Merge pull request #4631 from esl/sasl-channel-binding

Add support for XEP-440

Author: chrzaszcz

big_tests/rebar.config

@@ -13,7 +13,7 @@
         {proper, "1.4.0"},
         {gun, "2.1.0"},
         {fusco, "0.1.1"},
-        {escalus, "4.5.5"},
+        {escalus, "4.5.6"},
         {ranch, "2.2.0"},
         {cowboy, "2.13.0"},
         {csv, "3.0.3", {pkg, csve}},

big_tests/rebar.lock

@@ -10,11 +10,11 @@
  {<<"ct_groups_summary_hook">>,
   {pkg,<<"ct_groups_summary_hook">>,<<"0.1.1">>},
   0},
- {<<"escalus">>,{pkg,<<"escalus">>,<<"4.5.5">>},0},
+ {<<"escalus">>,{pkg,<<"escalus">>,<<"4.5.6">>},0},
  {<<"esip">>,{pkg,<<"esip">>,<<"1.0.57">>},0},
  {<<"exml">>,{pkg,<<"hexml">>,<<"4.1.2">>},0},
  {<<"fast_pbkdf2">>,{pkg,<<"fast_pbkdf2">>,<<"2.0.0">>},2},
- {<<"fast_scram">>,{pkg,<<"fast_scram">>,<<"0.7.0">>},1},
+ {<<"fast_scram">>,{pkg,<<"fast_scram">>,<<"0.7.1">>},1},
  {<<"fast_tls">>,{pkg,<<"fast_tls">>,<<"1.1.22">>},1},
  {<<"fusco">>,{pkg,<<"fusco">>,<<"0.1.1">>},0},
  {<<"gun">>,{pkg,<<"gun">>,<<"2.1.0">>},0},
@@ -42,11 +42,11 @@
  {<<"credentials_obfuscation">>, <<"61E282ADFB4439486B3994FAAEC69543C7EE6CC7E70C6340E8853FD9DEAF8219">>},
  {<<"csv">>, <<"69E7D9B3FDC72016644368762C6A3E6CBFEB85BCCADBF1BD99AB6C827E360E04">>},
  {<<"ct_groups_summary_hook">>, <<"21B94902B6CF2D345F4D790D34B49654E71CB8E570DCCC9C1C3616DAE720A7AA">>},
- {<<"escalus">>, <<"A4B0C297AA7633CF4380090564662F6B24C0E59A4453A8E96B22FE96AA1119F0">>},
+ {<<"escalus">>, <<"054826CE22FA65FEB243107163487AC0A1A6742E4605216DF0C89613FF68033F">>},
  {<<"esip">>, <<"4B14E4832D08B9FFC10D855B5D10B3083232B1D53DEB4C046679496CE85569C4">>},
  {<<"exml">>, <<"4EA6B95AF18922F94FD67BBDEAA325A75CCE04487083C786E7417BA862D590E5">>},
  {<<"fast_pbkdf2">>, <<"72CDEE3C10C6B9B40E31194DE946A883CEEF6CF1F37D7FC9FD1A9D87502723F5">>},
- {<<"fast_scram">>, <<"FAD4DD185E0DEFA34B0E30654AB0CC4048E9324BCF65BB261E0A86BF3C604F9F">>},
+ {<<"fast_scram">>, <<"4A0BB997A7836E44AC9E497D024A960FF9732A738190D1ABA4A02D0C8ABD170C">>},
  {<<"fast_tls">>, <<"44356B256AFAD4399C2FC5059A3066669DAFD8BD4E4E796C9C1CF8910DDD265E">>},
  {<<"fusco">>, <<"3DD6A90151DFEF30EA1937CC44E9A59177C0094918388D9BCAA2F2DC5E2AE4AA">>},
  {<<"gun">>, <<"B4E4CBBF3026D21981C447E9E7CA856766046EFF693720BA43114D7F5DE36E87">>},
@@ -73,11 +73,11 @@
  {<<"credentials_obfuscation">>, <<"843ADBE3246861CE0F1A0FA3222F384834EB31DEFD8D6B9CBA7AFD2977C957BC">>},
  {<<"csv">>, <<"741D1A55AABADAA3E0FE13051050101A73E90C4570B9F9403A939D9546813521">>},
  {<<"ct_groups_summary_hook">>, <<"997CDE48FEB0C398989E4091A341D4FFF43CFA06CDB8FB2E80CC4A0E0362691C">>},
- {<<"escalus">>, <<"C1FFC77E0B1A3FA74DBCCBA7EF66F0AC3B43979A1655AA6F6459FDA32BAC1791">>},
+ {<<"escalus">>, <<"4818627C907ECD557D5162A6FBFE8B6FF6628AD5AC819104CB070E451928B7E0">>},
  {<<"esip">>, <<"19C357E1817B1E04792EF359BF900400F3E6D0E5ADE929FD72F88EA9B44AF2ED">>},
  {<<"exml">>, <<"03883AE3E27970E9DAC204B27CE330B54A6C2772455E43FE2319349DFF40B1DC">>},
  {<<"fast_pbkdf2">>, <<"74159FD09FB8BF5E97D25137C6C83C28E2CF7E97D7C127D83310DFD0904BD732">>},
- {<<"fast_scram">>, <<"39CB1D4C91C99E637E000A3864D274D8A9CB43D86EEC2495FE9546798DBFA015">>},
+ {<<"fast_scram">>, <<"0022597BD143765B3884B64ABF53213DE32B4402F74BD24BFD4CEA9562E07EEF">>},
  {<<"fast_tls">>, <<"E65779AEFB7AB15C4755230FEF8077E687D20CC5A3984A5974F9F657E8E2485B">>},
  {<<"fusco">>, <<"6343551BD1E824F2A6CA85E1158C5B37C320FD449FBFEC7450A73F192AAF9022">>},
  {<<"gun">>, <<"52FC7FC246BFC3B00E01AEA1C2854C70A366348574AB50C57DFE796D24A0101D">>},

