login-common: Deny anonymous login by default.

Only services that explicitly enable anonymous logins will permit them. Plugins
can also mask anonymous logins by dropping the anonymous reply flag in the
sasl_check_login() client vfunc.

diff --git a/src/imap-login/client-authenticate.c b/src/imap-login/client-authenticate.c
index 2e7f73d3f3a0f9f0df257e4bcbfbf76b0965669d..c8c3db288f533ae3aa1a78d46d68a5b78cd58159 100644 (file)
--- a/src/imap-login/client-authenticate.c
+++ b/src/imap-login/client-authenticate.c
@@ -105,6 +105,7 @@ void imap_client_auth_result(struct client *client,
                                       IMAP_RESP_CODE_EXPIRED, text);
                break;
        case CLIENT_AUTH_RESULT_LOGIN_DISABLED:
+       case CLIENT_AUTH_RESULT_ANONYMOUS_DENIED:
                client_send_reply_code(client, IMAP_CMD_REPLY_NO,
                                       IMAP_RESP_CODE_CONTACTADMIN, text);
                break;

diff --git a/src/imap-login/imap-login-client.c b/src/imap-login/imap-login-client.c
index a05584ba2e243eb5a7ff78b771260b5145a4ff5e..2c3cd0d50b67f4ca25e5d3533d196321c003a68a 100644 (file)
--- a/src/imap-login/imap-login-client.c
+++ b/src/imap-login/imap-login-client.c
@@ -564,7 +564,8 @@ static const struct login_binary imap_login_binary = {
        .init = imap_login_init,
        .deinit = imap_login_deinit,
 
-       .sasl_support_final_reply = FALSE
+       .sasl_support_final_reply = FALSE,
+       .anonymous_login_acceptable = TRUE,
 };
 
 int main(int argc, char *argv[])

diff --git a/src/imap-urlauth/imap-urlauth-login.c b/src/imap-urlauth/imap-urlauth-login.c
index 9a627dabd500497052d18c854619acd2dcc8f344..fcde9aaf7a4ecf2887a9e927c2785f9bd28e10c0 100644 (file)
--- a/src/imap-urlauth/imap-urlauth-login.c
+++ b/src/imap-urlauth/imap-urlauth-login.c
@@ -181,6 +181,8 @@ static const struct login_binary imap_urlauth_login_binary = {
        .preinit = imap_urlauth_login_preinit,
        .init = imap_urlauth_login_init,
        .deinit = imap_urlauth_login_deinit,
+
+       .anonymous_login_acceptable = TRUE,
 };
 
 int main(int argc, char *argv[])

diff --git a/src/lib-auth/auth-client-interface.h b/src/lib-auth/auth-client-interface.h
index 7ac221691553e6a41a976561b90c488ac46034cd..cdccbee38bcb0487bd6a679f6388de3348e5367e 100644 (file)
--- a/src/lib-auth/auth-client-interface.h
+++ b/src/lib-auth/auth-client-interface.h
@@ -36,5 +36,6 @@ enum mech_security_flags {
 /* not actually returned from auth service */
 #define AUTH_CLIENT_FAIL_CODE_MECH_INVALID      "auth_mech_invalid"
 #define AUTH_CLIENT_FAIL_CODE_MECH_SSL_REQUIRED "auth_mech_ssl_required"
+#define AUTH_CLIENT_FAIL_CODE_ANONYMOUS_DENIED  "anonymous_denied"
 
 #endif

diff --git a/src/login-common/client-common-auth.c b/src/login-common/client-common-auth.c
index 8b87134f0495f6c45b73eb8c7c9e27bda622fcfb..a51c4a2e87f13bba2fc981fdcb41c2b566b81027 100644 (file)
--- a/src/login-common/client-common-auth.c
+++ b/src/login-common/client-common-auth.c
@@ -43,6 +43,8 @@ static const struct client_auth_fail_code_id client_auth_fail_codes[] = {
                CLIENT_AUTH_FAIL_CODE_MECH_INVALID },
        { AUTH_CLIENT_FAIL_CODE_MECH_SSL_REQUIRED,
                CLIENT_AUTH_FAIL_CODE_MECH_SSL_REQUIRED },
+       { AUTH_CLIENT_FAIL_CODE_ANONYMOUS_DENIED,
+               CLIENT_AUTH_FAIL_CODE_ANONYMOUS_DENIED },
        { NULL, CLIENT_AUTH_FAIL_CODE_NONE }
 };
 
@@ -549,6 +551,9 @@ client_auth_handle_reply(struct client *client,
                case CLIENT_AUTH_FAIL_CODE_MECH_SSL_REQUIRED:
                        result = CLIENT_AUTH_RESULT_MECH_SSL_REQUIRED;
                        break;
+               case CLIENT_AUTH_FAIL_CODE_ANONYMOUS_DENIED:
+                       result = CLIENT_AUTH_RESULT_ANONYMOUS_DENIED;
+                       break;
                case CLIENT_AUTH_FAIL_CODE_LOGIN_DISABLED:
                        result = CLIENT_AUTH_RESULT_LOGIN_DISABLED;
                        if (reason == NULL)

