auth: sasl-server - Use struct sasl_server_req_ctx in public API

diff --git a/src/auth/auth-request-handler.c b/src/auth/auth-request-handler.c
index 07abdf7584975e0919942f76e2d618bd9247e489..1d9e3388000440cf1cf7af80a26f632e72882321 100644 (file)
--- a/src/auth/auth-request-handler.c
+++ b/src/auth/auth-request-handler.c
@@ -10,7 +10,7 @@
 #include "str.h"
 #include "strescape.h"
 #include "str-sanitize.h"
-#include "sasl-server-protected.h" // FIXME: remove
+#include "sasl-server.h"
 #include "master-interface.h"
 #include "auth-sasl.h"
 #include "auth-penalty.h"

diff --git a/src/auth/auth-request.c b/src/auth/auth-request.c
index b0b41106b56bf6721b7f2682c01c37e84057c14f..ed3a483ff8b9520582663d512358a977537a9ad1 100644 (file)
--- a/src/auth/auth-request.c
+++ b/src/auth/auth-request.c
@@ -15,7 +15,6 @@
 #include "hostpid.h"
 #include "settings.h"
 #include "master-service.h"
-#include "sasl-server-private.h" // FIXME: remove
 #include "auth-cache.h"
 #include "auth-request.h"
 #include "auth-request-handler.h"

diff --git a/src/auth/auth-request.h b/src/auth/auth-request.h
index d829448e8ff5defb56e8ea0ebfe46058196f9106..cbef305000661459206e0043240e0559aa1a38d9 100644 (file)
--- a/src/auth/auth-request.h
+++ b/src/auth/auth-request.h
@@ -17,9 +17,6 @@
 
 #define AUTH_REQUEST_USER_KEY_IGNORE " "
 
-struct sasl_server_mech_def;
-struct sasl_server_mech_request;
-
 struct auth_client_connection;
 
 enum auth_request_state {
@@ -139,7 +136,11 @@ struct auth_request {
        enum passdb_result passdb_result;
 
        const struct sasl_server_mech_def *mech;
-       struct sasl_server_mech_request *sasl;
+       struct {
+               struct sasl_server_req_ctx req;
+               sasl_server_passdb_callback_t *passdb_callback;
+       } sasl;
+
        /* Protocol-specific settings */
        const struct auth_settings *protocol_set;
        /* Currently active settings. May be the same as protocol_set, but

diff --git a/src/auth/auth-sasl-mech-oauth2.c b/src/auth/auth-sasl-mech-oauth2.c
index 187e9c0a4fa14e831747933d29cf1ed46788bbb5..8c2d5a30ede6d6843c73fad69461b6fe801fea74 100644 (file)
--- a/src/auth/auth-sasl-mech-oauth2.c
+++ b/src/auth/auth-sasl-mech-oauth2.c
@@ -5,19 +5,24 @@
 #include "auth-sasl-oauth2.h"
 #include "auth-request.h"
 
+#include "auth-sasl-oauth2.h"
+
 static void
-oauth2_verify_finish(enum passdb_result result, struct auth_request *request)
+oauth2_verify_finish(enum passdb_result result,
+                    struct auth_request *auth_request)
 {
+       struct sasl_server_req_ctx *srctx = &auth_request->sasl.req;
+       struct sasl_server_mech_request *request =
+               sasl_server_request_get_mech_request(srctx);
        struct oauth2_auth_request *oauth2_req =
-               container_of(request->sasl,
-                            struct oauth2_auth_request, request);
+               container_of(request, struct oauth2_auth_request, request);
        struct sasl_server_oauth2_failure failure;
 
        i_zero(&failure);
 
        switch (result) {
        case PASSDB_RESULT_INTERNAL_FAILURE:
-               sasl_server_oauth2_request_fail(request, NULL);
+               sasl_server_oauth2_request_fail(srctx, NULL);
                return;
        case PASSDB_RESULT_USER_DISABLED:
        case PASSDB_RESULT_PASS_EXPIRED:
@@ -32,7 +37,7 @@ oauth2_verify_finish(enum passdb_result result, struct auth_request *request)
        case PASSDB_RESULT_SCHEME_NOT_AVAILABLE:
        case PASSDB_RESULT_OK:
                /* sending success */
-               sasl_server_oauth2_request_succeed(request);
+               sasl_server_oauth2_request_succeed(srctx);
                return;
        default:
                i_unreached();
@@ -42,17 +47,18 @@ oauth2_verify_finish(enum passdb_result result, struct auth_request *request)
                failure.openid_configuration =
                        db_oauth2_get_openid_configuration_url(oauth2_req->db);
        }
-       sasl_server_oauth2_request_fail(request, &failure);
+       sasl_server_oauth2_request_fail(srctx, &failure);
 }
 
 static void
 oauth2_verify_callback(enum passdb_result result,
                       const unsigned char *credentials ATTR_UNUSED,
-                      size_t size ATTR_UNUSED, struct auth_request *request)
+                      size_t size ATTR_UNUSED,
+                      struct auth_request *auth_request)
 {
        if (result == PASSDB_RESULT_USER_UNKNOWN)
                result = PASSDB_RESULT_OK;
-       oauth2_verify_finish(result, request);
+       oauth2_verify_finish(result, auth_request);
 }
 
 static void

diff --git a/src/auth/auth-sasl.c b/src/auth/auth-sasl.c
index cea96ca52deda89905f1674fd71ba1e5adc62e06..8ddf5588bd0286304cce5fe1b48a129add2765a2 100644 (file)
--- a/src/auth/auth-sasl.c
+++ b/src/auth/auth-sasl.c
@@ -1,22 +1,24 @@
 /* Copyright (c) 2023 Dovecot authors, see the included COPYING file */
 
