diaspora-vines 0.1.2

data/lib/vines/stream/http.rb

@@ -0,0 +1,157 @@
+# encoding: UTF-8
+
+module Vines
+  class Stream
+    class Http < Client
+      attr_accessor :session
+
+      def initialize(config)
+        super
+        @session = Http::Session.new(self)
+      end
+
+      # Override +Stream#create_parser+ to provide an HTTP parser rather than
+      # a Nokogiri XML parser.
+      def create_parser
+        @parser = ::Http::Parser.new.tap do |p|
+          body = ''
+          p.on_body = proc {|data| body << data }
+          p.on_message_complete = proc {
+            process_request(Request.new(self, @parser, body))
+            body = ''
+          }
+        end
+      end
+
+      # If the session ID is valid, switch this stream's session to the new
+      # ID and return true. Some clients, like Google Chrome, reuse one stream
+      # for multiple sessions.
+      def valid_session?(sid)
+        if session = Sessions[sid]
+          @session = session
+        end
+        !!session
+      end
+
+      %w[max_stanza_size max_resources_per_account bind root].each do |name|
+        define_method name do |*args|
+          config[:http].send(name, *args)
+        end
+      end
+
+      def process_request(request)
+        if request.path == self.bind && request.options?
+          request.reply_to_options
+        elsif request.path == self.bind
+          body = Nokogiri::XML(request.body).root
+          if session = Sessions[body['sid']]
+            @session = session
+          else
+            @session = Http::Session.new(self)
+          end
+          @session.request(request)
+          @nodes.push(body)
+        else
+          request.reply_with_file(self.root)
+        end
+      end
+
+      # Alias the Stream#write method before overriding it so we can call
+      # it later from a Session instance.
+      alias :stream_write :write
+
+      # Override Stream#write to queue stanzas rather than immediately writing
+      # to the stream. Stanza responses must be paired with a queued request.
+      def write(data)
+        @session.write(data)
+      end
+
+      # Return an array of Node objects inside the body element.
+      # TODO This parses the XML again just to strip namespaces. Figure out
+      # Nokogiri namespace handling instead.
+      def parse_body(body)
+        body.namespace = nil
+        body.elements.map do |node|
+          Nokogiri::XML(node.to_s.sub(' xmlns="jabber:client"', '')).root
+        end
+      end
+
+      def start(node)
+        domain, type, hold, wait, rid = %w[to content hold wait rid].map {|a| (node[a] || '').strip }
+        version = node.attribute_with_ns('version', NAMESPACES[:bosh]).value rescue nil
+
+        @session.inactivity = 20
+        @session.domain = domain
+        @session.content_type = type unless type.empty?
+        @session.hold = hold.to_i unless hold.empty?
+        @session.wait = wait.to_i unless wait.empty?
+
+        raise StreamErrors::UndefinedCondition.new('rid required') if rid.empty?
+        raise StreamErrors::UnsupportedVersion unless version == '1.0'
+        raise StreamErrors::ImproperAddressing unless valid_address?(domain)
+        raise StreamErrors::HostUnknown unless config.vhost?(domain)
+        raise StreamErrors::InvalidNamespace unless node.namespaces['xmlns'] == NAMESPACES[:http_bind]
+
+        Sessions[@session.id] = @session
+        send_stream_header
+      end
+
+      def terminate
+        doc = Nokogiri::XML::Document.new
+        node = doc.create_element('body',
+          'type'  => 'terminate',
+          'xmlns' => NAMESPACES[:http_bind])
+        @session.reply(node)
+        close_stream
+      end
+
+      private
+
+      def send_stream_header
+        doc = Nokogiri::XML::Document.new
+        node = doc.create_element('body',
+          'charsets'     => 'UTF-8',
+          'from'         => @session.domain,
+          'hold'         => @session.hold,
+          'inactivity'   => @session.inactivity,
+          'polling'      => '5',
+          'requests'     => '2',
+          'sid'          => @session.id,
+          'ver'          => '1.6',
+          'wait'         => @session.wait,
+          'xmpp:version' => '1.0',
+          'xmlns'        => NAMESPACES[:http_bind],
+          'xmlns:xmpp'   => NAMESPACES[:bosh],
+          'xmlns:stream' => NAMESPACES[:stream])
+
+        node << doc.create_element('stream:features') do |el|
+          el << doc.create_element('mechanisms') do |mechanisms|
+            mechanisms.default_namespace = NAMESPACES[:sasl]
+            mechanisms << doc.create_element('mechanism', 'PLAIN')
+          end
+        end
+        @session.reply(node)
+      end
+
+      # Override +Stream#send_stream_error+ to wrap the error XML in a BOSH
+      # terminate body tag.
+      def send_stream_error(e)
+        doc = Nokogiri::XML::Document.new
+        node = doc.create_element('body',
+          'condition'    => 'remote-stream-error',
+          'type'         => 'terminate',
+          'xmlns'        => NAMESPACES[:http_bind],
+          'xmlns:stream' => NAMESPACES[:stream])
+        node.inner_html = e.to_xml
+        @session.reply(node)
+      end
+
+      # Override +Stream#close_stream+ to simply close the connection without
+      # writing a closing stream tag.
+      def close_stream
+        close_connection_after_writing
+        @session.close
+      end
+    end
+  end
+end

