client-authenticate.c revision c49a19168dab6fda80aee16ad799a8a56d3bc18f
02c335c23bf5fa225a467c19f2c063fb0dc7b8c3Timo Sirainen/* Copyright (C) 2002-2004 Timo Sirainen */
568fec5b1e629f25d288b48007485b9aa4a018b1Timo Sirainenconst char *client_authenticate_get_capabilities(int secured)
3448096d5b1cd324ed5132045de0345cd7120a25Timo Sirainen unsigned int i, count;
19ed8f08b23d6ed204e6b27e5d1c0c6fe6bb11ddPhil Carmody mech = auth_client_get_available_mechs(auth_client, &count);
19ed8f08b23d6ed204e6b27e5d1c0c6fe6bb11ddPhil Carmody for (i = 0; i < count; i++) {
19ed8f08b23d6ed204e6b27e5d1c0c6fe6bb11ddPhil Carmody /* a) transport is secured
62fc0b4f07eb6f18a3bff4b1fccb636e6fae3cf4Timo Sirainen b) auth mechanism isn't plaintext
62fc0b4f07eb6f18a3bff4b1fccb636e6fae3cf4Timo Sirainen c) we allow insecure authentication
62fc0b4f07eb6f18a3bff4b1fccb636e6fae3cf4Timo Sirainen - but don't advertise AUTH=PLAIN, as RFC 2595 requires
62fc0b4f07eb6f18a3bff4b1fccb636e6fae3cf4Timo Sirainen if (i_stream_next_line(client->input) == NULL)
62fc0b4f07eb6f18a3bff4b1fccb636e6fae3cf4Timo Sirainen /* @UNSAFE */
f5c0d5cada4da23a167c38426d0c481a3e1d5583Timo Sirainen "Authentication aborted");
62fc0b4f07eb6f18a3bff4b1fccb636e6fae3cf4Timo Sirainen buf = buffer_create_static_hard(pool_datastack_create(), linelen);
568fec5b1e629f25d288b48007485b9aa4a018b1Timo Sirainen if (base64_decode(line, linelen, NULL, buf) < 0) {
8b1a9a4d63b0abccdf7cb1acb8359d5396dd657bTimo Sirainen sasl_server_auth_cancel(&client->common, "Invalid base64 data");
62fc0b4f07eb6f18a3bff4b1fccb636e6fae3cf4Timo Sirainen } else if (client->common.auth_request == NULL) {
568fec5b1e629f25d288b48007485b9aa4a018b1Timo Sirainen "Don't send unrequested data");
8b1a9a4d63b0abccdf7cb1acb8359d5396dd657bTimo Sirainen auth_client_request_continue(client->common.auth_request,
8b1a9a4d63b0abccdf7cb1acb8359d5396dd657bTimo Sirainen /* clear sensitive data */
62fc0b4f07eb6f18a3bff4b1fccb636e6fae3cf4Timo Sirainen safe_memset(buffer_free_without_data(buf), 0, bufsize);
62fc0b4f07eb6f18a3bff4b1fccb636e6fae3cf4Timo Sirainenstatic void sasl_callback(struct client *_client, enum sasl_server_reply reply,
8b1a9a4d63b0abccdf7cb1acb8359d5396dd657bTimo Sirainen struct imap_client *client = (struct imap_client *)_client;
62fc0b4f07eb6f18a3bff4b1fccb636e6fae3cf4Timo Sirainen "Login: ", client->common.virtual_user, NULL));
62fc0b4f07eb6f18a3bff4b1fccb636e6fae3cf4Timo Sirainen client_send_tagline(client, "Authentication failed");
568fec5b1e629f25d288b48007485b9aa4a018b1Timo Sirainen /* get back to normal client input. */
8b1a9a4d63b0abccdf7cb1acb8359d5396dd657bTimo Sirainen client->io = io_add(client->common.fd, IO_READ,
62fc0b4f07eb6f18a3bff4b1fccb636e6fae3cf4Timo Sirainen client_send_line(client, "* BYE Internal login failure. "
0c5854b6891c59c1c3f443569bc823d7db571582Teemu Huovila "Error report written to server log.");