 #include "lib.h"
-#include "sasl-server-protected.h" // FIXME: Use public API only
-#include "sasl-server.h"
+#include "sasl-server-private.h" // FIXME: remove
 #include "auth.h"
 #include "auth-common.h"
 #include "auth-sasl.h"
 #include "auth-request.h"
+#include "auth-request-handler.h"
 
 /*
  * Request
  */
 
 bool
-auth_sasl_request_set_authid(struct auth_request *request,
+auth_sasl_request_set_authid(struct sasl_server_req_ctx *rctx,
                             enum sasl_server_authid_type authid_type,
                             const char *authid)
 {
+       struct auth_request *request =
+               container_of(rctx, struct auth_request, sasl.req);
        const char *error;
 
        switch (authid_type) {
@@ -61,9 +63,11 @@ auth_sasl_request_set_authid(struct auth_request *request,
 }
 
 bool
-auth_sasl_request_set_authzid(struct auth_request *request,
+auth_sasl_request_set_authzid(struct sasl_server_req_ctx *rctx,
                              const char *authzid)
 {
+       struct auth_request *request =
+               container_of(rctx, struct auth_request, sasl.req);
        const char *error;
 
        if (!auth_request_set_login_username(request, authzid, &error)) {
@@ -74,16 +78,21 @@ auth_sasl_request_set_authzid(struct auth_request *request,
 }
 
 void
-auth_sasl_request_set_realm(struct auth_request *request,
+auth_sasl_request_set_realm(struct sasl_server_req_ctx *rctx,
                            const char *realm)
 {
+       struct auth_request *request =
+               container_of(rctx, struct auth_request, sasl.req);
+
        auth_request_set_realm(request, realm);
 }
 
 bool
-auth_sasl_request_get_extra_field(struct auth_request *request,
+auth_sasl_request_get_extra_field(struct sasl_server_req_ctx *rctx,
                                  const char *name, const char **field_r)
 {
+       struct auth_request *request =
+               container_of(rctx, struct auth_request, sasl.req);
        const char *value;
 
        value = auth_fields_find(request->fields.extra_fields, name);
@@ -95,23 +104,32 @@ auth_sasl_request_get_extra_field(struct auth_request *request,
 }
 
 void
-auth_sasl_request_start_channel_binding(struct auth_request *request,
+auth_sasl_request_start_channel_binding(struct sasl_server_req_ctx *rctx,
                                        const char *type)
 {
+       struct auth_request *request =
+               container_of(rctx, struct auth_request, sasl.req);
+
        auth_request_start_channel_binding(request, type);
 }
 
 int
-auth_sasl_request_accept_channel_binding(struct auth_request *request,
+auth_sasl_request_accept_channel_binding(struct sasl_server_req_ctx *rctx,
                                         buffer_t **data_r)
 {
+       struct auth_request *request =
+               container_of(rctx, struct auth_request, sasl.req);
+
        return auth_request_accept_channel_binding(request, data_r);
 }
 
 void
-auth_sasl_request_output(struct auth_request *request,
+auth_sasl_request_output(struct sasl_server_req_ctx *rctx,
                         const struct sasl_server_output *output)
 {
+       struct auth_request *request =
+               container_of(rctx, struct auth_request, sasl.req);
+
        switch (output->status) {
        case SASL_SERVER_OUTPUT_INTERNAL_FAILURE:
                auth_request_internal_failure(request);
@@ -129,28 +147,98 @@ auth_sasl_request_output(struct auth_request *request,
        }
 }
 