data/lib/vines/stream/parser.rb

@@ -0,0 +1,79 @@
+# encoding: UTF-8
+
+module Vines
+  class Stream
+    class Parser < Nokogiri::XML::SAX::Document
+      include Nokogiri::XML
+      STREAM_NAME = 'stream'.freeze
+      STREAM_URI  = 'http://etherx.jabber.org/streams'.freeze
+      IGNORE = NAMESPACES.values_at(:client, :component, :server)
+
+      def initialize(&block)
+        @listeners, @node = Hash.new {|h, k| h[k] = []}, nil
+        @parser = Nokogiri::XML::SAX::PushParser.new(self)
+        instance_eval(&block) if block
+      end
+
+      [:stream_open, :stream_close, :stanza].each do |name|
+        define_method(name) do |&block|
+          @listeners[name] << block
+        end
+      end
+
+      def <<(data)
+        @parser << data
+        self
+      end
+
+      def start_element_namespace(name, attrs=[], prefix=nil, uri=nil, ns=[])
+        el = node(name, attrs, prefix, uri, ns)
+        if stream?(name, uri)
+          notify(:stream_open, el)
+        else
+          @node << el if @node
+          @node = el
+        end
+      end
+
+      def end_element_namespace(name, prefix=nil, uri=nil)
+        if stream?(name, uri)
+          notify(:stream_close)
+        elsif @node.parent != @node.document
+          @node = @node.parent
+        else
+          notify(:stanza, @node)
+          @node = nil
+        end
+      end
+
+      def characters(chars)
+        @node << Text.new(chars, @node.document) if @node
+      end
+      alias :cdata_block :characters
+
+      private
+
+      def notify(msg, node=nil)
+        @listeners[msg].each do |b|
+          (node ? b.call(node) : b.call) rescue nil
+        end
+      end
+
+      def stream?(name, uri)
+        name == STREAM_NAME && uri == STREAM_URI
+      end
+
+      def node(name, attrs=[], prefix=nil, uri=nil, ns=[])
+        ignore = stream?(name, uri) ? [] : IGNORE
+        doc = @node ? @node.document : Document.new
+        node = doc.create_element(name) do |node|
+          attrs.each {|attr| node[attr.localname] = attr.value }
+          ns.each {|prefix, uri| node.add_namespace(prefix, uri) unless ignore.include?(uri) }
+          doc << node unless @node
+        end
+        node.namespace = node.add_namespace(prefix, uri) unless ignore.include?(uri)
+        node
+      end
+    end
+  end
+end

