From: Marco Bettini Date: Tue, 28 Jul 2026 14:02:54 +0000 (+0000) Subject: lib-sasl: Remove set-credentials support X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=52eb7a6c401cce4871c2a03485ccd475211b655e;p=thirdparty%2Fdovecot%2Fcore.git lib-sasl: Remove set-credentials support The OTP mechanism was the only mechanism that updated the stored passdb credentials, so with it gone nothing calls sasl_server_request_set_credentials() anymore. --- diff --git a/src/auth/auth-sasl.c b/src/auth/auth-sasl.c index a9a5b90a09..48a6c3397d 100644 --- a/src/auth/auth-sasl.c +++ b/src/auth/auth-sasl.c @@ -643,7 +643,6 @@ auth_sasl_mech_verify_passdb(const struct auth *auth, break; case SASL_MECH_PASSDB_NEED_VERIFY_RESPONSE: case SASL_MECH_PASSDB_NEED_LOOKUP_CREDENTIALS: - case SASL_MECH_PASSDB_NEED_SET_CREDENTIALS: if (!auth_passdb_list_have_lookup_credentials(auth)) return FALSE; break; diff --git a/src/lib-sasl/fuzz-sasl-authentication.c b/src/lib-sasl/fuzz-sasl-authentication.c index f07ca5cc6d..7a7998c461 100644 --- a/src/lib-sasl/fuzz-sasl-authentication.c +++ b/src/lib-sasl/fuzz-sasl-authentication.c @@ -223,23 +223,6 @@ fuzz_server_request_lookup_credentials( callback(&fctx->ssrctx, &result); } -static void -fuzz_server_request_set_credentials( - struct sasl_server_req_ctx *rctx, - const char *scheme ATTR_UNUSED, const char *data ATTR_UNUSED, - sasl_server_passdb_callback_t *callback) -{ - struct fuzz_sasl_context *fctx = - container_of(rctx, struct fuzz_sasl_context, ssrctx); - struct sasl_passdb_result result; - - /* Credentials are currently not actually stored */ - - i_zero(&result); - result.status = SASL_PASSDB_RESULT_OK; - callback(&fctx->ssrctx, &result); -} - static void fuzz_sasl_amend_data(struct fuzz_sasl_context *fctx, const unsigned char **_data, size_t *_size) @@ -502,7 +485,6 @@ struct sasl_server_request_funcs server_funcs = { .request_verify_plain = fuzz_server_request_verify_plain, .request_lookup_credentials = fuzz_server_request_lookup_credentials, - .request_set_credentials = fuzz_server_request_set_credentials, .request_output = fuzz_server_request_output, }; diff --git a/src/lib-sasl/sasl-server-private.h b/src/lib-sasl/sasl-server-private.h index 9dc2457bbf..6d1d6a0b5f 100644 --- a/src/lib-sasl/sasl-server-private.h +++ b/src/lib-sasl/sasl-server-private.h @@ -8,7 +8,6 @@ extern struct event_category event_category_sasl_server; enum sasl_server_passdb_type { SASL_SERVER_PASSDB_TYPE_VERIFY_PLAIN, SASL_SERVER_PASSDB_TYPE_LOOKUP_CREDENTIALS, - SASL_SERVER_PASSDB_TYPE_SET_CREDENTIALS, }; struct sasl_server_request { diff --git a/src/lib-sasl/sasl-server-protected.h b/src/lib-sasl/sasl-server-protected.h index acea156a49..36c76b4e9f 100644 --- a/src/lib-sasl/sasl-server-protected.h +++ b/src/lib-sasl/sasl-server-protected.h @@ -138,10 +138,6 @@ void sasl_server_request_verify_plain( void sasl_server_request_lookup_credentials( struct sasl_server_mech_request *mreq, const char *scheme, sasl_server_mech_passdb_callback_t *callback); -void sasl_server_request_set_credentials( - struct sasl_server_mech_request *mreq, - const char *scheme, const char *data, - sasl_server_mech_passdb_callback_t *callback); /* Obtains the mechanism request struct (protected) from the request context struct (public). This function meant for providing the means to have diff --git a/src/lib-sasl/sasl-server-request.c b/src/lib-sasl/sasl-server-request.c index 0688948384..54adf83868 100644 --- a/src/lib-sasl/sasl-server-request.c +++ b/src/lib-sasl/sasl-server-request.c @@ -627,51 +627,6 @@ void sasl_server_request_lookup_credentials( lookup_credentials_callback); } -static void -set_credentials_callback(struct sasl_server_req_ctx *rctx, - const struct sasl_passdb_result *result) -{ - struct sasl_server_request *req = rctx->request; - - i_assert(req->state == SASL_SERVER_REQUEST_STATE_PASSDB); - req->state = SASL_SERVER_REQUEST_STATE_SERVER; - if (result->status == SASL_PASSDB_RESULT_INTERNAL_FAILURE) - req->failed = TRUE; - - e_debug(req->event, "Finished updating passdb credentials (status=%s)", - sasl_passdb_result_to_string(result->status)); - - i_assert(req->passdb_type == SASL_SERVER_PASSDB_TYPE_SET_CREDENTIALS); - req->passdb_callback(req->mech, result); -} - -void sasl_server_request_set_credentials( - struct sasl_server_mech_request *mreq, - const char *scheme, const char *data, - sasl_server_mech_passdb_callback_t *callback) -{ - struct sasl_server_request *req = mreq->req; - struct sasl_server *server = req->sinst->server; - const struct sasl_server_request_funcs *funcs = server->funcs; - - i_assert(req->rctx != NULL); - - i_assert(!req->failed); - i_assert(req->state == SASL_SERVER_REQUEST_STATE_NEW || - req->state == SASL_SERVER_REQUEST_STATE_SERVER); - req->state = SASL_SERVER_REQUEST_STATE_PASSDB; - - e_debug(req->event, "Updating