CURLDIGESTALGO_MD5SESS
};
+/* Per-connection parameters */
+struct SASL {
+ unsigned int authmechs; /* Accepted authentication mechanisms */
+ unsigned int prefmech; /* Preferred authentication mechanism */
+ unsigned int authused; /* Auth mechanism used for the connection */
+ bool mutual_auth; /* Mutual authentication enabled (GSSAPI only) */
+};
+
/* This is used to test whether the line starts with the given mechanism */
#define sasl_mech_equal(line, wordlen, mech) \
(wordlen == (sizeof(mech) - 1) / sizeof(char) && \
CURLcode result = CURLE_OK;
struct imap_conn *imapc = &conn->proto.imapc;
- imapc->authmechs = 0; /* No known authentication mechanisms yet */
- imapc->authused = 0; /* Clear the authentication mechanism used */
- imapc->tls_supported = FALSE; /* Clear the TLS capability */
+ imapc->sasl.authmechs = SASL_AUTH_NONE; /* No known auth. mechanisms yet */
+ imapc->sasl.authused = SASL_AUTH_NONE; /* Clear the auth. mechanism used */
+ imapc->tls_supported = FALSE; /* Clear the TLS capability */
/* Send the CAPABILITY command */
result = imap_sendf(conn, "CAPABILITY");
/* Test the word for a matching authentication mechanism */
if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_LOGIN))
- imapc->authmechs |= SASL_MECH_LOGIN;
+ imapc->sasl.authmechs |= SASL_MECH_LOGIN;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_PLAIN))
- imapc->authmechs |= SASL_MECH_PLAIN;
+ imapc->sasl.authmechs |= SASL_MECH_PLAIN;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_CRAM_MD5))
- imapc->authmechs |= SASL_MECH_CRAM_MD5;
+ imapc->sasl.authmechs |= SASL_MECH_CRAM_MD5;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_DIGEST_MD5))
- imapc->authmechs |= SASL_MECH_DIGEST_MD5;
+ imapc->sasl.authmechs |= SASL_MECH_DIGEST_MD5;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_GSSAPI))
- imapc->authmechs |= SASL_MECH_GSSAPI;
+ imapc->sasl.authmechs |= SASL_MECH_GSSAPI;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_EXTERNAL))
- imapc->authmechs |= SASL_MECH_EXTERNAL;
+ imapc->sasl.authmechs |= SASL_MECH_EXTERNAL;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_NTLM))
- imapc->authmechs |= SASL_MECH_NTLM;
+ imapc->sasl.authmechs |= SASL_MECH_NTLM;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_XOAUTH2))
- imapc->authmechs |= SASL_MECH_XOAUTH2;
+ imapc->sasl.authmechs |= SASL_MECH_XOAUTH2;
}
line += wordlen;
/* Create the initial response message */
result = Curl_sasl_create_gssapi_user_message(data, conn->user,
conn->passwd, "imap",
- imapc->mutual_auth,
+ imapc->sasl.mutual_auth,
NULL, &conn->krb5,
&respmsg, &len);
if(!result && respmsg) {
/* Get the challenge message */
imap_get_message(data->state.buffer, &chlgmsg);
- if(imapc->mutual_auth)
+ if(imapc->sasl.mutual_auth)
/* Decode the user token challenge and create the optional response
message */
result = Curl_sasl_create_gssapi_user_message(data, NULL, NULL, NULL,
- imapc->mutual_auth,
+ imapc->sasl.mutual_auth,
chlgmsg, &conn->krb5,
&respmsg, &len);
else
result = Curl_pp_sendf(&imapc->pp, "%s", "");
if(!result)
- state(conn, (imapc->mutual_auth ? IMAP_AUTHENTICATE_GSSAPI_NO_DATA :
- IMAP_AUTHENTICATE_FINAL));
+ state(conn, imapc->sasl.mutual_auth? IMAP_AUTHENTICATE_GSSAPI_NO_DATA:
+ IMAP_AUTHENTICATE_FINAL);
}
}
(void)instate; /* no use for this yet */
/* Remove the offending mechanism from the supported list */
- imapc->authmechs ^= imapc->authused;
+ imapc->sasl.authmechs ^= imapc->sasl.authused;
/* Calculate alternative SASL login details */
result = imap_calc_sasl_details(conn, &mech, &initresp, &len, &state1,
/* Set the default preferred authentication type and mechanism */
imapc->preftype = IMAP_TYPE_ANY;
- imapc->prefmech = SASL_AUTH_ANY;
+ imapc->sasl.prefmech = SASL_AUTH_ANY;
/* Initialise the pingpong layer */
Curl_pp_init(pp);
Curl_pp_disconnect(&imapc->pp);
