Adds scram-sha1 SASL mechanism for mnesia and odbc

Makefile

@@ -21,6 +21,14 @@ clean: rebar
 test: test_deps
 	cd test/ejabberd_tests; make test
 
+quicktest: test_deps
+	cd test/ejabberd_tests; make quicktest
+
+run: deps compile quickrun
+
+quickrun:
+	erl -sname ejabberd -setcookie ejabberd -pa deps/*/ebin apps/*/ebin -config rel/files/app.run.config -s ejabberd -s sync
+
 cover_test: test_deps
 	cd test/ejabberd_tests; make cover_test
 

apps/ejabberd/include/ejabberd.hrl

@@ -37,6 +37,8 @@
 
 %%-define(DBGFSM, true).
 
+-define(SCRAM_DEFAULT_ITERATION_COUNT, 4096).
+
 %% ---------------------------------
 %% Logging mechanism
 
@@ -71,3 +73,12 @@
                           integer_to_binary/1]).
 
 -endif.
+
+
+-record(scram,
+        {storedkey = <<"">>,
+         serverkey = <<"">>,
+         salt = <<"">>,
+         iterationcount = 0 :: integer()}).
+
+-type scram() :: #scram{}.

apps/ejabberd/priv/mysql.sql

@@ -22,6 +22,7 @@
 CREATE TABLE users (
     username varchar(250) PRIMARY KEY,
     password text NOT NULL,
+    pass_details text,
     created_at timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP
 ) CHARACTER SET utf8;
 

apps/ejabberd/priv/pg.sql

@@ -20,6 +20,7 @@
 CREATE TABLE users (
     username text PRIMARY KEY,
     "password" text NOT NULL,
+    pass_details text,
     created_at TIMESTAMP NOT NULL DEFAULT now()
 );
 

apps/ejabberd/src/cyrsasl.erl

@@ -34,7 +34,9 @@
 	 server_start/3,
 	 server_step/2]).
 
--record(sasl_mechanism, {mechanism, module, require_plain_password}).
+-include("ejabberd.hrl").
+
+-record(sasl_mechanism, {mechanism, module, password_type}).
 -record(sasl_state, {service, myname, realm,
 		     get_password, check_password, check_password_digest,
 		     mech_mod, mech_state}).
@@ -52,14 +54,15 @@ start() ->
 			     {keypos, #sasl_mechanism.mechanism}]),
     cyrsasl_plain:start([]),
     cyrsasl_digest:start([]),
+    cyrsasl_scram:start([]),
     cyrsasl_anonymous:start([]),
     ok.
 
-register_mechanism(Mechanism, Module, RequirePlainPassword) ->
+register_mechanism(Mechanism, Module, PasswordType) ->
     ets:insert(sasl_mechanism,
 	       #sasl_mechanism{mechanism = Mechanism,
 			       module = Module,
-			       require_plain_password = RequirePlainPassword}).
+			       password_type = PasswordType}).
 
 %%% TODO: use callbacks
 %%-include("ejabberd.hrl").
@@ -97,17 +100,20 @@ check_credentials(_State, Props) ->
     end.
 
 listmech(Host) ->
-    RequirePlainPassword = ejabberd_auth:plain_password_required(Host),
-
     Mechs = ets:select(sasl_mechanism,
 		       [{#sasl_mechanism{mechanism = '$1',
-					 require_plain_password = '$2',
+					 password_type = '$2',
 					 _ = '_'},
-			 if
-			     RequirePlainPassword ->
-				 [{'==', '$2', false}];
-			     true ->
-				 []
+			 case catch ejabberd_auth:store_type(Host) of
+			 external ->
+			      [{'==', '$2', plain}];
+			 scram ->
+			      [{'/=', '$2', digest}];
+			 {'EXIT',{undef,[{Module,store_type,[]} | _]}} ->
+			      ?WARNING_MSG("~p doesn't implement the function store_type/0", [Module]),
+			      [];
+			 _Else ->
+			      []
 			 end,
 			 ['$1']}]),
     filter_anonymous(Host, Mechs).
@@ -152,6 +158,13 @@ server_step(State, ClientIn) ->
 		{error, Error} ->
 		    {error, Error}
 	    end;
+	{ok, Props, ServerOut} ->
+	    case check_credentials(State, Props) of
+		ok ->
+		    {ok, Props, ServerOut};
+		{error, Error} ->
+		    {error, Error}
+	    end;
 	{continue, ServerOut, NewMechState} ->
 	    {continue, ServerOut,
 	     State#sasl_state{mech_state = NewMechState}};

apps/ejabberd/src/cyrsasl_anonymous.erl

@@ -34,7 +34,7 @@
 -record(state, {server}).
 
 start(_Opts) ->
-    cyrsasl:register_mechanism(<<"ANONYMOUS">>, ?MODULE, false),
+    cyrsasl:register_mechanism(<<"ANONYMOUS">>, ?MODULE, plain),
     ok.
 
 stop() ->
@@ -47,7 +47,7 @@ mech_step(State, _ClientIn) ->
     %% We generate a random username:
     User = list_to_binary(lists:concat([randoms:get_string() | tuple_to_list(now())])),
     Server = State#state.server,
-    
+
     %% Checks that the username is available
     case ejabberd_auth:is_user_exists(User, Server) of
 	true  -> {error, <<"not-authorized">>};

apps/ejabberd/src/cyrsasl_digest.erl

@@ -40,7 +40,7 @@
 		host}).
 
 start(_Opts) ->
-    cyrsasl:register_mechanism(<<"DIGEST-MD5">>, ?MODULE, true).
+    cyrsasl:register_mechanism(<<"DIGEST-MD5">>, ?MODULE, digest).
 
 stop() ->
     ok.

apps/ejabberd/src/cyrsasl_plain.erl

@@ -34,7 +34,7 @@
 -record(state, {check_password}).
 
 start(_Opts) ->
-    cyrsasl:register_mechanism(<<"PLAIN">>, ?MODULE, false),
+    cyrsasl:register_mechanism(<<"PLAIN">>, ?MODULE, plain),
     ok.
 
 stop() ->
@@ -46,7 +46,7 @@ mech_new(_Host, _GetPassword, CheckPassword, _CheckPasswordDigest) ->
 mech_step(State, ClientIn) ->
     case prepare(ClientIn) of
 	[AuthzId, User, Password] ->
-	    case (State#state.check_password)(User, 
+	    case (State#state.check_password)(User,
                                           Password
                                          ) of
 		{true, AuthModule} ->
@@ -65,8 +65,8 @@ prepare(ClientIn) ->
 	    case parse_domain(UserMaybeDomain) of
 		%% <NUL>login@domain<NUL>pwd
 		[User, _Domain] ->
-		    [UserMaybeDomain, 
-             User, 
+		    [UserMaybeDomain,
+             User,
              Password];
 		%% <NUL>login<NUL>pwd
 		[User] ->