[exim.git] / src / src / auths / spa.c

/*************************************************
*     Exim - an Internet mail transport agent    *
*************************************************/

/* Copyright (c) University of Cambridge 1995 - 2018 */
/* See the file NOTICE for conditions of use and distribution. */

/* This file, which provides support for Microsoft's Secure Password
Authentication, was contributed by Marc Prud'hommeaux. Tom Kistner added SPA
server support. I (PH) have only modified it in very trivial ways.

References:
  http://www.innovation.ch/java/ntlm.html
  http://www.kuro5hin.org/story/2002/4/28/1436/66154
  http://download.microsoft.com/download/9/5/e/95ef66af-9026-4bb0-a41d-a4f81802d92c/%5bMS-SMTP%5d.pdf

 * It seems that some systems have existing but different definitions of some
 * of the following types. I received a complaint about "int16" causing
 * compilation problems. So I (PH) have renamed them all, to be on the safe
 * side, by adding 'x' on the end. See auths/auth-spa.h.

 * typedef signed short int16;
 * typedef unsigned short uint16;
 * typedef unsigned uint32;
 * typedef unsigned char  uint8;

07-August-2003:  PH: Patched up the code to avoid assert bombouts for stupid
                     input data. Find appropriate comment by grepping for "PH".
16-October-2006: PH: Added a call to auth_check_serv_cond() at the end
05-June-2010:    PP: handle SASL initial response
*/


#include "../exim.h"
#include "spa.h"

/* #define DEBUG_SPA */

#ifdef DEBUG_SPA
#define DSPA(x,y,z)   debug_printf(x,y,z)
#else
#define DSPA(x,y,z)
#endif

/* Options specific to the spa authentication mechanism. */

optionlist auth_spa_options[] = {
  { "client_domain",             opt_stringptr,
      (void *)(offsetof(auth_spa_options_block, spa_domain)) },
  { "client_password",           opt_stringptr,
      (void *)(offsetof(auth_spa_options_block, spa_password)) },
  { "client_username",           opt_stringptr,
      (void *)(offsetof(auth_spa_options_block, spa_username)) },
  { "server_password",           opt_stringptr,
      (void *)(offsetof(auth_spa_options_block, spa_serverpassword)) }
};

/* Size of the options list. An extern variable has to be used so that its
address can appear in the tables drtables.c. */

int auth_spa_options_count =
  sizeof(auth_spa_options)/sizeof(optionlist);

/* Default private options block for the condition authentication method. */

auth_spa_options_block auth_spa_option_defaults = {
  NULL,              /* spa_password */
  NULL,              /* spa_username */
  NULL,              /* spa_domain */
  NULL               /* spa_serverpassword (for server side use) */
};


#ifdef MACRO_PREDEF

/* Dummy values */
void auth_spa_init(auth_instance *ablock) {}
int auth_spa_server(auth_instance *ablock, uschar *data) {return 0;}
int auth_spa_client(auth_instance *ablock, smtp_inblock *inblock,
  smtp_outblock *outblock, int timeout, uschar *buffer, int buffsize) {return 0;}

#else   /*!MACRO_PREDEF*/


/*************************************************
*          Initialization entry point            *
*************************************************/

/* Called for each instance, after its options have been read, to
enable consistency checks to be done, or anything else that needs
to be set up. */

void
auth_spa_init(auth_instance *ablock)
{
auth_spa_options_block *ob =
  (auth_spa_options_block *)(ablock->options_block);

/* The public name defaults to the authenticator name */

if (ablock->public_name == NULL) ablock->public_name = ablock->name;

/* Both username and password must be set for a client */

if ((ob->spa_username == NULL) != (ob->spa_password == NULL))
  log_write(0, LOG_PANIC_DIE|LOG_CONFIG_FOR, "%s authenticator:\n  "
      "one of client_username and client_password cannot be set without "
      "the other", ablock->name);
ablock->client = ob->spa_username != NULL;

/* For a server we have just one option */

ablock->server = ob->spa_serverpassword != NULL;
}


/*************************************************
*             Server entry point                 *
*************************************************/

