From: Aki Tuomi Date: Mon, 21 Jan 2019 08:54:06 +0000 (+0200) Subject: auth: Fail authentication if certificate username was unexpectedly missing X-Git-Tag: 2.2.36.1~3 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d3db671c4be1aa8be1717e4f2aa830c9a5236043;p=thirdparty%2Fdovecot%2Fcore.git auth: Fail authentication if certificate username was unexpectedly missing --- diff --git a/src/auth/auth-request-handler.c b/src/auth/auth-request-handler.c index 617dc1883d..3044e94f91 100644 --- a/src/auth/auth-request-handler.c +++ b/src/auth/auth-request-handler.c @@ -560,6 +560,14 @@ bool auth_request_handler_auth_begin(struct auth_request_handler *handler, return TRUE; } + if (request->set->ssl_require_client_cert && + request->set->ssl_username_from_cert && + !request->cert_username) { + auth_request_handler_auth_fail(handler, request, + "SSL certificate didn't contain username"); + return TRUE; + } + /* Empty initial response is a "=" base64 string. Completely empty string shouldn't really be sent, but at least Exim does it, so just allow it for backwards compatibility.. */