Package: mellium.im/sasl

package sasl Import Path mellium.im/sasl (on go.dev) Dependency Relation imports 13 packages, and imported by one package

Involved Source Files #d doc.go Package sasl implements the Simple Authentication and Security Layer (SASL) as defined by RFC 4422. Most users of this package will only need to create a Negotiator using NewClient or NewServer and call its Step method repeatedly. Authors implementing SASL mechanisms other than the builtin ones will want to create a Mechanism struct which will likely use the other methods on the Negotiator. Be advised: This API is still unstable and is subject to change. mechanism.go negotiator.go nonce.go options.go plain.go scram.go xor.go xor_amd64.go xor_amd64.s

Code Examples _plainFailure package main import ( "fmt" "mellium.im/sasl" ) func main() { const ( username = "miranda" password = "pencil" ) creds := sasl.Credentials(func() ([]byte, []byte, []byte) { return []byte(username), []byte(password), []byte{} }) server := sasl.NewServer(sasl.Plain, func(n *sasl.Negotiator) bool { user, pass, ident := n.Credentials() // In a real auth system you might want to consider a constant time // comparison and this would probably involve hashing and a database lookup. if len(ident) == 0 && string(user) == username && string(pass) == password { fmt.Println("auth success!") return true } fmt.Println("auth failed!") return false }, creds) client := sasl.NewClient(sasl.Plain, sasl.Credentials(func() ([]byte, []byte, []byte) { // In a real auth system this would probably be user input. return []byte(username), []byte("password!"), []byte{} })) _, resp, err := client.Step(nil) if err != nil { fmt.Println(err) return } // Normally the response would come from the network, not from a client on the // same machine. _, _, err = server.Step(resp) if err != sasl.ErrAuthn { fmt.Println(err) return } } _plainSuccess package main import ( "fmt" "mellium.im/sasl" ) func main() { const ( username = "miranda" password = "pencil" ) creds := sasl.Credentials(func() ([]byte, []byte, []byte) { // In a real auth system this would probably be user input. return []byte(username), []byte(password), []byte{} }) server := sasl.NewServer(sasl.Plain, func(n *sasl.Negotiator) bool { user, pass, ident := n.Credentials() // In a real auth system you might want to consider a constant time // comparison and this would probably involve hashing and a database lookup. if len(ident) == 0 && string(user) == username && string(pass) == password { fmt.Println("auth success!") return true } fmt.Println("auth failed!") return false }, creds) client := sasl.NewClient(sasl.Plain, creds) _, resp, err := client.Step(nil) if err != nil { fmt.Println(err) return } // Normally the response would come from the network, not from a client on the // same machine. _, _, err = server.Step(resp) if err != nil { fmt.Println(err) return } } _xOAUTH2 package main import ( "bytes" "fmt" "mellium.im/sasl" ) // A custom SASL Mechanism that implements XOAUTH2: // https://developers.google.com/gmail/xoauth2_protocol var xoauth2 = sasl.Mechanism{ Name: "XOAUTH2", Start: func(m *sasl.Negotiator) (bool, []byte, interface{}, error) { // Start is called only by clients and returns the client first message. username, password, _ := m.Credentials() payload := []byte(`user=`) payload = append(payload, username...) payload = append(payload, '\x01') payload = append(payload, []byte(`auth=Bearer `)...) payload = append(payload, password...) payload = append(payload, '\x01', '\x01') return false, payload, nil, nil }, Next: func(m *sasl.Negotiator, challenge []byte, _ interface{}) (bool, []byte, interface{}, error) { // Next is called by both clients and servers and must be able to generate // and handle every challenge except for the client first message which is // generated (but not handled by) by Start. state := m.State() // If we're a client or a server that's past the AuthTextSent step, we // should never actually hit this step for the XOAUTH2 mechanism so return // an error. if state&sasl.Receiving != sasl.Receiving || state&sasl.StepMask != sasl.AuthTextSent { return false, nil, nil, sasl.ErrTooManySteps } parts := bytes.Split(challenge, []byte{1}) if len(parts) != 3 { return false, nil, nil, sasl.ErrInvalidChallenge } user := bytes.TrimPrefix([]byte("user="), parts[0]) if len(user) == len(parts[0]) { return false, nil, nil, sasl.ErrInvalidChallenge } pass := bytes.TrimPrefix([]byte("Auth=Bearer "), parts[1]) if len(pass) == len(parts[1]) { return false, nil, nil, sasl.ErrInvalidChallenge } if len(parts[2]) > 0 { return false, nil, nil, sasl.ErrInvalidChallenge } if m.Permissions(sasl.Credentials(func() ([]byte, []byte, []byte) { return user, pass, nil })) { return false, nil, nil, nil } return false, nil, nil, sasl.ErrAuthn }, } func main() { c := sasl.NewClient( xoauth2, sasl.Credentials(func() ([]byte, []byte, []byte) { return []byte("someuser@example.com"), []byte("vF9dft4qmTc2Nvb3RlckBhdHRhdmlzdGEuY29tCg=="), []byte{} }), ) // This is the first step and we haven't received any challenge from the // server yet. more, resp, _ := c.Step(nil) fmt.Printf("%v %s", more, bytes.Replace(resp, []byte{1}, []byte{' '}, -1)) }

Package-Level Functions (total 14, in which 5 are exported)

func Credentials(f func() (Username, Password, Identity []byte)) Option Credentials provides the negotiator with a username and password to authenticate with and (optionally) an authorization identity. Identity will normally be left empty to act as the username. The Credentials function is called lazily and may be called multiple times by the mechanism. It is not memoized by the negotiator.

func NewClient(m Mechanism, opts ...Option) *Negotiator NewClient creates a new SASL Negotiator that supports creating authentication requests using the given mechanism.

func NewServer(m Mechanism, permissions func(*Negotiator) bool, opts ...Option) *Negotiator NewServer creates a new SASL Negotiator that supports receiving authentication requests using the given mechanism. A nil permissions function is the same as a function that always returns false.

func RemoteMechanisms(m ...string) Option RemoteMechanisms sets a list of mechanisms supported by the remote client or server with which the state machine will be negotiating. It is used to determine if the server supports channel binding.

func TLSState(cs tls.ConnectionState) Option TLSState lets the state machine negotiate channel binding with a TLS session if supported by the underlying mechanism.

/* 9 unexporteds ... *//* 9 unexporteds: */