/* Cleanup the SASL module */
- Curl_sasl_cleanup(conn, imapc->authused);
+ Curl_sasl_cleanup(conn, imapc->sasl.authused);
/* Cleanup our connection based variables */
Curl_safefree(imapc->mailbox);
if(reset) {
reset = FALSE;
imapc->preftype = IMAP_TYPE_NONE;
- imapc->prefmech = SASL_AUTH_NONE;
+ imapc->sasl.prefmech = SASL_AUTH_NONE;
}
while(*ptr && *ptr != ';') {
if(strnequal(value, "*", len)) {
imapc->preftype = IMAP_TYPE_ANY;
- imapc->prefmech = SASL_AUTH_ANY;
+ imapc->sasl.prefmech = SASL_AUTH_ANY;
}
else if(strnequal(value, SASL_MECH_STRING_LOGIN, len)) {
imapc->preftype = IMAP_TYPE_SASL;
- imapc->prefmech |= SASL_MECH_LOGIN;
+ imapc->sasl.prefmech |= SASL_MECH_LOGIN;
}
else if(strnequal(value, SASL_MECH_STRING_PLAIN, len)) {
imapc->preftype = IMAP_TYPE_SASL;
- imapc->prefmech |= SASL_MECH_PLAIN;
+ imapc->sasl.prefmech |= SASL_MECH_PLAIN;
}
else if(strnequal(value, SASL_MECH_STRING_CRAM_MD5, len)) {
imapc->preftype = IMAP_TYPE_SASL;
- imapc->prefmech |= SASL_MECH_CRAM_MD5;
+ imapc->sasl.prefmech |= SASL_MECH_CRAM_MD5;
}
else if(strnequal(value, SASL_MECH_STRING_DIGEST_MD5, len)) {
imapc->preftype = IMAP_TYPE_SASL;
- imapc->prefmech |= SASL_MECH_DIGEST_MD5;
+ imapc->sasl.prefmech |= SASL_MECH_DIGEST_MD5;
}
else if(strnequal(value, SASL_MECH_STRING_GSSAPI, len)) {
imapc->preftype = IMAP_TYPE_SASL;
- imapc->prefmech |= SASL_MECH_GSSAPI;
+ imapc->sasl.prefmech |= SASL_MECH_GSSAPI;
}
else if(strnequal(value, SASL_MECH_STRING_NTLM, len)) {
imapc->preftype = IMAP_TYPE_SASL;
- imapc->prefmech |= SASL_MECH_NTLM;
+ imapc->sasl.prefmech |= SASL_MECH_NTLM;
}
else if(strnequal(value, SASL_MECH_STRING_XOAUTH2, len)) {
imapc->preftype = IMAP_TYPE_SASL;
- imapc->prefmech |= SASL_MECH_XOAUTH2;
+ imapc->sasl.prefmech |= SASL_MECH_XOAUTH2;
}
if(*ptr == ';')
/* Calculate the supported authentication mechanism, by decreasing order of
security, as well as the initial response where appropriate */
#if defined(USE_KERBEROS5)
- if((imapc->authmechs & SASL_MECH_GSSAPI) &&
- (imapc->prefmech & SASL_MECH_GSSAPI)) {
- imapc->mutual_auth = FALSE; /* TODO: Calculate mutual authentication */
+ if((imapc->sasl.authmechs & SASL_MECH_GSSAPI) &&
+ (imapc->sasl.prefmech & SASL_MECH_GSSAPI)) {
+ imapc->sasl.mutual_auth = FALSE; /* TODO: Calculate mutual auth. */
*mech = SASL_MECH_STRING_GSSAPI;
*state1 = IMAP_AUTHENTICATE_GSSAPI;
*state2 = IMAP_AUTHENTICATE_GSSAPI_TOKEN;
- imapc->authused = SASL_MECH_GSSAPI;
+ imapc->sasl.authused = SASL_MECH_GSSAPI;
if(imapc->ir_supported || data->set.sasl_ir)
result = Curl_sasl_create_gssapi_user_message(data, conn->user,
conn->passwd, "imap",
- imapc->mutual_auth,
+ imapc->sasl.mutual_auth,
NULL, &conn->krb5,
initresp, len);
}
else
#endif
#ifndef CURL_DISABLE_CRYPTO_AUTH
- if((imapc->authmechs & SASL_MECH_DIGEST_MD5) &&
- (imapc->prefmech & SASL_MECH_DIGEST_MD5)) {
+ if((imapc->sasl.authmechs & SASL_MECH_DIGEST_MD5) &&
+ (imapc->sasl.prefmech & SASL_MECH_DIGEST_MD5)) {
*mech = SASL_MECH_STRING_DIGEST_MD5;
*state1 = IMAP_AUTHENTICATE_DIGESTMD5;
- imapc->authused = SASL_MECH_DIGEST_MD5;
+ imapc->sasl.authused = SASL_MECH_DIGEST_MD5;
}
- else if((imapc->authmechs & SASL_MECH_CRAM_MD5) &&
- (imapc->prefmech & SASL_MECH_CRAM_MD5)) {
+ else if((imapc->sasl.authmechs & SASL_MECH_CRAM_MD5) &&
+ (imapc->sasl.prefmech & SASL_MECH_CRAM_MD5)) {
*mech = SASL_MECH_STRING_CRAM_MD5;
*state1 = IMAP_AUTHENTICATE_CRAMMD5;
- imapc->authused = SASL_MECH_CRAM_MD5;
+ imapc->sasl.authused = SASL_MECH_CRAM_MD5;
}
else
#endif
#ifdef USE_NTLM
- if((imapc->authmechs & SASL_MECH_NTLM) &&
- (imapc->prefmech & SASL_MECH_NTLM)) {
+ if((imapc->sasl.authmechs & SASL_MECH_NTLM) &&
+ (imapc->sasl.prefmech & SASL_MECH_NTLM)) {
*mech = SASL_MECH_STRING_NTLM;
*state1 = IMAP_AUTHENTICATE_NTLM;
*state2 = IMAP_AUTHENTICATE_NTLM_TYPE2MSG;
- imapc->authused = SASL_MECH_NTLM;
+ imapc->sasl.authused = SASL_MECH_NTLM;
