:35:45Z

packages/stream-features/route.js

-    if (!prevent && entity.jid) entity._status("online", entity.jid);
+    if (!prevent && entity.jid && entity.status !== "online") {
+      entity._status("online", entity.jid);
+    }


Added comment to explain: BIND2 inline handler may have already set to online, eg inline SM resum

sonnyp · 2024-12-12T13:36:42Z

packages/connection/index.js

+    if (
+      this.socket.secure &&
+      this.socket.secure() &&
+      (this.streamFrom || this.jid)
+    ) {
+      headerElement.attrs.from = (this.streamFrom || this.jid).toString();
+    }


added comment to explain:
When the stream is secure there is no leak to setting the stream from
This is suggested in general and in required for FAST implementations
in particular

Neustradamus · 2024-12-13T19:15:45Z

@sonnyp: Thanks to work on this @singpolyma PR :)

No details in description but supported XEPs in this PR:

XEP-0388: Extensible SASL Profile: https://xmpp.org/extensions/xep-0388.html
XEP-0386: Bind 2: https://xmpp.org/extensions/xep-0386.html
XEP-0484: Fast Authentication Streamlining Tokens: https://xmpp.org/extensions/xep-0484.html

@singpolyma: XEPs are up-to-date?
Since one year, updates have been done at XSF about a lot of XEPs :/

It will be nice to add XEP supported versions (example: 1.0.0) to be listed correctly in xmpp.org and to update easily:

singpolyma · 2024-12-18T17:44:24Z

Why removing the new sasl mechanism from browser? That's the main place I'm using it

singpolyma · 2024-12-18T20:02:05Z

@sonnyp e2e tests added and they work locally and in CI (that one CI failure looks like a hiccup to me but I don't have permission to ask it to rerun I guess)

Neustradamus · 2024-12-18T20:36:15Z

@singpolyma: Have you tested with ejabberd?
It supports XEP-0386 and XEP-0388 since a moment.
And @Prefix has added XEP-0484 recently and will be in ejabberd 24.12.

cc: @mremond.

sonnyp · 2024-12-19T23:40:40Z

server/modules/mod_sasl2_bind2.lua

+	if csi_state_tag then
+		session.state = csi_state_tag.name;
+	end
+end, 10);


aren't these available on prosody-trunk ?

I don't want to manage in tree prosody modules

we could add the prosody modules repo as a submodule to server

Prosody modules repo is in mercurial not git. Could document what modules are needed and install them with the plugin installer CI or something maybe if you object to having local copies of the ones we need.

sonnyp · 2024-12-19T23:44:40Z

packages/connection/index.js

@@ -263,6 +263,9 @@ class Connection extends EventEmitter {
      this.socket.secure() &&
      (this.streamFrom || this.jid)
    ) {
+      // When the stream is secure there is no leak to setting the stream from


there is no leak to setting the stream from

Needs clarification

and a reference to the spec 🙏

What kind of clarification would you like for that?

Spec reference:

However, if the client knows the XMPP identity then it SHOULD include the 'from' attribute after the confidentiality and integrity of the stream are protected via TLS or an equivalent security layer.
https://www.rfc-editor.org/rfc/rfc6120.html#section-4.7.1

packages/sasl2/test.js

packages/sasl2/README.md

packages/sasl-ht-sha-256-none/index.js

sonnyp · 2024-12-20T00:39:18Z

packages/sasl-ht-sha-256-none/index.js

+
+Mechanism.prototype.response = (cred) => {
+  this.password = cred.password;
+  const hmac = createHmac("sha256", this.password);


shouldn't password and token be 2 different concepts?

From the point of view of a sasl mechanism it's the same thing. It doesn't know if you're using a token or a password or what, it's just some shared secret string.

sonnyp · 2024-12-20T00:41:10Z

packages/connection/index.js

+      // This is suggested in general and in required for FAST implementations
+      // in particular


Suggested change

// This is suggested in general and in required for FAST implementations

// in particular

// This is recommended in general and required for FAST implementations

I don't see it in the spec

sonnyp · 2024-12-20T00:43:10Z

packages/connection/index.js

+    if (
+      this.socket.secure &&
+      this.socket.secure() &&
+      (this.streamFrom || this.jid)


why do we need a new streamFrom param?

Because we want to set the from on initial connection, before the jid is otherwise known in a c2s case, so it must be provided by the caller. Setting the jid too early causes various parts of the library to assume we have done binding already since that is where that value comes from curretly.

sonnyp · 2024-12-22T12:59:34Z

Update on xmpp.js

migrated test framework from Ava to Jest
migrated from commonjs to ESM (ECMAScript modules)
replaced browserify with rollup (and shaved > 2kb out of the browser bundle)

Update on this PR

merged main and updated to ESM/Jest
replaced in-tree modules with prosodyctl install
moved sasl factory from sasl/sasl2 to @xmpp/client so it can be shared

I'm now considering splitting this PR into multiple parts

sonnyp · 2025-01-05T22:41:44Z

singpolyma force-pushed the sasl2 branch from 516e372 to 91c98c8 Compare November 21, 2023 20:45

singpolyma added 2 commits November 22, 2023 13:55

Include stream from when possible

4c3a481

As reccomended by the RFC

Implement SASL HT-SHA-256-NONE mechanism

3fb0a08

singpolyma force-pushed the sasl2 branch 3 times, most recently from d655154 to 7c6e9c4 Compare November 22, 2023 21:28

singpolyma added 2 commits December 6, 2023 21:54

Implement SASL2 (with optional BIND2 and FAST)

36f543f

Use SASL2 from client

2d3bde9

singpolyma force-pushed the sasl2 branch from 7c6e9c4 to 07a4259 Compare December 7, 2023 02:55

This comment was marked as off-topic.

