auth: If client gives "final-resp-ok" parameter, send it in OK reply with DIGEST...

diff --git a/src/auth/auth-request.c b/src/auth/auth-request.c
index 989d49572fee02419b4dd58205a54dab774a5a0a..0edf0ca51d1c7baf36dcc8db7c271af036891d49 100644 (file)
--- a/src/auth/auth-request.c
+++ b/src/auth/auth-request.c
@@ -111,8 +111,15 @@ void auth_request_success(struct auth_request *request,
                return;
        }
 
-       auth_request_set_state(request, AUTH_REQUEST_STATE_FINISHED);
        request->successful = TRUE;
+       if (data_size > 0 && !request->final_resp_ok) {
+               /* we'll need one more SASL round, since client doesn't support
+                  the final SASL response */
+               auth_request_handler_reply_continue(request, data, data_size);
+               return;
+       }
+
+       auth_request_set_state(request, AUTH_REQUEST_STATE_FINISHED);
        auth_request_refresh_last_access(request);
        auth_request_handler_reply(request, AUTH_CLIENT_RESULT_SUCCESS,
                                   data, data_size);
@@ -235,6 +242,8 @@ bool auth_request_import_auth(struct auth_request *request,
        /* auth client may set these */
        if (strcmp(key, "secured") == 0)
                request->secured = TRUE;
+       else if (strcmp(key, "final-resp-ok") == 0)
+               request->final_resp_ok = TRUE;
        else if (strcmp(key, "no-penalty") == 0)
                request->no_penalty = TRUE;
        else if (strcmp(key, "valid-client-cert") == 0)
@@ -296,6 +305,11 @@ void auth_request_continue(struct auth_request *request,
 {
        i_assert(request->state == AUTH_REQUEST_STATE_MECH_CONTINUE);
 
+       if (request->successful) {
+               auth_request_success(request, NULL, 0);
+               return;
+       }
+
        auth_request_refresh_last_access(request);
        request->mech->auth_continue(request, data, data_size);
 }

diff --git a/src/auth/auth-request.h b/src/auth/auth-request.h
index c2969d030db94e537c45c937c79aec9f3e18a92b..69592dbf32830c17c3a52860a8338e0017f42c0c 100644 (file)
--- a/src/auth/auth-request.h
+++ b/src/auth/auth-request.h
@@ -111,6 +111,7 @@ struct auth_request {
        unsigned int userdb_lookup:1;
        unsigned int userdb_lookup_failed:1;
        unsigned int secured:1;
+       unsigned int final_resp_ok:1;
        unsigned int removed_from_handler:1;
 
        /* ... mechanism specific data ... */

diff --git a/src/auth/mech-digest-md5.c b/src/auth/mech-digest-md5.c
index 442dfbe2c388e272459c7a66892b6d2dce8df6f4..7959a94209b985487e55b9076412fb41b38f18b8 100644 (file)
--- a/src/auth/mech-digest-md5.c
+++ b/src/auth/mech-digest-md5.c
@@ -34,7 +34,6 @@ struct digest_auth_request {
        struct auth_request auth_request;
 
        pool_t pool;
-       unsigned int authenticated:1;
 
        /* requested: */
        char *nonce;
@@ -505,10 +504,8 @@ static void credentials_callback(enum passdb_result result,
                        return;
                }
 
-               request->authenticated = TRUE;
-               auth_request_handler_reply_continue(auth_request,
-                                                   request->rspauth,
-                                                   strlen(request->rspauth));
+               auth_request_success(auth_request, request->rspauth,
+                                    strlen(request->rspauth));
                break;
        case PASSDB_RESULT_INTERNAL_FAILURE:
                auth_request_internal_failure(auth_request);
@@ -527,13 +524,6 @@ mech_digest_md5_auth_continue(struct auth_request *auth_request,
                (struct digest_auth_request *)auth_request;
        const char *username, *error;
 
-       if (request->authenticated) {
-               /* authentication is done, we were just waiting the last
-                  word from client */
-               auth_request_success(auth_request, NULL, 0);
-               return;
-       }
-
        if (parse_digest_response(request, data, data_size, &error)) {
                if (auth_request->realm != NULL &&
                    strchr(request->username, '@') == NULL) {

diff --git a/src/auth/mech-scram-sha1.c b/src/auth/mech-scram-sha1.c
index 96cf1c85c0dcf1b850b63cb9eb5e2eb86f748156..ad44605f0c54daece767d4bc4a71db378784f88c 100644 (file)
--- a/src/auth/mech-scram-sha1.c
+++ b/src/auth/mech-scram-sha1.c
@@ -25,7 +25,6 @@ struct scram_auth_request {
        struct auth_request auth_request;
 
        pool_t pool;
-       unsigned int authenticated:1;
 
        /* sent: */
        const char *server_first_message;
@@ -265,11 +264,9 @@ static void credentials_callback(enum passdb_result result,
                                              "password mismatch");
                        auth_request_fail(auth_request);
                } else {
-                       request->authenticated = TRUE;
                        server_final_message = get_scram_server_final(request);
-                       auth_request_handler_reply_continue(auth_request,
-                               server_final_message,
-                               strlen(server_final_message));
+                       auth_request_success(auth_request, server_final_message,
+                                            strlen(server_final_message));
                }
                break;
        case PASSDB_RESULT_INTERNAL_FAILURE:
@@ -348,13 +345,6 @@ static void mech_scram_sha1_auth_continue(struct auth_request *auth_request,
                (struct scram_auth_request *)auth_request;
        const char *error = NULL;
 
-       if (request->authenticated) {
-               /* authentication is done, we were just waiting the last (empty)
-                  client response */
-               auth_request_success(auth_request, NULL, 0);
-               return;
-       }
-
        if (!request->client_first_message_bare) {
                /* Received client-first-message */
                if (parse_scram_client_first(request, data,