Implement SASL2, BIND2, and FAST #1006

singpolyma · 2023-11-21T20:20:50Z

Depends on #1030

As reccomended by the RFC

sonnyp · 2023-12-16T23:38:22Z

Thanks! I will get around to fixing CI and reviewing once I have a bit of time.

singpolyma · 2024-06-19T14:54:20Z

Not to be a pain, but any chance to get this looked at? Thanks :)

sonnyp

Hey thanks for this!

could you add tests? check the other similar modules

e2e tests would be needed as well

CI is broken but I can have a look eventually - let me know if you have troubles running tests locally but a fix would be awesome

singpolyma · 2024-07-04T02:58:27Z

@sonnyp tests added

FAIL ./packages/client/dist/xmpp.min.js: 45.01KB > maxSize 16KB (gzip)

sonnyp

I fixed CI and merged main into this. Plus a couple of minor changes, please see my commits

Please add end2end tests. See test/

You'll need to enable sasl2, bind2, fast in our Prosody (see server/) somehow so that tests that make use of it can be added.

End to end tests can be run with make ci

packages/sasl-ht-sha-256-none/index.js

packages/sasl2/index.js

sonnyp · 2024-12-12T13:34:57Z

packages/sasl2/lib/SASLError.js

+  }
+}
+
+module.exports = SASLError;


either this is different from SASLError or it uses the one from the @xmpp/saslerror package

I don't see such a package?

sorry I meant form the @xmpp/sasl package

sonnyp · 2024-12-12T13:35:45Z

packages/stream-features/route.js

-    if (!prevent && entity.jid) entity._status("online", entity.jid);
+    if (!prevent && entity.jid && entity.status !== "online") {
+      entity._status("online", entity.jid);
+    }


Added comment to explain: BIND2 inline handler may have already set to online, eg inline SM resum

sonnyp · 2024-12-12T13:36:42Z

packages/connection/index.js

+    if (
+      this.socket.secure &&
+      this.socket.secure() &&
+      (this.streamFrom || this.jid)
+    ) {
+      headerElement.attrs.from = (this.streamFrom || this.jid).toString();
+    }


added comment to explain:
When the stream is secure there is no leak to setting the stream from
This is suggested in general and in required for FAST implementations
in particular

singpolyma · 2024-12-18T17:44:24Z

Why removing the new sasl mechanism from browser? That's the main place I'm using it

singpolyma · 2024-12-18T20:02:05Z

@sonnyp e2e tests added and they work locally and in CI (that one CI failure looks like a hiccup to me but I don't have permission to ask it to rerun I guess)

sonnyp · 2024-12-19T23:40:40Z

server/modules/mod_sasl2_bind2.lua

+	if csi_state_tag then
+		session.state = csi_state_tag.name;
+	end
+end, 10);


aren't these available on prosody-trunk ?

I don't want to manage in tree prosody modules

we could add the prosody modules repo as a submodule to server

Prosody modules repo is in mercurial not git. Could document what modules are needed and install them with the plugin installer CI or something maybe if you object to having local copies of the ones we need.

sonnyp · 2024-12-19T23:44:40Z

packages/connection/index.js

      this.socket.secure() &&
      (this.streamFrom || this.jid)
    ) {
+      // When the stream is secure there is no leak to setting the stream from


there is no leak to setting the stream from

Needs clarification

and a reference to the spec 🙏

What kind of clarification would you like for that?

Spec reference:

However, if the client knows the XMPP identity then it SHOULD include the 'from' attribute after the confidentiality and integrity of the stream are protected via TLS or an equivalent security layer.
https://www.rfc-editor.org/rfc/rfc6120.html#section-4.7.1

packages/sasl2/test.js

packages/sasl2/README.md

packages/sasl-ht-sha-256-none/index.js

sonnyp · 2024-12-20T00:39:18Z

packages/sasl-ht-sha-256-none/index.js

+
+Mechanism.prototype.response = (cred) => {
+  this.password = cred.password;
+  const hmac = createHmac("sha256", this.password);


shouldn't password and token be 2 different concepts?

From the point of view of a sasl mechanism it's the same thing. It doesn't know if you're using a token or a password or what, it's just some shared secret string.

sonnyp · 2024-12-20T00:41:10Z

packages/connection/index.js

+      // This is suggested in general and in required for FAST implementations
+      // in particular


Suggested change

// This is suggested in general and in required for FAST implementations

// in particular

// This is recommended in general and required for FAST implementations

I don't see it in the spec

sonnyp · 2024-12-20T00:43:10Z

packages/connection/index.js

+    if (
+      this.socket.secure &&
+      this.socket.secure() &&
+      (this.streamFrom || this.jid)


why do we need a new streamFrom param?