+static enum sasl_passdb_result_status
+translate_result_status(enum passdb_result result)
+{
+       switch (result) {
+       case PASSDB_RESULT_INTERNAL_FAILURE:;
+               return SASL_PASSDB_RESULT_INTERNAL_FAILURE;
+       case PASSDB_RESULT_SCHEME_NOT_AVAILABLE:
+               return SASL_PASSDB_RESULT_SCHEME_NOT_AVAILABLE;
+       case PASSDB_RESULT_USER_UNKNOWN:
+               return SASL_PASSDB_RESULT_USER_UNKNOWN;
+       case PASSDB_RESULT_USER_DISABLED:
+               return SASL_PASSDB_RESULT_USER_DISABLED;
+       case PASSDB_RESULT_PASS_EXPIRED:
+               return SASL_PASSDB_RESULT_PASS_EXPIRED;
+       case PASSDB_RESULT_PASSWORD_MISMATCH:
+               return SASL_PASSDB_RESULT_PASSWORD_MISMATCH;
+       case PASSDB_RESULT_NEXT:
+       case PASSDB_RESULT_OK:
+               return SASL_PASSDB_RESULT_OK;
+       }
+       i_unreached();
+}
+
+static void
+verify_plain_callback(enum passdb_result status, struct auth_request *request)
+{
+       const struct sasl_passdb_result result = {
+               .status = translate_result_status(status),
+       };
+       request->sasl.passdb_callback(&request->sasl.req, &result);
+}
+
 void
-auth_sasl_request_verify_plain(struct auth_request *request,
+auth_sasl_request_verify_plain(struct sasl_server_req_ctx *rctx,
                               const char *password,
-                              verify_plain_callback_t *verify_plain_callback)
+                              sasl_server_passdb_callback_t *callback)
 {
+       struct auth_request *request =
+               container_of(rctx, struct auth_request, sasl.req);
+
+       request->sasl.passdb_callback = callback;
        auth_request_verify_plain(request, password, verify_plain_callback);
 }
 
+static void
+lookup_credentials_callback(enum passdb_result status,
+                           const unsigned char *credentials, size_t size,
+                           struct auth_request *request)
+{
+       const struct sasl_passdb_result result = {
+               .status = translate_result_status(status),
+               .credentials = {
+                       .data = credentials,
+                       .size = size,
+               },
+       };
+       request->sasl.passdb_callback(&request->sasl.req, &result);
+}
+
 void
-auth_sasl_request_lookup_credentials(struct auth_request *request,
+auth_sasl_request_lookup_credentials(struct sasl_server_req_ctx *rctx,
                                     const char *scheme,
-                                    lookup_credentials_callback_t *lookup_credentials_callback)
+                                    sasl_server_passdb_callback_t *callback)
 {
+       struct auth_request *request =
+               container_of(rctx, struct auth_request, sasl.req);
+
+       request->sasl.passdb_callback = callback;
        auth_request_lookup_credentials(request, scheme,
                                        lookup_credentials_callback);
 }
 
+static void
+set_credentials_callback(bool success, struct auth_request *request)
+{
+       const struct sasl_passdb_result result = {
+               .status = (success ?
+                          SASL_PASSDB_RESULT_OK :
+                          SASL_PASSDB_RESULT_INTERNAL_FAILURE),
+       };
+       request->sasl.passdb_callback(&request->sasl.req, &result);
+}
+
 void
-auth_sasl_request_set_credentials(struct auth_request *request,
+auth_sasl_request_set_credentials(struct sasl_server_req_ctx *rctx,
                                  const char *scheme, const char *data,
-                                 set_credentials_callback_t  *set_credentials_callback)
+                                 sasl_server_passdb_callback_t *callback)
 {
+       struct auth_request *request =
+               container_of(rctx, struct auth_request, sasl.req);
+
+       request->sasl.passdb_callback = callback;
        auth_request_set_credentials(request, scheme, data,
                                     set_credentials_callback);
 }
@@ -158,17 +246,18 @@ auth_sasl_request_set_credentials(struct auth_request *request,
 void auth_sasl_request_init(struct auth_request *request,
                            const struct sasl_server_mech_def *mech)
 {
-       sasl_server_request_create(request, mech, request->mech_event);
+       sasl_server_request_create(&request->sasl.req, mech,
+                                  request->mech_event);
 }
 
 void auth_sasl_request_deinit(struct auth_request *request)
 {
-       sasl_server_request_destroy(request);
+       sasl_server_request_destroy(&request->sasl.req);
 }
 
 void auth_sasl_request_initial(struct auth_request *request)
 {
-       sasl_server_request_initial(request->sasl,
+       sasl_server_request_initial(&request->sasl.req,
                                    request->initial_response,
                                    request->initial_response_len);
 }
@@ -176,7 +265,7 @@ void auth_sasl_request_initial(struct auth_request *request)
 void auth_sasl_request_continue(struct auth_request *request,
                                const unsigned char *data, size_t data_size)
 {
-       sasl_server_request_input(request->sasl, data, data_size);
+       sasl_server_request_input(&request->sasl.req, data, data_size);
 }
 
 /*

diff --git a/src/auth/auth-sasl.h b/src/auth/auth-sasl.h
index 3fdded49bf2053da5b6b6dff6812900175f6d2b5..75f1dbff7ccba2bd12bb824fbcf401ec27368710 100644 (file)
--- a/src/auth/auth-sasl.h
+++ b/src/auth/auth-sasl.h
@@ -17,47 +17,47 @@ struct auth_sasl_mech_module {
  */
 
 bool
-auth_sasl_request_set_authid(struct auth_request *request,
+auth_sasl_request_set_authid(struct sasl_server_req_ctx *rctx,
                             enum sasl_server_authid_type authid_type,
                             const char *authid);
 
 bool
-auth_sasl_request_set_authzid(struct auth_request *request,
+auth_sasl_request_set_authzid(struct sasl_server_req_ctx *rctx,
                              const char *authzid);
 
