#include "socket.h"
#include "i18n.h"
-#if OPIE
+#if OPIE_ENABLE
#include <opie.h>
-#endif /* OPIE */
+#endif /* OPIE_ENABLE */
#ifndef strstr /* glibc-2.1 declares this as a macro */
extern char *strstr(); /* needed on sysV68 R3V7.1. */
#endif /* strstr */
-static int pop3_phase;
-#define PHASE_GETAUTH 0
-#define PHASE_GETRANGE 1
-#define PHASE_GETSIZES 2
-#define PHASE_FETCH 3
-#define PHASE_LOGOUT 4
static int last;
#ifdef SDPS_ENABLE
-static flag sdps_enable = FALSE;
+char *sdps_envfrom;
char *sdps_envto;
#endif /* SDPS_ENABLE */
-#if OPIE
+#if OPIE_ENABLE
static char lastok[POPBUFSIZE+1];
-#endif /* OPIE */
+#endif /* OPIE_ENABLE */
-int pop3_ok (int sock, char *argbuf)
+#define DOTLINE(s) (s[0] == '.' && (s[1]=='\r'||s[1]=='\n'||s[1]=='\0'))
+
+static int pop3_ok (int sock, char *argbuf)
/* parse command response */
{
int ok;
char *bufp;
if ((ok = gen_recv(sock, buf, sizeof(buf))) == 0)
- {
- bufp = buf;
+ { bufp = buf;
if (*bufp == '+' || *bufp == '-')
bufp++;
else
if (strcmp(buf,"+OK") == 0)
{
-#if OPIE
+#if OPIE_ENABLE
strcpy(lastok, bufp);
-#endif /* OPIE */
+#endif /* OPIE_ENABLE */
ok = 0;
}
else if (strncmp(buf,"-ERR", 4) == 0)
{
- if (pop3_phase > PHASE_GETAUTH)
+ if (stage == STAGE_FETCH)
+ ok = PS_TRANSIENT;
+ else if (stage > STAGE_GETAUTH)
ok = PS_PROTOCOL;
/*
* We're checking for "lock busy", "unable to lock",
- * "already locked" etc. here. This indicates that we
- * have to wait for the server to clean up before we
- * can poll again.
+ * "already locked", "wait a few minutes" etc. here.
+ * This indicates that we have to wait for the server to
+ * unwedge itself before we can poll again.
*
* PS_LOCKBUSY check empirically verified with two recent
- * versions the Berkeley popper; QPOP (version 2.2) and
+ * versions of the Berkeley popper; QPOP (version 2.2) and
* QUALCOMM Pop server derived from UCB (version 2.1.4-R3)
+ * These are caught by the case-indifferent "lock" check.
+ * The "wait" catches "mail storage services unavailable,
+ * wait a few minutes and try again" on the InterMail server.
+ *
+ * If these aren't picked up on correctly, fetchmail will
+ * think there is an authentication failure and wedge the
+ * connection in order to prevent futile polls.
+ *
+ * Gad, what a kluge.
*/
- else if (strstr(bufp,"lock")||strstr(bufp,"Lock")||strstr(bufp,"LOCK"))
+ else if (strstr(bufp,"lock")
+ || strstr(bufp,"Lock")
+ || strstr(bufp,"LOCK")
+ || strstr(bufp,"wait")
+ /* these are blessed by RFC 2449 */
+ || strstr(bufp,"[IN-USE]")||strstr(bufp,"[LOGIN-DELAY]"))
ok = PS_LOCKBUSY;
+ else if ((strstr(bufp,"Service")
+ || strstr(bufp,"service"))
+ && (strstr(bufp,"unavailable")))
+ ok = PS_SERVBUSY;
else
ok = PS_AUTHFAIL;
- if (*bufp)
- report(stderr, 0, bufp);
+ /*
+ * We always want to pass the user lock-busy messages, because
+ * they're red flags. Other stuff (like AUTH failures on non-
+ * RFC1734 servers) only if we're debugging.
