Fix realm usage with DIGEST-MD5. Support generating other password schemes

out of plaintext passwords.

--HG--
branch : HEAD

diff --git a/src/auth/Makefile.am b/src/auth/Makefile.am
index f1eb92a499ae48c279a523a3b619ce731baf93a1..e28c326f6b76346b00b3fd670484164953fe9a81 100644 (file)
--- a/src/auth/Makefile.am
+++ b/src/auth/Makefile.am
@@ -38,7 +38,7 @@ dovecot_auth_SOURCES = \
        passdb-pam.c \
        passdb-shadow.c \
        passdb-vpopmail.c \
-       password-verify.c \
+       password-scheme.c \
        userdb.c \
        userdb-ldap.c \
        userdb-passwd.c \
@@ -59,6 +59,6 @@ noinst_HEADERS = \
        mech.h \
        mycrypt.h \
        passdb.h \
-       password-verify.h \
+       password-scheme.h \
        userdb.h \
        userdb-vpopmail.h

diff --git a/src/auth/mech-digest-md5.c b/src/auth/mech-digest-md5.c
index 0d55ad78683a8a89c881c4bf4151b207ada73604..9c7844f352f60b7ce24c668154a2fafe3a47cfd5 100644 (file)
--- a/src/auth/mech-digest-md5.c
+++ b/src/auth/mech-digest-md5.c
@@ -309,7 +309,7 @@ static int auth_handle_response(struct digest_auth_request *auth,
                        *error = "Invalid realm";
                        return FALSE;
                }
-               if (auth->realm == NULL)
+               if (auth->realm == NULL && *value != '\0')
                        auth->realm = p_strdup(auth->pool, value);
                return TRUE;
        }

diff --git a/src/auth/passdb-ldap.c b/src/auth/passdb-ldap.c
index 45c3d3a9d3e1ccbdeff78159a7cc43962916ea1b..b770f2d5793df4a402d9e7b2843b58320d57ce4d 100644 (file)
--- a/src/auth/passdb-ldap.c
+++ b/src/auth/passdb-ldap.c
@@ -8,7 +8,7 @@
 #include "common.h"
 #include "str.h"
 #include "var-expand.h"
-#include "password-verify.h"
+#include "password-scheme.h"
 #include "db-ldap.h"
 #include "passdb.h"
 

diff --git a/src/auth/passdb-passwd-file.c b/src/auth/passdb-passwd-file.c
index 73142f295253fcf25684dce27007d96cad913d35..54001d55d62c0899db9a4a473a607cebd71165db 100644 (file)
--- a/src/auth/passdb-passwd-file.c
+++ b/src/auth/passdb-passwd-file.c
@@ -7,7 +7,7 @@
 
 #include "common.h"
 #include "passdb.h"
-#include "password-verify.h"
+#include "password-scheme.h"
 #include "db-passwd-file.h"
 
 struct passwd_file *passdb_pwf = NULL;

diff --git a/src/auth/passdb.c b/src/auth/passdb.c
index 135ddfc73aceecbd555b0d2aba035ea082eb9b8e..477aa63ef9f04387fe80c512bea09e7a95bf31f7 100644 (file)
--- a/src/auth/passdb.c
+++ b/src/auth/passdb.c
@@ -3,6 +3,7 @@
 #include "common.h"
 #include "mech.h"
 #include "auth-module.h"
+#include "password-scheme.h"
 #include "passdb.h"
 