data/lib/vines/stream/sasl.rb

@@ -0,0 +1,128 @@
+# encoding: UTF-8
+
+module Vines
+  class Stream
+    # Provides plain (username/password) and external (TLS certificate) SASL
+    # authentication to client and server streams.
+    class SASL
+      include Vines::Log
+      EMPTY = '='.freeze
+
+      def initialize(stream)
+        @stream = stream
+      end
+
+      # Authenticate server-to-server streams, comparing their domain to their
+      # SSL certificate.
+      #
+      #   http://xmpp.org/extensions/xep-0178.html#s2s
+      #
+      # encoded - The Base64 encoded remote domain name String sent by the
+      #           server stream.
+      #
+      # Returns true if the Base64 encoded domain matches the TLS certificate
+      #   presented earlier in stream negotiation.
+      #
+      # Raises a SaslError if authentication failed.
+      def external_auth(encoded)
+        unless encoded == EMPTY
+          authzid = decode64(encoded)
+          matches_from = (authzid == @stream.remote_domain)
+          raise SaslErrors::InvalidAuthzid unless matches_from
+        end
+        matches_from = @stream.cert_domain_matches?(@stream.remote_domain)
+        matches_from or raise SaslErrors::NotAuthorized
+      end
+
+      # Authenticate client-to-server streams using a username and password.
+      #
+      # encoded - The Base64 encoded jid and password String sent by the
+      #           client stream.
+      #
+      # Returns the authenticated User or raises SaslError if authentication failed.
+      def plain_auth(encoded)
+        jid, password = decode_credentials(encoded)
+        user = authenticate(jid, password)
+        user or raise SaslErrors::NotAuthorized
+      end
+
+      private
+
+      # Storage backends should not raise errors, but if an unexpected error
+      # occurs during authentication, convert it to a temporary-auth-failure.
+      #
+      # jid      - The user's jid String.
+      # password - The String password.
+      #
+      # Returns the authenticated User or nil if authentication failed.
+      #
+      # Raises TemoraryAuthFailure if the storage system failed.
+      def authenticate(jid, password)
+        log.info("Authenticating user: %s" % jid)
+        @stream.storage.authenticate(jid, password).tap do |user|
+          log.info("Authentication succeeded: %s" % user.jid) if user
+        end
+      rescue => e
+        log.error("Failed to authenticate: #{e.to_s}")
+        raise SaslErrors::TemporaryAuthFailure
+      end
+
+      # Return the JID and password decoded from the Base64 encoded SASL PLAIN
+      # credentials formatted as authzid\0authcid\0password.
+      #
+      #   http://tools.ietf.org/html/rfc6120#section-6.3.8
+      #   http://tools.ietf.org/html/rfc4616
+      #
+      # encoded - The Base64 encoded String from which to extract jid and password.
+      #
+      # Returns an Array of jid String and password String.
+      def decode_credentials(encoded)
+        authzid, node, password = decode64(encoded).split("\x00")
+        raise SaslErrors::NotAuthorized if node.nil? || node.empty? || password.nil? || password.empty?
+        jid = JID.new(node, @stream.domain) rescue (raise SaslErrors::NotAuthorized)
+        validate_authzid!(authzid, jid)
+        [jid, password]
+      end
+
+      # An optional SASL authzid allows a user to authenticate with one
+      # user name and password and then have their connection authorized as a
+      # different ID (the authzid). We don't support that, so raise an error if
+      # the authzid is provided and different than the authcid.
+      #
+      # Most clients don't send an authzid at all because it's optional and not
+      # widely supported. However, Strophe and Blather send a bare JID, in
+      # compliance with RFC 6120, but Smack sends just the user name as the
+      # authzid. So, take care to handle non-compliant clients here.
+      #
+      #   http://tools.ietf.org/html/rfc6120#section-6.3.8
+      #
+      # authzid - The authzid String (may be nil).
+      # jid     - The username String.
+      #
+      # Returns nothing.
+      def validate_authzid!(authzid, jid)
+        return if authzid.nil? || authzid.empty?
+        authzid.downcase!
+        smack = authzid == jid.node
+        compliant = authzid == jid.to_s
+        raise SaslErrors::InvalidAuthzid unless compliant || smack
+      end
+
+      # Decode the Base64 encoded string, raising an error for invalid data.
+      #
+      #   http://tools.ietf.org/html/rfc6120#section-13.9.1
+      #
+      # encoded - The Base64 encoded String.
+      #
+      # Returns a UTF-8 String.
+      def decode64(encoded)
+        Base64.strict_decode64(encoded).tap do |decoded|
+          decoded.force_encoding(Encoding::UTF_8)
+          raise SaslErrors::IncorrectEncoding unless decoded.valid_encoding?
+        end
+      rescue
+        raise SaslErrors::IncorrectEncoding
+      end
+    end
+  end
+end

