auth: The mechanisms configured using the auth_mechanisms setting were not enforced.

The login service would check whether the mechanism is supported by auth,
but auth performed no such check of its own. This means that any
implemented mechanism was accessible from a login, even though was
presumably disabled.

diff --git a/src/auth/auth-request-handler.c b/src/auth/auth-request-handler.c
index 48698c5ebbcb6788ae51bf664570371fb459c798..c397bb323f10533b1ae46d72e6e70da0fe19b014 100644 (file)
--- a/src/auth/auth-request-handler.c
+++ b/src/auth/auth-request-handler.c
@@ -475,8 +475,9 @@ bool auth_request_handler_auth_begin(struct auth_request_handler *handler,
                                handler->client_pid, str_sanitize(list[1], MAX_MECH_NAME_LEN));
                        return FALSE;
                }
-       } else {                 
-               mech = mech_module_find(list[1]);
+       } else {
+               struct auth *auth_default = auth_default_service();
+               mech = mech_register_find(auth_default->reg, list[1]);
                if (mech == NULL) {
                        /* unsupported mechanism */
                        i_error("BUG: Authentication client %u requested unsupported "

diff --git a/src/auth/mech.c b/src/auth/mech.c
index 0b7ec6df46a33848f29cc70a7e53fd5a27aea6f2..8cd5553fce5b2621150e987f8114043f6bade64c 100644 (file)
--- a/src/auth/mech.c
+++ b/src/auth/mech.c
@@ -175,6 +175,18 @@ void mech_register_deinit(struct mechanisms_register **_reg)
        pool_unref(&reg->pool);
 }
 
+const struct mech_module *
+mech_register_find(const struct mechanisms_register *reg, const char *name)
+{
+       const struct mech_module_list *list;
+
+       for (list = reg->modules; list != NULL; list = list->next) {
+               if (strcasecmp(list->module.mech_name, name) == 0)
+                       return &list->module;
+       }
+       return NULL;
+}
+
 void mech_init(const struct auth_settings *set)
 {
        mech_register_module(&mech_plain);

diff --git a/src/auth/mech.h b/src/auth/mech.h
index 74408caf5df2e1fcc72f492899c04ee7b6b3c8c6..4a9f59358656173b1857076f72550c5096953dac 100644 (file)
--- a/src/auth/mech.h
+++ b/src/auth/mech.h
@@ -68,6 +68,8 @@ void mech_generic_auth_free(struct auth_request *request);
 struct mechanisms_register *
 mech_register_init(const struct auth_settings *set);
 void mech_register_deinit(struct mechanisms_register **reg);
+const struct mech_module *
+mech_register_find(const struct mechanisms_register *reg, const char *name);
 
 void mech_init(const struct auth_settings *set);
 void mech_deinit(const struct auth_settings *set);