Sign in to view

singpolyma force-pushed the sasl2 branch from 07a4259 to 9fc9c75 Compare July 3, 2024 14:20

sonnyp reviewed Jul 3, 2024

View reviewed changes

singpolyma added 3 commits July 3, 2024 21:57

Allow other modules to inline into sasl2/bind2

46f3ee6

Inline stream management into sasl2/bind2

917f30b

Add SASL2/BIND2/FAST tests

d9b0711

singpolyma force-pushed the sasl2 branch from 9fc9c75 to d9b0711 Compare July 4, 2024 02:58

sonnyp added 3 commits December 12, 2024 14:23

Merge branch 'main' into sasl2

3477d68

fix eslint

42cccdb

Remove sasl-ht-sha-256-none from @xmpp/client browser

296000d

FAIL ./packages/client/dist/xmpp.min.js: 45.01KB > maxSize 16KB (gzip)

sonnyp reviewed Dec 12, 2024

View reviewed changes

singpolyma added 4 commits December 18, 2024 12:32

Add doc comment to sasl-h2-sha-256-none

b8e0fac

Update sasl2 doc link comment

9f6ad2f

Add explanatory comment about bind2 inline setting to online

675aab9

Explanation of setting stream from

30ca0a7

Workaround for bug in babel-plugin-transform-async-to-promises

f2e29fa

singpolyma added 3 commits December 18, 2024 14:12

Enable SASL2 for test server

2fd7003

e2e tests for bind2 and fast

96d50c8

Fix for 0.12+

faf34ef

singpolyma force-pushed the sasl2 branch from d11f236 to b0adf3d Compare December 18, 2024 19:53

SASL2 et al need prosody trunk

07f4250

singpolyma force-pushed the sasl2 branch from b0adf3d to 07f4250 Compare December 18, 2024 19:57

Enable sasl2 in react-native

069d0f6

sonnyp reviewed Dec 20, 2024

View reviewed changes

sonnyp mentioned this pull request Dec 20, 2024

Prepare migration to ESM #1022

Merged

sonnyp added 10 commits December 21, 2024 16:07

Merge branch 'main' into sasl2

54db23a

fixes

7ce1b2f

Merge branch 'main' into sasl2

21bb7cb

Stop vendoring prosody modules

441efe0

Merge branch 'main' into sasl2

ca6b6f5

Address some review comments

e37dfbf

f

c5645bc

Fix CI install modules

195cda5

Remove sasl2 SASLError

2e1782f

Move sasl factory to client

c7e17c9

add make e2e with prosody modules install

9973b6f

sonnyp mentioned this pull request Dec 22, 2024

Implement SASL2 #1030

Merged

sonnyp mentioned this pull request Dec 29, 2024

client: Include from in the stream opening and stop resetting jid on disconnect #1039

Merged

sonnyp closed this Jan 5, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement SASL2, BIND2, and FAST #1006

Implement SASL2, BIND2, and FAST #1006

singpolyma commented Nov 21, 2023 •

edited by sonnyp

Loading

This comment was marked as off-topic.

sonnyp commented Dec 16, 2023

singpolyma commented Jun 19, 2024

sonnyp left a comment

singpolyma commented Jul 4, 2024

sonnyp left a comment

sonnyp Dec 12, 2024

singpolyma Dec 18, 2024

sonnyp Dec 19, 2024

sonnyp Dec 12, 2024

singpolyma Dec 18, 2024

sonnyp Dec 12, 2024

singpolyma Dec 18, 2024

Neustradamus commented Dec 13, 2024

singpolyma commented Dec 18, 2024

singpolyma commented Dec 18, 2024

Neustradamus commented Dec 18, 2024

sonnyp Dec 19, 2024

sonnyp Dec 20, 2024

singpolyma Dec 20, 2024

sonnyp Dec 19, 2024

singpolyma Dec 20, 2024

singpolyma Dec 20, 2024

sonnyp Dec 20, 2024

singpolyma Dec 20, 2024

sonnyp Dec 20, 2024

sonnyp Dec 20, 2024

sonnyp Dec 20, 2024

singpolyma Dec 20, 2024

sonnyp commented Dec 22, 2024

sonnyp commented Jan 5, 2025

		// This is suggested in general and in required for FAST implementations
		// in particular

	// This is suggested in general and in required for FAST implementations
	// in particular
	// This is recommended in general and required for FAST implementations

Implement SASL2, BIND2, and FAST #1006

Implement SASL2, BIND2, and FAST #1006

Conversation

singpolyma commented Nov 21, 2023 • edited by sonnyp Loading

This comment was marked as off-topic.

sonnyp commented Dec 16, 2023

singpolyma commented Jun 19, 2024

sonnyp left a comment

Choose a reason for hiding this comment

singpolyma commented Jul 4, 2024

sonnyp left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Neustradamus commented Dec 13, 2024

singpolyma commented Dec 18, 2024

singpolyma commented Dec 18, 2024

Neustradamus commented Dec 18, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sonnyp commented Dec 22, 2024

sonnyp commented Jan 5, 2025

singpolyma commented Nov 21, 2023 •

edited by sonnyp

Loading