From: Timo Sirainen Date: Mon, 3 Aug 2026 12:49:56 +0000 (+0000) Subject: login-common: Rename sasl-server.[ch] to sasl-proxy.[ch] X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;p=thirdparty%2Fdovecot%2Fcore.git login-common: Rename sasl-server.[ch] to sasl-proxy.[ch] Both lib-sasl and login-common had a sasl-server.h and both were installed into $(pkgincludedir), so one overwrote the other. They also shared the same SASL_SERVER_H include guard, and since login-common builds with -I on lib-sasl, the unqualified #include "sasl-server.h" was ambiguous. Rename the login-common header and source and change the symbol prefix from sasl_server_ to sasl_proxy_. The login process doesn't implement SASL itself, it only proxies the SASL exchange between the client and the auth process. --- diff --git a/src/imap-login/client-authenticate.c b/src/imap-login/client-authenticate.c index 84a958c563..dd929da776 100644 --- a/src/imap-login/client-authenticate.c +++ b/src/imap-login/client-authenticate.c @@ -24,7 +24,7 @@ void client_authenticate_get_capabilities(struct client *client, string_t *str) const struct auth_mech_desc *mech; unsigned int i, count; - mech = sasl_server_get_advertised_mechs(client, &count); + mech = sasl_proxy_get_advertised_mechs(client, &count); for (i = 0; i < count; i++) { str_append_c(str, ' '); str_append(str, "AUTH="); diff --git a/src/imap-login/imap-login-client.c b/src/imap-login/imap-login-client.c index f74a2e3647..d6ea1fd2db 100644 --- a/src/imap-login/imap-login-client.c +++ b/src/imap-login/imap-login-client.c @@ -77,7 +77,7 @@ bool client_handle_parser_error(struct imap_client *client, static bool is_login_cmd_disabled(struct client *client) { if (client->connection_secured) { - if (sasl_server_find_available_mech( + if (sasl_proxy_find_available_mech( client, SASL_MECH_NAME_PLAIN) == NULL) { /* no PLAIN authentication, can't use LOGIN command */ return TRUE; diff --git a/src/login-common/Makefile.am b/src/login-common/Makefile.am index c6c38aca48..4c1d052f62 100644 --- a/src/login-common/Makefile.am +++ b/src/login-common/Makefile.am @@ -23,7 +23,7 @@ liblogin_la_SOURCES = \ login-proxy-state.c \ login-settings.c \ main.c \ - sasl-server.c + sasl-proxy.c headers = \ client-common.h \ @@ -32,7 +32,7 @@ headers = \ login-proxy-state.h \ login-settings.h \ login-log.h \ - sasl-server.h + sasl-proxy.h pkginc_libdir=$(pkgincludedir) pkginc_lib_HEADERS = $(headers) diff --git a/src/login-common/client-common-auth.c b/src/login-common/client-common-auth.c index 9a10494645..db55352bbe 100644 --- a/src/login-common/client-common-auth.c +++ b/src/login-common/client-common-auth.c @@ -198,11 +198,11 @@ static bool client_auth_parse_args(const struct client *client, bool success, reply_r->fail_code = client_auth_fail_code_lookup(value); } } else if (strcmp(key, "user") == 0) { - /* Usually this is already handled in sasl-server.c, + /* Usually this is already handled in sasl-proxy.c, but this needs to be saved when handling reauth. */ *username_r = value; } else if (strcmp(key, "postlogin_socket") == 0) { - /* already handled in sasl-server.c */ + /* already handled in sasl-proxy.c */ } else if (str_begins_with(key, "user_")) { if (success) { alt_username_set(&reply_r->alt_usernames, @@ -472,7 +472,7 @@ proxy_redirect_reauth(struct client *client, const char *destuser, e_debug(client->event, "Reauthenticating user %s (redirect to %s:%u)", destuser, host, port); - if (sasl_server_auth_request_info_fill(client, &info, &client_error) < 