big_tests/tests/connect_SUITE.erl

@@ -455,7 +455,7 @@ correct_features_are_advertised_for_optional_starttls(Config) ->
              stream_features,
              {?MODULE, verify_features_with_optional_starttls},
              maybe_use_ssl,
-             {?MODULE, verify_features_without_starttls},
+             {?MODULE, verify_features_with_optional_starttls_post},
              authenticate],
     escalus_connection:start(UserSpec ++ [{ssl_opts, [{verify, verify_none}]}], Steps).
 
@@ -465,7 +465,7 @@ correct_features_are_advertised_for_required_starttls(Config) ->
              stream_features,
              {?MODULE, verify_features_with_required_starttls},
              maybe_use_ssl,
-             {?MODULE, verify_features_without_starttls},
+             {?MODULE, verify_features_with_optional_starttls_post},
              authenticate],
     escalus_connection:start(UserSpec ++ [{ssl_opts, [{verify, verify_none}]}], Steps).
 
@@ -479,6 +479,18 @@ verify_features_with_optional_starttls(Conn, Features) ->
     ?assertMatch({sasl_mechanisms, [_|_]}, get_feature(sasl_mechanisms, Features)),
     {Conn, Features}.
 
+verify_features_with_optional_starttls_post(Conn, Features) ->
+    ?assertEqual({starttls, false}, get_feature(starttls, Features)),
+    {sasl_mechanisms, Mechanisms} = get_feature(sasl_mechanisms, Features),
+    case lists:any(fun(M) -> re:run(M, "-PLUS$") /= nomatch end, Mechanisms) of
+        true ->
+            ?assertEqual({sasl_channel_bindings, [<<"tls-exporter">>]},
+                         get_feature(sasl_channel_bindings, Features));
+        false ->
+            ok
+    end,
+    {Conn, Features}.
+
 verify_features_with_required_starttls(Conn, Features) ->
     AdvertisedFeatures = lists:filter(fun is_present/1, Features),
     ?assertEqual([{starttls, true}], AdvertisedFeatures),

include/mongoose_ns.hrl

@@ -85,6 +85,7 @@
 -define(NS_TLS,                 <<"urn:ietf:params:xml:ns:xmpp-tls">>).
 -define(NS_SASL,                <<"urn:ietf:params:xml:ns:xmpp-sasl">>).
 -define(NS_SASL_2,              <<"urn:xmpp:sasl:2">>).
+-define(NS_SASL_CB,             <<"urn:xmpp:sasl-cb:0">>).
 -define(NS_SESSION,             <<"urn:ietf:params:xml:ns:xmpp-session">>).
 -define(NS_BIND,                <<"urn:ietf:params:xml:ns:xmpp-bind">>).
 -define(NS_BIND_2,              <<"urn:xmpp:bind:0">>).

