auth: Use mem_equals_timing_safe() for all password hash comparisons. It's unlikely these could be used to perform timing attacks, since the attacker would have to have broken MD5/SHA badly enough to be able to quickly generate string that result in wanted hashes. Still, the extra cost is almost nothing and it's always better to be super paranoid!

[LEN] to [static LEN] on some function parameters Also add STATIC_ARRAY macro to hide it in c++ compilation.

global: Replace buffer_get_used_size(buf) with buf->used Doesn't make any diffence to code generation, but it's somewhat simpler code. It's also more consistent since most of the code nowadays uses the ->used.

auth: Mark memory pools as growing and use the same sizes for all mechanisms. Mainly to have DEBUG log fewer warnings.

auth: Minor code cleanup

auth: Use special AUTH_SUBSYS_DB/MECH parameters as auth_request_log*() subsystem. This avoids hardcoded strings all over the place and also allows assigning the correct passdb/userdb name for log messages generated by generic passdb/userdb code, which doesn't know exactly where it was called from.

Marked functions parameters that are allowed to be NULL. Some APIs were also changed. The non-obvious APIs where NULL parameter was changed to "" are master_service_init() and auth_master_user_list_init(). These checks can currently be enabled only on a patched clang: http://llvm.org/bugs/show_bug.cgi?id=6786

auth: Removed unnecessary auth_request callback and context uses. --HG-- branch : HEAD

auth: Initial support for per-protocol auth settings. Currently the list of services is hard-coded. This should be changed so that config lookup returns the service names. --HG-- branch : HEAD

auth: Moved some variables generated from settings to struct auth_settings. --HG-- branch : HEAD

Removed MEMBER() macro. Require C99 style struct initializer. --HG-- branch : HEAD

auth: digest-md5, rpa mechanisms no longer require the realm to be listed in auth_realms. --HG-- branch : HEAD

Renamed headers to prevent collision if they were flattened on an install. --HG-- branch : HEAD

Initial commit for config rewrite. --HG-- branch : HEAD

auth: Code cleanup for specifying what passdb features auth mechanisms need. --HG-- branch : HEAD

RPA auth mechanism: Fixed handling usernames longer than 255 characters. --HG-- branch : HEAD

Allocate auth_realms from auth pool instead of from data stack. --HG-- branch : HEAD

pool_unref() now takes ** pointer. --HG-- branch : HEAD

Changed buffer_free() and buffer_free_without_data() APIs to take ** pointer which is set to NULL instead of hiding it with a macro. --HG-- branch : HEAD

All password schemes can now be encoded with base64 or hex. The encoding is ".b64", ".base64" or ".hex" suffix in the scheme, eg. {plain.b64}. Password scheme verification function can now be set to NULL, in which case the verification is done by generating a new crypted password from given plaintext password and comparing it. --HG-- branch : HEAD

cleanup: use a bit less magic numbers --HG-- branch : HEAD

Removed enum passdb_credentials. Use scheme strings directly instead. This makes it possible to implement new mechanisms in plugins. --HG-- branch : HEAD

Reverted accidental commit. This code isn't ready yet. --HG-- branch : HEAD

Moved all storage destruction code to mail-storage.c and made destroy() optional. Removed set_callbacks(). Made autodetect() optional. --HG-- branch : HEAD

Cleanups and minor fixes --HG-- branch : HEAD

Added auth_request_set_credentials() to modify credentials in passdb and implemented it for SQL passdb. Added passdb_need_set_credentials boolean to mechanisms to indicate that it's required (OTP will need it). Patch by Andrey Panin. --HG-- branch : HEAD

Added mech_generic_auth_internal() and mech_generic_auth_free() functions and used them wherever possible to reduce code duplication. Patch by Andrey Panin. --HG-- branch : HEAD

Relicensed dovecot-auth to MIT. --HG-- branch : HEAD

While casting const pointers to something else, the const was often unneededly dropped out in the middle of casts. --HG-- branch : HEAD

Added "bool" type and changed all ints that were used as booleans to bool. --HG-- branch : HEAD

Removed need_passdb from mechanism definitions. passdb_need_plain/credentials is enough to know that. Also give a better error message if no passdbs are set and a mechanism requires passdb. --HG-- branch : HEAD

Use a bit larger initial pool sizes --HG-- branch : HEAD

Added GSSAPI support. Patch by Jelmer Vernooij and some fixes by pod@herald.ox.ac.uk --HG-- branch : HEAD

Grow default auth_request pools to 512 bytes per request. --HG-- branch : HEAD

Proper realm support for RPA. Now RPA will use auth_realms and auth_default_realm configuration parameters instead of my_hostname variable. Patch by Andrey Panin. --HG-- branch : HEAD

Realm fixes. Patch by Andrey Panin --HG-- branch : HEAD

Another try with API cleanup. --HG-- branch : HEAD

API cleanup --HG-- branch : HEAD

Added auth_request_log_*(). --HG-- branch : HEAD

Cleanups. --HG-- branch : HEAD

Reorganized the code to have less global/static variables. --HG-- branch : HEAD

Split auth_request* functions from mech.c to auth-request.c --HG-- branch : HEAD

Make FAIL reply contain "temp" parameter if the authentication failed because of temporary internal error. Also cleaned up the auth code a bit. --HG-- branch : HEAD

Initial response support for NTLM and RPA. Patch by Andrey Panin. --HG-- branch : HEAD

s/protocol/service/ in authentication --HG-- branch : HEAD

Didn't work with asynchronous passdb. --HG-- branch : HEAD

Changed dovecot-auth protocol to ASCII based. Should be easier now to write replacement server if needed by someone. Also cleaned up/made more consistent auth code. The new code could still use some cleaning though.. --HG-- branch : HEAD

Buffer API change: we no longer support limited sized buffers where writes past limit wouldn't kill the process. They weren't used hardly anywhere, they could have hidden bugs and the code for handling them was too complex. This also changed base64 and hex-binary APIs. --HG-- branch : HEAD

Compiler warning fixes and cleanups --HG-- branch : HEAD

Changed "invalid username" error message. --HG-- branch : HEAD

Added auth_username_translation setting. --HG-- branch : HEAD

Added Compuserve RPA authentication. Patch by Andrey Panin. --HG-- branch : HEAD