data/lib/vines/stream/server/auth.rb

@@ -0,0 +1,13 @@
+# encoding: UTF-8
+
+module Vines
+  class Stream
+    class Server
+      class Auth < Client::Auth
+        def initialize(stream, success=FinalRestart)
+          super
+        end
+      end
+    end
+  end
+end

data/lib/vines/stream/server/auth_restart.rb

@@ -0,0 +1,13 @@
+# encoding: UTF-8
+
+module Vines
+  class Stream
+    class Server
+      class AuthRestart < Client::AuthRestart
+        def initialize(stream, success=Auth)
+          super
+        end
+      end
+    end
+  end
+end

data/lib/vines/stream/server/final_restart.rb

@@ -0,0 +1,21 @@
+# encoding: UTF-8
+
+module Vines
+  class Stream
+    class Server
+      class FinalRestart < State
+        def initialize(stream, success=Ready)
+          super
+        end
+
+        def node(node)
+          raise StreamErrors::NotAuthorized unless stream?(node)
+          stream.start(node)
+          stream.write('<stream:features/>')
+          stream.router << stream
+          advance
+        end
+      end
+    end
+  end
+end

data/lib/vines/stream/server/outbound/auth.rb

@@ -0,0 +1,31 @@
+# encoding: UTF-8
+
+module Vines
+  class Stream
+    class Server
+      class Outbound
+        class Auth < State
+          NS = NAMESPACES[:sasl]
+
+          def initialize(stream, success=AuthResult)
+            super
+          end
+
+          def node(node)
+            raise StreamErrors::NotAuthorized unless external?(node)
+            authzid = Base64.strict_encode64(stream.domain)
+            stream.write(%Q{<auth xmlns="#{NS}" mechanism="EXTERNAL">#{authzid}</auth>})
+            advance
+          end
+
+          private
+
+          def external?(node)
+            external = node.xpath("ns:mechanisms/ns:mechanism[text()='EXTERNAL']", 'ns' => NS).any?
+            node.name == 'features' && namespace(node) == NAMESPACES[:stream] && external
+          end
+        end
+      end
+    end
+  end
+end

data/lib/vines/stream/server/outbound/auth_restart.rb

@@ -0,0 +1,20 @@
+# encoding: UTF-8
+
+module Vines
+  class Stream
+    class Server
+      class Outbound
+        class AuthRestart < State
+          def initialize(stream, success=Auth)
+            super
+          end
+
+          def node(node)
+            raise StreamErrors::NotAuthorized unless stream?(node)
+            advance
+          end
+        end
+      end
+    end
+  end
+end

data/lib/vines/stream/server/outbound/auth_result.rb

@@ -0,0 +1,32 @@
+# encoding: UTF-8
+
+module Vines
+  class Stream
+    class Server
+      class Outbound
+        class AuthResult < State
+          SUCCESS = 'success'.freeze
+          FAILURE = 'failure'.freeze
+
+          def initialize(stream, success=FinalRestart)
+            super
+          end
+
+          def node(node)
+            raise StreamErrors::NotAuthorized unless namespace(node) == NAMESPACES[:sasl]
+            case node.name
+            when SUCCESS
+              stream.start(node)
+              stream.reset
+              advance
+            when FAILURE
+              stream.close_connection
+            else
+              raise StreamErrors::NotAuthorized
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/vines/stream/server/outbound/final_features.rb