rebar.config

@@ -59,7 +59,7 @@
 
   %%% Stateless libraries
   {opuntia, "1.1.2"},
-  {fast_scram, "0.7.0"},
+  {fast_scram, "0.7.1"},
   {idna, "6.1.1"},
   {uuid, "2.0.7", {pkg, uuid_erl}},
   {gen_fsm_compat, "0.3.0"},

rebar.lock

@@ -39,7 +39,7 @@
        {ref,"f1c369becb6e57871f1c7b0e491f6c3a302a65ee"}},
   0},
  {<<"fast_pbkdf2">>,{pkg,<<"fast_pbkdf2">>,<<"2.0.0">>},1},
- {<<"fast_scram">>,{pkg,<<"fast_scram">>,<<"0.7.0">>},0},
+ {<<"fast_scram">>,{pkg,<<"fast_scram">>,<<"0.7.1">>},0},
  {<<"flatlog">>,{pkg,<<"flatlog">>,<<"0.1.2">>},0},
  {<<"fusco">>,{pkg,<<"fusco">>,<<"0.1.1">>},0},
  {<<"gen_fsm_compat">>,{pkg,<<"gen_fsm_compat">>,<<"0.3.0">>},0},
@@ -139,7 +139,7 @@
  {<<"erlcloud">>, <<"66DE6C7D37C6E688C7AE198D56B9CBE07B2CB80054B88A798437C533C3C7F418">>},
  {<<"exml">>, <<"4EA6B95AF18922F94FD67BBDEAA325A75CCE04487083C786E7417BA862D590E5">>},
  {<<"fast_pbkdf2">>, <<"72CDEE3C10C6B9B40E31194DE946A883CEEF6CF1F37D7FC9FD1A9D87502723F5">>},
- {<<"fast_scram">>, <<"FAD4DD185E0DEFA34B0E30654AB0CC4048E9324BCF65BB261E0A86BF3C604F9F">>},
+ {<<"fast_scram">>, <<"4A0BB997A7836E44AC9E497D024A960FF9732A738190D1ABA4A02D0C8ABD170C">>},
  {<<"flatlog">>, <<"8C4B81A4931A1396254DBD975B841F4A6350D6F128FF94FFE86799A4451E32B1">>},
  {<<"fusco">>, <<"3DD6A90151DFEF30EA1937CC44E9A59177C0094918388D9BCAA2F2DC5E2AE4AA">>},
  {<<"gen_fsm_compat">>, <<"5903549F67D595F58A7101154CBE0FDD46955FBFBE40813F1E53C23A970FF5F4">>},
@@ -206,7 +206,7 @@
  {<<"erlcloud">>, <<"6ED59CBD8816045765E3E76F22D08118766DF1BB1D24F5D90794C8505BCD6D44">>},
  {<<"exml">>, <<"03883AE3E27970E9DAC204B27CE330B54A6C2772455E43FE2319349DFF40B1DC">>},
  {<<"fast_pbkdf2">>, <<"74159FD09FB8BF5E97D25137C6C83C28E2CF7E97D7C127D83310DFD0904BD732">>},
- {<<"fast_scram">>, <<"39CB1D4C91C99E637E000A3864D274D8A9CB43D86EEC2495FE9546798DBFA015">>},
+ {<<"fast_scram">>, <<"0022597BD143765B3884B64ABF53213DE32B4402F74BD24BFD4CEA9562E07EEF">>},
  {<<"flatlog">>, <<"FDD2A311A67F63F9D0BC194FAD6BEAF9CCCDE8FFFEE2919DF1C4D86098E49984">>},
  {<<"fusco">>, <<"6343551BD1E824F2A6CA85E1158C5B37C320FD449FBFEC7450A73F192AAF9022">>},
  {<<"gen_fsm_compat">>, <<"7153D11BAD328933D4B24E663D8CEC52874E14176C7FB392FA1FF768B17460D9">>},

src/c2s/mongoose_c2s_sasl.erl

@@ -9,6 +9,7 @@
 %% This way, we can decouple SASL from the client process core code.
 %% @end
 -module(mongoose_c2s_sasl).
+-xep([{xep, 440}, {version, "1.0.0"}]).
 