/* For interface, see auths/README */

#define CVAL(buf,pos) ((US (buf))[pos])
#define PVAL(buf,pos) ((unsigned)CVAL(buf,pos))
#define SVAL(buf,pos) (PVAL(buf,pos)|PVAL(buf,(pos)+1)<<8)
#define IVAL(buf,pos) (SVAL(buf,pos)|SVAL(buf,(pos)+2)<<16)

int
auth_spa_server(auth_instance *ablock, uschar *data)
{
auth_spa_options_block *ob = (auth_spa_options_block *)(ablock->options_block);
uint8x lmRespData[24];
uint8x ntRespData[24];
SPAAuthRequest request;
SPAAuthChallenge challenge;
SPAAuthResponse  response;
SPAAuthResponse  *responseptr = &response;
uschar msgbuf[2048];
uschar *clearpass;

/* send a 334, MS Exchange style, and grab the client's request,
unless we already have it via an initial response. */

if ((*data == '\0') &&
    (auth_get_no64_data(&data, US"NTLM supported") != OK))
  {
  /* something borked */
  return FAIL;
  }

if (spa_base64_to_bits(CS (&request), sizeof(request), CCS (data)) < 0)
  {
  DEBUG(D_auth) debug_printf("auth_spa_server(): bad base64 data in "
  "request: %s\n", data);
  return FAIL;
  }

/* create a challenge and send it back */

spa_build_auth_challenge(&request,&challenge);
spa_bits_to_base64 (msgbuf, (unsigned char*)&challenge,
    spa_request_length(&challenge));

if (auth_get_no64_data(&data, msgbuf) != OK)
  {
  /* something borked */
  return FAIL;
  }

/* dump client response */
if (spa_base64_to_bits(CS (&response), sizeof(response), CCS (data)) < 0)
  {
  DEBUG(D_auth) debug_printf("auth_spa_server(): bad base64 data in "
  "response: %s\n", data);
  return FAIL;
  }

/***************************************************************
PH 07-Aug-2003: The original code here was this:

Ustrcpy(msgbuf, unicodeToString(((char*)responseptr) +
  IVAL(&responseptr->uUser.offset,0),
  SVAL(&responseptr->uUser.len,0)/2) );

However, if the response data is too long, unicodeToString bombs out on
an assertion failure. It uses a 1024 fixed buffer. Bombing out is not a good
idea. It's too messy to try to rework that function to return an error because
it is called from a number of other places in the auth-spa.c module. Instead,
since it is a very small function, I reproduce its code here, with a size check
that causes failure if the size of msgbuf is exceeded. ****/

  {
  int i;
  char *p = ((char*)responseptr) + IVAL(&responseptr->uUser.offset,0);
  int len = SVAL(&responseptr->uUser.len,0)/2;

  if (len + 1 >= sizeof(msgbuf)) return FAIL;
  for (i = 0; i < len; ++i)
    {
    msgbuf[i] = *p & 0x7f;
    p += 2;
    }
  msgbuf[i] = 0;
  }

/***************************************************************/

/* Put the username in $auth1 and $1. The former is now the preferred variable;
the latter is the original variable. These have to be out of stack memory, and
need to be available once known even if not authenticated, for error messages
(server_set_id, which only makes it to authenticated_id if we return OK) */

auth_vars[0] = expand_nstring[1] = string_copy(msgbuf);
expand_nlength[1] = Ustrlen(msgbuf);
expand_nmax = 1;

debug_print_string(ablock->server_debug_string);    /* customized debug */

/* look up password */

clearpass = expand_string(ob->spa_serverpassword);
if (clearpass == NULL)
  {
  if (f.expand_string_forcedfail)
    {
    DEBUG(D_auth) debug_printf("auth_spa_server(): forced failure while "
      "expanding spa_serverpassword\n");
    return FAIL;
    }
  else
    {
    DEBUG(D_auth) debug_printf("auth_spa_server(): error while expanding "
      "spa_serverpassword: %s\n", expand_string_message);
    return DEFER;
    }
  }

/* create local hash copy */

spa_smb_encrypt (clearpass, challenge.challengeData, lmRespData);
spa_smb_nt_encrypt (clearpass, challenge.challengeData, ntRespData);