 void
-auth_sasl_request_set_realm(struct auth_request *request,
+auth_sasl_request_set_realm(struct sasl_server_req_ctx *rctx,
                            const char *realm);
 
 bool
-auth_sasl_request_get_extra_field(struct auth_request *request,
+auth_sasl_request_get_extra_field(struct sasl_server_req_ctx *rctx,
                                  const char *name, const char **field_r);
 
 void
-auth_sasl_request_start_channel_binding(struct auth_request *request,
+auth_sasl_request_start_channel_binding(struct sasl_server_req_ctx *rctx,
                                        const char *type);
 int
-auth_sasl_request_accept_channel_binding(struct auth_request *request,
+auth_sasl_request_accept_channel_binding(struct sasl_server_req_ctx *rctx,
                                         buffer_t **data_r);
 
 void
-auth_sasl_request_output(struct auth_request *request,
+auth_sasl_request_output(struct sasl_server_req_ctx *rctx,
                         const struct sasl_server_output *output);
 
 void
-auth_sasl_request_verify_plain(struct auth_request *request,
+auth_sasl_request_verify_plain(struct sasl_server_req_ctx *rctx,
                               const char *password,
-                              verify_plain_callback_t *verify_plain_callback);
+                              sasl_server_passdb_callback_t *callback);
 
 void
-auth_sasl_request_lookup_credentials(struct auth_request *request,
+auth_sasl_request_lookup_credentials(struct sasl_server_req_ctx *rctx,
                                     const char *scheme,
-                                    lookup_credentials_callback_t *lookup_credentials_callback);
+                                    sasl_server_passdb_callback_t *callback);
 
 void
-auth_sasl_request_set_credentials(struct auth_request *request,
+auth_sasl_request_set_credentials(struct sasl_server_req_ctx *rctx,
                                  const char *scheme, const char *data,
-                                 set_credentials_callback_t  *set_credentials_callback);
+                                 sasl_server_passdb_callback_t *callback);
 
 void auth_sasl_request_init(struct auth_request *request,
                            const struct sasl_server_mech_def *mech);

diff --git a/src/auth/sasl-server-mech-digest-md5.c b/src/auth/sasl-server-mech-digest-md5.c
index 678ebe47f475489290d0632d94f83a690efffd1a..5cba9a58b41dde7a8c50a12c72048ef650c9e78d 100644 (file)
--- a/src/auth/sasl-server-mech-digest-md5.c
+++ b/src/auth/sasl-server-mech-digest-md5.c
@@ -13,7 +13,7 @@
 #include "str-sanitize.h"
 #include "settings-parser.h"
 
-#include "sasl-server-protected.h"
+#include "sasl-server-private.h" // FIXME: Use protected API only
 
 /* Linear whitespace */
 #define IS_LWS(c) ((c) == ' ' || (c) == '\t')
@@ -620,8 +620,8 @@ void mech_digest_test_set_nonce(struct auth_request *auth_request,
                                const char *nonce)
 {
        struct digest_auth_request *request =
-               container_of(auth_request->sasl, struct digest_auth_request,
-                            auth_request);
+               container_of(auth_request->sasl.req.request->mech,
+                            struct digest_auth_request, auth_request);
 
        i_assert(auth_request->mech == &mech_digest_md5);
        request->nonce = p_strdup(auth_request->pool, nonce);

diff --git a/src/auth/sasl-server-mech-oauth2.c b/src/auth/sasl-server-mech-oauth2.c
index 69a0f1406d1868c91d195075d62d6cddf81ac18c..0e2fb0bcbcecdfcc96833e78d76c88f8602ae494 100644 (file)
--- a/src/auth/sasl-server-mech-oauth2.c
+++ b/src/auth/sasl-server-mech-oauth2.c
@@ -95,9 +95,10 @@ static void oauth2_fail_invalid_token(struct oauth2_auth_request *oauth2_req)
        oauth2_fail_status(oauth2_req, "invalid_token");
 }
 
-void sasl_server_oauth2_request_succeed(struct auth_request *auth_request)
+void sasl_server_oauth2_request_succeed(struct sasl_server_req_ctx *rctx)
 {
-       struct sasl_server_mech_request *request = auth_request->sasl;
+       struct sasl_server_mech_request *request =
+               sasl_server_request_get_mech_request(rctx);
 
        i_assert(request->mech == &mech_oauthbearer ||
                 request->mech == &mech_xoauth2);
@@ -110,10 +111,11 @@ void sasl_server_oauth2_request_succeed(struct auth_request *auth_request)
 }
 
 void sasl_server_oauth2_request_fail(
-       struct auth_request *auth_request,
+       struct sasl_server_req_ctx *rctx,
        const struct sasl_server_oauth2_failure *failure)
 {
-       struct sasl_server_mech_request *request = auth_request->sasl;
+       struct sasl_server_mech_request *request =
+               sasl_server_request_get_mech_request(rctx);
 
        i_assert(request->mech == &mech_oauthbearer ||
                 request->mech == &mech_xoauth2);

diff --git a/src/auth/sasl-server-oauth2.h b/src/auth/sasl-server-oauth2.h
index 15a644465aae09fa34ee2430eefbe5ca779581d0..cbe2580566142622794e4a42c07fa934b3a6b347 100644 (file)
--- a/src/auth/sasl-server-oauth2.h
+++ b/src/auth/sasl-server-oauth2.h
@@ -9,9 +9,9 @@ struct sasl_server_oauth2_failure {
        const char *openid_configuration;
 };
 