if(imapc->ir_supported || data->set.sasl_ir)
result = Curl_sasl_create_ntlm_type1_message(conn->user, conn->passwd,
}
else
#endif
- if(((imapc->authmechs & SASL_MECH_XOAUTH2) &&
- (imapc->prefmech & SASL_MECH_XOAUTH2) &&
- (imapc->prefmech != SASL_AUTH_ANY)) || conn->xoauth2_bearer) {
+ if(((imapc->sasl.authmechs & SASL_MECH_XOAUTH2) &&
+ (imapc->sasl.prefmech & SASL_MECH_XOAUTH2) &&
+ (imapc->sasl.prefmech != SASL_AUTH_ANY)) || conn->xoauth2_bearer) {
*mech = SASL_MECH_STRING_XOAUTH2;
*state1 = IMAP_AUTHENTICATE_XOAUTH2;
*state2 = IMAP_AUTHENTICATE_FINAL;
- imapc->authused = SASL_MECH_XOAUTH2;
+ imapc->sasl.authused = SASL_MECH_XOAUTH2;
if(imapc->ir_supported || data->set.sasl_ir)
result = Curl_sasl_create_xoauth2_message(data, conn->user,
conn->xoauth2_bearer,
initresp, len);
}
- else if((imapc->authmechs & SASL_MECH_LOGIN) &&
- (imapc->prefmech & SASL_MECH_LOGIN)) {
+ else if((imapc->sasl.authmechs & SASL_MECH_LOGIN) &&
+ (imapc->sasl.prefmech & SASL_MECH_LOGIN)) {
*mech = SASL_MECH_STRING_LOGIN;
*state1 = IMAP_AUTHENTICATE_LOGIN;
*state2 = IMAP_AUTHENTICATE_LOGIN_PASSWD;
- imapc->authused = SASL_MECH_LOGIN;
+ imapc->sasl.authused = SASL_MECH_LOGIN;
if(imapc->ir_supported || data->set.sasl_ir)
result = Curl_sasl_create_login_message(data, conn->user, initresp, len);
}
- else if((imapc->authmechs & SASL_MECH_PLAIN) &&
- (imapc->prefmech & SASL_MECH_PLAIN)) {
+ else if((imapc->sasl.authmechs & SASL_MECH_PLAIN) &&
+ (imapc->sasl.prefmech & SASL_MECH_PLAIN)) {
*mech = SASL_MECH_STRING_PLAIN;
*state1 = IMAP_AUTHENTICATE_PLAIN;
*state2 = IMAP_AUTHENTICATE_FINAL;
- imapc->authused = SASL_MECH_PLAIN;
+ imapc->sasl.authused = SASL_MECH_PLAIN;
if(imapc->ir_supported || data->set.sasl_ir)
result = Curl_sasl_create_plain_message(data, conn->user, conn->passwd,
***************************************************************************/
#include "pingpong.h"
+#include "curl_sasl.h"
/****************************************************************************
* IMAP unique setup
struct pingpong pp;
imapstate state; /* Always use imap.c:state() to change state! */
bool ssldone; /* Is connect() over SSL done? */
- unsigned int authmechs; /* Accepted authentication mechanisms */
+ struct SASL sasl; /* SASL-related parameters */
unsigned int preftype; /* Preferred authentication type */
- unsigned int prefmech; /* Preferred authentication mechanism */
- unsigned int authused; /* Auth mechanism used for the connection */
int cmdid; /* Last used command ID */
char resptag[5]; /* Response tag to wait for */
bool tls_supported; /* StartTLS capability supported by server */
bool login_disabled; /* LOGIN command disabled by server */
bool ir_supported; /* Initial response supported by server */
- bool mutual_auth; /* Mutual authentication enabled (GSSAPI only) */
char *mailbox; /* The last selected mailbox */
char *mailbox_uidvalidity; /* UIDVALIDITY parsed from select response */
};
CURLcode result = CURLE_OK;
struct pop3_conn *pop3c = &conn->proto.pop3c;
- pop3c->authmechs = 0; /* No known authentication mechanisms yet */
- pop3c->authused = 0; /* Clear the authentication mechanism used */
- pop3c->tls_supported = FALSE; /* Clear the TLS capability */
+ pop3c->sasl.authmechs = SASL_AUTH_NONE; /* No known auth. mechanisms yet */
+ pop3c->sasl.authused = SASL_AUTH_NONE; /* Clear the auth. mechanism used */
+ pop3c->tls_supported = FALSE; /* Clear the TLS capability */
/* Send the CAPA command */
result = Curl_pp_sendf(&pop3c->pp, "%s", "CAPA");
/* Test the word for a matching authentication mechanism */
if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_LOGIN))
- pop3c->authmechs |= SASL_MECH_LOGIN;
+ pop3c->sasl.authmechs |= SASL_MECH_LOGIN;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_PLAIN))
- pop3c->authmechs |= SASL_MECH_PLAIN;
