通过ejabberd的日志，整理了下客户端登录流程。
1. 通过TCP连接5222端口的流程：
(1) 客户端向服务器发送stream流
<stream:stream to="nba.com"
xml:lang="*" version="1.0" xmlns:stream="http://etherx.jabber.org/streams" xmlns="jabber:client"> (2) 服务器应答stream
<?xml version='1.0'?>
<stream:stream xmlns='jabber:client'
xmlns:stream='http://etherx.jabber.org/streams' id='4171758611' from='nba.com' version='1.0' xml:lang='en'>
(3) 服务器发送流特性
<stream:features>
<starttls xmlns='urn:ietf:params:xml:ns:xmpp-tls'/> <mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'> <mechanism>PLAIN</mechanism> </mechanisms> <c xmlns='http://jabber.org/protocol/caps' hash='sha-1' node='http://www.process-one.net/en/ejabberd/' ver='AxFG3uvIZfHAbBjOUb9t3klmoos='/> <register xmlns='http://jabber.org/features/iq-register'/> </stream:features>
(4) 客户端发送tls请求
<starttls xmlns="urn:ietf:params:xml:ns:xmpp-tls"/>
(5) 服务器回应并开始TLS握手
<proceed xmlns='urn:ietf:params:xml:ns:xmpp-tls'/>
(6) TLS握手完成后，客户端重新初始化stream流
<stream:stream to="nba.com"
xml:lang="*" version="1.0" xmlns:stream="http://etherx.jabber.org/streams" xmlns="jabber:client"> (7) 服务器应答
<?xml version='1.0'?>
<stream:stream xmlns='jabber:client'
xmlns:stream='http://etherx.jabber.org/streams' id='703708799' from='nba.com' version='1.0' xml:lang='en'>
(8) 服务器告知客户端支持的SASL验证机制
<stream:features>
<mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'> <mechanism>PLAIN</mechanism> </mechanisms> <c xmlns='http://jabber.org/protocol/caps' hash='sha-1' node='http://www.process-one.net/en/ejabberd/' ver='AxFG3uvIZfHAbBjOUb9t3klmoos='/> <register xmlns='http://jabber.org/features/iq-register'/> </stream:features>
(9) 客户端选择简单认证机制并发送用户名密码
<auth xmlns="urn:ietf:params:xml:ns:xmpp-sasl" mechanism="PLAIN">AG1iZWQAbWlycm9y</auth>
(10) 服务器告诉客户端校验通过，SASL握手完成
<success xmlns='urn:ietf:params:xml:ns:xmpp-sasl'/>
(11) 客户端再次初始化stream流
<stream:stream to="nba.com"
xml:lang="*" version="1.0" xmlns:stream="http://etherx.jabber.org/streams" xmlns="jabber:client"> (12) 服务器应答
<?xml version='1.0'?>
<stream:stream xmlns='jabber:client'
xmlns:stream='http://etherx.jabber.org/streams' id='2767342509' from='nba.com' version='1.0' xml:lang='en'>
(13) 通知客户端进行资源绑定
<stream:features>
<bind xmlns='urn:ietf:params:xml:ns:xmpp-bind'/> <session xmlns='urn:ietf:params:xml:ns:xmpp-session'/> <c xmlns='http://jabber.org/protocol/caps' hash='sha-1' node='http://www.process-one.net/en/ejabberd/' ver='AxFG3uvIZfHAbBjOUb9t3klmoos='/> <register xmlns='http://jabber.org/features/iq-register'/> </stream:features>
(14) 客户端请求资源绑定
<iq type="set" id="0"> <bind xmlns="urn:ietf:params:xml:ns:xmpp-bind"> <resource>boston</resource> </bind> </iq>
(15) 服务器应答
<iq id='0' type='result'> <bind xmlns='urn:ietf:params:xml:ns:xmpp-bind'> <jid>rondo@nba.com/boston</jid> </bind> </iq>
(16) 客户端请求session绑定
<iq type="set" id="1"> <session xmlns="urn:ietf:params:xml:ns:xmpp-session"/> </iq>
(17) 服务器应答
<iq type='result' id='1'> <session xmlns='urn:ietf:params:xml:ns:xmpp-session'/> </iq>
至此，可认为登陆完成，后续进行能力协商，发送其他请求消息，发送出息消息等。
2. 通过http连接5280端口的流程
http方式的交互是通过BOSH协议完成的，详细可参见
http://xmpp.org/extensions/xep-0124.html
http://xmpp.org/xmpp-protocols/xmpp-extensions/
具体流程为：
(1) 发起bosh会话
<body rid='16488487'
xmlns='http://jabber.org/protocol/httpbind'
to='nba.com'
xml:lang='en'
wait='60' hold='1' content='text/xml;charset=utf-8' ver='1.6' xmpp:version='1.0' xmlns:xmpp='urn:xmpp:xbosh'/>
(2) 服务器应答
<body xmlns='http://jabber.org/protocol/httpbind'
