X-Git-Url: https://vcs.fsf.org/?p=exim.git;a=blobdiff_plain;f=src%2Fsrc%2Fauths%2Fspa.c;h=378d4f6027d18403a6fe22f8670711f1f48737a7;hp=1abd657813b3d5d3d86fa550553675f49343ce5d;hb=4e910c01eea401e36044816744691789ef4656fa;hpb=3ecab1575ef1f45a5e7cd3c48cd937ffa8eb0ad9 diff --git a/src/src/auths/spa.c b/src/src/auths/spa.c index 1abd65781..378d4f602 100644 --- a/src/src/auths/spa.c +++ b/src/src/auths/spa.c @@ -61,7 +61,7 @@ address can appear in the tables drtables.c. */ int auth_spa_options_count = sizeof(auth_spa_options)/sizeof(optionlist); -/* Default private options block for the contidion authentication method. */ +/* Default private options block for the condition authentication method. */ auth_spa_options_block auth_spa_option_defaults = { NULL, /* spa_password */ @@ -196,17 +196,14 @@ that causes failure if the size of msgbuf is exceeded. ****/ /***************************************************************/ /* Put the username in $auth1 and $1. The former is now the preferred variable; -the latter is the original variable. */ +the latter is the original variable. These have to be out of stack memory, and +need to be available once known even if not authenticated, for error messages +(server_set_id, which only makes it to authenticated_id if we return OK) */ -auth_vars[0] = expand_nstring[1] = msgbuf; +auth_vars[0] = expand_nstring[1] = string_copy(msgbuf); expand_nlength[1] = Ustrlen(msgbuf); expand_nmax = 1; -/* clean up globals which aren't referenced, but still shouldn't be left -pointing to stack memory */ -#define CLEANUP_RETURN(Code) do { auth_vars[0] = expand_nstring[1] = NULL; \ - expand_nlength[1] = expand_nmax = 0; return (Code); } while (0); - debug_print_string(ablock->server_debug_string); /* customized debug */ /* look up password */ @@ -218,13 +215,13 @@ if (clearpass == NULL) { DEBUG(D_auth) debug_printf("auth_spa_server(): forced failure while " "expanding spa_serverpassword\n"); - CLEANUP_RETURN(FAIL); + return FAIL; } else { DEBUG(D_auth) debug_printf("auth_spa_server(): error while expanding " "spa_serverpassword: %s\n", expand_string_message); - CLEANUP_RETURN(DEFER); + return DEFER; } } @@ -240,13 +237,12 @@ if (memcmp(ntRespData, 24) == 0) /* success. we have a winner. */ { - int rc = auth_check_serv_cond(ablock); - CLEANUP_RETURN(rc); + return auth_check_serv_cond(ablock); } /* Expand server_condition as an authorization check (PH) */ -CLEANUP_RETURN(FAIL); +return FAIL; } @@ -265,109 +261,103 @@ auth_spa_client( uschar *buffer, /* buffer for reading response */ int buffsize) /* size of buffer */ { - auth_spa_options_block *ob = - (auth_spa_options_block *)(ablock->options_block); - SPAAuthRequest request; - SPAAuthChallenge challenge; - SPAAuthResponse response; - char msgbuf[2048]; - char *domain = NULL; - char *username, *password; - - /* Code added by PH to expand the options */ - - *buffer = 0; /* Default no message when cancelled */ - - username = CS expand_string(ob->spa_username); - if (username == NULL) - { - if (expand_string_forcedfail) return CANCELLED; - string_format(buffer, buffsize, "expansion of \"%s\" failed in %s " - "authenticator: %s", ob->spa_username, ablock->name, - expand_string_message); - return ERROR; - } - - password = CS expand_string(ob->spa_password); - if (password == NULL) - { - if (expand_string_forcedfail) return CANCELLED; - string_format(buffer, buffsize, "expansion of \"%s\" failed in %s " - "authenticator: %s", ob->spa_password, ablock->name, - expand_string_message); - return ERROR; - } - - if (ob->spa_domain != NULL) - { - domain = CS expand_string(ob->spa_domain); - if (domain == NULL) - { - if (expand_string_forcedfail) return CANCELLED; - string_format(buffer, buffsize, "expansion of \"%s\" failed in %s " - "authenticator: %s", ob->spa_domain, ablock->name, - expand_string_message); - return ERROR; - } - } - - /* Original code */ - - if (smtp_write_command(outblock, FALSE, "AUTH %s\r\n", - ablock->public_name) < 0) - return FAIL_SEND; - - /* wait for the 3XX OK message */ - if (!smtp_read_response(inblock, (uschar *)buffer, buffsize, '3', timeout)) - return FAIL; - - DSPA("\n\n%s authenticator: using domain %s\n\n", - ablock->name, domain); - - spa_build_auth_request (&request, CS username, domain); - spa_bits_to_base64 (US msgbuf, (unsigned char*)&request, - spa_request_length(&request)); - - DSPA("\n\n%s authenticator: sending request (%s)\n\n", ablock->name, - msgbuf); - - /* send the encrypted password */ - if (smtp_write_command(outblock, FALSE, "%s\r\n", msgbuf) < 0) - return FAIL_SEND; - - /* wait for the auth challenge */ - if (!smtp_read_response(inblock, (uschar *)buffer, buffsize, '3', timeout)) - return FAIL; - - /* convert the challenge into the challenge struct */ - DSPA("\n\n%s authenticator: challenge (%s)\n\n", - ablock->name, buffer + 4); - spa_base64_to_bits ((char *)(&challenge), sizeof(challenge), (const char *)(buffer + 4)); - - spa_build_auth_response (&challenge, &response, - CS username, CS password); - spa_bits_to_base64 (US msgbuf, (unsigned char*)&response, - spa_request_length(&response)); - DSPA("\n\n%s authenticator: challenge response (%s)\n\n", ablock->name, - msgbuf); - - /* send the challenge response */ - if (smtp_write_command(outblock, FALSE, "%s\r\n", msgbuf) < 0) - return FAIL_SEND; - - /* If we receive a success response from the server, authentication - has succeeded. There may be more data to send, but is there any point - in provoking an error here? */ - if (smtp_read_response(inblock, US buffer, buffsize, '2', timeout)) - return OK; - - /* Not a success response. If errno != 0 there is some kind of transmission - error. Otherwise, check the response code in the buffer. If it starts with - '3', more data is expected. */ - if (errno != 0 || buffer[0] != '3') - return FAIL; - - return FAIL; +auth_spa_options_block *ob = + (auth_spa_options_block *)(ablock->options_block); +SPAAuthRequest request; +SPAAuthChallenge challenge; +SPAAuthResponse response; +char msgbuf[2048]; +char *domain = NULL; +char *username, *password; + +/* Code added by PH to expand the options */ + +*buffer = 0; /* Default no message when cancelled */ + +if (!(username = CS expand_string(ob->spa_username))) + { + if (expand_string_forcedfail) return CANCELLED; + string_format(buffer, buffsize, "expansion of \"%s\" failed in %s " + "authenticator: %s", ob->spa_username, ablock->name, + expand_string_message); + return ERROR; + } + +if (!(password = CS expand_string(ob->spa_password))) + { + if (expand_string_forcedfail) return CANCELLED; + string_format(buffer, buffsize, "expansion of \"%s\" failed in %s " + "authenticator: %s", ob->spa_password, ablock->name, + expand_string_message); + return ERROR; + } + +if (ob->spa_domain) + { + if (!(domain = CS expand_string(ob->spa_domain))) + { + if (expand_string_forcedfail) return CANCELLED; + string_format(buffer, buffsize, "expansion of \"%s\" failed in %s " + "authenticator: %s", ob->spa_domain, ablock->name, + expand_string_message); + return ERROR; + } + } + +/* Original code */ + +if (smtp_write_command(outblock, SCMD_FLUSH, "AUTH %s\r\n", + ablock->public_name) < 0) + return FAIL_SEND; + +/* wait for the 3XX OK message */ +if (!smtp_read_response(inblock, (uschar *)buffer, buffsize, '3', timeout)) + return FAIL; + +DSPA("\n\n%s authenticator: using domain %s\n\n", ablock->name, domain); + +spa_build_auth_request (&request, CS username, domain); +spa_bits_to_base64 (US msgbuf, (unsigned char*)&request, + spa_request_length(&request)); + +DSPA("\n\n%s authenticator: sending request (%s)\n\n", ablock->name, msgbuf); + +/* send the encrypted password */ +if (smtp_write_command(outblock, SCMD_FLUSH, "%s\r\n", msgbuf) < 0) + return FAIL_SEND; + +/* wait for the auth challenge */ +if (!smtp_read_response(inblock, (uschar *)buffer, buffsize, '3', timeout)) + return FAIL; + +/* convert the challenge into the challenge struct */ +DSPA("\n\n%s authenticator: challenge (%s)\n\n", ablock->name, buffer + 4); +spa_base64_to_bits ((char *)(&challenge), sizeof(challenge), (const char *)(buffer + 4)); + +spa_build_auth_response (&challenge, &response, CS username, CS password); +spa_bits_to_base64 (US msgbuf, (unsigned char*)&response, + spa_request_length(&response)); +DSPA("\n\n%s authenticator: challenge response (%s)\n\n", ablock->name, msgbuf); + +/* send the challenge response */ +if (smtp_write_command(outblock, SCMD_FLUSH, "%s\r\n", msgbuf) < 0) + return FAIL_SEND; + +/* If we receive a success response from the server, authentication +has succeeded. There may be more data to send, but is there any point +in provoking an error here? */ + +if (smtp_read_response(inblock, US buffer, buffsize, '2', timeout)) + return OK; + +/* Not a success response. If errno != 0 there is some kind of transmission +error. Otherwise, check the response code in the buffer. If it starts with +'3', more data is expected. */ + +if (errno != 0 || buffer[0] != '3') + return FAIL; + +return FAIL; } /* End of spa.c */