 #include <stdlib.h>
@@ -49,12 +50,19 @@ void passdb_handle_credentials(enum passdb_credentials credentials,
        if (password != NULL) {
                wanted_scheme = passdb_credentials_to_str(credentials);
                if (strcasecmp(scheme, wanted_scheme) != 0) {
-                       if (verbose) {
-                               i_info("password(%s): Requested %s scheme, "
-                                      "but we have only %s", user,
-                                      wanted_scheme, scheme);
+                       if (strcasecmp(scheme, "PLAIN") == 0) {
+                               /* we can generate anything out of plaintext
+                                  passwords */
+                               password = password_generate(password, user,
+                                                            wanted_scheme);
+                       } else {
+                               if (verbose) {
+                                       i_info("password(%s): Requested %s "
+                                              "scheme, but we have only %s",
+                                              user, wanted_scheme, scheme);
+                               }
+                               password = NULL;
                        }
-                       password = NULL;
                }
        }
 

diff --git a/src/auth/password-verify.c b/src/auth/password-scheme.c
similarity index 55%
rename from src/auth/password-verify.c
rename to src/auth/password-scheme.c
index 3b981426a45cf070548f3ff6229f9fde5b54fddf..c9de2a5577aa4f5c43db0b1b7f3c1ccfa1e10459 100644 (file)
--- a/src/auth/password-verify.c
+++ b/src/auth/password-scheme.c
@@ -4,7 +4,8 @@
 #include "hex-binary.h"
 #include "md5.h"
 #include "mycrypt.h"
-#include "password-verify.h"
+#include "randgen.h"
+#include "password-scheme.h"
 
 int password_verify(const char *plaintext, const char *password,
                    const char *scheme, const char *user)
@@ -58,3 +59,42 @@ const char *password_get_scheme(const char **password)
        *password = p + 1;
        return scheme;
 }
+
+const char *password_generate(const char *plaintext, const char *user,
+                             const char *scheme)
+{
+       static const char *salt_chars =
+               "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ./";
+       const char *realm, *str;
+       unsigned char digest[16];
+       char salt[3];
+
+       if (strcasecmp(scheme, "CRYPT") == 0) {
+               random_fill(salt, 2);
+               salt[0] = salt_chars[salt[0] % (sizeof(salt_chars)-1)];
+               salt[1] = salt_chars[salt[1] % (sizeof(salt_chars)-1)];
+               salt[2] = '\0';
+               return t_strdup(mycrypt(plaintext, salt));
+       }
+
+       if (strcasecmp(scheme, "PLAIN") == 0)
+               return plaintext;
+
+       if (strcasecmp(scheme, "DIGEST-MD5") == 0) {
+               /* user:realm:passwd */
+               realm = strchr(user, '@');
+               if (realm != NULL) realm++; else realm = "";
+
+               str = t_strconcat(t_strcut(user, '@'), ":", realm,  ":",
+                                 plaintext, NULL);
+               md5_get_digest(str, strlen(str), digest);
+               return binary_to_hex(digest, sizeof(digest));
+       }
+
+       if (strcasecmp(scheme, "PLAIN-MD5") == 0) {
+               md5_get_digest(plaintext, strlen(plaintext), digest);
+               return binary_to_hex(digest, sizeof(digest));
+       }
+
+       return NULL;
+}

diff --git a/src/auth/password-verify.h b/src/auth/password-scheme.h
similarity index 57%
rename from src/auth/password-verify.h
rename to src/auth/password-scheme.h
index d0f28f93f5cbe4e7d48bc34227c072db4b08f20f..959af7e9b8e948ec440a1ece8b2541144d93a57a 100644 (file)
--- a/src/auth/password-verify.h
+++ b/src/auth/password-scheme.h
@@ -1,5 +1,5 @@
-#ifndef __PASSWORD_VERIFY_H
-#define __PASSWORD_VERIFY_H
+#ifndef __PASSWORD_SCHEME_H
+#define __PASSWORD_SCHEME_H
 
 /* Returns 1 = matched, 0 = didn't match, -1 = unknown scheme */
 int password_verify(const char *plaintext, const char *password,
@@ -8,4 +8,8 @@ int password_verify(const char *plaintext, const char *password,
 /* Extracts scheme from password, or returns NULL if it isn't found. */
 const char *password_get_scheme(const char **password);
 
+/* Create wanted password scheme out of plaintext password and username. */
+const char *password_generate(const char *plaintext, const char *user,
+                             const char *scheme);
+
 #endif