+ */
+ if (*bufp && (ok == PS_LOCKBUSY || outlevel >= O_MONITOR))
+ report(stderr, "%s\n", bufp);
}
else
ok = PS_PROTOCOL;
return(ok);
}
-int pop3_getauth(int sock, struct query *ctl, char *greeting)
+static int pop3_getauth(int sock, struct query *ctl, char *greeting)
/* apply for connection authorization */
{
int ok;
char *start,*end;
char *msg;
-#if OPIE
+#if OPIE_ENABLE
char *challenge;
-#endif /* OPIE */
-
- pop3_phase = PHASE_GETAUTH;
+#endif /* OPIE_ENABLE */
+#if defined(GSSAPI)
+ flag has_gssapi = FALSE;
+#endif /* defined(GSSAPI) */
+#if defined(KERBEROS_V4) || defined(KERBEROS_V5)
+ flag has_kerberos = FALSE;
+#endif /* defined(KERBEROS_V4) || defined(KERBEROS_V5) */
+ flag has_cram = FALSE;
+#ifdef OPIE_ENABLE
+ flag has_otp = FALSE;
+#endif /* OPIE_ENABLE */
+#ifdef SSL_ENABLE
+ flag has_ssl = FALSE;
+#endif /* SSL_ENABLE */
#ifdef SDPS_ENABLE
/*
* If we see either, and we're in multidrop mode, try to use
* the SDPS *ENV extension.
*/
- sdps_enable = (MULTIDROP(ctl) && strstr(greeting, "demon."));
- /*
- * Use SDPS if configured, regardless of the greeting string
- * returned from the POP server. (Users accessing demon by a
- * POP3 proxy may need this)
- */
- if (ctl->server.sdps)
- sdps_enable = ctl->server.sdps;
+ if (!(ctl->server.sdps) && MULTIDROP(ctl) && strstr(greeting, "demon."))
+ ctl->server.sdps = TRUE;
#endif /* SDPS_ENABLE */
switch (ctl->server.protocol) {
case P_POP3:
- ok = gen_transact(sock, "USER %s", ctl->remotename);
-
#ifdef RPA_ENABLE
- /*
- * CompuServe has changed its RPA behavior. Used to be they didn't
- * accept PASS, but I'm told this changed in mid-November 1997.
- */
- if (strstr(greeting, "csi.com")
- && (start = strchr(ctl->remotename, '@'))
- && !strcmp("@compuserve.com", start))
- {
- /* temporary fix to get back out of cleartext authentication */
- gen_transact(sock, "PASS %s", "dummypass");
-
- /* AUTH command should return a list of available mechanisms */
- if (gen_transact(sock, "AUTH") == 0)
- {
- char buffer[10];
- flag has_rpa = FALSE;
-
- while ((ok = gen_recv(sock, buffer, sizeof(buffer))) == 0)
- {
- if (buffer[0] == '.')
- break;
- if (strncasecmp(buffer, "rpa", 3) == 0)
- has_rpa = TRUE;
- }
- if (has_rpa && !POP3_auth_rpa(ctl->remotename,
- ctl->password, sock))
- return(PS_SUCCESS);
- }
-
- return(PS_AUTHFAIL);
- }
+ /* CompuServe POP3 Servers as of 990730 want AUTH first for RPA */
+ if (strstr(ctl->remotename, "@compuserve.com"))
+ {
+ /* AUTH command should return a list of available mechanisms */
+ if (gen_transact(sock, "AUTH") == 0)
+ {
+ char buffer[10];
+ flag has_rpa = FALSE;
+
+ while ((ok = gen_recv(sock, buffer, sizeof(buffer))) == 0)
+ {
+ if (DOTLINE(buffer))
+ break;
+ if (strncasecmp(buffer, "rpa", 3) == 0)
+ has_rpa = TRUE;
+ }
+ if (has_rpa && !POP3_auth_rpa(ctl->remotename,
+ ctl->password, sock))
+ return(PS_SUCCESS);
+ }
+
+ return(PS_AUTHFAIL);
+ }
#endif /* RPA_ENABLE */
-#if OPIE
- /* see RFC1938: A One-Time Password System */
- if (challenge = strstr(lastok, "otp-")) {
- char response[OPIE_RESPONSE_MAX+1];
- int i;
-
- i = opiegenerator(challenge, !strcmp(ctl->password, "opie") ? "" : ctl->password, response);
- if ((i == -2) && !run.poll_interval) {
- char secret[OPIE_SECRET_MAX+1];
- fprintf(stderr, _("Secret pass phrase: "));
- if (opiereadpass(secret, sizeof(secret), 0))
- i = opiegenerator(challenge, secret, response);
- memset(secret, 0, sizeof(secret));
- };
-
- if (i) {
- ok = PS_ERROR;
- break;
- };
+ /*
+ * CAPA command may return a list including available
+ * authentication mechanisms. if it doesn't, no harm done, we
+ * just fall back to a plain login. Note that this code
+ * latches the server's authentication type, so that in daemon mode
+ * the CAPA check only needs to be done once at start of run.
