Gitweb:
https://git.exim.org/exim.git/commitdiff/98eb95929140ee1e2b2b367b12abb45762d155e9
Commit: 98eb95929140ee1e2b2b367b12abb45762d155e9
Parent: c71c454d483e6bfbecea437978beda69044e5498
Author: Jeremy Harris <jgh146exb@???>
AuthorDate: Tue Dec 24 15:43:00 2019 +0000
Committer: Jeremy Harris <jgh146exb@???>
CommitDate: Tue Dec 24 15:49:46 2019 +0000
Fix the variables set by gsasl authenticator
---
doc/doc-txt/ChangeLog | 4 ++++
src/src/auths/gsasl_exim.c | 38 ++++++++++++++++++++++--------
test/confs/3820 | 47 +++++++++++++++++++++++++++++++++++++
test/scripts/3820-Gnu-SASL/3820 | 26 ++++++++++++++++++++
test/scripts/3820-Gnu-SASL/REQUIRES | 1 +
5 files changed, 106 insertions(+), 10 deletions(-)
diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 5280212..f1db064 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -66,6 +66,10 @@ JH/15 When PIPELINING, synch after every hundred or so RCPT commands sent and
a fast-retry of all 452'd recipients using a new MAIL FROM on the same
connection. The new facility is not tunable at this time.
+JH/16 Fix the variables set by the gsasl authenticator. Previously a pointer to
+ library live data was being used, so the results became garbage. Make
+ copies while it is still usable.
+
Exim version 4.93
-----------------
diff --git a/src/src/auths/gsasl_exim.c b/src/src/auths/gsasl_exim.c
index 78a63cd..614c179 100644
--- a/src/src/auths/gsasl_exim.c
+++ b/src/src/auths/gsasl_exim.c
@@ -456,11 +456,11 @@ switch (prop)
case GSASL_VALIDATE_SIMPLE:
/* GSASL_AUTHID, GSASL_AUTHZID, and GSASL_PASSWORD */
propval = US gsasl_property_fast(sctx, GSASL_AUTHID);
- auth_vars[0] = expand_nstring[1] = propval ? propval : US"";
+ auth_vars[0] = expand_nstring[1] = propval ? string_copy(propval) : US"";
propval = US gsasl_property_fast(sctx, GSASL_AUTHZID);
- auth_vars[1] = expand_nstring[2] = propval ? propval : US"";
+ auth_vars[1] = expand_nstring[2] = propval ? string_copy(propval) : US"";
propval = US gsasl_property_fast(sctx, GSASL_PASSWORD);
- auth_vars[2] = expand_nstring[3] = propval ? propval : US"";
+ auth_vars[2] = expand_nstring[3] = propval ? string_copy(propval) : US"";
expand_nmax = 3;
for (int i = 1; i <= 3; ++i)
expand_nlength[i] = Ustrlen(expand_nstring[i]);
@@ -479,7 +479,7 @@ switch (prop)
propval = US gsasl_property_fast(sctx, GSASL_AUTHZID);
/* We always set $auth1, even if only to empty string. */
- auth_vars[0] = expand_nstring[1] = propval ? propval : US"";
+ auth_vars[0] = expand_nstring[1] = propval ? string_copy(propval) : US"";
expand_nlength[1] = Ustrlen(expand_nstring[1]);
expand_nmax = 1;
@@ -499,7 +499,7 @@ switch (prop)
/* We always set $auth1, even if only to empty string. */
- auth_vars[0] = expand_nstring[1] = propval ? propval : US"";
+ auth_vars[0] = expand_nstring[1] = propval ? string_copy(propval) : US"";
expand_nlength[1] = Ustrlen(expand_nstring[1]);
expand_nmax = 1;
@@ -519,9 +519,9 @@ switch (prop)
switched to match the ordering of GSASL_VALIDATE_SIMPLE. */
propval = US gsasl_property_fast(sctx, GSASL_GSSAPI_DISPLAY_NAME);
- auth_vars[0] = expand_nstring[1] = propval ? propval : US"";
+ auth_vars[0] = expand_nstring[1] = propval ? string_copy(propval) : US"";
propval = US gsasl_property_fast(sctx, GSASL_AUTHZID);
- auth_vars[1] = expand_nstring[2] = propval ? propval : US"";
+ auth_vars[1] = expand_nstring[2] = propval ? string_copy(propval) : US"";
expand_nmax = 2;
