SASL Authentication for Clients

include/znc/Client.h

@@ -115,6 +115,10 @@ class CClient : public CIRCSocket {
           m_bBatch(false),
           m_bEchoMessage(false),
           m_bSelfMessage(false),
+          m_bSasl(false),
+          m_bSaslAuthenticating(false),
+          m_bSaslAuthenticated(false),
+          m_bSaslMultipart(false),
           m_bPlaybackActive(false),
           m_pUser(nullptr),
           m_pNetwork(nullptr),
@@ -123,6 +127,8 @@ class CClient : public CIRCSocket {
           m_sUser(""),
           m_sNetwork(""),
           m_sIdentifier(""),
+          m_sSaslBuffer(""),
+          m_sSaslMechanism(""),
           m_spAuth(),
           m_ssAcceptedCaps(),
           m_ssSupportedTags(),
@@ -150,6 +156,7 @@ class CClient : public CIRCSocket {
                {true, [this](bool bVal) { m_bAccountNotify = bVal; }}},
               {"extended-join",
                {true, [this](bool bVal) { m_bExtendedJoin = bVal; }}},
+              {"sasl", {false, [this](bool bVal) { m_bSasl = bVal; m_bSaslAuthenticating = bVal; }}},
           }) {
         EnableReadLine();
         // RFC says a line can have 512 chars max, but we are
@@ -326,6 +333,10 @@ class CClient : public CIRCSocket {
     unsigned int DetachChans(const std::set<CChan*>& sChans);
 
     bool OnActionMessage(CActionMessage& Message);
+    void OnAuthenticateMessage(CAuthenticateMessage& Message);
+
+    CString EnumerateSaslMechanisms(SCString& ssMechanisms);
+
     bool OnCTCPMessage(CCTCPMessage& Message);
     bool OnJoinMessage(CJoinMessage& Message);
     bool OnModeMessage(CModeMessage& Message);
@@ -354,6 +365,10 @@ class CClient : public CIRCSocket {
     bool m_bBatch;
     bool m_bEchoMessage;
     bool m_bSelfMessage;
+    bool m_bSasl;
+    bool m_bSaslAuthenticating;
+    bool m_bSaslAuthenticated;
+    bool m_bSaslMultipart;
     bool m_bPlaybackActive;
     CUser* m_pUser;
     CIRCNetwork* m_pNetwork;
@@ -362,6 +377,8 @@ class CClient : public CIRCSocket {
     CString m_sUser;
     CString m_sNetwork;
     CString m_sIdentifier;
+    CString m_sSaslBuffer;
+    CString m_sSaslMechanism;
     std::shared_ptr<CAuthBase> m_spAuth;
     SCString m_ssAcceptedCaps;
     SCString m_ssSupportedTags;

include/znc/Message.h

@@ -78,6 +78,7 @@ class CMessage {
         Unknown,
         Account,
         Action,
+        Authenticate,
         Away,
         Capability,
         CTCP,
@@ -238,6 +239,13 @@ class CActionMessage : public CTargetMessage {
 };
 REGISTER_ZNC_MESSAGE(CActionMessage);
 
+class CAuthenticateMessage : public CMessage {
+  public:
+    CString GetText() const { return GetParam(0); }
+    void SetText(const CString& sText) { SetParam(0, sText); }
+};
+REGISTER_ZNC_MESSAGE(CAuthenticateMessage);
+
 class CCTCPMessage : public CTargetMessage {
   public:
     bool IsReply() const { return GetCommand().Equals("NOTICE"); }

include/znc/Modules.h

@@ -1308,6 +1308,14 @@ class CModule {
      */
     virtual void OnClientCapRequest(CClient* pClient, const CString& sCap,
                                     bool bState);
+    virtual EModRet OnSaslServerChallenge(const CString& sMechanism,
+                                          CString& sResponse);
+    virtual EModRet OnClientSaslAuthenticate(const CString& sMechanism,
+                                             const CString& sBuffer,
+                                             CString& sUser,
+                                             CString& sMechanismResponse,
+                                             bool& bAuthenticationSuccess);
+    virtual void OnGetSaslMechanisms(SCString& ssMechanisms);
 
     /** Called when a module is going to be loaded.
      *  @param sModName name of the module.
@@ -1587,6 +1595,15 @@ class CModules : public std::vector<CModule*>, private CCoreTranslationMixin {
     bool IsClientCapSupported(CClient* pClient, const CString& sCap,
                               bool bState);
     bool OnClientCapRequest(CClient* pClient, const CString& sCap, bool bState);
+    bool OnSaslServerChallenge(const CString& sMechanism,
+                               CString& sResponse);
+    bool OnClientSaslAuthenticate(const CString& sMechanism,
+                                  const CString& sBuffer,
+                                  CString& sUser,
+                                  CString& sResponse,
+                                  bool& bAuthenticationSuccess);
+    bool OnGetSaslMechanisms(SCString& ssMechanisms);
+
     bool OnModuleLoading(const CString& sModName, const CString& sArgs,
                          CModInfo::EModuleType eType, bool& bSuccess,
                          CString& sRetMsg);

modules/saslplain.cpp

@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2004-2018 ZNC, see the NOTICE file for details.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <znc/User.h>
+#include <znc/znc.h>
+
+class CSASLMechanismPlain : public CModule {
+  public:
+    MODCONSTRUCTOR(CSASLMechanismPlain) { AddHelpCommand(); }
+
+    EModRet OnClientSaslAuthenticate(const CString& sMechanism,
+                                     const CString& sBuffer, CString& sUser,
+                                     CString& sMechanismResponse,
+                                     bool& bAuthenticationSuccess) override {
+        if (!sMechanism.Equals("PLAIN")) {
+            return CONTINUE;
+        }
+
+        bAuthenticationSuccess = false;
+
+        CString sNullSeparator = std::string("\0", 1);
+        auto sAuthzId = sBuffer.Token(0, false, sNullSeparator);
+        auto sAuthcId = sBuffer.Token(1, false, sNullSeparator);
+        auto sPassword = sBuffer.Token(2, false, sNullSeparator);
+
+        if (sAuthzId.empty()) sAuthzId = sAuthcId;
+
+		auto pUser = CZNC::Get().FindUser(sAuthcId);
+
+        if (!sAuthcId.empty() && !sPassword.empty()) {
+            if (pUser->CheckPass(sPassword)) {
+                bAuthenticationSuccess = true;
+				sUser = sAuthcId;
+			}
+        }
+
+		return HALTMODS;
+	}
+
+    void OnGetSaslMechanisms(SCString& ssMechanisms) override {
+        ssMechanisms.insert("PLAIN");
+	}
+};
+
+template <>
+void TModInfo<CSASLMechanismPlain>(CModInfo& Info) {
+    Info.SetWikiPage("saslplain");
+}
+
+GLOBALMODULEDEFS(
+    CSASLMechanismPlain,
+    t_s("Allows users to authenticate via the PLAIN SASL mechanism."))