291 lines
12 KiB
GDScript
291 lines
12 KiB
GDScript
extends Node
|
|
|
|
class Connection extends Reference:
|
|
var stream: StreamPeer
|
|
var identity: String
|
|
var domain: String
|
|
var bare_jid: String
|
|
var jid: String
|
|
var _id_counter: int = 0
|
|
|
|
func generate_id() -> int:
|
|
self._id_counter += 1
|
|
return hash(self._id_counter)
|
|
|
|
func establish_new_connection(domain: String, identity: String, password: String) -> Connection:
|
|
var stream := StreamPeerTCP.new()
|
|
if stream.connect_to_host(domain, 5222) != OK:
|
|
push_error("Cannot establish client->server pipe to " + domain)
|
|
return null
|
|
|
|
while stream.get_status() == StreamPeerTCP.STATUS_CONNECTING:
|
|
pass
|
|
|
|
if stream.get_status() == StreamPeerTCP.STATUS_ERROR:
|
|
push_error("Cannot establish client->server pipe to " + domain)
|
|
return null
|
|
|
|
var result := Connection.new()
|
|
result.stream = stream
|
|
result.identity = identity
|
|
result.domain = domain
|
|
result.bare_jid = identity + '@' + domain
|
|
|
|
if _negotiate_connection(result, password) != OK:
|
|
return null
|
|
|
|
return result
|
|
|
|
# todo: Make it async
|
|
func _negotiate_connection(connection: Connection, password: String) -> int:
|
|
## See [9. Detailed Examples] of https://datatracker.ietf.org/doc/rfc6120/
|
|
var error: int = OK
|
|
|
|
error = _negotiate_tls(connection)
|
|
if error != OK: return error
|
|
|
|
error = _negotiate_sasl(connection, password)
|
|
if error != OK: return error
|
|
|
|
error = _bind_resource(connection)
|
|
if error != OK: return error
|
|
|
|
return OK
|
|
|
|
func _form_initial_message(domain: String, bare_jid: String) -> String:
|
|
# todo: XML builder interface, writing by hand is extremely error prone.
|
|
return """<?xml version='1.0'?><stream:stream
|
|
from='{bare_jid}' to='{domain}' version='1.0'
|
|
xml:lang='en' xmlns='jabber:client'
|
|
xmlns:stream='http://etherx.jabber.org/streams'>""".format({
|
|
"bare_jid": bare_jid.xml_escape(), "domain": domain.xml_escape()})
|
|
|
|
func _negotiate_tls(connection: Connection) -> int:
|
|
var error: int = OK
|
|
var response
|
|
var parsed_response = Xml.Parser.new()
|
|
|
|
## Step 1: Client initiates stream to server:
|
|
if connection.stream.put_data(_form_initial_message(
|
|
connection.domain, connection.bare_jid).to_utf8()) != OK:
|
|
return ERR_CONNECTION_ERROR
|
|
|
|
## Step 2: Server responds by sending a response stream header to client:
|
|
response = _wait_blocking_for_utf8_data(connection.stream)
|
|
if response == null: return ERR_CONNECTION_ERROR
|
|
if parsed_response.parse_a_bit(response): return ERR_CONNECTION_ERROR
|
|
# If <stream:stream> is closed, - connection is closed too.
|
|
|
|
## Check that server response corresponds to what we ask for.
|
|
# todo: For conformity client must send closing stream tag on error.
|
|
if parsed_response.root.node_name != "stream:stream": return ERR_CANT_CONNECT
|
|
if parsed_response.root.attributes["from"] != connection.domain: return ERR_CANT_CONNECT
|
|
if "to" in parsed_response.root.attributes:
|
|
if parsed_response.root.attributes["to"] != connection.bare_jid: return ERR_CANT_CONNECT
|
|
if parsed_response.root.attributes["version"] != "1.0": return ERR_CANT_CONNECT
|
|
# todo: Assert for namespaces.
|
|
|
|
## Step 3: Server sends stream features to client (only the STARTTLS
|
|
## extension at this point, which is mandatory-to-negotiate):
|
|
if parsed_response.root.children.size() == 0:
|
|
response = _wait_blocking_for_utf8_data(connection.stream)
|
|
if response == null: return ERR_CONNECTION_ERROR
|
|
if parsed_response.parse_a_bit(response): return ERR_CONNECTION_ERROR
|
|
|
|
var features = parsed_response.root.take_named_child_element("stream:features")
|
|
if features == null: return ERR_CANT_CONNECT
|
|
var starttls = features.take_named_child_element("starttls")
|
|
if starttls == null or starttls.attributes["xmlns"] != "urn:ietf:params:xml:ns:xmpp-tls":
|
|
push_error("Connection declined, TLS is not a listed feature")
|
|
return ERR_CANT_CONNECT
|
|
|
|
## Step 4: Client sends STARTTLS command to server:
|
|
if connection.stream.put_data("<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>".to_utf8()) != OK:
|
|
return ERR_CONNECTION_ERROR
|
|
|
|
## Step 5: Server informs client that it is allowed to proceed:
|
|
response = _wait_blocking_for_utf8_data(connection.stream)
