global: Fix spelling mistakes in comments Original work by @andreasschulze and @jsoref

auth: Use mem_equals_timing_safe() for all password hash comparisons. It's unlikely these could be used to perform timing attacks, since the attacker would have to have broken MD5/SHA badly enough to be able to quickly generate string that result in wanted hashes. Still, the extra cost is almost nothing and it's always better to be super paranoid!

global: Change string position/length from unsigned int to size_t Mainly to avoid truncating >4GB strings, which might potentially cause some security holes. Normally there are other limits, which prevent such excessive strings from being created in the first place. I'm sure this didn't find everything. Maybe everything could be found with compiler warnings. -Wconversion kind of does it, but it gives way too many unnecessary warnings. These were mainly found with: grep " = strlen" egrep "unsigned int.*(size|len)"

auth: GSSAPI mechanism: Fix CLang -Wstrict-bool warnings. The GSS_ERROR() macro yields an integer rather than an actual bool value. The krb5_kuserok() function returns a krb_boolean type, which is unsigned int rather than a bool.

gssapi: Add missing PASSDB_RESULT_NEXT clause

Remove now-unnecessary direct stdlib.h #includes.

auth: Mark memory pools as growing and use the same sizes for all mechanisms. Mainly to have DEBUG log fewer warnings.

auth: Use special AUTH_SUBSYS_DB/MECH parameters as auth_request_log*() subsystem. This avoids hardcoded strings all over the place and also allows assigning the correct passdb/userdb name for log messages generated by generic passdb/userdb code, which doesn't know exactly where it was called from.

auth: Fixed compiling GSSAPI after recent changes.

auth: Added passdb { result_* and skip } settings. passdb { skip = never | authenticated | unauthenticated } can be used to skip over a passdb lookup based on previous passdb lookups. passdb { result_success, result_failure, result_internalfail } can be used to specify what to do on those conditions. Choices as continue, continue-ok, continue-fail, return, return-ok, return-fail. The -ok and -fail variants update the current "success" flag, while continue/return uses the current flag. The authentication succeeds only if the success flag is set after the last lookup. The continue variants continue to the next passdb, while return variants finish the lookup immediately.

auth: Cleaned up flags in auth request. Removed those that already exist in extra_fields. It's now slightly slower to check for those flags in extra_fields, but it's going to be easier to make commit/rollback feature to extra_fields.

auth: Fixed error handling in GSSAPI when __gss_userok() was used. An invalid username would have been treated as successful and auth process probably would have crashed.

auth: GSSAPI RFC compliancy fixes. Patch by Ben Morrow: The first problem is that, because of the way the client invokes libsasl, it sends a GSSAPI request which does not ask for mutual authentication. This means that on the server gss_accept_sec_context returns GSS_S_COMPLETE with a zero-length output token. Dovecot currently sends this to the client as a zero-length continuation response, but this is incorrect according to RFC 4752: what it ought to do instead is proceed straight to the security layer negotiations, and send a gss_wrap packet. The second is that Cyrus sends an empty authz identity; that is, the security layer negotiation packet, when gss_unwrapped, is exactly 4 bytes long. Dovecot objects to this, but in RFC 4422 this is explicitly allowed, and means the authz identity is identical to the authn identity.

gssapi: Allow logging in as users listed in "k5principals" extra field. This also enables other passdb extra fields for gssapi mechanism. Based on patch by Sam Morris.

auth: Removed unnecessary auth_request callback and context uses. --HG-- branch : HEAD

Static analyzer warning fix. --HG-- branch : HEAD

auth: Compile fix for gssapi. --HG-- branch : HEAD

auth: Initial support for per-protocol auth settings. Currently the list of services is hard-coded. This should be changed so that config lookup returns the service names. --HG-- branch : HEAD

Removed MEMBER() macro. Require C99 style struct initializer. --HG-- branch : HEAD

auth: Fixed compiling with --with-gssapi=plugin --HG-- branch : HEAD

gssapi: Apparently all usernames end with NUL. Allow it. --HG-- branch : HEAD

auth: Check for potentially dangerous NULs in usernames. --HG-- branch : HEAD

gssapi: Error handling fix. --HG-- branch : HEAD

gssapi: Fixed compiling for non-MIT/Heimdal GSSAPI implementations (Solaris). --HG-- branch : HEAD

gssapi: Fail authentication if mechanism type isn't Kerberos 5. Also check GSS_KRB5_NT_PRINCIPAL_NAME more correctly. --HG-- branch : HEAD

gssapi: Don't do krb5_kuserok() to authz_name. It shouldn't be necessary. --HG-- branch : HEAD