/* compare NT hash (LM may not be available) */

if (memcmp(ntRespData,
      ((unsigned char*)responseptr)+IVAL(&responseptr->ntResponse.offset,0),
      24) == 0)
  /* success. we have a winner. */
  {
  return auth_check_serv_cond(ablock);
  }

  /* Expand server_condition as an authorization check (PH) */

return FAIL;
}


/*************************************************
*              Client entry point                *
*************************************************/

/* For interface, see auths/README */

int
auth_spa_client(
  auth_instance *ablock,                 /* authenticator block */
  smtp_inblock *inblock,                 /* connection inblock */
  smtp_outblock *outblock,               /* connection outblock */
  int timeout,                           /* command timeout */
  uschar *buffer,                        /* buffer for reading response */
  int buffsize)                          /* size of buffer */
{
auth_spa_options_block *ob =
       (auth_spa_options_block *)(ablock->options_block);
SPAAuthRequest   request;
SPAAuthChallenge challenge;
SPAAuthResponse  response;
char msgbuf[2048];
char *domain = NULL;
char *username, *password;

/* Code added by PH to expand the options */

*buffer = 0;    /* Default no message when cancelled */

if (!(username = CS expand_string(ob->spa_username)))
  {
  if (f.expand_string_forcedfail) return CANCELLED;
  string_format(buffer, buffsize, "expansion of \"%s\" failed in %s "
   "authenticator: %s", ob->spa_username, ablock->name,
   expand_string_message);
  return ERROR;
  }

if (!(password = CS expand_string(ob->spa_password)))
  {
  if (f.expand_string_forcedfail) return CANCELLED;
  string_format(buffer, buffsize, "expansion of \"%s\" failed in %s "
   "authenticator: %s", ob->spa_password, ablock->name,
   expand_string_message);
  return ERROR;
  }

if (ob->spa_domain)
  {
  if (!(domain = CS expand_string(ob->spa_domain)))
    {
    if (f.expand_string_forcedfail) return CANCELLED;
    string_format(buffer, buffsize, "expansion of \"%s\" failed in %s "
		  "authenticator: %s", ob->spa_domain, ablock->name,
		  expand_string_message);
    return ERROR;
    }
  }

/* Original code */

if (smtp_write_command(outblock, SCMD_FLUSH, "AUTH %s\r\n",
    ablock->public_name) < 0)
  return FAIL_SEND;

/* wait for the 3XX OK message */
if (!smtp_read_response(inblock, US buffer, buffsize, '3', timeout))
  return FAIL;

DSPA("\n\n%s authenticator: using domain %s\n\n", ablock->name, domain);

spa_build_auth_request (&request, CS username, domain);
spa_bits_to_base64 (US msgbuf, (unsigned char*)&request,
       spa_request_length(&request));

DSPA("\n\n%s authenticator: sending request (%s)\n\n", ablock->name, msgbuf);

/* send the encrypted password */
if (smtp_write_command(outblock, SCMD_FLUSH, "%s\r\n", msgbuf) < 0)
  return FAIL_SEND;

/* wait for the auth challenge */
if (!smtp_read_response(inblock, US buffer, buffsize, '3', timeout))
  return FAIL;

/* convert the challenge into the challenge struct */
DSPA("\n\n%s authenticator: challenge (%s)\n\n", ablock->name, buffer + 4);
spa_base64_to_bits (CS (&challenge), sizeof(challenge), CCS (buffer + 4));

spa_build_auth_response (&challenge, &response, CS username, CS password);
spa_bits_to_base64 (US msgbuf, (unsigned char*)&response,
       spa_request_length(&response));
DSPA("\n\n%s authenticator: challenge response (%s)\n\n", ablock->name, msgbuf);

/* send the challenge response */
if (smtp_write_command(outblock, SCMD_FLUSH, "%s\r\n", msgbuf) < 0)
       return FAIL_SEND;

/* If we receive a success response from the server, authentication
has succeeded. There may be more data to send, but is there any point
in provoking an error here? */

if (smtp_read_response(inblock, US buffer, buffsize, '2', timeout))
  return OK;