+ *
+ * If CAPA fails, then force the authentication method to PASSORD
+ * and repoll immediately.
+ *
+ * These authentication methods are blessed by RFC1734,
+ * describing the POP3 AUTHentication command.
+ */
+ if (ctl->server.authenticate == A_ANY)
+ {
+ ok = gen_transact(sock, "CAPA");
+ if (ok == PS_SUCCESS)
+ {
+ char buffer[64];
- ok = gen_transact(sock, "PASS %s", response);
- break;
+ /* determine what authentication methods we have available */
+ while ((ok = gen_recv(sock, buffer, sizeof(buffer))) == 0)
+ {
+ if (DOTLINE(buffer))
+ break;
+#ifdef SSL_ENABLE
+ if (strstr(buffer, "STLS"))
+ has_ssl = TRUE;
+#endif /* SSL_ENABLE */
+#if defined(GSSAPI)
+ if (strstr(buffer, "GSSAPI"))
+ has_gssapi = TRUE;
+#endif /* defined(GSSAPI) */
+#if defined(KERBEROS_V4)
+ if (strstr(buffer, "KERBEROS_V4"))
+ has_kerberos = TRUE;
+#endif /* defined(KERBEROS_V4) */
+#ifdef OPIE_ENABLE
+ if (strstr(buffer, "X-OTP"))
+ has_otp = TRUE;
+#endif /* OPIE_ENABLE */
+ if (strstr(buffer, "CRAM-MD5"))
+ has_cram = TRUE;
+ }
+ }
+ /* we are in STAGE_GETAUTH! */
+ else if (ok == PS_AUTHFAIL ||
+ /* Some servers directly close the socket. However, if we
+ * have already authenticated before, then a previous CAPA
+ * must have succeeded. In that case, treat this as a
+ * genuine socket error and do not change the auth method.
+ */
+ (ok == PS_SOCKET && !ctl->wehaveauthed))
+ {
+ ctl->server.authenticate = A_PASSWORD;
+ /* repoll immediately */
+ ok = PS_REPOLL;
+ break;
+ }
+ }
+
+#ifdef SSL_ENABLE
+ if (has_ssl && !ctl->use_ssl &&
+#if INET6_ENABLE
+ ctl->server.service && (strcmp(ctl->server.service, "pop3s"))
+#else /* INET6_ENABLE */
+ ctl->server.port != 995
+#endif /* INET6_ENABLE */
+ )
+ {
+ char *realhost;
+
+ realhost = ctl->server.via ? ctl->server.via : ctl->server.pollname; gen_transact(sock, "STLS");
+ if (SSLOpen(sock,ctl->sslcert,ctl->sslkey,ctl->sslproto,ctl->sslcertck, ctl->sslcertpath,ctl->sslfingerprint,realhost,ctl->server.pollname) == -1)
+ {
+ report(stderr,
+ GT_("SSL connection failed.\n"));
+ return(PS_AUTHFAIL);
+ }
+ }
+#endif /* SSL_ENABLE */
+
+ /*
+ * OK, we have an authentication type now.