+ pop3c->sasl.authmechs |= SASL_MECH_PLAIN;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_CRAM_MD5))
- pop3c->authmechs |= SASL_MECH_CRAM_MD5;
+ pop3c->sasl.authmechs |= SASL_MECH_CRAM_MD5;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_DIGEST_MD5))
- pop3c->authmechs |= SASL_MECH_DIGEST_MD5;
+ pop3c->sasl.authmechs |= SASL_MECH_DIGEST_MD5;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_GSSAPI))
- pop3c->authmechs |= SASL_MECH_GSSAPI;
+ pop3c->sasl.authmechs |= SASL_MECH_GSSAPI;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_EXTERNAL))
- pop3c->authmechs |= SASL_MECH_EXTERNAL;
+ pop3c->sasl.authmechs |= SASL_MECH_EXTERNAL;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_NTLM))
- pop3c->authmechs |= SASL_MECH_NTLM;
+ pop3c->sasl.authmechs |= SASL_MECH_NTLM;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_XOAUTH2))
- pop3c->authmechs |= SASL_MECH_XOAUTH2;
+ pop3c->sasl.authmechs |= SASL_MECH_XOAUTH2;
line += wordlen;
len -= wordlen;
/* Create the initial response message */
result = Curl_sasl_create_gssapi_user_message(data, conn->user,
conn->passwd, "pop",
- pop3c->mutual_auth,
+ pop3c->sasl.mutual_auth,
NULL, &conn->krb5,
&respmsg, &len);
if(!result && respmsg) {
/* Get the challenge message */
pop3_get_message(data->state.buffer, &chlgmsg);
- if(pop3c->mutual_auth)
+ if(pop3c->sasl.mutual_auth)
/* Decode the user token challenge and create the optional response
message */
result = Curl_sasl_create_gssapi_user_message(data, NULL, NULL, NULL,
- pop3c->mutual_auth,
+ pop3c->sasl.mutual_auth,
chlgmsg, &conn->krb5,
&respmsg, &len);
else
result = Curl_pp_sendf(&pop3c->pp, "%s", "");
if(!result)
- state(conn, (pop3c->mutual_auth ? POP3_AUTH_GSSAPI_NO_DATA :
- POP3_AUTH_FINAL));
+ state(conn, (pop3c->sasl.mutual_auth ? POP3_AUTH_GSSAPI_NO_DATA :
+ POP3_AUTH_FINAL));
}
}
(void)instate; /* no use for this yet */
/* Remove the offending mechanism from the supported list */
- pop3c->authmechs ^= pop3c->authused;
+ pop3c->sasl.authmechs ^= pop3c->sasl.authused;
/* Calculate alternative SASL login details */
result = pop3_calc_sasl_details(conn, &mech, &initresp, &len, &state1,
/* Set the default preferred authentication type and mechanism */
pop3c->preftype = POP3_TYPE_ANY;
- pop3c->prefmech = SASL_AUTH_ANY;
+ pop3c->sasl.prefmech = SASL_AUTH_ANY;
/* Initialise the pingpong layer */
Curl_pp_init(pp);
Curl_pp_disconnect(&pop3c->pp);
/* Cleanup the SASL module */
- Curl_sasl_cleanup(conn, pop3c->authused);
+ Curl_sasl_cleanup(conn, pop3c->sasl.authused);
/* Cleanup our connection based variables */
Curl_safefree(pop3c->apoptimestamp);
if(reset) {
reset = FALSE;
pop3c->preftype = POP3_TYPE_NONE;
- pop3c->prefmech = SASL_AUTH_NONE;
+ pop3c->sasl.prefmech = SASL_AUTH_NONE;
}
while(*ptr && *ptr != ';') {
if(strnequal(value, "*", len)) {
pop3c->preftype = POP3_TYPE_ANY;
- pop3c->prefmech = SASL_AUTH_ANY;
+ pop3c->sasl.prefmech = SASL_AUTH_ANY;
}
else if(strnequal(value, "+APOP", len)) {
pop3c->preftype = POP3_TYPE_APOP;
- pop3c->prefmech = SASL_AUTH_NONE;
+ pop3c->sasl.prefmech = SASL_AUTH_NONE;
}
else if(strnequal(value, SASL_MECH_STRING_LOGIN, len)) {
pop3c->preftype = POP3_TYPE_SASL;
- pop3c->prefmech |= SASL_MECH_LOGIN;
+ pop3c->sasl.prefmech |= SASL_MECH_LOGIN;
}
else if(strnequal(value, SASL_MECH_STRING_PLAIN, len)) {
pop3c->preftype = POP3_TYPE_SASL;
- pop3c->prefmech |= SASL_MECH_PLAIN;
+ pop3c->sasl.prefmech |= SASL_MECH_PLAIN;
}
else if(strnequal(value, SASL_MECH_STRING_CRAM_MD5, len)) {
pop3c->preftype = POP3_TYPE_SASL;
- pop3c->prefmech |= SASL_MECH_CRAM_MD5;
+ pop3c->sasl.prefmech |= SASL_MECH_CRAM_MD5;
}
else if(strnequal(value, SASL_MECH_STRING_DIGEST_MD5, len)) {
pop3c->preftype = POP3_TYPE_SASL;
- pop3c->prefmech |= SASL_MECH_DIGEST_MD5;
+ pop3c->sasl.prefmech |= SASL_MECH_DIGEST_MD5;
}
else if(strnequal(value, SASL_MECH_STRING_GSSAPI, len)) {