diff --git a/src/login-common/client-common.h b/src/login-common/client-common.h
index bf44f6e4a9789775e2bb052afaf131fc2ec98a07..08f7ebcc20222ead3e999275dacc4eb622574713 100644 (file)
--- a/src/login-common/client-common.h
+++ b/src/login-common/client-common.h
@@ -56,6 +56,7 @@ enum client_auth_fail_code {
        CLIENT_AUTH_FAIL_CODE_LOGIN_DISABLED,
        CLIENT_AUTH_FAIL_CODE_MECH_INVALID,
        CLIENT_AUTH_FAIL_CODE_MECH_SSL_REQUIRED,
+       CLIENT_AUTH_FAIL_CODE_ANONYMOUS_DENIED,
 };
 
 enum client_auth_result {
@@ -72,7 +73,8 @@ enum client_auth_result {
        CLIENT_AUTH_RESULT_INVALID_BASE64,
        CLIENT_AUTH_RESULT_LOGIN_DISABLED,
        CLIENT_AUTH_RESULT_MECH_INVALID,
-       CLIENT_AUTH_RESULT_MECH_SSL_REQUIRED
+       CLIENT_AUTH_RESULT_MECH_SSL_REQUIRED,
+       CLIENT_AUTH_RESULT_ANONYMOUS_DENIED
 };
 
 struct client_auth_reply {

diff --git a/src/login-common/login-common.h b/src/login-common/login-common.h
index 7974a79b37fe011170091768bedeb4ae3f8f0dee..23935dd43b0603a99767b7b77889e131e92d26aa 100644 (file)
--- a/src/login-common/login-common.h
+++ b/src/login-common/login-common.h
@@ -35,7 +35,8 @@ struct login_binary {
        void (*init)(void);
        void (*deinit)(void);
 
-       bool sasl_support_final_reply;
+       bool sasl_support_final_reply:1;
+       bool anonymous_login_acceptable:1;
 };
 
 struct login_module_register {

diff --git a/src/login-common/sasl-server.c b/src/login-common/sasl-server.c
index dde238f1d7470618d4e73b9e3366407447dc778b..7eedbfc1a931996b7c215fcea660f22f233f4023 100644 (file)
--- a/src/login-common/sasl-server.c
+++ b/src/login-common/sasl-server.c
@@ -37,7 +37,8 @@ sasl_server_filter_mech(struct client *client, struct auth_mech_desc *mech)
        if (client->v.sasl_filter_mech != NULL &&
            !client->v.sasl_filter_mech(client, mech))
                return FALSE;
-       return TRUE;
+       return ((mech->flags & MECH_SEC_ANONYMOUS) == 0 ||
+               login_binary->anonymous_login_acceptable);
 }
 
 const struct auth_mech_desc *
@@ -278,6 +279,13 @@ sasl_server_check_login(struct client *client)
        if (client->v.sasl_check_login != NULL &&
            !client->v.sasl_check_login(client))
                return FALSE;
+       if (client->auth_anonymous &&
+           !login_binary->anonymous_login_acceptable) {
+               sasl_server_auth_failed(client,
+                       "Anonymous login denied",
+                       AUTH_CLIENT_FAIL_CODE_ANONYMOUS_DENIED);
+               return FALSE;
+       }
        return TRUE;
 }
 

diff --git a/src/pop3-login/client.c b/src/pop3-login/client.c
index ab8d33d774e8bb35621e7e8360458095b9b20e54..3e9cc1bfb881b35aaa08f80438f87aaab1da988c 100644 (file)
--- a/src/pop3-login/client.c
+++ b/src/pop3-login/client.c
@@ -344,7 +344,8 @@ static const struct login_binary pop3_login_binary = {
        .init = pop3_login_init,
        .deinit = pop3_login_deinit,
 
-       .sasl_support_final_reply = FALSE
+       .sasl_support_final_reply = FALSE,
+       .anonymous_login_acceptable = TRUE,
 };
 
 int main(int argc, char *argv[])

diff --git a/src/submission-login/client-authenticate.c b/src/submission-login/client-authenticate.c
index 6b70701a1a75c531e2a7a2ca9aafacdc99fbde14..3b2680a520453bd01baed298bf874cd14b519302 100644 (file)
--- a/src/submission-login/client-authenticate.c
+++ b/src/submission-login/client-authenticate.c
@@ -177,6 +177,7 @@ void submission_client_auth_result(struct client *client,
                smtp_server_reply(cmd, 504, "5.5.4", "%s", text);
                break;
        case CLIENT_AUTH_RESULT_LOGIN_DISABLED:
+       case CLIENT_AUTH_RESULT_ANONYMOUS_DENIED:
                /* RFC5248, Section 2.4:
 
                   525 X.7.13 User Account Disabled

diff --git a/src/submission-login/client.c b/src/submission-login/client.c
index 62e19cc3690675d58e413bf96b41681a7b34594a..6921a4386dd2c7528316324b58c7acec7ccd1947 100644 (file)
--- a/src/submission-login/client.c
+++ b/src/submission-login/client.c
@@ -306,7 +306,8 @@ static const struct login_binary submission_login_binary = {
        .init = submission_login_init,
        .deinit = submission_login_deinit,
 
-       .sasl_support_final_reply = FALSE
+       .sasl_support_final_reply = FALSE,
+       .anonymous_login_acceptable = FALSE,
 };
 
 int main(int argc, char *argv[])