0) { + if (sasl_proxy_auth_request_info_fill(client, &info, &client_error) < 0) { const char *error = t_strdup_printf( "Unexpected failure on reauth: %s", client_error); login_proxy_failed(client->login_proxy, @@ -904,7 +904,7 @@ void client_auth_respond(struct client *client, const char *response) io_remove(&client->io); if (strcmp(response, "*") == 0) { - sasl_server_auth_abort(client, "Aborted by client"); + sasl_proxy_auth_abort(client, "Aborted by client"); return; } @@ -918,12 +918,12 @@ void client_auth_respond(struct client *client, const char *response) client->auth_client_continue_pending = FALSE; client_set_auth_waiting(client); - sasl_server_auth_continue(client, response); + sasl_proxy_auth_continue(client, response); } void client_auth_fail(struct client *client, const char *text) { - sasl_server_auth_failed(client, text, NULL); + sasl_proxy_auth_failed(client, text, NULL); } int client_auth_read_line(struct client *client) @@ -992,11 +992,11 @@ void client_auth_send_challenge(struct client *client, const char *data) } static bool -client_auth_reply_args(struct client *client, enum sasl_server_reply sasl_reply, +client_auth_reply_args(struct client *client, enum sasl_proxy_reply sasl_reply, const char *data, const char *const *args, struct client_auth_reply *reply_r) { - bool success = sasl_reply == SASL_SERVER_REPLY_SUCCESS; + bool success = sasl_reply == SASL_PROXY_REPLY_SUCCESS; const char *username; timeout_remove(&client->to_auth_waiting); @@ -1023,20 +1023,20 @@ client_auth_reply_args(struct client *client, enum sasl_server_reply sasl_reply, } static void -sasl_callback(struct client *client, enum sasl_server_reply sasl_reply, +sasl_callback(struct client *client, enum sasl_proxy_reply sasl_reply, const char *data, const char *const *args) { struct client_auth_reply reply; i_assert(!client->destroyed || - sasl_reply == SASL_SERVER_REPLY_AUTH_ABORTED || - sasl_reply == SASL_SERVER_REPLY_MASTER_FAILED || - sasl_reply == SASL_SERVER_REPLY_MASTER_FAILED_LIMIT); + sasl_reply == SASL_PROXY_REPLY_AUTH_ABORTED || + sasl_reply == SASL_PROXY_REPLY_MASTER_FAILED || + sasl_reply == SASL_PROXY_REPLY_MASTER_FAILED_LIMIT); client->last_auth_fail = CLIENT_AUTH_FAIL_CODE_NONE; i_zero(&reply); switch (sasl_reply) { - case SASL_SERVER_REPLY_SUCCESS: + case SASL_PROXY_REPLY_SUCCESS: if (!client_auth_reply_args(client, sasl_reply, data, args, &reply)) break; @@ -1046,13 +1046,13 @@ sasl_callback(struct client *client, enum sasl_server_reply sasl_reply, &reply, NULL); client_destroy_success(client, "Logged in"); break; - case SASL_SERVER_REPLY_AUTH_FAILED: - case SASL_SERVER_REPLY_AUTH_ABORTED: + case SASL_PROXY_REPLY_AUTH_FAILED: + case SASL_PROXY_REPLY_AUTH_ABORTED: if (!client_auth_reply_args(client, sasl_reply, data, args, &reply)) break; - if (sasl_reply == SASL_SERVER_REPLY_AUTH_ABORTED) { + if (sasl_reply == SASL_PROXY_REPLY_AUTH_ABORTED) { client_auth_result(client, CLIENT_AUTH_RESULT_ABORTED, &reply, "Authentication aborted by client."); } else if (data == NULL) { @@ -1068,11 +1068,11 @@ sasl_callback(struct client *client, enum sasl_server_reply sasl_reply, if (!client->destroyed) client_auth_failed(client); break; - case SASL_SERVER_REPLY_MASTER_FAILED: - case SASL_SERVER_REPLY_MASTER_FAILED_LIMIT: + case SASL_PROXY_REPLY_MASTER_FAILED: + case SASL_PROXY_REPLY_MASTER_FAILED_LIMIT: if (data == NULL) ; - else if (sasl_reply == SASL_SERVER_REPLY_MASTER_FAILED) { + else if (sasl_reply == SASL_PROXY_REPLY_MASTER_FAILED) { /* authentication