vines 0.2.1 → 0.3.0

data/lib/vines/storage/couchdb.rb

@@ -23,7 +23,7 @@ module Vines
       end
 
       def find_user(jid)
-        jid = JID.new(jid || '').bare.to_s
+        jid = JID.new(jid).bare.to_s
         if jid.empty? then yield; return end
         get("user:#{jid}") do |doc|
           user = if doc && doc['type'] == 'User'
@@ -61,7 +61,7 @@ module Vines
       fiber :save_user
 
       def find_vcard(jid)
-        jid = JID.new(jid || '').bare.to_s
+        jid = JID.new(jid).bare.to_s
         if jid.empty? then yield; return end
         get("vcard:#{jid}") do |doc|
           card = if doc && doc['type'] == 'Vcard'
@@ -85,7 +85,7 @@ module Vines
       fiber :save_vcard
 
       def find_fragment(jid, node)
-        jid = JID.new(jid || '').bare.to_s
+        jid = JID.new(jid).bare.to_s
         if jid.empty? then yield; return end
         get(fragment_id(jid, node)) do |doc|
           fragment = if doc && doc['type'] == 'Fragment'

data/lib/vines/storage/ldap.rb

@@ -9,8 +9,8 @@ module Vines
     # information.
     class Ldap
       @@required = [:host, :port]
-      %w[tls dn password basedn object_class user_attr name_attr].each do |name|
-        @@required << name.to_sym
+      %w[tls dn password basedn object_class user_attr name_attr groupdn].each do |name|
+        @@required << name.to_sym unless name == 'groupdn'
         define_method name do |*args|
           @config[name.to_sym] = args.first
         end
@@ -28,13 +28,10 @@ module Vines
       def authenticate(username, password)
         return if [username, password].any? {|arg| (arg || '').strip.empty? }
 
-        clas = Net::LDAP::Filter.eq('objectClass', @config[:object_class])
-        uid = Net::LDAP::Filter.eq(@config[:user_attr], username)
-        filter = clas & uid
-        attrs = [@config[:name_attr], 'mail']
-
         ldap = connect(@config[:dn], @config[:password])
-        entries = ldap.search(:attributes => attrs, :filter => filter)
+        entries = ldap.search(
+          :attributes => [@config[:name_attr], 'mail'],
+          :filter => filter(username))
         return unless entries && entries.size == 1
 
         user = if connect(entries.first.dn, password).bind
@@ -44,6 +41,20 @@ module Vines
         user
       end
 
+      # Return an LDAP search filter for a user optionally belonging to the
+      # group defined by the groupdn config attribute.
+      def filter(username)
+        clas = Net::LDAP::Filter.eq('objectClass', @config[:object_class])
+        uid = Net::LDAP::Filter.eq(@config[:user_attr], username)
+        filter = clas & uid
+        if group = @config[:groupdn]
+          memberOf = Net::LDAP::Filter.eq('memberOf', group)
+          isMemberOf = Net::LDAP::Filter.eq('isMemberOf', group)
+          filter = filter & (memberOf | isMemberOf)
+        end
+        filter
+      end
+
       private
 
       def connect(dn, password)

data/lib/vines/storage/local.rb

@@ -20,8 +20,8 @@ module Vines
       end
 
       def find_user(jid)
-        jid = JID.new(jid || '').bare.to_s
-        file = File.join(@dir, "#{jid}.user") unless jid.empty?
+        jid = JID.new(jid).bare.to_s
+        file = absolute_path("#{jid}.user") unless jid.empty?
         record = YAML.load_file(file) rescue nil
         return User.new(:jid => jid).tap do |user|
           user.name, user.password = record.values_at('name', 'password')
@@ -41,44 +41,55 @@ module Vines
         user.roster.each do |contact|
           record['roster'][contact.jid.bare.to_s] = contact.to_h
         end
-        file = File.join(@dir, "#{user.jid.bare.to_s}.user")
-        File.open(file, 'w') do |f|
+        save("#{user.jid.bare.to_s}.user") do |f|
           YAML.dump(record, f)
         end
       end
 
       def find_vcard(jid)
-        jid = JID.new(jid || '').bare.to_s
+        jid = JID.new(jid).bare.to_s
         return if jid.empty?
-        file = File.join(@dir, "#{jid}.vcard")
+        file = absolute_path("#{jid}.vcard")
         Nokogiri::XML(File.read(file)).root rescue nil
       end
 
