Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add SASL EXTERNAL authentication and example #48

Merged
merged 1 commit into from
Aug 10, 2020
Merged

Add SASL EXTERNAL authentication and example #48

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 62 additions & 0 deletions example/externalSasl.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
#!/usr/bin/env node

var irc = require('../');
var fs = require('fs');

// example of authenticating through external sasl on freenode
// set up your cert as instructed here https://freenode.net/kb/answer/certfp
// change these to your cert
var options = {
key: fs.readFileSync('/path/to/.weechat/certs/freenode.pem'),
cert: fs.readFileSync('/path/to/.weechat/certs/freenode.pem')
};

var bot = new irc.Client('chat.freenode.net', 'nodebot', {
port: 6697,
sasl: true,
saslType: 'EXTERNAL',
debug: true,
secure: options,
channels: ['#botwar']
});

bot.addListener('error', function(message) {
console.error('ERROR: %s: %s', message.command, message.args.join(' '));
});

bot.addListener('message#blah', function(from, message) {
console.log('<%s> %s', from, message);
});

bot.addListener('message', function(from, to, message) {
console.log('%s => %s: %s', from, to, message);

if (to.match(/^[#&]/)) {
// channel message
if (message.match(/hello/i)) {
bot.say(to, 'Hello there ' + from);
}
if (message.match(/dance/)) {
setTimeout(function() { bot.say(to, '\u0001ACTION dances: :D\\-<\u0001'); }, 1000);
setTimeout(function() { bot.say(to, '\u0001ACTION dances: :D|-<\u0001'); }, 2000);
setTimeout(function() { bot.say(to, '\u0001ACTION dances: :D/-<\u0001'); }, 3000);
setTimeout(function() { bot.say(to, '\u0001ACTION dances: :D|-<\u0001'); }, 4000);
}
}
else {
// private message
console.log('private message');
}
});
bot.addListener('pm', function(nick, message) {
console.log('Got private message from %s: %s', nick, message);
});
bot.addListener('join', function(channel, who) {
console.log('%s has joined %s', who, channel);
});
bot.addListener('part', function(channel, who, reason) {
console.log('%s has left %s: %s', who, channel, reason);
});
bot.addListener('kick', function(channel, who, by, reason) {
console.log('%s was kicked from %s by %s: %s', who, channel, by, reason);
});
24 changes: 17 additions & 7 deletions lib/irc.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,7 @@ function Client(server, nick, opt) {
floodProtection: false,
floodProtectionDelay: 1000,
sasl: false,
saslType: 'PLAIN',
stripColors: false,
channelPrefixes: '&#',
messageSplit: 512,
Expand Down Expand Up @@ -661,15 +662,24 @@ function Client(server, nick, opt) {
if (message.args[0] === '*' &&
message.args[1] === 'ACK' &&
message.args[2] === 'sasl ') // there's a space after sasl
self._send('AUTHENTICATE', 'PLAIN');
self._send('AUTHENTICATE', self.opt.saslType);
break;
case 'AUTHENTICATE':
if (message.args[0] === '+') self._send('AUTHENTICATE',
Buffer.from(
self.opt.nick + '\0' +
self.opt.userName + '\0' +
self.opt.password
).toString('base64'));
if (message.args[0] === '+') {
switch (self.opt.saslType) {
case 'PLAIN':
self._send('AUTHENTICATE',
Buffer.from(
self.opt.nick + '\0' +
self.opt.userName + '\0' +
self.opt.password
).toString('base64'));
break;
case 'EXTERNAL':
self._send('AUTHENTICATE', '+');
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just to be clear, this is just the client saying that it doesn't need to provide a set of authentication credentials because the cert provided does that?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yep that should be it. the rfc says The mechanism is capable of transferring an authorization identity string. If empty, the client is requesting to act as the identity the server has associated with the client's credentials.

I implemented this looking at how weechat and other clients do it.

break;
}
}
break;
case '903':
self._send('CAP', 'END');
Expand Down