关于sasl

1
2
3
4
5
6
7
8

250-mail.example.com Hello pc.example.org [192.168.1.42], pleased to meet you
250-AUTH DIGEST-MD5 CRAM-MD5 LOGIN PLAIN
AUTH LOGIN
334 VXNlcm5hbWU6
eHh4eAo=
334 UGFzc3dvcmQ6
b294eAo=
235 2.0.0 OK Authenticated

#client与server建立链接后发出一个strem头
C:<stream:stream xmlns='jabber:client' xmlns:stream='http://etherx.jabber.org/streams' to='example.com' version='1.0'>
#server回应一个steam头
S:<stream:stream xmlns='jabber:client' xmlns:stream='http://etherx.jabber.org/streams' id='c2s_234' from='example.com' version='1.0'>
#server发送自己支持的验证方式列表
S:<stream:features>
<mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
<mechanism>DIGEST-MD5</mechanism>
<mechanism>PLAIN</mechanism>
</mechanisms>
</stream:features>
#client 说它要用DIGEST-MD5做验证
C:
<auth xmlns='urn:ietf:params:xml:ns:xmpp-sasl' mechanism='DIGEST-MD5'/>
#server 发送challenge code
S:<challenge xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
cmVhbG09InNvbWVyZWFsbSIsbm9uY2U9Ik9BNk1HOXRFUUdtMmhoIixxb3A9ImF1dGgi
LGNoYXJzZXQ9dXRmLTgsYWxnb3JpdGhtPW1kNS1zZXNzCg==
</challenge>
#client 回应challenge
C:
<response xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
dXNlcm5hbWU9InNvbWVub2RlIixyZWFsbT0ic29tZXJlYWxtIixub25jZT0i
T0E2TUc5dEVRR20yaGgiLGNub25jZT0iT0E2TUhYaDZWcVRyUmsiLG5jPTAw
MDAwMDAxLHFvcD1hdXRoLGRpZ2VzdC11cmk9InhtcHAvZXhhbXBsZS5jb20i
LHJlc3BvbnNlPWQzODhkYWQ5MGQ0YmJkNzYwYTE1MjMyMWYyMTQzYWY3LGNo
YXJzZXQ9dXRmLTgK
</response>
#server 回应验证结果
S:
<success xmlns='urn:ietf:params:xml:ns:xmpp-sasl'/>

Gsasl *ctx = NULL; char buffer[BUFSIZ] = ""; char *buf; Gsasl_session *session; int rc; char *p; //使用gsasl之前初始化 if ((rc = gsasl_init (&ctx)) != GSASL_OK) { printf ("Cannot initialize libgsasl (%d): %s", rc, gsasl_strerror (rc)); return; }   //创建一个使用LOGIN验证方式的客户端session if ((rc = gsasl_client_start (ctx, "LOGIN", &session)) != GSASL_OK) { printf ("Cannot initialize client (%d): %s\n", rc, gsasl_strerror (rc)); return; }   //设置用户名和密码 gsasl_property_set (session, GSASL_AUTHID, "username"); gsasl_property_set (session, GSASL_PASSWORD, "password");   //假设socket_fd为我们与server已经建立连接的描述字   //告诉server我们选择使用LOGIN做验证 buf = buffer; sprintf(buf, "AUTH LOGIN\r\n"); write(socket_fd, buf, strlen(buf));   do { buf = buffer; //从server读取一行， readline(buf, sizeof (buf) - 1, socket_fd); //334 是多余的  buf += 4; //将challenge code 交给gsasl处理 rc = gsasl_step64 (session, buf, &p);   if (rc == GSASL_NEEDS_MORE || rc == GSASL_OK) { //将gsasl的处理结果发送给server write(socket_fd, p, strlen(p)); free (p); } } while (rc == GSASL_NEEDS_MORE);   if (rc != GSASL_OK) { printf ("Authentication error (%d): %s\n", rc, gsasl_strerror (rc)); return; }   printf("success!");
gsasl_finish (session); gsasl_done (ctx);

int callback (Gsasl * ctx, Gsasl_session * sctx, Gsasl_property prop) { char buf[BUFSIZ] = ""; int rc = GSASL_NO_CALLBACK;   switch (prop) { case GSASL_AUTHID: gsasl_property_set (sctx, GSASL_AUTHID, "username"); rc = GSASL_OK; break; // ..............  default: printf ("Unknown property! Don't worry.\n"); break; }   return rc; } //................. gsasl_callback_set (ctx, callback);