-void sasl_server_oauth2_request_succeed(struct auth_request *request);
+void sasl_server_oauth2_request_succeed(struct sasl_server_req_ctx *rctx);
 void sasl_server_oauth2_request_fail(
-       struct auth_request *request,
+       struct sasl_server_req_ctx *rctx,
        const struct sasl_server_oauth2_failure *failure);
 
 #endif

diff --git a/src/auth/sasl-server-private.h b/src/auth/sasl-server-private.h
index 88432be6bcafa1552be4ebdca764191308a09673..93e512de3f21a1fb36731e901ffd16dfec591662 100644 (file)
--- a/src/auth/sasl-server-private.h
+++ b/src/auth/sasl-server-private.h
@@ -10,6 +10,8 @@ enum sasl_server_passdb_type {
 };
 
 struct sasl_server_request {
+       pool_t pool;
+       struct sasl_server_req_ctx *rctx;
        struct sasl_server_mech_request *mech;
 
        enum sasl_server_passdb_type passdb_type;

diff --git a/src/auth/sasl-server-protected.h b/src/auth/sasl-server-protected.h
index 24a541a85cfdb20d109108e3ab0b30a275dbc3de..8e6df4065a5c3356117111d1f7edac66872d011a 100644 (file)
--- a/src/auth/sasl-server-protected.h
+++ b/src/auth/sasl-server-protected.h
@@ -1,8 +1,7 @@
 #ifndef SASL_SERVER_PROTECTED_H
 #define SASL_SERVER_PROTECTED_H
 
-#include "passdb.h" // FIXME: remove
-#include "auth-request-handler.h"
+#include "auth-request.h" // FIXME: remove
 
 #include "sasl-server.h"
 
@@ -118,4 +117,13 @@ void sasl_server_request_set_credentials(
        const char *scheme, const char *data,
        sasl_server_mech_passdb_callback_t *callback);
 
+/* Obtains the mechanism request struct (protected) from the request context
+   struct (public). This function meant for providing the means to have
+   mechanisms that add their own backend API. If you use this function for
+   something else, you are subverting the design of the SASL server API, which
+   is to be avoided.
+*/
+struct sasl_server_mech_request *
+sasl_server_request_get_mech_request(struct sasl_server_req_ctx *rctx);
+
 #endif

diff --git a/src/auth/sasl-server-request.c b/src/auth/sasl-server-request.c
index 0559398d4bc4af5c95be406bce71977971535c35..cd36244524b911221ee4ae3d9c473af5b0d36c70 100644 (file)
--- a/src/auth/sasl-server-request.c
+++ b/src/auth/sasl-server-request.c
@@ -9,15 +9,21 @@
  * Public API
  */
 
-void sasl_server_request_create(struct auth_request *request,
+void sasl_server_request_create(struct sasl_server_req_ctx *rctx,
                                const struct sasl_server_mech_def *mech,
                                struct event *event_parent)
 {
+       struct auth_request *request =
+               container_of(rctx, struct auth_request, sasl.req);
        struct sasl_server_request *req;
        pool_t pool;
 
+       i_zero(rctx);
+
        pool = request->pool;
        req = p_new(pool, struct sasl_server_request, 1);
+       req->pool = pool;
+       req->rctx = rctx;
 
        struct sasl_server_mech_request *mreq;
 
@@ -32,55 +38,63 @@ void sasl_server_request_create(struct auth_request *request,
        mreq->mech_event = event_parent;
 
        req->mech = mreq;
-       request->sasl = mreq;
+       rctx->mech = mech;
+       rctx->mech_name = mech->mech_name;
+       rctx->request = req;
 }
 
-void sasl_server_request_destroy(struct auth_request *request)
+void sasl_server_request_destroy(struct sasl_server_req_ctx *rctx)
 {
-       struct sasl_server_mech_request *mreq = request->sasl;
+       struct sasl_server_request *req = rctx->request;
 
-       if (mreq == NULL)
+       i_zero(rctx);
+       if (req == NULL)
                return;
-       request->sasl = NULL;
+
+       struct sasl_server_mech_request *mreq = req->mech;
 
        if (mreq->mech->auth_free != NULL)
                mreq->mech->auth_free(mreq);
 }
 
 static bool
-sasl_server_request_fail_on_nuls(struct sasl_server_mech_request *mreq,
+sasl_server_request_fail_on_nuls(struct sasl_server_request *req,
                                 const unsigned char *data, size_t data_size)
 {
-       const struct sasl_server_mech_def *mech = mreq->mech;
+       const struct sasl_server_mech_def *mech = req->mech->mech;
 
        if ((mech->flags & SASL_MECH_SEC_ALLOW_NULS) != 0)
                return FALSE;
        if (memchr(data, '\0', data_size) != NULL) {
-               e_debug(mreq->mech_event, "Unexpected NUL in auth data");
-               sasl_server_request_failure(mreq);
+               e_debug(req->mech->mech_event, "Unexpected NUL in auth data");
+               sasl_server_request_failure(req->mech);
                return TRUE;
        }
        return FALSE;
 }
 