sid='90582e464361adb537351e65ecfa66d1336ea486' wait='60' requests='2' inactivity='30' maxpause='120' polling='2' ver='1.8' from='nba.com' secure='true' authid='1145683568' xmlns:xmpp='urn:xmpp:xbosh' xmlns:stream='http://etherx.jabber.org/streams' xmpp:version='1.0'> <stream:features xmlns:stream='http://etherx.jabber.org/streams'> <mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'> <mechanism>PLAIN</mechanism> </mechanisms> <c xmlns='http://jabber.org/protocol/caps' hash='sha-1' node='http://www.process-one.net/en/ejabberd/' ver='AxFG3uvIZfHAbBjOUb9t3klmoos='/> <register xmlns='http://jabber.org/features/iq-register'/> </stream:features> </body>
(3) 客户端发送用户名密码
<body rid='16488488'
xmlns='http://jabber.org/protocol/httpbind' sid='90582e464361adb537351e65ecfa66d1336ea486'> <auth xmlns='urn:ietf:params:xml:ns:xmpp-sasl' mechanism='PLAIN'> AGNoZW53ZW5jYW4ja2VkYWNvbS5jb20AMjEyMThjY2E3NwgzNGQyYmExOTIyYzMzZTAxNTExMDU= </auth> </body>
(4) 服务器响应告知校验结果
<body xmlns='http://jabber.org/protocol/httpbind'>
<success xmlns='urn:ietf:params:xml:ns:xmpp-sasl'/> </body>
(5) 客户端重新初始化stream流
<body rid='16488489'
xmlns='http://jabber.org/protocol/httpbind' sid='90582e464361adb537351e65ecfa66d1336ea486' to='nba.com' xml:lang='en' xmpp:restart='true' xmlns:xmpp='urn:xmpp:xbosh'/>
(6) 服务器通知完成资源绑定
<body xmlns='http://jabber.org/protocol/httpbind'
sid='90582e464361adb537351e65ecfa66d1336ea486' wait='60' requests='2' inactivity='30' maxpause='120' polling='2' ver='1.8' from='nba.com' secure='true' authid='3855745118' xmlns:xmpp='urn:xmpp:xbosh' xmlns:stream='http://etherx.jabber.org/streams' xmpp:version='1.0'> <stream:features xmlns:stream='http://etherx.jabber.org/streams'> <bind xmlns='urn:ietf:params:xml:ns:xmpp-bind'/> <session xmlns='urn:ietf:params:xml:ns:xmpp-session'/> <c xmlns='http://jabber.org/protocol/caps' hash='sha-1' node='http://www.process-one.net/en/ejabberd/' ver='AxFG3uvIZfHAbBjOUb9t3klmoos='/> <register xmlns='http://jabber.org/features/iq-register'/> </stream:features> </body>
(7) 客户端请求资源绑定
<body rid='16488490'
xmlns='http://jabber.org/protocol/httpbind' sid='90582e464361adb537351e65ecfa66d1336ea486'> <iq type='set' id='_bind_auth_2' xmlns='jabber:client'> <bind xmlns='urn:ietf:params:xml:ns:xmpp-bind'> <resource>boston</resource> </bind> </iq> </body>
(8) 服务器应答
<body xmlns='http://jabber.org/protocol/httpbind'>
<iq xmlns='jabber:client' id='_bind_auth_2' type='result'> <bind xmlns='urn:ietf:params:xml:ns:xmpp-bind'> <jid>rondo@nba.com/boston</jid> </bind> </iq> </body>
(9) 客户端请求session绑定
<body rid='16488491'
xmlns='http://jabber.org/protocol/httpbind' sid='90582e464361adb537351e65ecfa66d1336ea486'> <iq type='set' id='_session_auth_2' xmlns='jabber:client'> <session xmlns='urn:ietf:params:xml:ns:xmpp-session'/> </iq> </body>
(10) 服务器应答
<body xmlns='http://jabber.org/protocol/httpbind'>
<iq xmlns='jabber:client' id='_session_auth_2' type='result'> <session xmlns='urn:ietf:params:xml:ns:xmpp-session'/> </iq> </body>
分析：
SASL 交涉
Client 客户端需要选择一个服务器上有效的认证方式来携带SASL交涉数据, 上面的情况, “DIGEST-MD5“, “PLAIN” 和 “EXTERNAL” 是一些可选项.
“PLAIN” 认证模式是三者之中最简单的了. 它是这样工作的:
Client: 客户端按照自己选择的认证模式发送一个将用户名和密码以base64编码的 stream. 用户名和密码按这种格式组织:
“\0UserName\0Password”.
例如我想以用户名为“mbed@ceit.org”登录, 密码是“mirror”. 那么, 在进行base64编码之前, 用户名和密码按照上面的格式组织为一个新的字符串,“\0mbed\0mirror”, 再进行base64编码, 得到字符串“AG1iZWQAbWlycm9y”.
然后, 客户端发送下列 stream 到服务器.
<auth xmlns='urn:ietf:params:xml:ns:xmpp-sasl' mechanism='PLAIN'>AG1iZWQAbWlycm9y</auth>
代码如下：
直接base64 编码decode，可看到用户名和密码。
1092
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