62fc0b4f07eb6f18a3bff4b1fccb636e6fae3cf4Timo Sirainen client_destroy(client, t_strconcat("Internal login failure: ",
c865b0e9c65fd77f7b2ab6f8616d3def5501ecb3Timo Sirainen client_destroy(client, "Transmit buffer full");
c865b0e9c65fd77f7b2ab6f8616d3def5501ecb3Timo Sirainen /* continue */
c865b0e9c65fd77f7b2ab6f8616d3def5501ecb3Timo Sirainenint cmd_authenticate(struct imap_client *client, struct imap_arg *args)
0c5854b6891c59c1c3f443569bc823d7db571582Teemu Huovila /* we want only one argument: authentication mechanism name */
0c5854b6891c59c1c3f443569bc823d7db571582Teemu Huovila if (args[0].type != IMAP_ARG_ATOM && args[0].type != IMAP_ARG_STRING)
202468f94e6c6c8b5d3d98ee74e01bb0d0bb04aaTimo Sirainen sasl_server_auth_begin(&client->common, "IMAP", mech_name, NULL, 0,
83172e28d4ac684dfed83f7c9db933493d7c5922Timo Sirainen /* following input data will go to authentication */
62fc0b4f07eb6f18a3bff4b1fccb636e6fae3cf4Timo Sirainen client->io = io_add(client->common.fd, IO_READ,
3a54211bd6c4dc3f8687c16020770551cf83a548Teemu Huovilaint cmd_login(struct imap_client *client, struct imap_arg *args)
c865b0e9c65fd77f7b2ab6f8616d3def5501ecb3Timo Sirainen /* two arguments: username and password */
62fc0b4f07eb6f18a3bff4b1fccb636e6fae3cf4Timo Sirainen if (args[0].type != IMAP_ARG_ATOM && args[0].type != IMAP_ARG_STRING)
62fc0b4f07eb6f18a3bff4b1fccb636e6fae3cf4Timo Sirainen if (args[1].type != IMAP_ARG_ATOM && args[1].type != IMAP_ARG_STRING)
c865b0e9c65fd77f7b2ab6f8616d3def5501ecb3Timo Sirainen if (!client->common.secured && disable_plaintext_auth) {
62fc0b4f07eb6f18a3bff4b1fccb636e6fae3cf4Timo Sirainen client_syslog(&client->common, "Login failed: "
c865b0e9c65fd77f7b2ab6f8616d3def5501ecb3Timo Sirainen "Plaintext authentication disabled");
c865b0e9c65fd77f7b2ab6f8616d3def5501ecb3Timo Sirainen "* BAD [ALERT] Plaintext authentication is disabled, "
3448096d5b1cd324ed5132045de0345cd7120a25Timo Sirainen "but your client sent password in plaintext anyway. "
fdf70410de49eadfbb77997bb60ebba19aee4752Teemu Huovila "If anyone was listening, the password was exposed.");
19ed8f08b23d6ed204e6b27e5d1c0c6fe6bb11ddPhil Carmody "NO Plaintext authentication disabled.");
fdf70410de49eadfbb77997bb60ebba19aee4752Teemu Huovila /* authorization ID \0 authentication ID \0 pass */
c865b0e9c65fd77f7b2ab6f8616d3def5501ecb3Timo Sirainen plain_login = buffer_create_dynamic(pool_datastack_create(), 64);
b04e76cbc807707d299055be79500f8ff131da43Timo Sirainen buffer_append(plain_login, user, strlen(user));
0c5854b6891c59c1c3f443569bc823d7db571582Teemu Huovila buffer_append(plain_login, pass, strlen(pass));
b6b06530d654f0436bfbaefc1e988d53fff0cbeeTimo Sirainen sasl_server_auth_begin(&client->common, "IMAP", "PLAIN",
b6b06530d654f0436bfbaefc1e988d53fff0cbeeTimo Sirainen /* don't read any input from client until login is finished */