itself succeeded, we just hit some internal failure. */ client_auth_result(client, CLIENT_AUTH_RESULT_TEMPFAIL, @@ -1101,7 +1101,7 @@ sasl_callback(struct client *client, enum sasl_server_reply sasl_reply, } client_destroy(client, data); break; - case SASL_SERVER_REPLY_CONTINUE: + case SASL_PROXY_REPLY_CONTINUE: i_assert(client->v.auth_send_challenge != NULL); client->v.auth_send_challenge(client, data); @@ -1125,7 +1125,7 @@ sasl_callback(struct client *client, enum sasl_server_reply sasl_reply, static int client_auth_begin_common(struct client *client, const char *mech_name, - enum sasl_server_auth_flags auth_flags, + enum sasl_proxy_auth_flags auth_flags, const char *init_resp) { i_assert(!client->authenticating); @@ -1143,8 +1143,8 @@ client_auth_begin_common(struct client *client, const char *mech_name, client_ref(client); client->auth_initializing = TRUE; - sasl_server_auth_begin(client, mech_name, auth_flags, - init_resp, sasl_callback); + sasl_proxy_auth_begin(client, mech_name, auth_flags, + init_resp, sasl_callback); client->auth_initializing = FALSE; if (!client->authenticating) return 1; @@ -1165,7 +1165,7 @@ int client_auth_begin_private(struct client *client, const char *mech_name, const char *init_resp) { return client_auth_begin_common(client, mech_name, - SASL_SERVER_AUTH_FLAG_PRIVATE, + SASL_PROXY_AUTH_FLAG_PRIVATE, init_resp); } @@ -1173,7 +1173,7 @@ int client_auth_begin_implicit(struct client *client, const char *mech_name, const char *init_resp) { return client_auth_begin_common(client, mech_name, - SASL_SERVER_AUTH_FLAG_IMPLICIT, + SASL_PROXY_AUTH_FLAG_IMPLICIT, init_resp); } diff --git a/src/login-common/client-common.c b/src/login-common/client-common.c index 09ea2b0591..c4398aa91d 100644 --- a/src/login-common/client-common.c +++ b/src/login-common/client-common.c @@ -531,8 +531,8 @@ void client_destroy(struct client *client, const char *reason) } else if (client->auth_request != NULL || client->anvil_query != NULL) { i_assert(client->authenticating); - sasl_server_auth_abort(client, - reason != NULL ? reason : "Aborted"); + sasl_proxy_auth_abort(client, + reason != NULL ? reason : "Aborted"); } i_assert(!client->authenticating); i_assert(client->auth_request == NULL); diff --git a/src/login-common/client-common.h b/src/login-common/client-common.h index 39c05cc746..91e23f823e 100644 --- a/src/login-common/client-common.h +++ b/src/login-common/client-common.h @@ -5,7 +5,7 @@ struct module; #include "net.h" #include "login-proxy.h" -#include "sasl-server.h" +#include "sasl-proxy.h" #include "login-client.h" #define LOGIN_MAX_SESSION_ID_LEN 64 @@ -230,7 +230,7 @@ struct client { unsigned int proxy_ttl; char *auth_mech_name; - enum sasl_server_auth_flags auth_flags; + enum sasl_proxy_auth_flags auth_flags; /* Auth request set while the client is authenticating. During this time authenticating=TRUE also. */ struct auth_client_request *auth_request; @@ -249,7 +249,7 @@ struct client { sending client fd to mail process. authenticating is always TRUE while this is non-zero. */ unsigned int master_tag; - sasl_server_callback_t *sasl_callback; + sasl_proxy_callback_t *sasl_callback; unsigned int bad_counter; unsigned int auth_attempts, auth_successes; diff --git a/src/login-common/sasl-server.c b/src/login-common/sasl-proxy.c similarity index 85% rename from src/login-common/sasl-server.c rename to src/login-common/sasl-proxy.c index f7b6e752b9..f76ef26ccc 100644 --- a/src/login-common/sasl-server.c +++ b/src/login-common/sasl-proxy.c @@ -3,7 +3,7 @@ #include "login-common.h" #include "array.h" #include "md5.h" -#include "sasl-server.h" +#include "sasl-proxy.h" #include "str.h" #include "buffer.h" #include "hex-binary.h" @@ -32,8 +32,8 @@ struct anvil_request { }; static bool -sasl_server_filter_mech(struct client *client, struct auth_mech_desc *mech, - bool advertize) +sasl_proxy_filter_mech(struct client *client, struct auth_mech_desc *mech, + bool advertize) { /* Allow plugins to filter and amend available mechanisms. */ if (client->v.sasl_filter_mech != NULL && @@ -70,7 +70,7 @@ sasl_server_filter_mech(struct client *client, struct auth_mech_desc *mech, } const struct auth_mech_desc * -sasl_server_get_advertised_mechs(struct client *client, unsigned int *count_r) +sasl_proxy_get_advertised_mechs(struct client *client, unsigned int *count_r) { const struct auth_mech_desc *mech; struct auth_mech_desc *ret_mech; @@ -87,7 +87,7 @@ sasl_server_get_advertised_mechs(struct client *client, unsigned int *count_r) for (i = j = 0; i < count; i++) { struct auth_mech_desc fmech = mech[i]; - if (!sasl_server_filter_mech(client, &fmech, TRUE)) + if (!sasl_proxy_filter_mech(client, &fmech, TRUE)) continue; ret_mech[j++] = fmech; @@ -97,7 +97,7 @@ sasl_server_get_advertised_mechs(struct client *client, unsigned int *count_r) } const struct auth_mech_desc * -sasl_server_find_available_mech(struct client *client, const char *name) +sasl_proxy_find_available_mech(struct client *client, const char *name) { const struct auth_mech_desc *mech; struct auth_mech_desc fmech; @@ -107,7 +107,7 @@ sasl_server_find_available_mech(struct client *client, const char *name) return NULL; fmech = *mech; - if (!sasl_server_filter_mech(client, &fmech, FALSE)) + if (!sasl_proxy_filter_mech(client, &fmech, FALSE)) return NULL; if (memcmp(&fmech, mech, sizeof(fmech)) != 0) { struct auth_mech_desc *nmech = t_new(struct auth_mech_desc, 1); @@ -137,12 +137,12 @@ client_get_auth_flags(struct client *client) } static void ATTR_NULL(3, 4) -call_client_callback(struct client *client, enum sasl_server_reply reply, +call_client_callback(struct client *client, enum sasl_proxy_reply reply, const char *data, const char *const *args) { - sasl_server_callback_t *sasl_callback; + sasl_proxy_callback_t *sasl_callback; - i_assert(reply != SASL_SERVER_REPLY_CONTINUE); + i_assert(reply != SASL_PROXY_REPLY_CONTINUE); sasl_callback = client->sasl_callback; client->sasl_callback = NULL; @@ -155,7 +155,7 @@ static void login_callback(const struct login_reply *reply, void *context) { struct client *client = context; - enum sasl_server_reply sasl_reply = SASL_SERVER_REPLY_MASTER_FAILED; + enum sasl_proxy_reply sasl_reply = SASL_PROXY_REPLY_MASTER_FAILED; const char *data = NULL; client->master_tag = 0; @@ -163,11 +163,11 @@ login_callback(const struct login_reply *reply, void *context) if (reply != NULL) { switch (reply->status) { case LOGIN_REPLY_STATUS_OK: - sasl_reply = SASL_SERVER_REPLY_SUCCESS; + sasl_reply = SASL_PROXY_REPLY_SUCCESS; data = client->auth_success_data; break; case LOGIN_REPLY_STATUS_INTERNAL_ERROR: - sasl_reply = SASL_SERVER_REPLY_MASTER_FAILED; + sasl_reply = SASL_PROXY_REPLY_MASTER_FAILED; break; } client->mail_pid = reply->mail_pid; @@ -207,7 +207,7 @@ static int master_send_request(struct anvil_request *anvil_request) req.flags |= LOGIN_REQUEST_FLAG_TLS_COMPRESSION; if (client->end_client_tls_secured) req.flags |= LOGIN_REQUEST_FLAG_END_CLIENT_SECURED_TLS; - if (HAS_ALL_BITS(client->auth_flags, SASL_SERVER_AUTH_FLAG_IMPLICIT)) + if (HAS_ALL_BITS(client->auth_flags, SASL_PROXY_AUTH_FLAG_IMPLICIT)) req.flags |= LOGIN_REQUEST_FLAG_IMPLICIT; memcpy(req.cookie, anvil_request->cookie, sizeof(req.cookie)); @@ -245,7 +245,7 @@ anvil_lookup_callback(const struct anvil_reply *reply, const struct login_settings *set = client->set; const char *errmsg; unsigned int conn_count; - enum sasl_server_reply sasl_reply = SASL_SERVER_REPLY_SUCCESS; + enum sasl_proxy_reply sasl_reply = SASL_PROXY_REPLY_SUCCESS; client->anvil_query = NULL; client->anvil_request = NULL; @@ -265,14 +265,14 @@ anvil_lookup_callback(const struct anvil_reply *reply, if (reply == NULL || reply->error != NULL || conn_count < set->mail_max_userip_connections) { if (master_send_request(req) < 0) - sasl_reply = SASL_SERVER_REPLY_MASTER_FAILED; + sasl_reply = SASL_PROXY_REPLY_MASTER_FAILED; errmsg = NULL; /* client will see internal error */ } else { - sasl_reply = SASL_SERVER_REPLY_MASTER_FAILED_LIMIT; + sasl_reply = SASL_PROXY_REPLY_MASTER_FAILED_LIMIT; errmsg = t_strdup_printf(ERR_TOO_MANY_USERIP_CONNECTIONS, set->mail_max_userip_connections); } - if (sasl_reply != SASL_SERVER_REPLY_SUCCESS) { + if (sasl_reply != SASL_PROXY_REPLY_SUCCESS) { client->authenticating = FALSE; auth_client_send_cancel(auth_client, client->master_auth_id); call_client_callback(client, sasl_reply, errmsg, NULL); @@ -313,14 +313,14 @@ anvil_check_too_many_connections(struct client *client) } static bool -sasl_server_check_login(struct client *client) +sasl_proxy_check_login(struct client *client) { if (client->v.sasl_check_login != NULL && !client->v.sasl_check_login(client)) return FALSE; if (client->auth_anonymous && !login_binary->anonymous_login_acceptable) { - sasl_server_auth_failed(client, + sasl_proxy_auth_failed(client, "Anonymous login denied", AUTH_CLIENT_FAIL_CODE_ANONYMOUS_DENIED); return FALSE; @@ -350,8 +350,8 @@ args_parse_user(struct client *client, const char *key, const char *value) } static int -sasl_server_channel_binding(const char *type, void *context, - const buffer_t **data_r, const char **error_r) +sasl_proxy_channel_binding(const char *type, void *context, + const buffer_t **data_r, const char **error_r) { struct client *client = context; @@ -360,14 +360,14 @@ sasl_server_channel_binding(const char *type, void *context, } static void -sasl_server_auth_success_finish(struct client *client, bool nologin, - const char *data, const char *const *args) +sasl_proxy_auth_success_finish(struct client *client, bool nologin, + const char *data, const char *const *args) { if (nologin) { client->authenticating = FALSE; - call_client_callback(client, SASL_SERVER_REPLY_SUCCESS, + call_client_callback(client, SASL_PROXY_REPLY_SUCCESS, data, args); - } else if (!sasl_server_check_login(client)) { + } else if (!sasl_proxy_check_login(client)) { i_assert(!client->authenticating); } else { client->auth_success_data = @@ -398,7 +398,7 @@ authenticate_callback(struct auth_client_request *request, switch (status) { case AUTH_REQUEST_STATUS_CONTINUE: /* continue */ - client->sasl_callback(client, SASL_SERVER_REPLY_CONTINUE, + client->sasl_callback(client, SASL_PROXY_REPLY_CONTINUE, data_base64, NULL); break; case AUTH_REQUEST_STATUS_OK: @@ -436,8 +436,8 @@ authenticate_callback(struct auth_client_request *request, } } - sasl_server_auth_success_finish(client, nologin, - data_base64, args); + sasl_proxy_auth_success_finish(client, nologin, + data_base64, args); break; case AUTH_REQUEST_STATUS_INTERNAL_FAIL: client->auth_process_comm_fail = TRUE; @@ -457,7 +457,7 @@ authenticate_callback(struct auth_client_request *request, } client->authenticating = FALSE; - call_client_callback(client, SASL_SERVER_REPLY_AUTH_FAILED, + call_client_callback(client, SASL_PROXY_REPLY_AUTH_FAILED, NULL, args); break; } @@ -501,9 +501,9 @@ get_cert_username(struct client *client, const char **username_r, return TRUE; } -int sasl_server_auth_request_info_fill(struct client *client, - struct auth_request_info *info_r, - const char **client_error_r) +int sasl_proxy_auth_request_info_fill(struct client *client, + struct auth_request_info *info_r, + const char **client_error_r) { const char *error; @@ -567,14 +567,14 @@ int sasl_server_auth_request_info_fill(struct client *client, return 0; } -void sasl_server_auth_begin(struct client *client, const char *mech_name, - enum sasl_server_auth_flags flags, - const char *initial_resp_base64, - sasl_server_callback_t *callback) +void sasl_proxy_auth_begin(struct client *client, const char *mech_name, + enum sasl_proxy_auth_flags flags, + const char *initial_resp_base64, + sasl_proxy_callback_t *callback) { struct auth_request_info info; const struct auth_mech_desc *mech; - bool private = HAS_ALL_BITS(flags, SASL_SERVER_AUTH_FLAG_PRIVATE); + bool private = HAS_ALL_BITS(flags, SASL_PROXY_AUTH_FLAG_PRIVATE); const char *client_error; i_assert(auth_client_is_connected(auth_client)); @@ -592,10 +592,10 @@ void sasl_server_auth_begin(struct client *client, const char *mech_name, client->auth_flags = flags; client->sasl_callback = callback; - mech = sasl_server_find_available_mech(client, mech_name); + mech = sasl_proxy_find_available_mech(client, mech_name); if (mech == NULL || ((mech->flags & SASL_MECH_SEC_PRIVATE) != 0 && !private)) { - sasl_server_auth_failed(client, + sasl_proxy_auth_failed(client, "Unsupported authentication mechanism.", AUTH_CLIENT_FAIL_CODE_MECH_INVALID); return; @@ -609,15 +609,15 @@ void sasl_server_auth_begin(struct client *client, const char *mech_name, "cleartext authentication not allowed " "without SSL/TLS, but your client did it anyway. " "If anyone was listening, the password was exposed."); - sasl_server_auth_failed(client, + sasl_proxy_auth_failed(client, AUTH_CLEARTEXT_DISABLED_MSG, AUTH_CLIENT_FAIL_CODE_MECH_SSL_REQUIRED); return; } - if (sasl_server_auth_request_info_fill(client, &info, &client_error) < 0) { - sasl_server_auth_failed(client, client_error, - AUTH_CLIENT_FAIL_CODE_AUTHZFAILED); + if (sasl_proxy_auth_request_info_fill(client, &info, &client_error) < 0) { + sasl_proxy_auth_failed(client, client_error, + AUTH_CLIENT_FAIL_CODE_AUTHZFAILED); return; } info.mech = mech->name; @@ -626,13 +626,13 @@ void sasl_server_auth_begin(struct client *client, const char *mech_name, auth_client_request_new(auth_client, &info, authenticate_callback, client); auth_client_request_enable_channel_binding(client->auth_request, - sasl_server_channel_binding, + sasl_proxy_channel_binding, client); } static void ATTR_NULL(2, 3) -sasl_server_auth_cancel(struct client *client, const char *reason, - const char *code, enum sasl_server_reply reply) +sasl_proxy_auth_cancel(struct client *client, const char *reason, + const char *code, enum sasl_proxy_reply reply) { i_assert(client->authenticating); @@ -661,25 +661,25 @@ sasl_server_auth_cancel(struct client *client, const char *reason, call_client_callback(client, reply, reason, NULL); } -void sasl_server_auth_continue(struct client *client, const char *response) +void