/* Not a success response. If errno != 0 there is some kind of transmission
error. Otherwise, check the response code in the buffer. If it starts with
'3', more data is expected. */

if (errno != 0 || buffer[0] != '3')
  return FAIL;

return FAIL;
}

#endif   /*!MACRO_PREDEF*/
/* End of spa.c */
Commit	Line	Data
0756eb3c PH	1	/*************************************************
	2	* Exim - an Internet mail transport agent *
	3	*************************************************/
	4
f9ba5e22	5	/* Copyright (c) University of Cambridge 1995 - 2018 */
0756eb3c PH	6	/* See the file NOTICE for conditions of use and distribution. */
	7
	8	/* This file, which provides support for Microsoft's Secure Password
	9	Authentication, was contributed by Marc Prud'hommeaux. Tom Kistner added SPA
	10	server support. I (PH) have only modified it in very trivial ways.
	11
	12	References:
	13	http://www.innovation.ch/java/ntlm.html
	14	http://www.kuro5hin.org/story/2002/4/28/1436/66154
55c75993	15	http://download.microsoft.com/download/9/5/e/95ef66af-9026-4bb0-a41d-a4f81802d92c/%5bMS-SMTP%5d.pdf
0756eb3c PH	16
	17	* It seems that some systems have existing but different definitions of some
	18	* of the following types. I received a complaint about "int16" causing
	19	* compilation problems. So I (PH) have renamed them all, to be on the safe
	20	* side, by adding 'x' on the end. See auths/auth-spa.h.
	21
	22	* typedef signed short int16;
	23	* typedef unsigned short uint16;
	24	* typedef unsigned uint32;
	25	* typedef unsigned char uint8;
	26
16ff981e PH	27	07-August-2003: PH: Patched up the code to avoid assert bombouts for stupid
	28	input data. Find appropriate comment by grepping for "PH".
	29	16-October-2006: PH: Added a call to auth_check_serv_cond() at the end
55c75993	30	05-June-2010: PP: handle SASL initial response
0756eb3c PH	31	*/
	32
	33
	34	#include "../exim.h"
	35	#include "spa.h"
	36
	37	/* #define DEBUG_SPA */
	38
	39	#ifdef DEBUG_SPA
	40	#define DSPA(x,y,z) debug_printf(x,y,z)
	41	#else
	42	#define DSPA(x,y,z)
	43	#endif
	44
	45	/* Options specific to the spa authentication mechanism. */
	46
	47	optionlist auth_spa_options[] = {
	48	{ "client_domain", opt_stringptr,
	49	(void *)(offsetof(auth_spa_options_block, spa_domain)) },
	50	{ "client_password", opt_stringptr,
	51	(void *)(offsetof(auth_spa_options_block, spa_password)) },
	52	{ "client_username", opt_stringptr,
	53	(void *)(offsetof(auth_spa_options_block, spa_username)) },
	54	{ "server_password", opt_stringptr,
	55	(void *)(offsetof(auth_spa_options_block, spa_serverpassword)) }
	56	};
	57
	58	/* Size of the options list. An extern variable has to be used so that its
	59	address can appear in the tables drtables.c. */
	60
	61	int auth_spa_options_count =
	62	sizeof(auth_spa_options)/sizeof(optionlist);
	63
4c04137d	64	/* Default private options block for the condition authentication method. */
0756eb3c PH	65
	66	auth_spa_options_block auth_spa_option_defaults = {
	67	NULL, /* spa_password */
	68	NULL, /* spa_username */
	69	NULL, /* spa_domain */
	70	NULL /* spa_serverpassword (for server side use) */
	71	};
	72
	73
d185889f JH	74	#ifdef MACRO_PREDEF
	75
	76	/* Dummy values */
	77	void auth_spa_init(auth_instance *ablock) {}
	78	int auth_spa_server(auth_instance ablock, uschar data) {return 0;}
	79	int auth_spa_client(auth_instance ablock, smtp_inblock inblock,
	80	smtp_outblock outblock, int timeout, uschar buffer, int buffsize) {return 0;}
	81