Because we want to set the from on initial connection, before the jid is otherwise known in a c2s case, so it must be provided by the caller. Setting the jid too early causes various parts of the library to assume we have done binding already since that is where that value comes from curretly.

sonnyp · 2024-12-22T12:59:34Z

Update on xmpp.js

migrated test framework from Ava to Jest
migrated from commonjs to ESM (ECMAScript modules)
replaced browserify with rollup (and shaved > 2kb out of the browser bundle)

Update on this PR

merged main and updated to ESM/Jest
replaced in-tree modules with prosodyctl install
moved sasl factory from sasl/sasl2 to @xmpp/client so it can be shared

I'm now considering splitting this PR into multiple parts

sonnyp · 2025-01-05T22:41:44Z

singpolyma force-pushed the sasl2 branch from 516e372 to 91c98c8 Compare November 21, 2023 20:45

singpolyma added 2 commits November 22, 2023 13:55

Include stream from when possible

4c3a481

As reccomended by the RFC

Implement SASL HT-SHA-256-NONE mechanism

3fb0a08

singpolyma force-pushed the sasl2 branch 3 times, most recently from d655154 to 7c6e9c4 Compare November 22, 2023 21:28

singpolyma added 2 commits December 6, 2023 21:54

Implement SASL2 (with optional BIND2 and FAST)

36f543f

Use SASL2 from client

2d3bde9

singpolyma force-pushed the sasl2 branch from 7c6e9c4 to 07a4259 Compare December 7, 2023 02:55

This comment was marked as off-topic.

Sign in to view

singpolyma force-pushed the sasl2 branch from 07a4259 to 9fc9c75 Compare July 3, 2024 14:20

sonnyp reviewed Jul 3, 2024

View reviewed changes

singpolyma added 3 commits July 3, 2024 21:57

Allow other modules to inline into sasl2/bind2

46f3ee6

Inline stream management into sasl2/bind2

917f30b

Add SASL2/BIND2/FAST tests

d9b0711

singpolyma force-pushed the sasl2 branch from 9fc9c75 to d9b0711 Compare July 4, 2024 02:58

sonnyp added 3 commits December 12, 2024 14:23

Merge branch 'main' into sasl2

3477d68

fix eslint

42cccdb

Remove sasl-ht-sha-256-none from @xmpp/client browser

296000d

FAIL ./packages/client/dist/xmpp.min.js: 45.01KB > maxSize 16KB (gzip)

sonnyp reviewed Dec 12, 2024

View reviewed changes

This comment was marked as abuse.

Sign in to view

singpolyma added 4 commits December 18, 2024 12:32

Add doc comment to sasl-h2-sha-256-none

b8e0fac

Update sasl2 doc link comment

9f6ad2f

Add explanatory comment about bind2 inline setting to online

675aab9

Explanation of setting stream from

30ca0a7

Workaround for bug in babel-plugin-transform-async-to-promises

f2e29fa

singpolyma added 3 commits December 18, 2024 14:12

Enable SASL2 for test server

2fd7003

e2e tests for bind2 and fast

96d50c8

Fix for 0.12+

faf34ef

singpolyma force-pushed the sasl2 branch from d11f236 to b0adf3d Compare December 18, 2024 19:53

SASL2 et al need prosody trunk

07f4250

singpolyma force-pushed the sasl2 branch from b0adf3d to 07f4250 Compare December 18, 2024 19:57

This comment was marked as abuse.

Sign in to view

Enable sasl2 in react-native

069d0f6

sonnyp reviewed Dec 20, 2024

View reviewed changes

sonnyp mentioned this pull request Dec 20, 2024

Prepare migration to ESM #1022

Merged

sonnyp added 10 commits December 21, 2024 16:07

Merge branch 'main' into sasl2

54db23a

fixes

7ce1b2f

Merge branch 'main' into sasl2

21bb7cb

Stop vendoring prosody modules

441efe0

Merge branch 'main' into sasl2

ca6b6f5

Address some review comments

e37dfbf

f

c5645bc

Fix CI install modules

195cda5

Remove sasl2 SASLError

2e1782f

Move sasl factory to client

c7e17c9

add make e2e with prosody modules install

9973b6f

sonnyp mentioned this pull request Dec 22, 2024

Implement SASL2 #1030

Merged

sonnyp mentioned this pull request Dec 29, 2024

client: Include from in the stream opening and stop resetting jid on disconnect #1039

Merged

sonnyp closed this Jan 5, 2025

Neustradamus mentioned this pull request Jan 21, 2025

Status of project? #1032

Closed

kousu mentioned this pull request May 31, 2025

Support XEP-0484: Fast Authentication Streamlining Tokens conversejs/converse.js#3144

Open

		// This is suggested in general and in required for FAST implementations
		// in particular

	// This is suggested in general and in required for FAST implementations
	// in particular
	// This is recommended in general and required for FAST implementations

Implement SASL2, BIND2, and FAST #1006

Implement SASL2, BIND2, and FAST #1006

Uh oh!

Conversation

singpolyma commented Nov 21, 2023 • edited by sonnyp Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as off-topic.

sonnyp commented Dec 16, 2023

Uh oh!

singpolyma commented Jun 19, 2024

Uh oh!

sonnyp left a comment

Choose a reason for hiding this comment

Uh oh!

singpolyma commented Jul 4, 2024

Uh oh!

sonnyp left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment was marked as abuse.

singpolyma commented Dec 18, 2024

Uh oh!

singpolyma commented Dec 18, 2024

Uh oh!

This comment was marked as abuse.

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonnyp commented Dec 22, 2024

Uh oh!

sonnyp commented Jan 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

singpolyma commented Nov 21, 2023 •

edited by sonnyp

Loading