|
|
if response == null: return ERR_CONNECTION_ERROR
|
|
if parsed_response.parse_a_bit(response): return ERR_CONNECTION_ERROR
|
|
|
|
# todo: Handle failure case.
|
|
|
|
var proceed = parsed_response.root.take_named_child_element("proceed")
|
|
if proceed == null: return ERR_CANT_CONNECT
|
|
if proceed.attributes["xmlns"] != "urn:ietf:params:xml:ns:xmpp-tls": return ERR_CANT_CONNECT
|
|
|
|
## Step 6: Client and server attempt to complete TLS negotiation over
|
|
## the existing TCP connection (see [TLS] for details).
|
|
var tls_stream := StreamPeerSSL.new()
|
|
error = tls_stream.connect_to_stream(connection.stream, true, connection.domain)
|
|
if error != OK:
|
|
push_error("Cannot establish client->server TLS connection")
|
|
return error
|
|
|
|
connection.stream = tls_stream
|
|
|
|
## Step 7 (alt): If TLS negotiation is unsuccessful, server closes TCP
|
|
## connection (thus, the stream negotiation process ends unsuccessfully
|
|
## and the parties do not move on to the next step):
|
|
|
|
return OK
|
|
|
|
func _negotiate_sasl(connection: Connection, password: String) -> int:
|
|
var response
|
|
var parsed_response = Xml.Parser.new()
|
|
|
|
## Step 7: If TLS negotiation is successful, client initiates a new
|
|
## stream to server over the TLS-protected TCP connection:
|
|
if connection.stream.put_data(_form_initial_message(
|
|
connection.domain, connection.bare_jid).to_utf8()) != OK:
|
|
return ERR_CONNECTION_ERROR
|
|
|
|
## Step 8: Server responds by sending a stream header to client along
|
|
## with any available stream features:
|
|
|
|
response = _wait_blocking_for_utf8_data(connection.stream)
|
|
if response == null: return ERR_CONNECTION_ERROR
|
|
if parsed_response.parse_a_bit(response): return ERR_CONNECTION_ERROR
|
|
|
|
## Check that server response corresponds to what we ask for.
|
|
# todo: For conformity client must send closing stream tag on error.
|
|
if parsed_response.root.node_name != "stream:stream": return ERR_CANT_CONNECT
|
|
if parsed_response.root.attributes["from"] != connection.domain: return ERR_CANT_CONNECT
|
|
if "to" in parsed_response.root.attributes:
|
|
if parsed_response.root.attributes["to"] != connection.bare_jid: return ERR_CANT_CONNECT
|
|
if parsed_response.root.attributes["version"] != "1.0": return ERR_CANT_CONNECT
|
|
# todo: Assert for namespaces.
|
|
|
|
if parsed_response.root.children.size() == 0:
|
|
response = _wait_blocking_for_utf8_data(connection.stream)
|
|
if response == null: return ERR_CONNECTION_ERROR
|
|
if parsed_response.parse_a_bit(response): return ERR_CONNECTION_ERROR
|
|
|
|
var features = parsed_response.root.take_named_child_element("stream:features")
|
|
if features == null: return ERR_CANT_CONNECT
|
|
var mechanisms = features.take_named_child_element("mechanisms")
|
|
if mechanisms == null or mechanisms.attributes["xmlns"] != "urn:ietf:params:xml:ns:xmpp-sasl":
|
|
push_error("Connection declined, mechanisms is not a listed feature")
|
|
return ERR_CANT_CONNECT
|
|
|
|
## We only support PLAIN mechanism as it's sufficient over TLS.
|
|
var plain_found := false
|
|
for machanism in mechanisms.children:
|
|
if machanism.is_element() and machanism.node_name == "mechanism":
|
|
if machanism.children[0].data == "PLAIN":
|
|
plain_found = true
|
|
break
|
|
|
|
if not plain_found:
|
|
push_error("Connection declined, mechanisms don't include PLAIN method")
|
|
return ERR_CANT_CONNECT
|
|
|
|
## Step 9: Client selects an authentication mechanism, including initial response data:
|
|
## https://datatracker.ietf.org/doc/html/rfc4616
|
|
if connection.stream.put_data((
|
|
"<auth xmlns='urn:ietf:params:xml:ns:xmpp-sasl' mechanism='PLAIN'>%s</auth>" %
|
|
[_plain_auth_message(connection.identity, password)]).to_utf8()) != OK:
|
|
return ERR_CONNECTION_ERROR
|
|
|
|
## (Skipped steps related to another auth machanism)
|
|
|
|
## Step 12: Server informs client of success, including additional data
|
|
## with success:
|
|
response = _wait_blocking_for_utf8_data(connection.stream)
|
|
if response == null: return ERR_CONNECTION_ERROR
|
|
if parsed_response.parse_a_bit(response): return ERR_CONNECTION_ERROR
|
|
|
|
var success = parsed_response.root.take_named_child_element("success")
|
|
if success == null or success.attributes["xmlns"] != "urn:ietf:params:xml:ns:xmpp-sasl":
|
|
return ERR_CANT_CONNECT
|
|
|
|
return OK
|
|
|
|
func _bind_resource(connection: Connection, resource: String = "tochie-facade") -> int:
|
|
var response
|
|
var parsed_response = Xml.Parser.new()
|
|
|
|
## Step 13: Client initiates a new stream to server:
|
|
if connection.stream.put_data(_form_initial_message(
|
|
connection.domain, connection.bare_jid).to_utf8()) != OK:
|
|
return ERR_CONNECTION_ERROR
|
|
|
|
## Step 14: Server responds by sending a stream header to client along
|
|
response = _wait_blocking_for_utf8_data(connection.stream)
