imap proxy: Detect and log invalid remote input.

--HG--
branch : HEAD

diff --git a/src/imap-login/client.h b/src/imap-login/client.h
index 5dc3d34107e2e393edbd6313989cf911da01efb7..1339ee39fcf21bbf35d2ac93f049c6d85bed44b9 100644 (file)
--- a/src/imap-login/client.h
+++ b/src/imap-login/client.h
@@ -15,6 +15,7 @@ struct imap_client {
        unsigned int cmd_finished:1;
        unsigned int proxy_sasl_ir:1;
        unsigned int proxy_seen_banner:1;
+       unsigned int proxy_wait_auth_continue:1;
        unsigned int skip_line:1;
        unsigned int id_logged:1;
        unsigned int client_ignores_capability_resp_code:1;

diff --git a/src/imap-login/imap-proxy.c b/src/imap-login/imap-proxy.c
index a94f4511dacf286a6af291ee30b70b0be5085b3d..34f16e80211c60b20f2176cc69e4f059e23dde22 100644 (file)
--- a/src/imap-login/imap-proxy.c
+++ b/src/imap-login/imap-proxy.c
@@ -91,6 +91,7 @@ static void proxy_write_login(struct imap_client *client, string_t *str)
        } else {
                /* master user login without SASL initial response */
                str_append(str, "L AUTHENTICATE PLAIN");
+               client->proxy_wait_auth_continue = TRUE;
        }
        str_append(str, "\r\n");
 }
@@ -155,6 +156,15 @@ int imap_proxy_parse_line(struct client *client, const char *line)
                return 0;
        } else if (*line == '+') {
                /* AUTHENTICATE started. finish it. */
+               if (!imap_client->proxy_wait_auth_continue) {
+                       client_log_err(client, t_strdup_printf(
+                               "proxy: Unexpected input: %s",
+                               str_sanitize(line, 160)));
+                       client_proxy_failed(client, TRUE);
+                       return -1;
+               }
+               imap_client->proxy_wait_auth_continue = FALSE;
+
                str = t_str_new(128);
                get_plain_auth(client, str);
                str_append(str, "\r\n");
@@ -250,6 +260,9 @@ int imap_proxy_parse_line(struct client *client, const char *line)
                return 0;
        } else {
                /* tagged reply, shouldn't happen. */
+               client_log_err(client, t_strdup_printf(
+                       "proxy: Unexpected input, ignoring: %s",
+                       str_sanitize(line, 160)));
                return 0;
        }
 }
@@ -260,4 +273,5 @@ void imap_proxy_reset(struct client *client)
 
        imap_client->proxy_sasl_ir = FALSE;
        imap_client->proxy_seen_banner = FALSE;
+       imap_client->proxy_wait_auth_continue = FALSE;
 }