	82	#else /!MACRO_PREDEF/
	83
	84
	85
	86
0756eb3c PH	87	/*************************************************
	88	* Initialization entry point *
	89	*************************************************/
	90
	91	/* Called for each instance, after its options have been read, to
	92	enable consistency checks to be done, or anything else that needs
	93	to be set up. */
	94
	95	void
	96	auth_spa_init(auth_instance *ablock)
	97	{
	98	auth_spa_options_block *ob =
	99	(auth_spa_options_block *)(ablock->options_block);
	100
	101	/* The public name defaults to the authenticator name */
	102
	103	if (ablock->public_name == NULL) ablock->public_name = ablock->name;
	104
	105	/* Both username and password must be set for a client */
	106
	107	if ((ob->spa_username == NULL) != (ob->spa_password == NULL))
	108	log_write(0, LOG_PANIC_DIE\|LOG_CONFIG_FOR, "%s authenticator:\n "
	109	"one of client_username and client_password cannot be set without "
	110	"the other", ablock->name);
	111	ablock->client = ob->spa_username != NULL;
	112
	113	/* For a server we have just one option */
	114
	115	ablock->server = ob->spa_serverpassword != NULL;
	116	}
	117
	118
	119
	120	/*************************************************
	121	* Server entry point *
	122	*************************************************/
	123
	124	/* For interface, see auths/README */
	125
5903c6ff	126	#define CVAL(buf,pos) ((US (buf))[pos])
0756eb3c PH	127	#define PVAL(buf,pos) ((unsigned)CVAL(buf,pos))
	128	#define SVAL(buf,pos) (PVAL(buf,pos)\|PVAL(buf,(pos)+1)<<8)
	129	#define IVAL(buf,pos) (SVAL(buf,pos)\|SVAL(buf,(pos)+2)<<16)
	130
	131	int
	132	auth_spa_server(auth_instance ablock, uschar data)
	133	{
	134	auth_spa_options_block ob = (auth_spa_options_block )(ablock->options_block);
	135	uint8x lmRespData[24];
	136	uint8x ntRespData[24];
	137	SPAAuthRequest request;
	138	SPAAuthChallenge challenge;
	139	SPAAuthResponse response;
	140	SPAAuthResponse *responseptr = &response;
	141	uschar msgbuf[2048];
	142	uschar *clearpass;
	143
55c75993 PP	144	/* send a 334, MS Exchange style, and grab the client's request,
55c75993 PP	145	unless we already have it via an initial response. */
0756eb3c	146
55c75993 PP	147	if ((*data == '\0') &&
55c75993 PP	148	(auth_get_no64_data(&data, US"NTLM supported") != OK))
0756eb3c PH	149	{
	150	/* something borked */
	151	return FAIL;
	152	}
	153
5903c6ff	154	if (spa_base64_to_bits(CS (&request), sizeof(request), CCS (data)) < 0)
0756eb3c PH	155	{
	156	DEBUG(D_auth) debug_printf("auth_spa_server(): bad base64 data in "
	157	"request: %s\n", data);
	158	return FAIL;
	159	}
	160
	161	/* create a challenge and send it back */
	162
	163	spa_build_auth_challenge(&request,&challenge);
	164	spa_bits_to_base64 (msgbuf, (unsigned char*)&challenge,
	165	spa_request_length(&challenge));
	166
	167	if (auth_get_no64_data(&data, msgbuf) != OK)
	168	{
	169	/* something borked */
	170	return FAIL;
	171	}
	172
	173	/* dump client response */
5903c6ff	174	if (spa_base64_to_bits(CS (&response), sizeof(response), CCS (data)) < 0)
0756eb3c PH	175	{
	176	DEBUG(D_auth) debug_printf("auth_spa_server(): bad base64 data in "
	177	"response: %s\n", data);
	178	return FAIL;
	179	}
	180
0756eb3c PH	181	/***************************************************************
	182	PH 07-Aug-2003: The original code here was this:
	183
	184	Ustrcpy(msgbuf, unicodeToString(((char*)responseptr) +
	185	IVAL(&responseptr->uUser.offset,0),
	186	SVAL(&responseptr->uUser.len,0)/2) );