-void sasl_server_request_initial(struct sasl_server_mech_request *mreq,
+void sasl_server_request_initial(struct sasl_server_req_ctx *rctx,
                                 const unsigned char *data, size_t data_size)
 {
+       struct sasl_server_request *req = rctx->request;
+       struct sasl_server_mech_request *mreq = req->mech;
        const struct sasl_server_mech_def *mech = mreq->mech;
 
-       if (sasl_server_request_fail_on_nuls(mreq, data, data_size))
+       if (sasl_server_request_fail_on_nuls(req, data, data_size))
                return;
 
        i_assert(mech->auth_initial != NULL);
        mech->auth_initial(mreq, data, data_size);
 }
 
-void sasl_server_request_input(struct sasl_server_mech_request *mreq,
+void sasl_server_request_input(struct sasl_server_req_ctx *rctx,
                               const unsigned char *data, size_t data_size)
 {
+       struct sasl_server_request *req = rctx->request;
+       struct sasl_server_mech_request *mreq = req->mech;
        const struct sasl_server_mech_def *mech = mreq->mech;
 
-       if (sasl_server_request_fail_on_nuls(mreq, data, data_size))
+       if (sasl_server_request_fail_on_nuls(req, data, data_size))
                return;
 
        i_assert(mech->auth_continue != NULL);
@@ -95,76 +109,76 @@ bool sasl_server_request_set_authid(struct sasl_server_mech_request *mreq,
                                    enum sasl_server_authid_type authid_type,
                                    const char *authid)
 {
-       struct auth_request *request = mreq->request;
+       struct sasl_server_request *req = mreq->req;
 
-       return auth_sasl_request_set_authid(request, authid_type, authid);
+       return auth_sasl_request_set_authid(req->rctx, authid_type, authid);
 }
 
 bool sasl_server_request_set_authzid(struct sasl_server_mech_request *mreq,
                                     const char *authzid)
 {
-       struct auth_request *request = mreq->request;
+       struct sasl_server_request *req = mreq->req;
 
-       return auth_sasl_request_set_authzid(request, authzid);
+       return auth_sasl_request_set_authzid(req->rctx, authzid);
 }
 
 void sasl_server_request_set_realm(struct sasl_server_mech_request *mreq,
                                   const char *realm)
 {
-       struct auth_request *request = mreq->request;
+       struct sasl_server_request *req = mreq->req;
 
-       auth_sasl_request_set_realm(request, realm);
+       auth_sasl_request_set_realm(req->rctx, realm);
 }
 
 bool sasl_server_request_get_extra_field(struct sasl_server_mech_request *mreq,
                                         const char *name,
                                         const char **field_r)
 {
-       struct auth_request *request = mreq->request;
+       struct sasl_server_request *req = mreq->req;
 
-       return auth_sasl_request_get_extra_field(request, name, field_r);
+       return auth_sasl_request_get_extra_field(req->rctx, name, field_r);
 }
 
 void sasl_server_request_start_channel_binding(
        struct sasl_server_mech_request *mreq, const char *type)
 {
-       struct auth_request *request = mreq->request;
+       struct sasl_server_request *req = mreq->req;
 
-       auth_sasl_request_start_channel_binding(request, type);
+       auth_sasl_request_start_channel_binding(req->rctx, type);
 }
 
 int sasl_server_request_accept_channel_binding(
        struct sasl_server_mech_request *mreq, buffer_t **data_r)
 {
-       struct auth_request *request = mreq->request;
+       struct sasl_server_request *req = mreq->req;
 
-       return auth_sasl_request_accept_channel_binding(request, data_r);
+       return auth_sasl_request_accept_channel_binding(req->rctx, data_r);
 }
 
 void sasl_server_request_output(struct sasl_server_mech_request *mreq,
                                const void *data, size_t data_size)
 {
-       struct auth_request *request = mreq->request;
+       struct sasl_server_request *req = mreq->req;
 
        const struct sasl_server_output output = {
                .status = SASL_SERVER_OUTPUT_CONTINUE,
                .data = data,
                .data_size = data_size,
        };
-       auth_sasl_request_output(request, &output);
+       auth_sasl_request_output(req->rctx, &output);
 }
 
 void sasl_server_request_success(struct sasl_server_mech_request *mreq,
                                 const void *data, size_t data_size)
 {
-       struct auth_request *request = mreq->request;
+       struct sasl_server_request *req = mreq->req;
 
        const struct sasl_server_output output = {
                .status = SASL_SERVER_OUTPUT_SUCCESS,
                .data = data,
                .data_size = data_size,
        };
-       auth_sasl_request_output(request, &output);
+       auth_sasl_request_output(req->rctx, &output);
 }
 
 static void
@@ -172,14 +186,14 @@ sasl_server_request_failure_common(struct sasl_server_mech_request *mreq,
                                   enum sasl_server_output_status status,
                                   const void *data, size_t data_size)
 {
-       struct auth_request *request = mreq->request;
+       struct sasl_server_request *req = mreq->req;
 
        const struct sasl_server_output output = {
                .status = status,
                .data = data,
                .data_size = data_size,
        };
-       auth_sasl_request_output(request, &output);
+       auth_sasl_request_output(req->rctx, &output);
 }
 
 void sasl_server_request_failure_with_reply(
@@ -203,103 +217,61 @@ void sasl_server_request_internal_failure(
                mreq, SASL_SERVER_OUTPUT_INTERNAL_FAILURE, "", 0);
 }
 