pop3c->preftype = POP3_TYPE_SASL;
- pop3c->prefmech |= SASL_MECH_GSSAPI;
+ pop3c->sasl.prefmech |= SASL_MECH_GSSAPI;
}
else if(strnequal(value, SASL_MECH_STRING_NTLM, len)) {
pop3c->preftype = POP3_TYPE_SASL;
- pop3c->prefmech |= SASL_MECH_NTLM;
+ pop3c->sasl.prefmech |= SASL_MECH_NTLM;
}
else if(strnequal(value, SASL_MECH_STRING_XOAUTH2, len)) {
pop3c->preftype = POP3_TYPE_SASL;
- pop3c->prefmech |= SASL_MECH_XOAUTH2;
+ pop3c->sasl.prefmech |= SASL_MECH_XOAUTH2;
}
if(*ptr == ';')
/* Calculate the supported authentication mechanism, by decreasing order of
security, as well as the initial response where appropriate */
#if defined(USE_KERBEROS5)
- if((pop3c->authmechs & SASL_MECH_GSSAPI) &&
- (pop3c->prefmech & SASL_MECH_GSSAPI)) {
- pop3c->mutual_auth = FALSE; /* TODO: Calculate mutual authentication */
+ if((pop3c->sasl.authmechs & SASL_MECH_GSSAPI) &&
+ (pop3c->sasl.prefmech & SASL_MECH_GSSAPI)) {
+ pop3c->sasl.mutual_auth = FALSE; /* TODO: Calculate mutual auth. */
*mech = SASL_MECH_STRING_GSSAPI;
*state1 = POP3_AUTH_GSSAPI;
*state2 = POP3_AUTH_GSSAPI_TOKEN;
- pop3c->authused = SASL_MECH_GSSAPI;
+ pop3c->sasl.authused = SASL_MECH_GSSAPI;
if(data->set.sasl_ir)
result = Curl_sasl_create_gssapi_user_message(data, conn->user,
conn->passwd, "pop",
- pop3c->mutual_auth,
+ pop3c->sasl.mutual_auth,
NULL, &conn->krb5,
initresp, len);
}
else
#endif
#ifndef CURL_DISABLE_CRYPTO_AUTH
- if((pop3c->authmechs & SASL_MECH_DIGEST_MD5) &&
- (pop3c->prefmech & SASL_MECH_DIGEST_MD5)) {
+ if((pop3c->sasl.authmechs & SASL_MECH_DIGEST_MD5) &&
+ (pop3c->sasl.prefmech & SASL_MECH_DIGEST_MD5)) {
*mech = SASL_MECH_STRING_DIGEST_MD5;
*state1 = POP3_AUTH_DIGESTMD5;
- pop3c->authused = SASL_MECH_DIGEST_MD5;
+ pop3c->sasl.authused = SASL_MECH_DIGEST_MD5;
}
- else if((pop3c->authmechs & SASL_MECH_CRAM_MD5) &&
- (pop3c->prefmech & SASL_MECH_CRAM_MD5)) {
+ else if((pop3c->sasl.authmechs & SASL_MECH_CRAM_MD5) &&
+ (pop3c->sasl.prefmech & SASL_MECH_CRAM_MD5)) {
*mech = SASL_MECH_STRING_CRAM_MD5;
*state1 = POP3_AUTH_CRAMMD5;
- pop3c->authused = SASL_MECH_CRAM_MD5;
+ pop3c->sasl.authused = SASL_MECH_CRAM_MD5;
}
else
#endif
#ifdef USE_NTLM
- if((pop3c->authmechs & SASL_MECH_NTLM) &&
- (pop3c->prefmech & SASL_MECH_NTLM)) {
+ if((pop3c->sasl.authmechs & SASL_MECH_NTLM) &&
+ (pop3c->sasl.prefmech & SASL_MECH_NTLM)) {
*mech = SASL_MECH_STRING_NTLM;
*state1 = POP3_AUTH_NTLM;
*state2 = POP3_AUTH_NTLM_TYPE2MSG;
- pop3c->authused = SASL_MECH_NTLM;
+ pop3c->sasl.authused = SASL_MECH_NTLM;
if(data->set.sasl_ir)
result = Curl_sasl_create_ntlm_type1_message(conn->user, conn->passwd,
}
else
#endif
- if(((pop3c->authmechs & SASL_MECH_XOAUTH2) &&
- (pop3c->prefmech & SASL_MECH_XOAUTH2) &&
- (pop3c->prefmech != SASL_AUTH_ANY)) || conn->xoauth2_bearer) {
+ if(((pop3c->sasl.authmechs & SASL_MECH_XOAUTH2) &&
+ (pop3c->sasl.prefmech & SASL_MECH_XOAUTH2) &&
+ (pop3c->sasl.prefmech != SASL_AUTH_ANY)) || conn->xoauth2_bearer) {
*mech = SASL_MECH_STRING_XOAUTH2;
*state1 = POP3_AUTH_XOAUTH2;
*state2 = POP3_AUTH_FINAL;
- pop3c->authused = SASL_MECH_XOAUTH2;
+ pop3c->sasl.authused = SASL_MECH_XOAUTH2;
if(data->set.sasl_ir)
result = Curl_sasl_create_xoauth2_message(data, conn->user,
conn->xoauth2_bearer,
initresp, len);
}
- else if((pop3c->authmechs & SASL_MECH_LOGIN) &&
- (pop3c->prefmech & SASL_MECH_LOGIN)) {
+ else if((pop3c->sasl.authmechs & SASL_MECH_LOGIN) &&
+ (pop3c->sasl.prefmech & SASL_MECH_LOGIN)) {
*mech = SASL_MECH_STRING_LOGIN;
*state1 = POP3_AUTH_LOGIN;
*state2 = POP3_AUTH_LOGIN_PASSWD;
- pop3c->authused = SASL_MECH_LOGIN;
+ pop3c->sasl.authused = SASL_MECH_LOGIN;
if(data->set.sasl_ir)
result = Curl_sasl_create_login_message(data, conn->user, initresp, len);
}
- else if((pop3c->authmechs & SASL_MECH_PLAIN) &&
- (pop3c->prefmech & SASL_MECH_PLAIN)) {
+ else if((pop3c->sasl.authmechs & SASL_MECH_PLAIN) &&
