lib-sasl: dsasl-client - Add support for channel binding

diff --git a/src/imap-login/Makefile.am b/src/imap-login/Makefile.am
index b0a240ff4f3a967fb8cd2f4d2265a9c9d525a462..13a2651c74d1e4a171f3f5aac2fd45ab9d59ce3d 100644 (file)
--- a/src/imap-login/Makefile.am
+++ b/src/imap-login/Makefile.am
@@ -14,6 +14,7 @@ AM_CPPFLAGS = \
        -I$(top_srcdir)/src/lib-login \
        -I$(top_srcdir)/src/lib-mail \
        -I$(top_srcdir)/src/lib-var-expand \
+       -I$(top_srcdir)/src/lib-ssl-iostream \
        -I$(top_srcdir)/src/login-common \
        $(BINARY_CFLAGS)
 

diff --git a/src/lib-sasl/Makefile.am b/src/lib-sasl/Makefile.am
index 914be5e0c4946e35b50508df78466549691a5d52..22a6f290e71d17c30b2c5c1ec502e417aa013bea 100644 (file)
--- a/src/lib-sasl/Makefile.am
+++ b/src/lib-sasl/Makefile.am
@@ -3,8 +3,10 @@ noinst_LTLIBRARIES = libsasl.la
 AM_CPPFLAGS = \
        -I$(top_srcdir)/src/lib \
        -I$(top_srcdir)/src/lib-test \
+       -I$(top_srcdir)/src/lib-settings \
        -I$(top_srcdir)/src/lib-auth \
-       -I$(top_srcdir)/src/lib-json
+       -I$(top_srcdir)/src/lib-json \
+       -I$(top_srcdir)/src/lib-ssl-iostream
 
 libsasl_la_SOURCES = \
        mech-external.c \

diff --git a/src/lib-sasl/dsasl-client-private.h b/src/lib-sasl/dsasl-client-private.h
index 00272e9cf7772dc01a0f5c7ca1fcf668ccd0ee9d..b67964ffa1dc833c195350b665ad24a784a0f3af 100644 (file)
--- a/src/lib-sasl/dsasl-client-private.h
+++ b/src/lib-sasl/dsasl-client-private.h
@@ -12,6 +12,10 @@ struct dsasl_client {
        struct dsasl_client_settings set;
        char *password;
        const struct dsasl_client_mech *mech;
+
+       enum ssl_iostream_protocol_version channel_version;
+       dsasl_client_channel_binding_callback_t *cbinding_callback;
+       void *cbinding_context;
 };
 
 struct dsasl_client_mech {
@@ -44,4 +48,18 @@ extern const struct dsasl_client_mech dsasl_client_mech_scram_sha_256;
 void dsasl_client_mech_register(const struct dsasl_client_mech *mech);
 void dsasl_client_mech_unregister(const struct dsasl_client_mech *mech);
 
+static inline int
+dasl_client_get_channel_binding(struct dsasl_client *client,
+                               const char *type, const buffer_t **data_r,
+                               const char **error_r)
+{
+       if (client->channel_version == SSL_IOSTREAM_PROTOCOL_VERSION_UNKNOWN ||
+           client->cbinding_callback == NULL) {
+               *error_r = "Channel binding not available locally";
+               return -1;
+       }
+       return client->cbinding_callback(type, client->cbinding_context,
+                                        data_r, error_r);
+}
+
 #endif

diff --git a/src/lib-sasl/dsasl-client.c b/src/lib-sasl/dsasl-client.c
index aa14809eefc792ee2784f58de9adec26d5a37d1b..ebe6ffbd0114dc667fe323cc65fb8e7e8dc936b7 100644 (file)
--- a/src/lib-sasl/dsasl-client.c
+++ b/src/lib-sasl/dsasl-client.c
@@ -85,6 +85,16 @@ void dsasl_client_free(struct dsasl_client **_client)
        pool_unref(&client->pool);
 }
 
+void dsasl_client_enable_channel_binding(
+       struct dsasl_client *client,
+       enum ssl_iostream_protocol_version channel_version,
+       dsasl_client_channel_binding_callback_t *callback, void *context)
+{
+       client->channel_version = channel_version;
+       client->cbinding_callback = callback;
+       client->cbinding_context = context;
+}
+
 int dsasl_client_input(struct dsasl_client *client,
                       const unsigned char *input, size_t input_len,
                       const char **error_r)

diff --git a/src/lib-sasl/dsasl-client.h b/src/lib-sasl/dsasl-client.h
index 999008d588e700c4b98fb7efd7722f523951c13d..1b3a7fa8080b93ee21369787e81e4e8915770c9a 100644 (file)
--- a/src/lib-sasl/dsasl-client.h
+++ b/src/lib-sasl/dsasl-client.h
@@ -1,6 +1,8 @@
 #ifndef DSASL_CLIENT_H
 #define DSASL_CLIENT_H
 
+#include "iostream-ssl.h"
+
 struct dsasl_client_settings {
        /* authentication ID - must be set with most mechanisms */
        const char *authid;
@@ -11,6 +13,11 @@ struct dsasl_client_settings {
        const char *password;
 };
 
+typedef int
+dsasl_client_channel_binding_callback_t(const char *type, void *context,
+                                       const buffer_t **data_r,
+                                       const char **error_r);
+
 /* PLAIN mechanism always exists and can be accessed directly via this. */
 extern const struct dsasl_client_mech dsasl_client_mech_plain;
 
@@ -21,6 +28,12 @@ struct dsasl_client *dsasl_client_new(const struct dsasl_client_mech *mech,
                                      const struct dsasl_client_settings *set);
 void dsasl_client_free(struct dsasl_client **client);
 
+/* Enable channel binding support for this client. */
+void dsasl_client_enable_channel_binding(
+       struct dsasl_client *client,
+       enum ssl_iostream_protocol_version channel_version,
+       dsasl_client_channel_binding_callback_t *callback, void *context);
+
 /* Call for server input. */
 int dsasl_client_input(struct dsasl_client *client,
                       const unsigned char *input, size_t input_len,

diff --git a/src/pop3-login/Makefile.am b/src/pop3-login/Makefile.am
index f639d484336c84bf9eaaa25b5f81710de430edab..59e66b0034e6eb4d43e54979da8ce9c5fc12ed90 100644 (file)
--- a/src/pop3-login/Makefile.am
+++ b/src/pop3-login/Makefile.am
@@ -10,6 +10,7 @@ AM_CPPFLAGS = \
        -I$(top_srcdir)/src/lib-master \
        -I$(top_srcdir)/src/lib-login \
        -I$(top_srcdir)/src/login-common \
+       -I$(top_srcdir)/src/lib-ssl-iostream \
        -I$(top_srcdir)/src/lib-pop3 \
        -I$(top_srcdir)/src/lib-var-expand \
        $(BINARY_CFLAGS)

diff --git a/src/submission-login/Makefile.am b/src/submission-login/Makefile.am
index 928da154ad37e3a01555484720d9c2892085ae7c..b7ec914c227109b102ce945fd43d67b72afb1456 100644 (file)
--- a/src/submission-login/Makefile.am
+++ b/src/submission-login/Makefile.am
@@ -12,6 +12,7 @@ AM_CPPFLAGS = \
        -I$(top_srcdir)/src/lib-login \
        -I$(top_srcdir)/src/lib-smtp \
        -I$(top_srcdir)/src/lib-var-expand \
+       -I$(top_srcdir)/src/lib-ssl-iostream \
        -I$(top_srcdir)/src/login-common
 
 submission_login_LDADD = \