-static enum sasl_passdb_result_status
-translate_result_status(enum passdb_result result)
-{
-       switch (result) {
-       case PASSDB_RESULT_INTERNAL_FAILURE:;
-               return SASL_PASSDB_RESULT_INTERNAL_FAILURE;
-       case PASSDB_RESULT_SCHEME_NOT_AVAILABLE:
-               return SASL_PASSDB_RESULT_SCHEME_NOT_AVAILABLE;
-       case PASSDB_RESULT_USER_UNKNOWN:
-               return SASL_PASSDB_RESULT_USER_UNKNOWN;
-       case PASSDB_RESULT_USER_DISABLED:
-               return SASL_PASSDB_RESULT_USER_DISABLED;
-       case PASSDB_RESULT_PASS_EXPIRED:
-               return SASL_PASSDB_RESULT_PASS_EXPIRED;
-       case PASSDB_RESULT_PASSWORD_MISMATCH:
-               return SASL_PASSDB_RESULT_PASSWORD_MISMATCH;
-       case PASSDB_RESULT_NEXT:
-       case PASSDB_RESULT_OK:
-               return SASL_PASSDB_RESULT_OK;
-       }
-       i_unreached();
-}
-
 static void
-verify_plain_callback(enum passdb_result status, struct auth_request *request)
+verify_plain_callback(struct sasl_server_req_ctx *rctx,
+                     const struct sasl_passdb_result *result)
 {
-       struct sasl_server_mech_request *mreq = request->sasl;
-       struct sasl_server_request *req = mreq->req;
+       struct sasl_server_request *req = rctx->request;
 
        i_assert(req->passdb_type == SASL_SERVER_PASSDB_TYPE_VERIFY_PLAIN);
-
-       const struct sasl_passdb_result result = {
-               .status = translate_result_status(status),
-       };
-       req->passdb_callback(mreq, &result);
+       req->passdb_callback(req->mech, result);
 }
 
 void sasl_server_request_verify_plain(
        struct sasl_server_mech_request *mreq, const char *password,
        sasl_server_mech_passdb_callback_t *callback)
 {
-       struct auth_request *request = mreq->request;
        struct sasl_server_request *req = mreq->req;
 
        req->passdb_type = SASL_SERVER_PASSDB_TYPE_VERIFY_PLAIN;
        req->passdb_callback = callback;
-       auth_sasl_request_verify_plain(request, password, verify_plain_callback);
+
+       auth_sasl_request_verify_plain(req->rctx, password,
+                                      verify_plain_callback);
 }
 
 static void
-lookup_credentials_callback(enum passdb_result status,
-                           const unsigned char *credentials,
-                           size_t size, struct auth_request *request)
+lookup_credentials_callback(struct sasl_server_req_ctx *rctx,
+                           const struct sasl_passdb_result *result)
 {
-       struct sasl_server_mech_request *mreq = request->sasl;
-       struct sasl_server_request *req = mreq->req;
+       struct sasl_server_request *req = rctx->request;
 
        i_assert(req->passdb_type ==
                 SASL_SERVER_PASSDB_TYPE_LOOKUP_CREDENTIALS);
-
-       const struct sasl_passdb_result result = {
-               .status = translate_result_status(status),
-               .credentials = {
-                       .data = credentials,
-                       .size = size,
-               },
-       };
-       req->passdb_callback(mreq, &result);
+       req->passdb_callback(req->mech, result);
 }
 
 void sasl_server_request_lookup_credentials(
        struct sasl_server_mech_request *mreq, const char *scheme,
        sasl_server_mech_passdb_callback_t *callback)
 {
-       struct auth_request *request = mreq->request;
        struct sasl_server_request *req = mreq->req;
 
        req->passdb_type = SASL_SERVER_PASSDB_TYPE_LOOKUP_CREDENTIALS;
        req->passdb_callback = callback;
-       auth_sasl_request_lookup_credentials(request, scheme, 
+
+       auth_sasl_request_lookup_credentials(req->rctx, scheme,
                                             lookup_credentials_callback);
 }
 
 static void
-set_credentials_callback(bool success, struct auth_request *request)
+set_credentials_callback(struct sasl_server_req_ctx *rctx,
+                        const struct sasl_passdb_result *result)
 {
-       struct sasl_server_mech_request *mreq = request->sasl;
-       struct sasl_server_request *req = mreq->req;
+       struct sasl_server_request *req = rctx->request;
 