+ (pop3c->sasl.prefmech & SASL_MECH_PLAIN)) {
*mech = SASL_MECH_STRING_PLAIN;
*state1 = POP3_AUTH_PLAIN;
*state2 = POP3_AUTH_FINAL;
- pop3c->authused = SASL_MECH_PLAIN;
+ pop3c->sasl.authused = SASL_MECH_PLAIN;
if(data->set.sasl_ir)
result = Curl_sasl_create_plain_message(data, conn->user, conn->passwd,
***************************************************************************/
#include "pingpong.h"
+#include "curl_sasl.h"
/****************************************************************************
* POP3 unique setup
have been received so far */
size_t strip; /* Number of bytes from the start to ignore as
non-body */
+ struct SASL sasl; /* SASL-related storage */
unsigned int authtypes; /* Accepted authentication types */
- unsigned int authmechs; /* Accepted SASL authentication mechanisms */
unsigned int preftype; /* Preferred authentication type */
- unsigned int prefmech; /* Preferred SASL authentication mechanism */
- unsigned int authused; /* SASL auth mechanism used for the connection */
char *apoptimestamp; /* APOP timestamp from the server greeting */
bool tls_supported; /* StartTLS capability supported by server */
- bool mutual_auth; /* Mutual authentication enabled (GSSAPI only) */
};
extern const struct Curl_handler Curl_handler_pop3;
CURLcode result = CURLE_OK;
struct smtp_conn *smtpc = &conn->proto.smtpc;
- smtpc->authmechs = 0; /* No known authentication mechanisms yet */
- smtpc->authused = 0; /* Clear the authentication mechanism used
- for esmtp connections */
- smtpc->tls_supported = FALSE; /* Clear the TLS capability */
- smtpc->auth_supported = FALSE; /* Clear the AUTH capability */
+ smtpc->sasl.authmechs = SASL_AUTH_NONE; /* No known auth. mechanism yet */
+ smtpc->sasl.authused = SASL_AUTH_NONE; /* Clear the authentication mechanism
+ used for esmtp connections */
+ smtpc->tls_supported = FALSE; /* Clear the TLS capability */
+ smtpc->auth_supported = FALSE; /* Clear the AUTH capability */
/* Send the EHLO command */
result = Curl_pp_sendf(&smtpc->pp, "EHLO %s", smtpc->domain);
CURLcode result = CURLE_OK;
struct smtp_conn *smtpc = &conn->proto.smtpc;
- smtpc->authused = 0; /* No authentication mechanism used in smtp
- connections */
+ smtpc->sasl.authused = SASL_AUTH_NONE; /* No authentication mechanism used
+ in smtp connections */
/* Send the HELO command */
result = Curl_pp_sendf(&smtpc->pp, "HELO %s", smtpc->domain);
return CURLE_OUT_OF_MEMORY;
/* Calculate the optional AUTH parameter */
- if(data->set.str[STRING_MAIL_AUTH] && conn->proto.smtpc.authused) {
+ if(data->set.str[STRING_MAIL_AUTH] && conn->proto.smtpc.sasl.authused) {
if(data->set.str[STRING_MAIL_AUTH][0] != '\0')
auth = aprintf("%s", data->set.str[STRING_MAIL_AUTH]);
else
/* Test the word for a matching authentication mechanism */
if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_LOGIN))
- smtpc->authmechs |= SASL_MECH_LOGIN;
+ smtpc->sasl.authmechs |= SASL_MECH_LOGIN;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_PLAIN))
- smtpc->authmechs |= SASL_MECH_PLAIN;
+ smtpc->sasl.authmechs |= SASL_MECH_PLAIN;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_CRAM_MD5))
- smtpc->authmechs |= SASL_MECH_CRAM_MD5;
+ smtpc->sasl.authmechs |= SASL_MECH_CRAM_MD5;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_DIGEST_MD5))
- smtpc->authmechs |= SASL_MECH_DIGEST_MD5;
+ smtpc->sasl.authmechs |= SASL_MECH_DIGEST_MD5;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_GSSAPI))
- smtpc->authmechs |= SASL_MECH_GSSAPI;
+ smtpc->sasl.authmechs |= SASL_MECH_GSSAPI;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_EXTERNAL))
- smtpc->authmechs |= SASL_MECH_EXTERNAL;
+ smtpc->sasl.authmechs |= SASL_MECH_EXTERNAL;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_NTLM))
- smtpc->authmechs |= SASL_MECH_NTLM;
+ smtpc->sasl.authmechs |= SASL_MECH_NTLM;