+ */
+#if defined(KERBEROS_V4)
+ /*
+ * Servers doing KPOP have to go through a dummy login sequence
+ * rather than doing SASL.
+ */
+ if (has_kerberos &&
+#if INET6_ENABLE
+ ctl->server.service && (strcmp(ctl->server.service, KPOP_PORT)!=0)
+#else /* INET6_ENABLE */
+ ctl->server.port != KPOP_PORT
+#endif /* INET6_ENABLE */
+ && (ctl->server.authenticate == A_KERBEROS_V4
+ || ctl->server.authenticate == A_KERBEROS_V5
+ || ctl->server.authenticate == A_ANY))
+ {
+ ok = do_rfc1731(sock, "AUTH", ctl->server.truename);
+ if (ok == PS_SUCCESS || ctl->server.authenticate != A_ANY)
+ break;
+ }
+#endif /* defined(KERBEROS_V4) || defined(KERBEROS_V5) */
+
+#if defined(GSSAPI)
+ if (has_gssapi &&
+ (ctl->server.authenticate == A_GSSAPI ||
+ ctl->server.authenticate == A_ANY))
+ {
+ ok = do_gssauth(sock,"AUTH",ctl->server.truename,ctl->remotename);
+ if (ok == PS_SUCCESS || ctl->server.authenticate != A_ANY)
+ break;
+ }
+#endif /* defined(GSSAPI) */
+
+#ifdef OPIE_ENABLE
+ if (has_otp &&
+ (ctl->server.authenticate == A_OTP ||
+ ctl->server.authenticate == A_ANY))
+ {
+ ok = do_otp(sock, "AUTH", ctl);
+ if (ok == PS_SUCCESS || ctl->server.authenticate != A_ANY)
+ break;
+ }
+#endif /* OPIE_ENABLE */
+
+ if (has_cram &&
+ (ctl->server.authenticate == A_CRAM_MD5 ||
+ ctl->server.authenticate == A_ANY))
+ {
+ ok = do_cram_md5(sock, "AUTH", ctl, NULL);
+ if (ok == PS_SUCCESS || ctl->server.authenticate != A_ANY)
+ break;
}
-#endif /* OPIE */
/* ordinary validation, no one-time password or RPA */
+ gen_transact(sock, "USER %s", ctl->remotename);
+ strcpy(shroud, ctl->password);
ok = gen_transact(sock, "PASS %s", ctl->password);
+ shroud[0] = '\0';
break;
case P_APOP:
for (start = greeting; *start != 0 && *start != '<'; start++)
continue;
if (*start == 0) {
- report(stderr, 0, _("Required APOP timestamp not found in greeting"));
+ report(stderr,
+ GT_("Required APOP timestamp not found in greeting\n"));
return(PS_AUTHFAIL);
}
for (end = start; *end != 0 && *end != '>'; end++)
continue;
if (*end == 0 || end == start + 1) {
- report(stderr, 0, _("Timestamp syntax error in greeting"));
+ report(stderr,
+ GT_("Timestamp syntax error in greeting\n"));
return(PS_AUTHFAIL);
}
else
break;
default:
- report(stderr, 0, _("Undefined protocol request in POP3_auth"));
+ report(stderr, GT_("Undefined protocol request in POP3_auth\n"));
ok = PS_ERROR;
}
{
/* maybe we detected a lock-busy condition? */
if (ok == PS_LOCKBUSY)
- report(stderr, 0, _("lock busy! Is another session active?"));
+ report(stderr, GT_("lock busy! Is another session active?\n"));
return(ok);
}
return(PS_SUCCESS);
}
-static int
-pop3_gettopid( int sock, int num , char *id)
+static int pop3_gettopid( int sock, int num , char *id)
{
int ok;