	187
	188	However, if the response data is too long, unicodeToString bombs out on
	189	an assertion failure. It uses a 1024 fixed buffer. Bombing out is not a good
	190	idea. It's too messy to try to rework that function to return an error because
	191	it is called from a number of other places in the auth-spa.c module. Instead,
	192	since it is a very small function, I reproduce its code here, with a size check
	193	that causes failure if the size of msgbuf is exceeded. ****/
	194
	195	{
	196	int i;
	197	char p = ((char)responseptr) + IVAL(&responseptr->uUser.offset,0);
	198	int len = SVAL(&responseptr->uUser.len,0)/2;
	199
	200	if (len + 1 >= sizeof(msgbuf)) return FAIL;
	201	for (i = 0; i < len; ++i)
	202	{
	203	msgbuf[i] = *p & 0x7f;
	204	p += 2;
	205	}
	206	msgbuf[i] = 0;
	207	}
	208
	209	/***************************************************************/
	210
f78eb7c6	211	/* Put the username in $auth1 and $1. The former is now the preferred variable;
f68fe5f6 PP	212	the latter is the original variable. These have to be out of stack memory, and
	213	need to be available once known even if not authenticated, for error messages
	214	(server_set_id, which only makes it to authenticated_id if we return OK) */
f78eb7c6	215
f68fe5f6	216	auth_vars[0] = expand_nstring[1] = string_copy(msgbuf);
0756eb3c PH	217	expand_nlength[1] = Ustrlen(msgbuf);
	218	expand_nmax = 1;
	219
f78eb7c6 PH	220	debug_print_string(ablock->server_debug_string); /* customized debug */
f78eb7c6 PH	221
0756eb3c PH	222	/* look up password */
	223
	224	clearpass = expand_string(ob->spa_serverpassword);
	225	if (clearpass == NULL)
	226	{
8768d548	227	if (f.expand_string_forcedfail)
0756eb3c PH	228	{
	229	DEBUG(D_auth) debug_printf("auth_spa_server(): forced failure while "
	230	"expanding spa_serverpassword\n");
f68fe5f6	231	return FAIL;
0756eb3c PH	232	}
	233	else
	234	{
	235	DEBUG(D_auth) debug_printf("auth_spa_server(): error while expanding "
	236	"spa_serverpassword: %s\n", expand_string_message);
f68fe5f6	237	return DEFER;
0756eb3c PH	238	}
	239	}
	240
	241	/* create local hash copy */
	242
	243	spa_smb_encrypt (clearpass, challenge.challengeData, lmRespData);
	244	spa_smb_nt_encrypt (clearpass, challenge.challengeData, ntRespData);
	245
	246	/* compare NT hash (LM may not be available) */
	247
	248	if (memcmp(ntRespData,
	249	((unsigned char*)responseptr)+IVAL(&responseptr->ntResponse.offset,0),
	250	24) == 0)
	251	/* success. we have a winner. */
08488c86	252	{
f68fe5f6	253	return auth_check_serv_cond(ablock);
08488c86	254	}
16ff981e PH	255
16ff981e PH	256	/* Expand server_condition as an authorization check (PH) */
0756eb3c	257
f68fe5f6	258	return FAIL;
0756eb3c PH	259	}
	260
	261
	262	/*************************************************
	263	* Client entry point *
	264	*************************************************/
	265
	266	/* For interface, see auths/README */
	267
	268	int
	269	auth_spa_client(
	270	auth_instance ablock, / authenticator block */
	271	smtp_inblock inblock, / connection inblock */
	272	smtp_outblock outblock, / connection outblock */
	273	int timeout, /* command timeout */
	274	uschar buffer, / buffer for reading response */
	275	int buffsize) /* size of buffer */
	276	{
4e910c01 JH	277	auth_spa_options_block *ob =
	278	(auth_spa_options_block *)(ablock->options_block);
	279	SPAAuthRequest request;
	280	SPAAuthChallenge challenge;
	281	SPAAuthResponse response;
	282	char msgbuf[2048];