else if(sasl_mech_equal(line, wordlen, SASL_MECH_STRING_XOAUTH2))
- smtpc->authmechs |= SASL_MECH_XOAUTH2;
+ smtpc->sasl.authmechs |= SASL_MECH_XOAUTH2;
line += wordlen;
len -= wordlen;
/* Create the initial response message */
result = Curl_sasl_create_gssapi_user_message(data, conn->user,
conn->passwd, "smtp",
- smtpc->mutual_auth, NULL,
+ smtpc->sasl.mutual_auth,
+ NULL,
&conn->krb5,
&respmsg, &len);
if(!result && respmsg) {
/* Get the challenge message */
smtp_get_message(data->state.buffer, &chlgmsg);
- if(smtpc->mutual_auth)
+ if(smtpc->sasl.mutual_auth)
/* Decode the user token challenge and create the optional response
message */
result = Curl_sasl_create_gssapi_user_message(data, NULL, NULL, NULL,
- smtpc->mutual_auth,
+ smtpc->sasl.mutual_auth,
chlgmsg, &conn->krb5,
&respmsg, &len);
else
result = Curl_pp_sendf(&smtpc->pp, "%s", "");
if(!result)
- state(conn, (smtpc->mutual_auth ? SMTP_AUTH_GSSAPI_NO_DATA :
+ state(conn, (smtpc->sasl.mutual_auth ? SMTP_AUTH_GSSAPI_NO_DATA :
SMTP_AUTH_FINAL));
}
}
(void)instate; /* no use for this yet */
/* Remove the offending mechanism from the supported list */
- smtpc->authmechs ^= smtpc->authused;
+ smtpc->sasl.authmechs ^= smtpc->sasl.authused;
/* Calculate alternative SASL login details */
result = smtp_calc_sasl_details(conn, &mech, &initresp, &len, &state1,
pp->conn = conn;
/* Set the default preferred authentication mechanism */
- smtpc->prefmech = SASL_AUTH_ANY;
+ smtpc->sasl.prefmech = SASL_AUTH_ANY;
/* Initialise the pingpong layer */
Curl_pp_init(pp);
Curl_pp_disconnect(&smtpc->pp);
/* Cleanup the SASL module */
- Curl_sasl_cleanup(conn, smtpc->authused);
+ Curl_sasl_cleanup(conn, smtpc->sasl.authused);
/* Cleanup our connection based variables */
Curl_safefree(smtpc->domain);
if(reset) {
reset = FALSE;
- smtpc->prefmech = SASL_AUTH_NONE;
+ smtpc->sasl.prefmech = SASL_AUTH_NONE;
}
while(*ptr && *ptr != ';') {
}
if(strnequal(value, "*", len))
- smtpc->prefmech = SASL_AUTH_ANY;
+ smtpc->sasl.prefmech = SASL_AUTH_ANY;
else if(strnequal(value, SASL_MECH_STRING_LOGIN, len))
- smtpc->prefmech |= SASL_MECH_LOGIN;
+ smtpc->sasl.prefmech |= SASL_MECH_LOGIN;
else if(strnequal(value, SASL_MECH_STRING_PLAIN, len))
- smtpc->prefmech |= SASL_MECH_PLAIN;
+ smtpc->sasl.prefmech |= SASL_MECH_PLAIN;
else if(strnequal(value, SASL_MECH_STRING_CRAM_MD5, len))
- smtpc->prefmech |= SASL_MECH_CRAM_MD5;
+ smtpc->sasl.prefmech |= SASL_MECH_CRAM_MD5;
else if(strnequal(value, SASL_MECH_STRING_DIGEST_MD5, len))
- smtpc->prefmech |= SASL_MECH_DIGEST_MD5;
+ smtpc->sasl.prefmech |= SASL_MECH_DIGEST_MD5;
else if(strnequal(value, SASL_MECH_STRING_GSSAPI, len))
- smtpc->prefmech |= SASL_MECH_GSSAPI;
+ smtpc->sasl.prefmech |= SASL_MECH_GSSAPI;
else if(strnequal(value, SASL_MECH_STRING_NTLM, len))
- smtpc->prefmech |= SASL_MECH_NTLM;
+ smtpc->sasl.prefmech |= SASL_MECH_NTLM;
else if(strnequal(value, SASL_MECH_STRING_XOAUTH2, len))
- smtpc->prefmech |= SASL_MECH_XOAUTH2;
+ smtpc->sasl.prefmech |= SASL_MECH_XOAUTH2;
if(*ptr == ';')
ptr++;
/* Calculate the supported authentication mechanism, by decreasing order of
security, as well as the initial response where appropriate */
#if defined(USE_KERBEROS5)
- if((smtpc->authmechs & SASL_MECH_GSSAPI) &&
- (smtpc->prefmech & SASL_MECH_GSSAPI)) {
- smtpc->mutual_auth = FALSE; /* TODO: Calculate mutual authentication */
+ if((smtpc->sasl.authmechs & SASL_MECH_GSSAPI) &&
+ (smtpc->sasl.prefmech & SASL_MECH_GSSAPI)) {
+ smtpc->sasl.mutual_auth = FALSE; /* TODO: Calculate mutual auth. */
*mech = SASL_MECH_STRING_GSSAPI;
*state1 = SMTP_AUTH_GSSAPI;
*state2 = SMTP_AUTH_GSSAPI_TOKEN;
- smtpc->authused = SASL_MECH_GSSAPI;
+ smtpc->sasl.authused = SASL_MECH_GSSAPI;
if(data->set.sasl_ir)
result = Curl_sasl_create_gssapi_user_message(data, conn->user,
conn->passwd, "smtp",
- smtpc->mutual_auth,
+ smtpc->sasl.mutual_auth,