for (int i = 1; i <= 2; ++i)
expand_nlength[i] = Ustrlen(expand_nstring[i]);
@@ -534,6 +534,24 @@ switch (prop)
checked_server_condition = TRUE;
break;
+ case GSASL_SCRAM_ITER:
+ if (ob->server_scram_iter)
+ {
+ tmps = CS expand_string(ob->server_scram_iter);
+ gsasl_property_set(sctx, GSASL_SCRAM_ITER, tmps);
+ cbrc = GSASL_OK;
+ }
+ break;
+
+ case GSASL_SCRAM_SALT:
+ if (ob->server_scram_iter)
+ {
+ tmps = CS expand_string(ob->server_scram_salt);
+ gsasl_property_set(sctx, GSASL_SCRAM_SALT, tmps);
+ cbrc = GSASL_OK;
+ }
+ break;
+
case GSASL_PASSWORD:
/* DIGEST-MD5: GSASL_AUTHID, GSASL_AUTHZID and GSASL_REALM
CRAM-MD5: GSASL_AUTHID
@@ -559,11 +577,11 @@ switch (prop)
point of SASL. */
propval = US gsasl_property_fast(sctx, GSASL_AUTHID);
- auth_vars[0] = expand_nstring[1] = propval ? propval : US"";
+ auth_vars[0] = expand_nstring[1] = propval ? string_copy(propval) : US"";
propval = US gsasl_property_fast(sctx, GSASL_AUTHZID);
- auth_vars[1] = expand_nstring[2] = propval ? propval : US"";
+ auth_vars[1] = expand_nstring[2] = propval ? string_copy(propval) : US"";
propval = US gsasl_property_fast(sctx, GSASL_REALM);
- auth_vars[2] = expand_nstring[3] = propval ? propval : US"";
+ auth_vars[2] = expand_nstring[3] = propval ? string_copy(propval) : US"";
expand_nmax = 3;
for (int i = 1; i <= 3; ++i)
expand_nlength[i] = Ustrlen(expand_nstring[i]);
diff --git a/test/confs/3820 b/test/confs/3820
new file mode 100644
index 0000000..a0206f3
--- /dev/null
+++ b/test/confs/3820
@@ -0,0 +1,47 @@
+# Exim test configuration 3820
+
+SERVER=
+
+.include DIR/aux-var/std_conf_prefix
+
+primary_hostname = myhost.test.ex
+
+# ----- Main settings -----
+
+
+# ----- Authentication -----
+
+begin authenticators
+
+sasl1:
+ driver = gsasl
+ public_name = ANONYMOUS
+ server_set_id = $auth1
+ server_condition = true
+
+sasl2:
+ driver = gsasl
+ public_name = PLAIN
+ server_set_id = $auth1
+ server_condition = false
+
+sasl3:
+ driver = gsasl
+ public_name = SCRAM-SHA-1
+
+ # will need to give library salt, stored-key, server-key, itercount
+ #
+ # sigh
+ # gsasl takes props: GSASL_SCRAM_ITER, GSASL_SCRAM_SALT. It _might_ take
+ # a GSASL_SCRAM_SALTED_PASSWORD - but that is only documented for client mode.
+
+ server_scram_iter = 4096
+ # unclear if the salt is given in binary or base64 to the library
+ server_scram_salt = QSXCR+Q6sek8bf92
+ server_password = pencil
+
+ server_condition = true
+ server_set_id = $auth1
+
+
+# End
diff --git a/test/scripts/3820-Gnu-SASL/3820 b/test/scripts/3820-Gnu-SASL/3820
new file mode 100644
index 0000000..d9fb80b
--- /dev/null
+++ b/test/scripts/3820-Gnu-SASL/3820
@@ -0,0 +1,26 @@
+# GSASL authentication (server only)
+#
+# An ANONYMOUS ath seems to want the username b64'd. Which is consistent with
+# other SASL stuff, but inconsistent vs. cyrus-sasl. It also wants the username
+# on the AUTH line, otherwise it GSASL_MECHANISM_PARSE_ERROR, and 435.
+#
+exim -d+all -DSERVER=server -bd -oX PORT_D
+****
+client 127.0.0.1 PORT_D
+??? 220
+EHLO xxxx
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250-
+??? 250
+AUTH PLAIN AHBoMTAAc2VjcmV0
+??? 535
+AUTH ANONYMOUS cGgxMA==
+??? 235
+QUIT
+??? 221
+****
+killdaemon
+no_msglog_check
diff --git a/test/scripts/3820-Gnu-SASL/REQUIRES b/test/scripts/3820-Gnu-SASL/REQUIRES
new file mode 100644
index 0000000..4614489
--- /dev/null
+++ b/test/scripts/3820-Gnu-SASL/REQUIRES
@@ -0,0 +1 @@
+authenticator gsasl
