Changeset 724 in code for trunk/upstream.go

Timestamp:

Nov 21, 2021, 3:10:54 PM (4 years ago)

Author:

contact

Message:

Add support for post-connection-registration upstream SASL auth

Once the downstream connection has logged in with their bouncer
credentials, allow them to issue more SASL auths which will be
redirected to the upstream network. This allows downstream clients
to provide UIs to login to transparently login to upstream networks.

File:

• trunk/upstream.go (modified) (6 diffs)

trunk/upstream.go

@@ -32 +32 @@
         "message-tags":     true,
         "multi-prefix":     true,
+        "sasl":             true,
         "server-time":      true,
         "setname":          true,
@@ -294 +295 @@
                                         Params:  []string{dc.nick, mask, "End of /WHO"},
                                 })
+                        case "AUTHENTICATE":
+                                dc.endSASL(&irc.Message{
+                                        Prefix:  dc.srv.prefix(),
+                                        Command: irc.ERR_SASLABORTED,
+                                        Params:  []string{dc.nick, "SASL authentication aborted"},
+                                })
                         default:
                                 panic(fmt.Errorf("Unsupported pending command %q", pendingCmd.msg.Command))
@@ -312 +319 @@
 func (uc *upstreamConn) enqueueCommand(dc *downstreamConn, msg *irc.Message) {
         switch msg.Command {
-        case "LIST", "WHO":
+        case "LIST", "WHO", "AUTHENTICATE":
                 // Supported
         default:
@@ -613 +620 @@
                 uc.saslStarted = false
 
-                uc.SendMessage(&irc.Message{
-                        Command: "CAP",
-                        Params:  []string{"END"},
-                })
+                if dc, _ := uc.dequeueCommand("AUTHENTICATE"); dc != nil && dc.sasl != nil {
+                        if msg.Command == irc.RPL_SASLSUCCESS {
+                                uc.network.autoSaveSASLPlain(context.TODO(), dc.sasl.plainUsername, dc.sasl.plainPassword)
+                        }
+
+                        dc.endSASL(msg)
+                }
+
+                if !uc.registered {
+                        uc.SendMessage(&irc.Message{
+                                Command: "CAP",
+                                Params:  []string{"END"},
+                        })
+                }
         case irc.RPL_WELCOME:
                 uc.registered = true
@@ -1705 +1722 @@
         }
 
-        if uc.requestSASL() && !uc.caps["sasl"] {
-                requestCaps = append(requestCaps, "sasl")
-        }
-
         if len(requestCaps) == 0 {
                 return
@@ -1750 +1763 @@
         switch name {
         case "sasl":
+                if !uc.requestSASL() {
+                        return nil
+                }
                 if !ok {
                         uc.logger.Printf("server refused to acknowledge the SASL capability")