       def save_vcard(jid, card)
         jid = JID.new(jid).bare.to_s
-        file = File.join(@dir, "#{jid}.vcard")
-        File.open(file, 'w') do |f|
+        return if jid.empty?
+        save("#{jid}.vcard") do |f|
           f.write(card.to_xml)
         end
       end
 
       def find_fragment(jid, node)
-        jid = JID.new(jid || '').bare.to_s
+        jid = JID.new(jid).bare.to_s
         return if jid.empty?
-        file = File.join(@dir, fragment_id(jid, node))
+        file = absolute_path(fragment_id(jid, node))
         Nokogiri::XML(File.read(file)).root rescue nil
       end
 
       def save_fragment(jid, node)
         jid = JID.new(jid).bare.to_s
-        file = File.join(@dir, fragment_id(jid, node))
-        File.open(file, 'w') do |f|
+        return if jid.empty?
+        save(fragment_id(jid, node)) do |f|
           f.write(node.to_xml)
         end
       end
 
       private
 
+      def absolute_path(file)
+        File.expand_path(file, @dir).tap do |absolute|
+          raise 'path traversal' unless File.dirname(absolute) == @dir
+        end
+      end
+
+      def save(file)
+        file = absolute_path(file)
+        File.open(file, 'w') {|f| yield f }
+        File.chmod(0600, file)
+      end
+
       def fragment_id(jid, node)
         id = Digest::SHA1.hexdigest("#{node.name}:#{node.namespace.href}")
         "#{jid}-#{id}.fragment"

data/lib/vines/storage/redis.rb

@@ -22,7 +22,7 @@ module Vines
       end
 
       def find_user(jid)
-        jid = JID.new(jid || '').bare.to_s
+        jid = JID.new(jid).bare.to_s
         if jid.empty? then yield; return end
         find_roster(jid) do |contacts|
           redis.get("user:#{jid}") do |response|
@@ -53,7 +53,7 @@ module Vines
       fiber :save_user
 
       def find_vcard(jid)
-        jid = JID.new(jid || '').bare.to_s
+        jid = JID.new(jid).bare.to_s
         if jid.empty? then yield; return end
         redis.get("vcard:#{jid}") do |response|
           card = if response
@@ -75,7 +75,7 @@ module Vines
       fiber :save_vcard
 
       def find_fragment(jid, node)
-        jid = JID.new(jid || '').bare.to_s
+        jid = JID.new(jid).bare.to_s
         if jid.empty? then yield; return end
         redis.hget("fragments:#{jid}", fragment_id(node)) do |response|
           fragment = if response

data/lib/vines/storage/sql.rb

@@ -40,7 +40,7 @@ module Vines
       def find_user(jid)
         ActiveRecord::Base.clear_reloadable_connections!
 
-        jid = JID.new(jid || '').bare.to_s
+        jid = JID.new(jid).bare.to_s
         return if jid.empty?
         xuser = user_by_jid(jid)
         return Vines::User.new(:jid => jid).tap do |user|
@@ -99,7 +99,7 @@ module Vines
       def find_vcard(jid)
         ActiveRecord::Base.clear_reloadable_connections!
 
-        jid = JID.new(jid || '').bare.to_s
+        jid = JID.new(jid).bare.to_s
         return if jid.empty?
         if xuser = user_by_jid(jid)
           Nokogiri::XML(xuser.vcard).root rescue nil
@@ -121,7 +121,7 @@ module Vines
       def find_fragment(jid, node)
         ActiveRecord::Base.clear_reloadable_connections!
 
-        jid = JID.new(jid || '').bare.to_s
+        jid = JID.new(jid).bare.to_s
         return if jid.empty?
         if fragment = fragment_by_jid(jid, node)
           Nokogiri::XML(fragment.xml).root rescue nil
@@ -151,7 +151,7 @@ module Vines
 
         ActiveRecord::Schema.define do
           create_table :users, :force => args[:force] do |t|
-            t.string :jid,      :limit => 1000, :null => false
+            t.string :jid,      :limit => 2048, :null => false
             t.string :name,     :limit => 1000, :null => true
             t.string :password, :limit => 1000, :null => true
             t.text   :vcard,    :null => true
@@ -160,7 +160,7 @@ module Vines
 
           create_table :contacts, :force => args[:force] do |t|
             t.integer :user_id,      :null => false
-            t.string  :jid,          :limit => 1000, :null => false
+            t.string  :jid,          :limit => 2048, :null => false
             t.string  :name,         :limit => 1000, :null => true
             t.string  :ask,          :limit => 1000, :null => true
             t.string  :subscription, :limit => 1000, :null => false

data/lib/vines/stream.rb

@@ -10,26 +10,36 @@ module Vines
     ERROR = 'error'.freeze
     PAD   = 20
 
-    attr_reader   :domain
+    attr_reader   :config, :domain
     attr_accessor :user
 