sasl_proxy_auth_continue(struct client *client, const char *response) { auth_client_request_continue(client->auth_request, response); } -void sasl_server_auth_failed(struct client *client, const char *reason, - const char *code) +void sasl_proxy_auth_failed(struct client *client, const char *reason, + const char *code) { - sasl_server_auth_cancel(client, reason, code, - SASL_SERVER_REPLY_AUTH_FAILED); + sasl_proxy_auth_cancel(client, reason, code, + SASL_PROXY_REPLY_AUTH_FAILED); } -void sasl_server_auth_abort(struct client *client, const char *reason) +void sasl_proxy_auth_abort(struct client *client, const char *reason) { client->auth_aborted_by_client = TRUE; if (client->anvil_query != NULL) { anvil_client_query_abort(anvil, &client->anvil_query); i_free(client->anvil_request); } - sasl_server_auth_cancel(client, reason, NULL, - SASL_SERVER_REPLY_AUTH_ABORTED); + sasl_proxy_auth_cancel(client, reason, NULL, + SASL_PROXY_REPLY_AUTH_ABORTED); } diff --git a/src/login-common/sasl-proxy.h b/src/login-common/sasl-proxy.h new file mode 100644 index 0000000000..40b2c06ad7 --- /dev/null +++ b/src/login-common/sasl-proxy.h @@ -0,0 +1,48 @@ +#ifndef SASL_PROXY_H +#define SASL_PROXY_H + +struct auth_request_info; +struct client; + +enum sasl_proxy_reply { + SASL_PROXY_REPLY_SUCCESS, + SASL_PROXY_REPLY_AUTH_FAILED, + SASL_PROXY_REPLY_AUTH_ABORTED, + SASL_PROXY_REPLY_MASTER_FAILED, + SASL_PROXY_REPLY_MASTER_FAILED_LIMIT, + SASL_PROXY_REPLY_CONTINUE +}; + +enum sasl_proxy_auth_flags { + /* Allow the use of private mechanism */ + SASL_PROXY_AUTH_FLAG_PRIVATE = BIT(0), + /* Signal to the post-login service that this is an implicit login, + meaning that no command success reply is expected. */ + SASL_PROXY_AUTH_FLAG_IMPLICIT = BIT(1), +}; + +typedef void sasl_proxy_callback_t(struct client *client, + enum sasl_proxy_reply reply, + const char *data, const char *const *args); + +const struct auth_mech_desc * +sasl_proxy_get_advertised_mechs(struct client *client, unsigned int *count_r); +const struct auth_mech_desc * +sasl_proxy_find_available_mech(struct client *client, const char *name); + +int sasl_proxy_auth_request_info_fill(struct client *client, + struct auth_request_info *info_r, + const char **client_error_r); + +void sasl_proxy_auth_begin(struct client *client, const char *mech_name, + enum sasl_proxy_auth_flags flags, + const char *initial_resp_base64, + sasl_proxy_callback_t *callback); +void sasl_proxy_auth_continue(struct client *client, const char *response); +void sasl_proxy_auth_failed(struct client *client, const char *reason, + const char *code) ATTR_NULL(3); +/* Called when client asks for SASL authentication to be aborted by sending + "*" line. */ +void sasl_proxy_auth_abort(struct client *client, const char *reason); + +#endif diff --git a/src/login-common/sasl-server.h b/src/login-common/sasl-server.h deleted file mode 100644 index 2c8fd33720..0000000000 --- a/src/login-common/sasl-server.h +++ /dev/null @@ -1,48 +0,0 @@ -#ifndef SASL_SERVER_H -#define SASL_SERVER_H - -struct auth_request_info; -struct client; - -enum sasl_server_reply { - SASL_SERVER_REPLY_SUCCESS, - SASL_SERVER_REPLY_AUTH_FAILED, - SASL_SERVER_REPLY_AUTH_ABORTED, - SASL_SERVER_REPLY_MASTER_FAILED, - SASL_SERVER_REPLY_MASTER_FAILED_LIMIT, - SASL_SERVER_REPLY_CONTINUE -}; - -enum sasl_server_auth_flags { - /* Allow the use of private mechanism */ - SASL_SERVER_AUTH_FLAG_PRIVATE = BIT(0), - /* Signal to the post-login service that this is an implicit login, - meaning