GSSAPI: Fixed memory leak on error conditions. --HG-- branch : HEAD

gssapi: Code cleanup. --HG-- branch : HEAD

gssapi: Use *userok() functions only when authz_name != authn_name. Some more code cleanups. --HG-- branch : HEAD

gssapi: Set username via auth_request_set_username(). This makes GSSAPI also use auth_username_* settings. Also improved logging. --HG-- branch : HEAD

gssapi: Code cleanups. Logging error level changes. --HG-- branch : HEAD

Renamed headers to prevent collision if they were flattened on an install. --HG-- branch : HEAD

Fixed --with-ldap=plugin and --with-gssapi=plugin --HG-- branch : HEAD

gssapi: Fix to previous change. --HG-- branch : HEAD

gssapi: Cross-realm authentication fix. Patch by Bryan Jacobs. --HG-- branch : HEAD

Initial commit for config rewrite. --HG-- branch : HEAD

auth: Code cleanup for specifying what passdb features auth mechanisms need. --HG-- branch : HEAD

GSSAPI: stdlib.h wasn't included with all OSes, causing crash at startup with 64bit systems. --HG-- branch : HEAD

Renamed auth_ntlm_use_winbind to auth_use_winbind, which also determines if GSS-SPNEGO is handled by GSSAPI or winbind. --HG-- branch : HEAD

Support GSS-SPNEGO mechanism if GSSAPI library supports it. Based on a patch by Jason Gunthorpe. --HG-- branch : HEAD

Added support for gssapi_hostname=$ALL for multihomed hosts. Patch by Jason Gunthorpe. --HG-- branch : HEAD

gssapi: Make auth_krb5_keytab work by calling _register_acceptor_identity() instead of relying on KRB5_KTNAME environment to be picked up. --HG-- branch : HEAD

gssapi: Check for gssapi_krb5.h existence before trying to use it. --HG-- branch : HEAD

Don't use krb5_get_error_message(), it doesn't work with Heimdal Kerberos. --HG-- branch : HEAD

Support cross-realm krb5 authentication. Based on patch by Zachary Kotlarek. --HG-- branch : HEAD

GSSAPI: Show username in "autn_name and authz_name differ" error. --HG-- branch : HEAD

pool_unref() now takes ** pointer. --HG-- branch : HEAD

Crashfix for failed GSSAPI requests. --HG-- branch : HEAD

Added --with-gssapi=plugin --HG-- branch : HEAD

And removed unneeded code. --HG-- branch : HEAD

If __gss_userok() exists, use it to verify username. Patch by Peter Eriksson. --HG-- branch : HEAD

Added auth_gssapi_hostname setting. --HG-- branch : HEAD

Added more debug logging. --HG-- branch : HEAD

Some systems have gssapi elsewhere than gssapi/gssapi.h. So check also plain gssapi.h. Based on patch by Chris Wakelin --HG-- branch : HEAD

Added auth_request_set_credentials() to modify credentials in passdb and implemented it for SQL passdb. Added passdb_need_set_credentials boolean to mechanisms to indicate that it's required (OTP will need it). Patch by Andrey Panin. --HG-- branch : HEAD

POP3 service name is "pop" with GSSAPI. --HG-- branch : HEAD

Array API redesigned to work using unions. It now provides type safety without having to enable DEBUG, as long as the compiler supports typeof(). Its API changed a bit. It now allows directly accessing the array contents, although that's not necessarily recommended. Changed existing array usage to be type safe in a bit more places. Removed array_t completely. Also did s/modifyable/modifiable/. --HG-- branch : HEAD

Relicensed dovecot-auth to MIT. --HG-- branch : HEAD

Crashfix. Patch by Mark Davies --HG-- branch : HEAD

deinit, unref, destroy, close, free, etc. functions now take a pointer to their data pointer, and set it to NULL. This makes double-frees less likely to cause security holes. --HG-- branch : HEAD

Removed need_passdb from mechanism definitions. passdb_need_plain/credentials is enough to know that. Also give a better error message if no passdbs are set and a mechanism requires passdb. --HG-- branch : HEAD

Use a bit larger initial pool sizes --HG-- branch : HEAD

Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by pod@herald.ox.ac.uk --HG-- branch : HEAD