+    def initialize(config)
+      @config = config
+    end
+
     def post_init
       router << self
       @remote_addr, @local_addr = addresses
       @user, @closed, @stanza_size = nil, false, 0
       @bucket = TokenBucket.new(100, 10)
       @store = Store.new
-
       @nodes = EM::Queue.new
       process_node_queue
+      create_parser
+      log.info { "%s %21s -> %s" %
+        ['Stream connected:'.ljust(PAD), @remote_addr, @local_addr] }
+    end
 
+    # Initialize a new XML parser for this connection. This is called when the
+    # stream is first connected as well as for stream restarts during
+    # negotiation. Subclasses can override this method to provide a different
+    # type of parser (e.g. HTTP).
+    def create_parser
       @parser = Parser.new.tap do |p|
         p.stream_open {|node| @nodes.push(node) }
         p.stream_close { close_connection }
         p.stanza {|node| @nodes.push(node) }
       end
-      log.info { "%s %21s -> %s" %
-        ['Stream connected:'.ljust(PAD), @remote_addr, @local_addr] }
     end
 
     def close_connection(after_writing=false)
@@ -48,21 +58,40 @@ module Vines
       end
     end
 
+    # Reset the connection's XML parser when a new <stream:stream> header
+    # is received.
+    def reset
+      create_parser
+    end
+
     # Returns the storage system for the domain. If no domain is given,
     # the stream's storage mechanism is returned.
     def storage(domain=nil)
-      @config.vhosts[domain || self.domain]
+      host = @config.vhosts[domain || self.domain]
+      host.storage if host
     end
 
     # Reload the user's information into their active connections. Call this
     # after storage.save_user() to sync the new user state with their other
     # connections.
     def update_user_streams(user)
-      router.connected_resources(user.jid.bare).each do |stream|
+      connected_resources(user.jid.bare).each do |stream|
         stream.user.update_from(user)
       end
     end
 
+    def connected_resources(jid)
+      router.connected_resources(jid, user.jid)
+    end
+
+    def available_resources(*jid)
+      router.available_resources(*jid, user.jid)
+    end
+
+    def interested_resources(*jid)
+      router.interested_resources(*jid, user.jid)
+    end
+
     def ssl_verify_peer(pem)
       # EM is supposed to close the connection when this returns false,
       # but it only does that for inbound connections, not when we
@@ -206,5 +235,10 @@ module Vines
     def tls_files
       %w[crt key].map {|ext| File.join(VINES_ROOT, 'conf', 'certs', "#{domain}.#{ext}") }
     end
+
+    def valid_address?(jid)
+      jid = JID.new(jid) rescue nil
+      jid && !jid.empty?
+    end
   end
 end

data/lib/vines/stream/client.rb

@@ -6,10 +6,8 @@ module Vines
     # Implements the XMPP protocol for client-to-server (c2s) streams. This
     # serves connected streams using the jabber:client namespace.
     class Client < Stream
-      attr_reader :config
-
       def initialize(config)
-        @config = config
+        super
         @session = Client::Session.new(self)
       end
 
@@ -24,9 +22,9 @@ module Vines
         end
       end
 
-      %w[max_stanza_size max_resources_per_account private_storage?].each do |name|
+      %w[max_stanza_size max_resources_per_account].each do |name|
         define_method name do |*args|
-          @config[:client].send(name, *args)
+          config[:client].send(name, *args)
         end
       end
 