|
|
if response == null: return ERR_CONNECTION_ERROR
|
|
if parsed_response.parse_a_bit(response): return ERR_CONNECTION_ERROR
|
|
|
|
## Check that server response corresponds to what we ask for.
|
|
# todo: For conformity client must send closing stream tag on error.
|
|
if parsed_response.root.node_name != "stream:stream": return ERR_CANT_CONNECT
|
|
if parsed_response.root.attributes["from"] != connection.domain: return ERR_CANT_CONNECT
|
|
if "to" in parsed_response.root.attributes:
|
|
if parsed_response.root.attributes["to"] != connection.bare_jid: return ERR_CANT_CONNECT
|
|
if parsed_response.root.attributes["version"] != "1.0": return ERR_CANT_CONNECT
|
|
# todo: Assert for namespaces.
|
|
|
|
if parsed_response.root.children.size() == 0:
|
|
response = _wait_blocking_for_utf8_data(connection.stream)
|
|
if response == null: return ERR_CONNECTION_ERROR
|
|
if parsed_response.parse_a_bit(response): return ERR_CONNECTION_ERROR
|
|
|
|
var features = parsed_response.root.take_named_child_element("stream:features")
|
|
if features == null: return ERR_CANT_CONNECT
|
|
var bind = features.take_named_child_element("bind")
|
|
if bind == null or bind.attributes["xmlns"] != "urn:ietf:params:xml:ns:xmpp-bind":
|
|
push_error("Connection declined, bind is not a listed feature")
|
|
return ERR_CANT_CONNECT
|
|
|
|
## Step 15: Client binds a resource:
|
|
var iq_id := connection.generate_id()
|
|
if connection.stream.put_data("""<iq id='{id}' type='set'>
|
|
<bind xmlns='urn:ietf:params:xml:ns:xmpp-bind'>
|
|
<resource>{resource}</resource>
|
|
</bind></iq>""".format({
|
|
"id": iq_id,
|
|
"resource": resource.xml_escape()
|
|
}).to_utf8()) != OK:
|
|
return ERR_CONNECTION_ERROR
|
|
|
|
response = _wait_blocking_for_utf8_data(connection.stream)
|
|
if response == null: return ERR_CONNECTION_ERROR
|
|
if parsed_response.parse_a_bit(response): return ERR_CONNECTION_ERROR
|
|
|
|
## Step 16: Server accepts submitted resourcepart and informs client of
|
|
## successful resource binding:
|
|
var iq = parsed_response.root.take_named_child_element("iq")
|
|
if iq.attributes["id"] != String(iq_id):
|
|
push_error("iq id mismatch, expected: " + String(iq_id) + " but got: " + iq.attributes["id"])
|
|
return ERR_CANT_CONNECT
|
|
|
|
bind = iq.take_named_child_element("bind")
|
|
if bind == null or bind.attributes["xmlns"] != "urn:ietf:params:xml:ns:xmpp-bind":
|
|
return ERR_CANT_CONNECT
|
|
|
|
var jid = bind.take_named_child_element("jid")
|
|
if jid == null: return ERR_CANT_CONNECT
|
|
|
|
connection.jid = jid.children[0].data
|
|
|
|
return OK
|
|
|
|
func _plain_auth_message(identity: String, password: String) -> String:
|
|
var raw = PoolByteArray([0])
|
|
raw.append_array(identity.to_utf8() + PoolByteArray([0]))
|
|
raw.append_array(password.to_utf8())
|
|
return Marshalls.raw_to_base64(raw)
|
|
|
|
func _wait_blocking_for_utf8_data(stream: StreamPeer, timeout_ms: int = 1000): # -> String or null:
|
|
var enter_time := OS.get_system_time_msecs()
|
|
|
|
if stream is StreamPeerSSL: stream.poll()
|
|
var available_bytes := stream.get_available_bytes()
|
|
|
|
while available_bytes == 0:
|
|
if OS.get_system_time_msecs() - enter_time >= timeout_ms:
|
|
return null
|
|
if stream is StreamPeerSSL: stream.poll()
|
|
available_bytes = stream.get_available_bytes()
|
|
|
|
return stream.get_utf8_string(available_bytes)
|