 -include_lib("kernel/include/logger.hrl").
 

src/c2s/mongoose_c2s_stanzas.erl

@@ -61,19 +61,20 @@ stream_features_before_auth(StateData) ->
 determine_features(_, _, _, #{tls := #{mode := starttls_required}}, false) ->
     [starttls_stanza(required)];
 determine_features(StateData, HostType, LServer, #{tls := #{mode := starttls}}, false) ->
-    InitialFeatures = [starttls_stanza(optional) | maybe_sasl_mechanisms(StateData)],
+    InitialFeatures = [starttls_stanza(optional) | maybe_sasl_features(StateData)],
     StreamFeaturesParams = #{c2s_data => StateData, lserver => LServer},
     mongoose_hooks:c2s_stream_features(HostType, StreamFeaturesParams, InitialFeatures);
 determine_features(StateData, HostType, LServer, _, _) ->
-    InitialFeatures = maybe_sasl_mechanisms(StateData),
+    InitialFeatures = maybe_sasl_features(StateData),
     StreamFeaturesParams = #{c2s_data => StateData, lserver => LServer},
     mongoose_hooks:c2s_stream_features(HostType, StreamFeaturesParams, InitialFeatures).
 
--spec maybe_sasl_mechanisms(mongoose_c2s:data()) -> [exml:element()].
-maybe_sasl_mechanisms(StateData) ->
+-spec maybe_sasl_features(mongoose_c2s:data()) -> [exml:element()].
+maybe_sasl_features(StateData) ->
     case mongoose_c2s:get_auth_mechs_to_announce(StateData) of
         [] -> [];
         Mechanisms ->
+            maybe_sasl_channel_bindings(Mechanisms) ++
             [#xmlel{name = <<"mechanisms">>,
                     attrs = #{<<"xmlns">> => ?NS_SASL},
                     children = [ mechanism(M) || M <- Mechanisms ]}]
@@ -83,6 +84,30 @@ maybe_sasl_mechanisms(StateData) ->
 mechanism(M) ->
     #xmlel{name = <<"mechanism">>, children = [#xmlcdata{content = M}]}.
 
+-spec maybe_sasl_channel_bindings([binary()]) -> [exml:element()].
+maybe_sasl_channel_bindings(Mechanisms) ->
+    case determine_channel_bindings(Mechanisms) of
+        [] -> [];
+        Bindings ->
+            [#xmlel{name = <<"sasl-channel-binding">>,
+                    attrs = #{<<"xmlns">> => ?NS_SASL_CB},
+                    children = [ channel_binding(B) || B <- Bindings ]}]
+    end.
+
+determine_channel_bindings(Mechanisms) ->
+    case lists:any(fun(<<"SCRAM-SHA-1-PLUS">>) -> true;
+                      (<<"SCRAM-SHA-", _:3/binary, "-PLUS">>) -> true;
+                      (_) -> false
+                   end, Mechanisms) of
+        true -> [<<"tls-exporter">>];
+        false -> []
+    end.
+
+-spec channel_binding(binary()) -> exml:element().
+channel_binding(B) ->
+    #xmlel{name = <<"channel-binding">>, attrs = #{<<"type">> => B}}.
+
+
 -spec starttls_stanza(required | optional) -> exml:element().
 starttls_stanza(TLSRequired) when TLSRequired =:= required; TLSRequired =:= optional ->
     #xmlel{name = <<"starttls">>,

tools/ssl/openssl-ca.cnf

@@ -10,7 +10,7 @@ default_ca  = CA_default            # The default ca section
 
 [ CA_default ]
 
-default_days        = 1000          # how long to certify for
+default_days        = 825           # how long to certify for
 default_crl_days    = 30            # how long before next CRL
 default_md          = sha256        # use public key default MD
 preserve            = no            # keep passed DN ordering

tools/ssl/openssl-mongooseim.cnf

@@ -22,6 +22,7 @@ commonName                  = MongooseIM
 subjectKeyIdentifier        = hash
 basicConstraints            = CA:FALSE
 keyUsage                    = digitalSignature, keyEncipherment
+extendedKeyUsage            = serverAuth
 subjectAltName              = @alternate_names
 nsComment                   = "Fake Dev-Only Certificate"