passdb credentials (scheme=%s)", - scheme); - - req->passdb_type = SASL_SERVER_PASSDB_TYPE_SET_CREDENTIALS; - req->passdb_callback = callback; - - i_assert(funcs->request_set_credentials != NULL); - funcs->request_set_credentials(req->rctx, scheme, data, - set_credentials_callback); -} - struct sasl_server_mech_request * sasl_server_request_get_mech_request(struct sasl_server_req_ctx *rctx) { diff --git a/src/lib-sasl/sasl-server.h b/src/lib-sasl/sasl-server.h index 6dd7d7609d..62d16100d4 100644 --- a/src/lib-sasl/sasl-server.h +++ b/src/lib-sasl/sasl-server.h @@ -33,8 +33,6 @@ enum sasl_mech_passdb_need { SASL_MECH_PASSDB_NEED_VERIFY_RESPONSE, /* Mechanism needs to look up credentials with appropriate scheme */ SASL_MECH_PASSDB_NEED_LOOKUP_CREDENTIALS, - /* Mechanism needs to look up credentials and also modify them */ - SASL_MECH_PASSDB_NEED_SET_CREDENTIALS, }; enum sasl_server_output_status { @@ -141,10 +139,6 @@ struct sasl_server_request_funcs { void (*request_lookup_credentials)( struct sasl_server_req_ctx *rctx, const char *scheme, sasl_server_passdb_callback_t *callback); - void (*request_set_credentials)( - struct sasl_server_req_ctx *rctx, - const char *scheme, const char *data, - sasl_server_passdb_callback_t *callback); void (*request_free)(struct sasl_server_req_ctx *rctx); }; diff --git a/src/lib-sasl/test-sasl-authentication.c b/src/lib-sasl/test-sasl-authentication.c index fac0b1246b..c755c5a081 100644 --- a/src/lib-sasl/test-sasl-authentication.c +++ b/src/lib-sasl/test-sasl-authentication.c @@ -33,18 +33,9 @@ struct test_sasl { bool failure:1; }; -struct test_sasl_passdb { - pool_t pool; - - const char *credentials_stored; - const char *credentials_scheme; -}; - struct test_sasl_context { pool_t pool; - struct test_sasl_passdb *passdb; - struct sasl_server_req_ctx ssrctx; const struct test_sasl *test; @@ -202,7 +193,6 @@ test_server_request_lookup_credentials( struct test_sasl_context *tctx = container_of(rctx, struct test_sasl_context, ssrctx); const struct test_sasl *test = tctx->test; - struct test_sasl_passdb *passdb = tctx->passdb; struct sasl_passdb_result result; i_zero(&result); @@ -225,16 +215,6 @@ test_server_request_lookup_credentials( return; } - if (passdb->credentials_stored != NULL) { - i_assert(strcasecmp(scheme, passdb->credentials_scheme) == 0); - result.status = SASL_PASSDB_RESULT_OK; - result.credentials.data = - (const unsigned char *)passdb->credentials_stored; - result.credentials.size = strlen(passdb->credentials_stored); - callback(&tctx->ssrctx, &result); - return; - } - const struct password_generate_params params = { .user = (test->server.realm == NULL ? test->server.authid : t_strconcat(test->server.authid, "@", @@ -253,23 +233,6 @@ test_server_request_lookup_credentials( callback(&tctx->ssrctx, &result); } -static void -test_server_request_set_credentials( - struct sasl_server_req_ctx *rctx, const char *scheme, const char *data, - sasl_server_passdb_callback_t *callback) -{ - struct test_sasl_context *tctx = - container_of(rctx, struct test_sasl_context, ssrctx); - struct test_sasl_passdb *passdb = tctx->passdb; - struct sasl_passdb_result result; - - passdb->credentials_stored = p_strdup(passdb->pool, data); - passdb->credentials_scheme = p_strdup(passdb->pool, scheme); - - result.status = SASL_PASSDB_RESULT_OK; - callback(&tctx->ssrctx, &result); -} - static void test_server_request_output(struct sasl_server_req_ctx *rctx, const struct sasl_server_output *output) @@ -363,7 +326,6 @@ struct sasl_server_request_funcs server_funcs = { .request_verify_plain = test_server_request_verify_plain, .request_lookup_credentials = test_server_request_lookup_credentials, - .request_set_credentials = test_server_request_set_credentials, .request_output = test_server_request_output, }; @@ -421,7 +383,6 @@ static void test_sasl_interact(struct test_sasl_context *tctx) static void test_sasl_run_once(const struct test_sasl *test, - struct test_sasl_passdb *passdb, const struct sasl_server_mech *server_mech, bool auth_initial) { @@ -430,7 +391,6 @@ test_sasl_run_once(const struct test_sasl *test, i_zero(&tctx); tctx.pool = pool_alloconly_create(MEMPOOL_GROWING"test_sasl", 2048); - tctx.passdb = passdb; tctx.test = test; tctx.auth_initial = auth_initial; @@ -544,16 +504,10 @@ test_sasl_run(const struct test_sasl *test, const char *label, } #endif - struct test_sasl_passdb passdb; unsigned int repeat = (test->repeat > 0 ? test->repeat : 1); - i_zero(&passdb); - passdb.pool = pool_alloconly_create(MEMPOOL_GROWING"test passdb", 2048); - for (i = 0; i < repeat && !test_has_failed(); i++) - test_sasl_run_once(test, &passdb, server_mech, auth_initial); - - pool_unref(&passdb.pool); + test_sasl_run_once(test, server_mech, auth_initial); sasl_server_instance_unref(&server_inst); sasl_server_deinit(&server);