mech-apop: Fix spelling mistake Original work by @jsoref

auth: Use mem_equals_timing_safe() for all password hash comparisons. It's unlikely these could be used to perform timing attacks, since the attacker would have to have broken MD5/SHA badly enough to be able to quickly generate string that result in wanted hashes. Still, the extra cost is almost nothing and it's always better to be super paranoid!

auth: Ensure username can't be left unset in APOP Makes static analysers happy

auth: Mark memory pools as growing and use the same sizes for all mechanisms. Mainly to have DEBUG log fewer warnings.

auth: Use special AUTH_SUBSYS_DB/MECH parameters as auth_request_log*() subsystem. This avoids hardcoded strings all over the place and also allows assigning the correct passdb/userdb name for log messages generated by generic passdb/userdb code, which doesn't know exactly where it was called from.

Marked functions parameters that are allowed to be NULL. Some APIs were also changed. The non-obvious APIs where NULL parameter was changed to "" are master_service_init() and auth_master_user_list_init(). These checks can currently be enabled only on a patched clang: http://llvm.org/bugs/show_bug.cgi?id=6786

Removed MEMBER() macro. Require C99 style struct initializer. --HG-- branch : HEAD

Renamed headers to prevent collision if they were flattened on an install. --HG-- branch : HEAD

apop: Compile fix for previous commit. --HG-- branch : HEAD

auth: Code cleanup for specifying what passdb features auth mechanisms need. --HG-- branch : HEAD

APOP auth: Minor code cleanups. --HG-- branch : HEAD

All password schemes can now be encoded with base64 or hex. The encoding is ".b64", ".base64" or ".hex" suffix in the scheme, eg. {plain.b64}. Password scheme verification function can now be set to NULL, in which case the verification is done by generating a new crypted password from given plaintext password and comparing it. --HG-- branch : HEAD

Removed enum passdb_credentials. Use scheme strings directly instead. This makes it possible to implement new mechanisms in plugins. --HG-- branch : HEAD

Reverted accidental commit. This code isn't ready yet. --HG-- branch : HEAD

Moved all storage destruction code to mail-storage.c and made destroy() optional. Removed set_callbacks(). Made autodetect() optional. --HG-- branch : HEAD

Verify the APOP input before passing it to sscanf() to make sure it's NUL-terminated. --HG-- branch : HEAD

Added auth_request_set_credentials() to modify credentials in passdb and implemented it for SQL passdb. Added passdb_need_set_credentials boolean to mechanisms to indicate that it's required (OTP will need it). Patch by Andrey Panin. --HG-- branch : HEAD

Added mech_generic_auth_internal() and mech_generic_auth_free() functions and used them wherever possible to reduce code duplication. Patch by Andrey Panin. --HG-- branch : HEAD

Relicensed dovecot-auth to MIT. --HG-- branch : HEAD

Added "bool" type and changed all ints that were used as booleans to bool. --HG-- branch : HEAD

Removed need_passdb from mechanism definitions. passdb_need_plain/credentials is enough to know that. Also give a better error message if no passdbs are set and a mechanism requires passdb. --HG-- branch : HEAD

Use a bit larger initial pool sizes --HG-- branch : HEAD

Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by pod@herald.ox.ac.uk --HG-- branch : HEAD

Grow default auth_request pools to 512 bytes per request. --HG-- branch : HEAD

Moving code around. --HG-- branch : HEAD

Require a valid timestamp in APOP challenge. --HG-- branch : HEAD

Another try with API cleanup. --HG-- branch : HEAD

API cleanup --HG-- branch : HEAD

Added auth_request_log_*(). --HG-- branch : HEAD

Cleanups. --HG-- branch : HEAD

Reorganized the code to have less global/static variables. --HG-- branch : HEAD

Split auth_request* functions from mech.c to auth-request.c --HG-- branch : HEAD

Make FAIL reply contain "temp" parameter if the authentication failed because of temporary internal error. Also cleaned up the auth code a bit. --HG-- branch : HEAD

Changed dovecot-auth protocol to ASCII based. Should be easier now to write replacement server if needed by someone. Also cleaned up/made more consistent auth code. The new code could still use some cleaning though.. --HG-- branch : HEAD

Compiler warning fixes and cleanups --HG-- branch : HEAD

Changed "invalid username" error message. --HG-- branch : HEAD

Added auth_username_translation setting. --HG-- branch : HEAD

Fixes, patch by Andrey Panin --HG-- branch : HEAD

was missing from last commit --HG-- branch : HEAD