	283	char *domain = NULL;
	284	char username, password;
	285
	286	/* Code added by PH to expand the options */
	287
	288	buffer = 0; / Default no message when cancelled */
	289
	290	if (!(username = CS expand_string(ob->spa_username)))
	291	{
8768d548	292	if (f.expand_string_forcedfail) return CANCELLED;
4e910c01 JH	293	string_format(buffer, buffsize, "expansion of \"%s\" failed in %s "
	294	"authenticator: %s", ob->spa_username, ablock->name,
	295	expand_string_message);
	296	return ERROR;
	297	}
	298
	299	if (!(password = CS expand_string(ob->spa_password)))
	300	{
8768d548	301	if (f.expand_string_forcedfail) return CANCELLED;
4e910c01 JH	302	string_format(buffer, buffsize, "expansion of \"%s\" failed in %s "
	303	"authenticator: %s", ob->spa_password, ablock->name,
	304	expand_string_message);
	305	return ERROR;
	306	}
	307
	308	if (ob->spa_domain)
	309	{
	310	if (!(domain = CS expand_string(ob->spa_domain)))
	311	{
8768d548	312	if (f.expand_string_forcedfail) return CANCELLED;
4e910c01 JH	313	string_format(buffer, buffsize, "expansion of \"%s\" failed in %s "
	314	"authenticator: %s", ob->spa_domain, ablock->name,
	315	expand_string_message);
	316	return ERROR;
	317	}
	318	}
	319
	320	/* Original code */
	321
	322	if (smtp_write_command(outblock, SCMD_FLUSH, "AUTH %s\r\n",
	323	ablock->public_name) < 0)
	324	return FAIL_SEND;
	325
	326	/* wait for the 3XX OK message */
5903c6ff	327	if (!smtp_read_response(inblock, US buffer, buffsize, '3', timeout))
4e910c01 JH	328	return FAIL;
	329
	330	DSPA("\n\n%s authenticator: using domain %s\n\n", ablock->name, domain);
	331
	332	spa_build_auth_request (&request, CS username, domain);
	333	spa_bits_to_base64 (US msgbuf, (unsigned char*)&request,
	334	spa_request_length(&request));
	335
	336	DSPA("\n\n%s authenticator: sending request (%s)\n\n", ablock->name, msgbuf);
	337
	338	/* send the encrypted password */
	339	if (smtp_write_command(outblock, SCMD_FLUSH, "%s\r\n", msgbuf) < 0)
	340	return FAIL_SEND;
	341
	342	/* wait for the auth challenge */
5903c6ff	343	if (!smtp_read_response(inblock, US buffer, buffsize, '3', timeout))
4e910c01 JH	344	return FAIL;
	345
	346	/* convert the challenge into the challenge struct */
	347	DSPA("\n\n%s authenticator: challenge (%s)\n\n", ablock->name, buffer + 4);
5903c6ff	348	spa_base64_to_bits (CS (&challenge), sizeof(challenge), CCS (buffer + 4));
4e910c01 JH	349
	350	spa_build_auth_response (&challenge, &response, CS username, CS password);
	351	spa_bits_to_base64 (US msgbuf, (unsigned char*)&response,
	352	spa_request_length(&response));
	353	DSPA("\n\n%s authenticator: challenge response (%s)\n\n", ablock->name, msgbuf);
	354
	355	/* send the challenge response */
	356	if (smtp_write_command(outblock, SCMD_FLUSH, "%s\r\n", msgbuf) < 0)
	357	return FAIL_SEND;
	358
	359	/* If we receive a success response from the server, authentication
	360	has succeeded. There may be more data to send, but is there any point
	361	in provoking an error here? */
	362
	363	if (smtp_read_response(inblock, US buffer, buffsize, '2', timeout))
	364	return OK;
	365
	366	/* Not a success response. If errno != 0 there is some kind of transmission
	367	error. Otherwise, check the response code in the buffer. If it starts with
	368	'3', more data is expected. */
	369
	370	if (errno != 0 \|\| buffer[0] != '3')
	371	return FAIL;
	372
	373	return FAIL;
0756eb3c PH	374	}
0756eb3c PH	375
d185889f	376	#endif /!MACRO_PREDEF/
0756eb3c	377	/* End of spa.c */