Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Don't send CAP END before SASL auth is complete #47

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

russss
Copy link

@russss russss commented May 23, 2021

The SASL-3.1 spec recommends that CAP END is not sent until SASL auth has completed. The current behaviour is to send CAP END immediately after all requested capabilities have been ACKed or NACKed.

I've found the current behaviour to fail SASL auth intermittently in practice, particularly when additional capabilities are requested. This change is working much more reliably for me.

There's still arguably a race condition in the other direction now - if SASL auth completes before capability negotiation - but I think this is very unlikely to happen in practice.

(Love the library, thanks!)

This is "RECOMMENDED" in the SASL-3.1 spec, and I've found the previous
behaviour to be intermittent in practice.
@linuxdaemon
Copy link
Member

Hey, sorry I wasn't maintaining this library for awhile but I'm getting back to it now. The code as it is should wait until sasl auth finishes as the sasl handler is awaited

await asyncio.gather(*[func(conn, cap) for func in handlers])

which will wait until the sasl handler returns before sending cap end. The intermittent behavior may be related to what I just fixed in v0.1.8 where the AUTHENTICATE payload was malformed in some circumstances

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants