auth: Add policy check configuration options Allows disabling before/after auth checks, or reporting.

global: don't cast NULL to void * NULL is guaranteed to be a void * thanks to dd6043c05e32a8e8db1233ed711a2c74d1477a89.

auth: client protocol: Recognize empty initial response field as an absent initial response for older clients. Particularly, Exim sends an empty initial response field in the AUTH request for an authentication command that has no initial response. Originally, Dovecot allowed this, but this was recently changed so that the EXTERNAL SASL mechanism works properly from ManageSieve. This commit makes it allowed again for older authentication clients to send an empty initial response field for an authentication command that has no initial response part. Sending '=' for an empty initial response is still allowed in general.

Updated copyright notices to include the year 2018.

auth: Properly recognize an empty initial SASL response. It was erroneously handled as an absent initial response. Restructured the code for clarity and changed the comments: '=' should not be passed to SASL layer at all.

global: Use t_buffer_create sed -i -e 's/buffer_create_dynamic(pool_datastack_create(), */t_buffer_create(/g'

global: Fix spelling mistakes in comments Original work by @andreasschulze and @jsoref

global: start relying on timeout_remove(NULL) being a no-op Cleanup performed with the following semantic patch: @@ expression E; @@ - if (E != NULL) { - timeout_remove(&E); - } + timeout_remove(&E);

auth: Access always first entry when flushing failures The code is deleting the first item after accessing it, and then moving forward. It will eventually go beyond the array and get NULL ptr and fail. Instead we need to always get the first item, since the array deletion is moving the queued items forward. Broken by e18b4e41

auth: Shuffle failed auth requests before sending the failure replies. This might be helpful against some timing attacks. Using Fisher–Yates shuffle.

Updated copyright notices to include the year 2017.

auth,login-common: Added result code for invalid base64-encoded response data.

auth: Added a code= field to the auth FAIL response that replaces the "authz", "temp", "pass_expired", and "user_disabled" fields.

global: Replaced t_strsplit_tab() calls with t_strsplit_tabescaped() This is useful especially in auth code to support LFs in extra fields. Other pieces of code were also tab-escaping strings, but never unescaping them. Usually it didn't matter, because nobody would use the escaped characters. Still, the code wasn't exactly behaving correctly. One downside to this change is that it's now possible to pass through TABs, CRs and LFs through the various protocols. In theory this shouldn't cause any problems, but combined with other bugs this could trigger some security problems.

auth: Fixed assert-crash on invalid auth-client input For example if client sends invalid input like: auth: Error: BUG: Authentication client sent unknown command: XYZ Fixes crash: auth: Panic: key not found from hash

global: Added uchar_empty_ptr and use it instead of &uchar_nul. This makes Coverity happier about not treating a char as an array. For now this is a pointer to a 0, but could as well become a pointer that crashes if dereferenced. Shouldn't be NULL anyway because clang's -fsanitize=nonnull-attribute will complain about them.

auth: Skip authentication with noauthenticate

auth: Finish policy.[ch] renaming..

auth-policy: Report success earlier

auth-policy: Hook auth policy to auth code

global: unsigned int:1 -> bool:1 perl -i -pe 's/unsigned int ([^,:;]+):1;/bool $1:1;/' **/*.[ch]

auth: Code cleanup - avoid using void *context auth_request_callback_t always uses struct auth_client/master_connection* in the context - no need to try to be too generic here.

global: freshen copyright git ls-files | xargs perl -p -i -e 's/(\d+)-201[0-5]/$1-2016/g;s/ (201[0-5]) Dovecot/ $1-2016 Dovecot/'

Remove now-unnecessary direct stdlib.h #includes.

auth: The mechanisms configured using the auth_mechanisms setting were not enforced. The login service would check whether the mechanism is supported by auth, but auth performed no such check of its own. This means that any implemented mechanism was accessible from a login, even though was presumably disabled.

auth: Don't add original_user or auth_user to passdb reply if they already exist. This allows passdb to override their values cleanly.

global: freshen copyright Robomatically: git ls-files | xargs perl -p -i -e 's/(\d+)-201[0-4]/$1-2015/g;s/ (201[0-4]) Dovecot/ $1-2015 Dovecot/' Happy 2015 everyone! Signed-off-by: Phil Carmody <phil@dovecot.fi>

auth: If authentication fails, never send back "nologin" field. This only causes confusion.

auth: Use special AUTH_SUBSYS_DB/MECH parameters as auth_request_log*() subsystem. This avoids hardcoded strings all over the place and also allows assigning the correct passdb/userdb name for log messages generated by generic passdb/userdb code, which doesn't know exactly where it was called from.

Updated copyright notices to include year 2014.

auth, login, mail: Added %{auth_user}, %{auth_username} and %{auth_domain} They expand to the SASL authentication ID. So if master user login is done, it expands to the master user. If username changes during authentication, it expands to the original username. Otherwise %{user} and %{auth_user} are equal.

auth: Send original_user to auth client also when there aren't any extra fields.

auth: Added userdb result_success/failure/tempfail and skip settings, similar to passdb's.

auth: Fixed potential crash.

auth: Potential crashfix

auth: Added %{session_pid} variable for userdb lookups in login requests. session_pid is now always sent to auth process. A new request_auth_token parameter was added to specify if auth_token should be returned or not.

*-login: Added %{orig_user}, %{orig_username} and %{orig_domain} variables. The original username is what the client sent to server before any translations.

auth: Return "nologin" and "proxy" fields to login process without "=value".

Oops :) Update copyrights to 2013 without breaking all .c files.

Updated copyright notices to include year 2013.