@@ -46,7 +44,8 @@ module Vines
         @session.domain = to
         send_stream_header(from)
         raise StreamErrors::UnsupportedVersion unless node['version'] == '1.0'
-        raise StreamErrors::HostUnknown unless @config.vhost?(@session.domain)
+        raise StreamErrors::ImproperAddressing unless valid_address?(@session.domain)
+        raise StreamErrors::HostUnknown unless config.vhost?(@session.domain)
         raise StreamErrors::InvalidNamespace unless node.namespaces['xmlns'] == NAMESPACES[:client]
         raise StreamErrors::InvalidNamespace unless node.namespaces['xmlns:stream'] == NAMESPACES[:stream]
       end

data/lib/vines/stream/client/auth.rb

@@ -9,7 +9,7 @@ module Vines
         SUCCESS = %Q{<success xmlns="#{NS}"/>}.freeze
         MAX_AUTH_ATTEMPTS = 3
         AUTH_MECHANISMS = {'PLAIN' => :plain_auth, 'EXTERNAL' => :external_auth}.freeze
-  
+
         def initialize(stream, success=BindRestart)
           super
           @attempts, @outstanding = 0, false
@@ -49,7 +49,7 @@ module Vines
 
         # Authenticate c2s streams using a username and password. Call the
         # authentication module in a separate thread to avoid blocking stanza
-        # processing for other users. 
+        # processing for other users.
         def plain_auth(stanza)
           jid, node, password = Base64.decode64(stanza.text).split("\000")
           jid = [node, stream.domain].join('@') if jid.nil? || jid.empty?
@@ -77,6 +77,7 @@ module Vines
 
         def send_auth_success
           stream.write(SUCCESS)
+          stream.reset
           advance
         end
 

data/lib/vines/stream/client/bind.rb

@@ -51,12 +51,12 @@ module Vines
         end
 
         def resource_limit_reached?
-          used = stream.router.connected_resources(stream.user.jid.bare).size
+          used = stream.connected_resources(stream.user.jid.bare).size
           used >= stream.max_resources_per_account
         end
 
         def resource_used?(resource)
-          stream.router.available_resources(stream.user.jid).any? do |c|
+          stream.available_resources(stream.user.jid).any? do |c|
             c.user.jid.resource == resource
           end
         end

data/lib/vines/stream/client/bind_restart.rb

@@ -14,11 +14,10 @@ module Vines
           doc = Document.new
           features = doc.create_element('stream:features') do |el|
             el << doc.create_element('bind', 'xmlns' => NAMESPACES[:bind])
-            el << doc.create_element('session', 'xmlns' => NAMESPACES[:session])
           end
           stream.write(features)
           advance
-        end  
+        end
       end
     end
   end

data/lib/vines/stream/client/ready.rb

@@ -7,6 +7,8 @@ module Vines
         def node(node)
           stanza = to_stanza(node)
           raise StreamErrors::UnsupportedStanzaType unless stanza
+          stanza.validate_to
+          stanza.validate_from
           stanza.process
         end
       end

data/lib/vines/stream/client/session.rb

@@ -15,6 +15,7 @@ module Vines
 
         def initialize(stream)
           @id = Kit.uuid
+          @config = stream.config
           @state = Client::Start.new(stream)
           @available = false
           @domain = nil
@@ -91,14 +92,22 @@ module Vines
         # has successfully subscribed.
         def available_subscribed_to_resources
           subscribed = @user.subscribed_to_contacts.map {|c| c.jid }
-          router.available_resources(subscribed)
+          router.available_resources(subscribed, @user.jid)
         end
 
         # Returns streams for available resources that are subscribed
         # to this user's presence updates.
         def available_subscribers
           subscribed = @user.subscribed_from_contacts.map {|c| c.jid }
-          router.available_resources(subscribed)
+          router.available_resources(subscribed, @user.jid)
+        end
+
+        # Returns contacts hosted at remote servers to which this user has
+        # successfully subscribed.
+        def remote_subscribed_to_contacts
+          @user.subscribed_to_contacts.reject do |c|
+            @config.local_jid?(c.jid)
+          end
         end
 
         # Returns contacts hosted at remote servers that are subscribed
@@ -106,7 +115,7 @@ module Vines
         def remote_subscribers(to=nil)
           jid = (to.nil? || to.empty?) ? nil : JID.new(to).bare
           @user.subscribed_from_contacts.reject do |c|
-            router.local_jid?(c.jid) || (jid && c.jid.bare != jid)
+            @config.local_jid?(c.jid) || (jid && c.jid.bare != jid)
           end
         end
 
@@ -121,7 +130,7 @@ module Vines
             'type' => 'unavailable')
 
           broadcast(el, available_subscribers)
-          broadcast(el, router.available_resources(@user.jid))
+          broadcast(el, router.available_resources(@user.jid, @user.jid))
 
           remote_subscribers.each do |contact|
             node = el.clone