that no command success reply is expected. */ - SASL_SERVER_AUTH_FLAG_IMPLICIT = BIT(1), -}; - -typedef void sasl_server_callback_t(struct client *client, - enum sasl_server_reply reply, - const char *data, const char *const *args); - -const struct auth_mech_desc * -sasl_server_get_advertised_mechs(struct client *client, unsigned int *count_r); -const struct auth_mech_desc * -sasl_server_find_available_mech(struct client *client, const char *name); - -int sasl_server_auth_request_info_fill(struct client *client, - struct auth_request_info *info_r, - const char **client_error_r); - -void sasl_server_auth_begin(struct client *client, const char *mech_name, - enum sasl_server_auth_flags flags, - const char *initial_resp_base64, - sasl_server_callback_t *callback); -void sasl_server_auth_continue(struct client *client, const char *response); -void sasl_server_auth_failed(struct client *client, const char *reason, - const char *code) ATTR_NULL(3); -/* Called when client asks for SASL authentication to be aborted by sending - "*" line. */ -void sasl_server_auth_abort(struct client *client, const char *reason); - -#endif diff --git a/src/pop3-login/client-authenticate.c b/src/pop3-login/client-authenticate.c index ab37d77a84..112febd68d 100644 --- a/src/pop3-login/client-authenticate.c +++ b/src/pop3-login/client-authenticate.c @@ -40,7 +40,7 @@ bool cmd_capa(struct pop3_client *client, const char *args ATTR_UNUSED) str_append(str, "USER\r\n"); str_append(str, "SASL"); - mech = sasl_server_get_advertised_mechs(&client->common, &count); + mech = sasl_proxy_get_advertised_mechs(&client->common, &count); for (i = 0; i < count; i++) { str_append_c(str, ' '); str_append(str, mech[i].name); @@ -134,7 +134,7 @@ int cmd_auth(struct pop3_client *pop3_client) const struct auth_mech_desc *mech; client_send_raw(client, "+OK\r\n"); - mech = sasl_server_get_advertised_mechs(client, &count); + mech = sasl_proxy_get_advertised_mechs(client, &count); for (i = 0; i < count; i++) { client_send_raw(client, mech[i].name); client_send_raw(client, "\r\n"); diff --git a/src/pop3-login/client.c b/src/pop3-login/client.c index 96c933bd61..5e64134f3f 100644 --- a/src/pop3-login/client.c +++ b/src/pop3-login/client.c @@ -249,7 +249,7 @@ static char *get_apop_challenge(struct pop3_client *client) unsigned char buffer_base64[MAX_BASE64_ENCODED_SIZE(sizeof(buffer)) + 1]; buffer_t buf; - if (sasl_server_find_available_mech( + if (sasl_proxy_find_available_mech( &client->common, AUTH_SASL_MECH_NAME_APOP) == NULL) { /* disabled, no need to present the challenge */ return NULL; diff --git a/src/submission-login/client-authenticate.c b/src/submission-login/client-authenticate.c index 7dae150051..5b3472c761 100644 --- a/src/submission-login/client-authenticate.c +++ b/src/submission-login/client-authenticate.c @@ -41,8 +41,8 @@ static void cmd_helo_reply(struct submission_client *subm_client, unsigned int count, i; string_t *param = t_str_new(128); - mechs = sasl_server_get_advertised_mechs(client, - &count); + mechs = sasl_proxy_get_advertised_mechs(client, + &count); for (i = 0; i < count; i++) { if (i > 0) str_append_c(param, ' '); @@ -388,7 +388,7 @@ void cmd_mail(struct smtp_server_cmd_ctx *cmd, const char *params) if (HAS_NO_BITS(workarounds, SUBMISSION_LOGIN_WORKAROUND_IMPLICIT_AUTH_EXTERNAL) || - sasl_server_find_available_mech( + sasl_proxy_find_available_mech( client, SASL_MECH_NAME_EXTERNAL) == NULL) { smtp_server_command_fail(cmd->cmd, 530, "5.7.0", "Authentication required.");