NULL, &conn->krb5,
initresp, len);
}
else
#endif
#ifndef CURL_DISABLE_CRYPTO_AUTH
- if((smtpc->authmechs & SASL_MECH_DIGEST_MD5) &&
- (smtpc->prefmech & SASL_MECH_DIGEST_MD5)) {
+ if((smtpc->sasl.authmechs & SASL_MECH_DIGEST_MD5) &&
+ (smtpc->sasl.prefmech & SASL_MECH_DIGEST_MD5)) {
*mech = SASL_MECH_STRING_DIGEST_MD5;
*state1 = SMTP_AUTH_DIGESTMD5;
- smtpc->authused = SASL_MECH_DIGEST_MD5;
+ smtpc->sasl.authused = SASL_MECH_DIGEST_MD5;
}
- else if((smtpc->authmechs & SASL_MECH_CRAM_MD5) &&
- (smtpc->prefmech & SASL_MECH_CRAM_MD5)) {
+ else if((smtpc->sasl.authmechs & SASL_MECH_CRAM_MD5) &&
+ (smtpc->sasl.prefmech & SASL_MECH_CRAM_MD5)) {
*mech = SASL_MECH_STRING_CRAM_MD5;
*state1 = SMTP_AUTH_CRAMMD5;
- smtpc->authused = SASL_MECH_CRAM_MD5;
+ smtpc->sasl.authused = SASL_MECH_CRAM_MD5;
}
else
#endif
#ifdef USE_NTLM
- if((smtpc->authmechs & SASL_MECH_NTLM) &&
- (smtpc->prefmech & SASL_MECH_NTLM)) {
+ if((smtpc->sasl.authmechs & SASL_MECH_NTLM) &&
+ (smtpc->sasl.prefmech & SASL_MECH_NTLM)) {
*mech = SASL_MECH_STRING_NTLM;
*state1 = SMTP_AUTH_NTLM;
*state2 = SMTP_AUTH_NTLM_TYPE2MSG;
- smtpc->authused = SASL_MECH_NTLM;
+ smtpc->sasl.authused = SASL_MECH_NTLM;
if(data->set.sasl_ir)
result = Curl_sasl_create_ntlm_type1_message(conn->user, conn->passwd,
}
else
#endif
- if(((smtpc->authmechs & SASL_MECH_XOAUTH2) &&
- (smtpc->prefmech & SASL_MECH_XOAUTH2) &&
- (smtpc->prefmech != SASL_AUTH_ANY)) || conn->xoauth2_bearer) {
+ if(((smtpc->sasl.authmechs & SASL_MECH_XOAUTH2) &&
+ (smtpc->sasl.prefmech & SASL_MECH_XOAUTH2) &&
+ (smtpc->sasl.prefmech != SASL_AUTH_ANY)) || conn->xoauth2_bearer) {
*mech = SASL_MECH_STRING_XOAUTH2;
*state1 = SMTP_AUTH_XOAUTH2;
*state2 = SMTP_AUTH_FINAL;
- smtpc->authused = SASL_MECH_XOAUTH2;
+ smtpc->sasl.authused = SASL_MECH_XOAUTH2;
if(data->set.sasl_ir)
result = Curl_sasl_create_xoauth2_message(data, conn->user,
conn->xoauth2_bearer,
initresp, len);
}
- else if((smtpc->authmechs & SASL_MECH_LOGIN) &&
- (smtpc->prefmech & SASL_MECH_LOGIN)) {
+ else if((smtpc->sasl.authmechs & SASL_MECH_LOGIN) &&
+ (smtpc->sasl.prefmech & SASL_MECH_LOGIN)) {
*mech = SASL_MECH_STRING_LOGIN;
*state1 = SMTP_AUTH_LOGIN;
*state2 = SMTP_AUTH_LOGIN_PASSWD;
- smtpc->authused = SASL_MECH_LOGIN;
+ smtpc->sasl.authused = SASL_MECH_LOGIN;
if(data->set.sasl_ir)
result = Curl_sasl_create_login_message(data, conn->user, initresp, len);
}
- else if((smtpc->authmechs & SASL_MECH_PLAIN) &&
- (smtpc->prefmech & SASL_MECH_PLAIN)) {
+ else if((smtpc->sasl.authmechs & SASL_MECH_PLAIN) &&
+ (smtpc->sasl.prefmech & SASL_MECH_PLAIN)) {
*mech = SASL_MECH_STRING_PLAIN;
*state1 = SMTP_AUTH_PLAIN;
*state2 = SMTP_AUTH_FINAL;
- smtpc->authused = SASL_MECH_PLAIN;
+ smtpc->sasl.authused = SASL_MECH_PLAIN;
if(data->set.sasl_ir)
result = Curl_sasl_create_plain_message(data, conn->user, conn->passwd,
***************************************************************************/
#include "pingpong.h"
+#include "curl_sasl.h"
/****************************************************************************
* SMTP unique setup
smtpstate state; /* Always use smtp.c:state() to change state! */
bool ssldone; /* Is connect() over SSL done? */
char *domain; /* Client address/name to send in the EHLO */
- unsigned int authmechs; /* Accepted authentication mechanisms */
- unsigned int prefmech; /* Preferred authentication mechanism */
- unsigned int authused; /* Auth mechanism used for the connection */
+ struct SASL sasl; /* SASL-related storage */
bool tls_supported; /* StartTLS capability supported by server */
bool size_supported; /* If server supports SIZE extension according to
RFC 1870 */
bool auth_supported; /* AUTH capability supported by server */
- bool mutual_auth; /* Mutual authentication enabled (GSSAPI only) */
};
extern const struct Curl_handler Curl_handler_smtp;
projects / curl / commitdiff