        i_assert(req->passdb_type == SASL_SERVER_PASSDB_TYPE_SET_CREDENTIALS);
-
-       const struct sasl_passdb_result result = {
-               .status = (success ?
-                          SASL_PASSDB_RESULT_OK :
-                          SASL_PASSDB_RESULT_INTERNAL_FAILURE),
-       };
-       req->passdb_callback(mreq, &result);
+       req->passdb_callback(req->mech, result);
 }
 
 void sasl_server_request_set_credentials(
@@ -307,11 +279,17 @@ void sasl_server_request_set_credentials(
        const char *scheme, const char *data,
        sasl_server_mech_passdb_callback_t *callback)
 {
-       struct auth_request *request = mreq->request;
        struct sasl_server_request *req = mreq->req;
 
        req->passdb_type = SASL_SERVER_PASSDB_TYPE_SET_CREDENTIALS;
        req->passdb_callback = callback;
-       auth_sasl_request_set_credentials(request, scheme, data,
+
+       auth_sasl_request_set_credentials(req->rctx, scheme, data,
                                          set_credentials_callback);
 }
+
+struct sasl_server_mech_request *
+sasl_server_request_get_mech_request(struct sasl_server_req_ctx *rctx)
+{
+       return rctx->request->mech;
+}

diff --git a/src/auth/sasl-server.h b/src/auth/sasl-server.h
index 882e1fda17bf91dc0fcd054c96e826a1e61e3113..d6aa1f7ed383f2a3e3dc3a32289f1c0e15861930 100644 (file)
--- a/src/auth/sasl-server.h
+++ b/src/auth/sasl-server.h
@@ -3,8 +3,8 @@
 
 #include "sasl-common.h"
 
+struct sasl_passdb_result;
 struct sasl_server_mech_def;
-struct sasl_server_mech_request;
 struct sasl_server_request;
 struct sasl_server_req_ctx;
 
@@ -46,6 +46,10 @@ enum sasl_server_output_status {
        SASL_SERVER_OUTPUT_SUCCESS = 1,
 };
 
+typedef void
+sasl_server_passdb_callback_t(struct sasl_server_req_ctx *rctx,
+                             const struct sasl_passdb_result *result);
+
 struct sasl_server_output {
        enum sasl_server_output_status status;
 
@@ -75,14 +79,21 @@ enum sasl_server_authid_type {
        SASL_SERVER_AUTHID_TYPE_EXTERNAL,
 };
 
-void sasl_server_request_create(struct auth_request *request,
+struct sasl_server_req_ctx {
+       const struct sasl_server_mech_def *mech;
+       const char *mech_name;
+
+       struct sasl_server_request *request;
+};
+
+void sasl_server_request_create(struct sasl_server_req_ctx *rctx,
                                const struct sasl_server_mech_def *mech,
                                struct event *event_parent);
-void sasl_server_request_destroy(struct auth_request *request);
+void sasl_server_request_destroy(struct sasl_server_req_ctx *rctx);
 
-void sasl_server_request_initial(struct sasl_server_mech_request *mreq,
+void sasl_server_request_initial(struct sasl_server_req_ctx *rctx,
                                 const unsigned char *data, size_t data_size);
-void sasl_server_request_input(struct sasl_server_mech_request *mreq,
+void sasl_server_request_input(struct sasl_server_req_ctx *rctx,
                               const unsigned char *data, size_t data_size);
 
 #endif

diff --git a/src/auth/test-auth.c b/src/auth/test-auth.c
index 7d6c8a20e9164eb01ed52592a286113d1cda9c0d..1806e2bbd215bf6011cfed80d56673739cc16a08 100644 (file)
--- a/src/auth/test-auth.c
+++ b/src/auth/test-auth.c
@@ -7,6 +7,7 @@
 #include "auth-token.h"
 #include "auth-penalty.h"
 #include "sasl-server-protected.h" // FIXME: remove
+#include "auth-sasl-oauth2.h"
 #include "otp.h"
 #include "mech-otp.h"
 #include "db-oauth2.h"
@@ -62,6 +63,7 @@ void test_auth_init(void)
        password_schemes_register_all();
        password_schemes_allow_weak(TRUE);
 
+       auth_sasl_oauth2_initialize();
        auths_preinit(simple_set.event, global_auth_settings, mech_reg, protocols);
        auths_init();
        auth_token_init();

diff --git a/src/auth/test-mech.c b/src/auth/test-mech.c
index 1ba82e24bc2072c025a3c8b61ed6cf299bfe6047..358bb8ccca02f801bdcb3ee4385856d93e69dfc1 100644 (file)
--- a/src/auth/test-mech.c
+++ b/src/auth/test-mech.c
@@ -5,7 +5,7 @@
 #include "str.h"
 #include "ioloop.h"
 #include "master-service.h"
-#include "sasl-server-protected.h" // FIXME: remove
+#include "sasl-server-private.h" // FIXME: remove
 #include "auth-common.h"
 #include "auth-request.h"
 #include "auth-request-handler-private.h"