Merge 4.80.1 security fix in.

[exim.git] / src / src / auths / dovecot.c

diff --git a/src/src/auths/dovecot.c b/src/src/auths/dovecot.c
index ff0f8469cd6013f61371af5cb9ee509e8b8ff0da..0824240a03588d5b474ba35908a91a70ddb07caa 100644 (file)
--- a/src/src/auths/dovecot.c
+++ b/src/src/auths/dovecot.c
@@ -1,5 +1,3 @@
-/* $Cambridge: exim/src/src/auths/dovecot.c,v 1.10 2008/05/16 12:22:08 nm4 Exp $ */
-
 /*
  * Copyright (c) 2004 Andrey Panin <pazke@donpac.ru>
  *
@@ -131,6 +129,7 @@ for (;;)
     {
     sbp = read(fd, sbuffer, sizeof(sbuffer));
     if (sbp == 0) { if (count == 0) return NULL; else break; }
+    p = 0;
     }
 
   while (p < sbp)
@@ -208,35 +207,23 @@ int auth_dovecot_server(auth_instance *ablock, uschar *data)
                HDEBUG(D_auth) debug_printf("received: %s\n", buffer);
                nargs = strcut(buffer, args, sizeof(args) / sizeof(args[0]));
 
-               switch (toupper(*args[0])) {
-               case 'C':
+               /* Code below rewritten by Kirill Miazine (km@krot.org). Only check commands that
+                  Exim will need. Original code also failed if Dovecot server sent unknown
+                  command. E.g. COOKIE in version 1.1 of the protocol would cause troubles. */
+               if (Ustrcmp(args[0], US"CUID") == 0) {
                        CHECK_COMMAND("CUID", 1, 1);
                        cuid = Uatoi(args[1]);
-                       break;
-
-               case 'D':
-                       CHECK_COMMAND("DONE", 0, 0);
-                       cont = 0;
-                       break;
-
-               case 'M':
-                       CHECK_COMMAND("MECH", 1, INT_MAX);
-                       if (strcmpic(US args[1], ablock->public_name) == 0)
-                               found = 1;
-                       break;
-
-               case 'S':
-                       CHECK_COMMAND("SPID", 1, 1);
-                       break;
-
-               case 'V':
+               } else if (Ustrcmp(args[0], US"VERSION") == 0) {
                        CHECK_COMMAND("VERSION", 2, 2);
                        if (Uatoi(args[1]) != VERSION_MAJOR)
                                OUT("authentication socket protocol version mismatch");
-                       break;
-
-               default:
-                       goto out;
+               } else if (Ustrcmp(args[0], US"MECH") == 0) {
+                       CHECK_COMMAND("MECH", 1, INT_MAX);
+                       if (strcmpic(US args[1], ablock->public_name) == 0)
+                               found = 1;
+               } else if (Ustrcmp(args[0], US"DONE") == 0) {
+                       CHECK_COMMAND("DONE", 0, 0);
+                       cont = 0;
                }
        }
 
@@ -254,10 +241,10 @@ int auth_dovecot_server(auth_instance *ablock, uschar *data)
        /* Added by PH: extra fields when TLS is in use or if the TCP/IP
        connection is local. */
 
-       if (tls_cipher != NULL)
+       if (tls_in.cipher != NULL)
                auth_extra_data = string_sprintf("secured\t%s%s",
-                   tls_certificate_verified? "valid-client-cert" : "",
-                   tls_certificate_verified? "\t" : "");
+                   tls_in.certificate_verified? "valid-client-cert" : "",
+                   tls_in.certificate_verified? "\t" : "");
        else if (interface_address != NULL &&
                 Ustrcmp(sender_host_address, interface_address) == 0)
                auth_extra_data = US"secured\t";