@@ -0,0 +1,28 @@
+# encoding: UTF-8
+
+module Vines
+  class Stream
+    class Server
+      class Outbound
+        class FinalFeatures < State
+          def initialize(stream, success=Server::Ready)
+            super
+          end
+
+          def node(node)
+            raise StreamErrors::NotAuthorized unless empty_features?(node)
+            stream.router << stream
+            advance
+            stream.notify_connected
+          end
+
+          private
+
+          def empty_features?(node)
+            node.name == 'features' && namespace(node) == NAMESPACES[:stream] && node.elements.empty?
+          end
+        end
+      end
+    end
+  end
+end

data/lib/vines/stream/server/outbound/final_restart.rb

@@ -0,0 +1,20 @@
+# encoding: UTF-8
+
+module Vines
+  class Stream
+    class Server
+      class Outbound
+        class FinalRestart < State
+          def initialize(stream, success=FinalFeatures)
+            super
+          end
+
+          def node(node)
+            raise StreamErrors::NotAuthorized unless stream?(node)
+            advance
+          end
+        end
+      end
+    end
+  end
+end

data/lib/vines/stream/server/outbound/start.rb

@@ -0,0 +1,20 @@
+# encoding: UTF-8
+
+module Vines
+  class Stream
+    class Server
+      class Outbound
+        class Start < State
+          def initialize(stream, success=TLS)
+            super
+          end
+
+          def node(node)
+            raise StreamErrors::NotAuthorized unless stream?(node)
+            advance
+          end
+        end
+      end
+    end
+  end
+end

data/lib/vines/stream/server/outbound/tls.rb

@@ -0,0 +1,30 @@
+# encoding: UTF-8
+
+module Vines
+  class Stream
+    class Server
+      class Outbound
+        class TLS < State
+          NS = NAMESPACES[:tls]
+
+          def initialize(stream, success=TLSResult)
+            super
+          end
+
+          def node(node)
+            raise StreamErrors::NotAuthorized unless tls?(node)
+            stream.write("<starttls xmlns='#{NS}'/>")
+            advance
+          end
+
+          private
+
+          def tls?(node)
+            tls = node.xpath('ns:starttls', 'ns' => NS).any?
+            node.name == 'features' && namespace(node) == NAMESPACES[:stream] && tls
+          end
+        end
+      end
+    end
+  end
+end

data/lib/vines/stream/server/outbound/tls_result.rb

@@ -0,0 +1,34 @@
+# encoding: UTF-8
+
+module Vines
+  class Stream
+    class Server
+      class Outbound
+        class TLSResult < State
+          NS      = NAMESPACES[:tls]
+          PROCEED = 'proceed'.freeze
+          FAILURE = 'failure'.freeze
+
+          def initialize(stream, success=AuthRestart)
+            super
+          end
+
+          def node(node)
+            raise StreamErrors::NotAuthorized unless namespace(node) == NS
+            case node.name
+            when PROCEED
+              stream.encrypt
+              stream.start(node)
+              stream.reset
+              advance
+            when FAILURE
+              stream.close_connection
+            else
+              raise StreamErrors::NotAuthorized
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/vines/stream/server/ready.rb

@@ -0,0 +1,24 @@
+# encoding: UTF-8
+
+module Vines
+  class Stream
+    class Server
+      class Ready < State
+        def node(node)
+          stanza = to_stanza(node)
+          raise StreamErrors::UnsupportedStanzaType unless stanza
+          to, from = stanza.validate_to, stanza.validate_from
+          raise StreamErrors::ImproperAddressing unless to && from
+          raise StreamErrors::InvalidFrom unless from.domain == stream.remote_domain
+          raise StreamErrors::HostUnknown unless to.domain == stream.domain
+          stream.user = User.new(jid: from)
+          if stanza.local? || stanza.to_pubsub_domain?
+            stanza.process
+          else
+            stanza.route
+          end
+        end
+      end
+    end
+  end
+end

data/lib/vines/stream/server/start.rb

@@ -0,0 +1,13 @@
+# encoding: UTF-8
+
+module Vines
+  class Stream
+    class Server
+      class Start < Client::Start
+        def initialize(stream, success=TLS)
+          super
+        end
+      end
+    end
+  end
+end

data/lib/vines/stream/server/tls.rb

@@ -0,0 +1,13 @@
+# encoding: UTF-8
+
+module Vines
+  class Stream
+    class Server
+      class TLS < Client::TLS
+        def initialize(stream, success=AuthRestart)
+          super
+        end
+      end
+    end
+  end
+end