Updated copyright notices to include the year 2018.

auth: Fix 'Password mismatch' casing consistency

global: Use t_buffer_create sed -i -e 's/buffer_create_dynamic(pool_datastack_create(), */t_buffer_create(/g'

libpassword: Deinitialize hash iterator in password_scheme_detect Otherwise it will leak memory

libpassword: Add BLF-CRYPT support independent of crypt

libpassword: Add support for ARGON2 scheme

auth: global rounds parameter replaced with argument to password_generate() username and rounds parameter moved to a single password_generate_params structure.

global: Add/change switch case "fall through" comments These fix warnings with gcc 7's -Wimplicit-fallthrough

auth: Empty schemes cannot be aliases Optimizes cases where empty scheme is compared to PLAIN

auth: Use strchr to split encoding and scheme This is an optimization because usually strchr is faster

auth: Use hash table for schemes

auth: Use mem_equals_timing_safe() for all password hash comparisons. It's unlikely these could be used to perform timing attacks, since the attacker would have to have broken MD5/SHA badly enough to be able to quickly generate string that result in wanted hashes. Still, the extra cost is almost nothing and it's always better to be super paranoid!

auth: Make plaintext password comparisons safe against timing attacks

Updated copyright notices to include the year 2017.

global: Change string position/length from unsigned int to size_t Mainly to avoid truncating >4GB strings, which might potentially cause some security holes. Normally there are other limits, which prevent such excessive strings from being created in the first place. I'm sure this didn't find everything. Maybe everything could be found with compiler warnings. -Wconversion kind of does it, but it gives way too many unnecessary warnings. These were mainly found with: grep " = strlen" egrep "unsigned int.*(size|len)"

Remove t_malloc in favour of t_malloc_no0 Using either t_malloc_no0 or t_malloc0 makes it clear whether the allocated memory is zeroed or not.

auth: Add PBKDF2 password scheme

global: freshen copyright git ls-files | xargs perl -p -i -e 's/(\d+)-201[0-5]/$1-2016/g;s/ (201[0-5]) Dovecot/ $1-2016 Dovecot/'

auth: Don't crash when trying to use CRYPT scheme when crypt() doesn't support DES

global: freshen copyright Robomatically: git ls-files | xargs perl -p -i -e 's/(\d+)-201[0-4]/$1-2015/g;s/ (201[0-4]) Dovecot/ $1-2015 Dovecot/' Happy 2015 everyone! Signed-off-by: Phil Carmody <phil@dovecot.fi>

Updated copyright notices to include year 2014.

Oops :) Update copyrights to 2013 without breaking all .c files.

Updated copyright notices to include year 2013.

auth: Added CLEAR as yet another alias to PLAIN/CLEARTEXT password scheme. This apparently is used by Sun LDAP server.

auth: Add and use SCRAM-SHA-1 password scheme

lib: Generalize hmac to be hash independent

Make static analyzer happier.

Updated copyright notices to include year 2012.