int got_it;
char buf [POPBUFSIZE+1];
sprintf( buf, "TOP %d 1", num );
- if( (ok = gen_transact(sock, buf ) ) != 0 )
+ if ((ok = gen_transact(sock, buf )) != 0)
return ok;
got_it = 0;
- while((ok = gen_recv(sock, buf, sizeof(buf))) == 0) {
- if( buf[0] == '.' )
+ while ((ok = gen_recv(sock, buf, sizeof(buf))) == 0)
+ {
+ if (DOTLINE(buf))
break;
- if( ! got_it && ! strncasecmp("Message-Id:", buf, 11 )) {
+ if ( ! got_it && ! strncasecmp("Message-Id:", buf, 11 )) {
got_it = 1;
/* prevent stack overflows */
buf[IDLEN+12] = 0;
return 0;
}
-static int
-pop3_slowuidl( int sock, struct query *ctl, int *countp, int *newp)
+static int pop3_slowuidl( int sock, struct query *ctl, int *countp, int *newp)
{
/* This approach tries to get the message headers from the
* remote hosts and compares the message-id to the already known
try_id--;
}
} else {
- report(stderr, 0,
- _("Messages inserted into list on server. Cannot handle this."));
+ report(stderr,
+ GT_("Messages inserted into list on server. Cannot handle this.\n"));
return -1;
}
}
int ok;
char buf [POPBUFSIZE+1];
- pop3_phase = PHASE_GETRANGE;
-
/* Ensure that the new list is properly empty */
ctl->newsaved = (struct idlist *)NULL;
{
if (sscanf(buf, "%d", &last) == 0)
{
- report(stderr, 0, _("protocol error"));
+ report(stderr, GT_("protocol error\n"));
return(PS_ERROR);
}
*newp = (*countp - last);
/* don't worry, yet! do it the slow way */
if((ok = pop3_slowuidl( sock, ctl, countp, newp))!=0)
{
- report(stderr, 0, _("protocol error while fetching UIDLs"));
+ report(stderr, GT_("protocol error while fetching UIDLs\n"));
return(PS_ERROR);
}
}
*newp = 0;
while ((ok = gen_recv(sock, buf, sizeof(buf))) == 0)
{
- if (buf[0] == '.')
+ if (DOTLINE(buf))
break;
else if (sscanf(buf, "%d %s", &num, id) == 2)
{
{
int ok;
- /* pop3_phase = PHASE_GETSIZES */
-
if ((ok = gen_transact(sock, "LIST")) != 0)
return(ok);
else
while ((ok = gen_recv(sock, buf, sizeof(buf))) == 0)
{
- int num, size;
+ unsigned int num, size;
- if (buf[0] == '.')
+ if (DOTLINE(buf))
break;
- else if (sscanf(buf, "%d %d", &num, &size) == 2)
- sizes[num - 1] = size;
+ else if (sscanf(buf, "%u %u", &num, &size) == 2) {
+ if (num > 0 && num <= count)
+ sizes[num - 1] = size;
+ else
+ /* warn about possible attempt to induce buffer overrun */
+ report(stderr, "Warning: ignoring bogus data for message sizes returned by server.\n");
+ }
}
return(ok);
int ok;
char buf[POPBUFSIZE+1];
- /* pop3_phase = PHASE_FETCH */
-
gen_send(sock, "TOP %d 0", number);
if ((ok = pop3_ok(sock, buf)) != 0)
return(ok);
int ok;
char buf[POPBUFSIZE+1];
- /* pop3_phase = PHASE_FETCH */
-
#ifdef SDPS_ENABLE
/*
* See http://www.demon.net/services/mail/sdps-tech.html
* for a description of what we're parsing here.
