From: Timo Sirainen <tss@iki.fi>
Date: Sat, 1 May 2004 19:09:34 +0000 (+0300)
Subject: Don't advertise AUTH=PLAIN unless transport is secure
X-Git-Tag: 1.1.alpha1~4157
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=9eb98cb3f9139afaaaf84b789b70abd1d0890932;p=thirdparty%2Fdovecot%2Fcore.git

Don't advertise AUTH=PLAIN unless transport is secure

--HG--
branch : HEAD
---

diff --git a/src/imap-login/client-authenticate.c b/src/imap-login/client-authenticate.c
index f01f7ef48c..b9033f0dcd 100644
--- a/src/imap-login/client-authenticate.c
+++ b/src/imap-login/client-authenticate.c
@@ -34,10 +34,17 @@ const char *client_authenticate_get_capabilities(int secured)
 	str = t_str_new(128);
 
 	for (i = 0; i < AUTH_MECH_COUNT; i++) {
-		if ((auth_mechs & auth_mech_desc[i].mech) &&
-		    auth_mech_desc[i].name != NULL &&
-		    (secured || !auth_mech_desc[i].plaintext ||
-		     !disable_plaintext_auth)) {
+		if ((auth_mechs & auth_mech_desc[i].mech) == 0)
+			continue; /* not available */
+
+		/* a) transport is secured
+		   b) auth mechanism isn't plaintext
+		   c) we allow insecure authentication
+		        - but don't advertise AUTH=PLAIN, as RFC 2595 requires
+		*/
+		if (secured || !auth_mech_desc[i].plaintext ||
+		    (!disable_plaintext_auth &&
+		     auth_mech_desc[i].mech != AUTH_MECH_PLAIN)) {
 			str_append_c(str, ' ');
 			str_append(str, "AUTH=");
 			str_append(str, auth_mech_desc[i].name);
diff --git a/src/pop3-login/client-authenticate.c b/src/pop3-login/client-authenticate.c
index 6f5203ea69..7001a56e27 100644
--- a/src/pop3-login/client-authenticate.c
+++ b/src/pop3-login/client-authenticate.c
@@ -34,10 +34,18 @@ int cmd_capa(struct pop3_client *client, const char *args __attr_unused__)
 
 		str_append(str, "SASL");
 		for (i = 0; i < AUTH_MECH_COUNT; i++) {
-			if ((auth_mechs & auth_mech_desc[i].mech) &&
-			    auth_mech_desc[i].name != NULL &&
-			    (client->secured || !auth_mech_desc[i].plaintext ||
-			     !disable_plaintext_auth)) {
+			if ((auth_mechs & auth_mech_desc[i].mech) == 0)
+				continue; /* not available */
+
+			/* a) transport is secured
+			   b) auth mechanism isn't plaintext
+			   c) we allow insecure authentication
+			       - but don't advertise AUTH=PLAIN,
+			         as RFC 2595 requires
+			*/
+			if (client->secured || !auth_mech_desc[i].plaintext ||
+			    (!disable_plaintext_auth &&
+			     auth_mech_desc[i].mech != AUTH_MECH_PLAIN)) {
 				str_append_c(str, ' ');
 				str_append(str, auth_mech_desc[i].name);
 			}