*/
- if (sdps_enable)
+ if (ctl->server.sdps)
{
int linecount = 0;
+ sdps_envfrom = (char *)NULL;
sdps_envto = (char *)NULL;
gen_send(sock, "*ENV %d", number);
do {
break;
}
linecount++;
- if (linecount == 5)
- {
+ switch (linecount) {
+ case 4:
+ /* No need to wrap envelope from address */
+ sdps_envfrom = xmalloc(strlen(buf)+1);
+ strcpy(sdps_envfrom,buf);
+ break;
+ case 5:
/* Wrap address with To: <> so nxtaddr() likes it */
sdps_envto = xmalloc(strlen(buf)+7);
sprintf(sdps_envto,"To: <%s>",buf);
+ break;
}
} while
(!(buf[0] == '.' && (buf[1] == '\r' || buf[1] == '\n' || buf[1] == '\0')));
#endif /* SDPS_ENABLE */
/*
- * Though the POP RFCs don't document this fact, on every POP3 server
- * I know of messages are marked "seen" only at the time the OK
- * response to a RETR is issued.
+ * Though the POP RFCs don't document this fact, on almost every
+ * POP3 server I know of messages are marked "seen" only at the
+ * time the OK response to a RETR is issued.
*
* This means we can use TOP to fetch the message without setting its
* seen flag. This is good! It means that if the protocol exchange
* craps out during the message, it will still be marked `unseen' on
- * the server.
+ * the server. (Exception: in early 1999 SpryNet's POP3 servers were
+ * reported to mark messages seen on a TOP fetch.)
*
* However...*don't* do this if we're using keep to suppress deletion!
* In that case, marking the seen flag is the only way to prevent the
*
* The line count passed (99999999) is the maximum value CompuServe will
* accept; it's much lower than the natural value 2147483646 (the maximum
- * twos-complement signed 32-bit integer minus 1)
- */
+ * twos-complement signed 32-bit integer minus 1) */
if (ctl->keep || ctl->fetchall)
gen_send(sock, "RETR %d", number);
else
{
int ok;
- /* pop3_phase = PHASE_LOGOUT */
+#ifdef __UNUSED__
+ /*
+ * We used to do this in case the server marks messages deleted when seen.
+ * (Yes, this has been reported, in the MercuryP/NLM server.
+ * It's even legal under RFC 1939 (section 8) as a site policy.)
+ * It interacted badly with UIDL, though. Thomas Zajic wrote:
+ * "Running 'fetchmail -F -v' and checking the logs, I found out
+ * that fetchmail did in fact flush my mailbox properly, but sent
+ * a RSET just before sending QUIT to log off. This caused the
+ * POP3 server to undo/forget about the previous DELEs, resetting
+ * my mailbox to its original (ie. unflushed) state. The
+ * ~/.fetchids file did get flushed though, so the next time
+ * fetchmail was run it saw all the old messages as new ones ..."
+ */
+ if (ctl->keep)
+ gen_transact(sock, "RSET");
+#endif /* __UNUSED__ */
ok = gen_transact(sock, "QUIT");
if (!ok)
expunge_uids(ctl);
+ if (ctl->lastid)
+ {
+ free(ctl->lastid);
+ ctl->lastid = NULL;
+ }
+
return(ok);
}
const static struct method pop3 =
{
"POP3", /* Post Office Protocol v3 */
-#if INET6
+#if INET6_ENABLE
"pop3", /* standard POP3 port */
-#else /* INET6 */
+ "pop3s", /* ssl POP3 port */
+#else /* INET6_ENABLE */
110, /* standard POP3 port */
-#endif /* INET6 */
+ 995, /* ssl POP3 port */
+#endif /* INET6_ENABLE */
FALSE, /* this is not a tagged protocol */
TRUE, /* this uses a message delimiter */
pop3_ok, /* parse command response */
- NULL, /* no password canonicalization */
pop3_getauth, /* get authorization */
pop3_getrange, /* query range of messages */
pop3_getsizes, /* we can get a list of sizes */
{
#ifndef MBOX
if (ctl->mailboxes->id) {
- fprintf(stderr,_("Option --remote is not supported with POP3\n"));
+ fprintf(stderr,GT_("Option --remote is not supported with POP3\n"));
return(PS_SYNTAX);
}
#endif /* MBOX */
projects / ~andy / fetchmail / blobdiff