X-Git-Url: http://pileus.org/git/?a=blobdiff_plain;f=pop3.c;h=f8796731286fa36daa3d476f8a2752fed17c77ec;hb=87bcf29364c4640edb87cc2186b965d1a564d70c;hp=dd8e46041e74728ee5286122351d25d482d5fd2f;hpb=3e0432c01c37e7cd4f059be7dfd1a1ca2286683b;p=~andy%2Ffetchmail

diff --git a/pop3.c b/pop3.c
index dd8e4604..f8796731 100644
--- a/pop3.c
+++ b/pop3.c
@@ -259,15 +259,63 @@ static void set_peek_capable(struct query *ctl)
      * we have a means of reliably tracking which mail we need to
      * refetch should the connection abort in the middle.
      * fetchall forces RETR, as does keep without UIDL */
-    peek_capable = !ctl->fetchall && (!ctl->keep || ctl->server.uidl);
+    peek_capable = !ctl->fetchall;
+}
+
+static int do_apop(int sock, struct query *ctl, char *greeting)
+{
+    char *start, *end;
+
+    /* build MD5 digest from greeting timestamp + password */
+    /* find start of timestamp */
+    start = strchr(greeting, '<');
+    if (!start) {
+	if (ctl->server.authenticate == A_APOP || outlevel >= O_DEBUG) {
+	    report(ctl->server.authenticate == A_APOP ? stderr : stdout,
+		    GT_("Required APOP timestamp not found in greeting\n"));
+	}
+	return PS_AUTHFAIL;
+    }
+
+    /* find end of timestamp */
+    end = strchr(start + 1, '>');
+
+    if (!end || end == start + 1) {
+	report(stderr,
+		GT_("Timestamp syntax error in greeting\n"));
+	return(PS_AUTHFAIL);
+    } else {
+	*++end = '\0';
+    }
+
+    /* SECURITY: 2007-03-17
+     * Strictly validating the presented challenge for RFC-822
+     * conformity (it must be a msg-id in terms of that standard) is
+     * supposed to make attacks against the MD5 implementation
+     * harder[1]
+     *
+     * [1] "Security vulnerability in APOP authentication",
+     *     Gaëtan Leurent, fetchmail-devel, 2007-03-17 */
+    if (!rfc822_valid_msgid((unsigned char *)start)) {
+	report(stderr,
+		GT_("Invalid APOP timestamp.\n"));
+	return PS_AUTHFAIL;
+    }
+
+    /* copy timestamp and password into digestion buffer */
+    char *msg = (char *)xmalloc((end-start+1) + strlen(ctl->password) + 1);
+    strcpy(msg,start);
+    strcat(msg,ctl->password);
+    strcpy((char *)ctl->digest, MD5Digest((unsigned char *)msg));
+    free(msg);
+
+    return gen_transact(sock, "APOP %s %s", ctl->remotename, (char *)ctl->digest);
 }
 
 static int pop3_getauth(int sock, struct query *ctl, char *greeting)
 /* apply for connection authorization */
 {
     int ok;
-    char *start,*end;
-    char *msg;
 #ifdef OPIE_ENABLE
     char *challenge;
 #endif /* OPIE_ENABLE */
@@ -314,9 +362,9 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting)
      *
      * Matthias Andree
      */
-    if (peek_capable && strstr(greeting, "Maillennium POP3/PROXY server")) {
+    if (peek_capable && strstr(greeting, "Maillennium POP3")) {
 	if ((ctl->server.workarounds & WKA_TOP) == 0) {
-	    report(stdout, GT_("Warning: \"Maillennium POP3/PROXY server\" found, using RETR command instead of TOP.\n"));
+	    report(stdout, GT_("Warning: \"Maillennium POP3\" found, using RETR command instead of TOP.\n"));
 	    ctl->server.workarounds |= WKA_TOP;
 	}
 	peek_capable = 0;
@@ -335,8 +383,12 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting)
         ctl->server.sdps = TRUE;
 #endif /* SDPS_ENABLE */
 
+    /* this is a leftover from the times 6.3.X and older when APOP was a
+     * "protocol" (P_APOP) rather than an authenticator (A_APOP),
+     * however, the switch is still useful because we can break; after
+     * an authenticator failed. */
    switch (ctl->server.protocol) {
-    case P_POP3:
+   case P_POP3:
 #ifdef RPA_ENABLE
 	/* XXX FIXME: AUTH probing (RFC1734) should become global */
 	/* CompuServe POP3 Servers as of 990730 want AUTH first for RPA */
@@ -439,9 +491,9 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting)
 		* whether TLS is mandatory or opportunistic unless SSLOpen() fails
 		* (see below). */
 	       if (gen_transact(sock, "STLS") == PS_SUCCESS
-		       && SSLOpen(sock, ctl->sslcert, ctl->sslkey, "tls1", ctl->sslcertck,
+		       && (set_timeout(mytimeout), SSLOpen(sock, ctl->sslcert, ctl->sslkey, "tls1", ctl->sslcertck,
 			   ctl->sslcertfile, ctl->sslcertpath, ctl->sslfingerprint, commonname,
-			   ctl->server.pollname, &ctl->remotename) != -1)
+			   ctl->server.pollname, &ctl->remotename)) != -1)
 	       {
 		   /*
 		    * RFC 2595 says this:
@@ -456,6 +508,7 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting)
 		    * Now that we're confident in our TLS connection we can
 		    * guarantee a secure capability re-probe.
 		    */
+		   set_timeout(0);
 		   done_capa = FALSE;
 		   ok = capa_probe(sock);
 		   if (ok != PS_SUCCESS) {
@@ -468,6 +521,7 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting)
 	       } else if (must_tls(ctl)) {
 		   /* Config required TLS but we couldn't guarantee it, so we must
 		    * stop. */
+		   set_timeout(0);
 		   report(stderr, GT_("%s: upgrade to TLS failed.\n"), commonname);
 		   return PS_SOCKET;
 	       } else {
@@ -476,6 +530,7 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting)
 		    * allowed til post-authentication), so leave it in an unknown
 		    * state, mark it as such, and check more carefully if things
 		    * go wrong when we try to authenticate. */
+		   set_timeout(0);
 		   connection_may_have_tls_errors = TRUE;
 		   if (outlevel >= O_VERBOSE)
 		   {
@@ -514,31 +569,39 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting)
 #endif /* OPIE_ENABLE */
 
 #ifdef NTLM_ENABLE
-    /* MSN servers require the use of NTLM (MSN) authentication */
-    if (!strcasecmp(ctl->server.pollname, "pop3.email.msn.com") ||
-	    ctl->server.authenticate == A_MSN)
-	return (do_pop3_ntlm(sock, ctl, 1) == 0) ? PS_SUCCESS : PS_AUTHFAIL;
-    if (ctl->server.authenticate == A_NTLM || (has_ntlm && ctl->server.authenticate == A_ANY)) {
-	ok = do_pop3_ntlm(sock, ctl, 0);
-        if (ok == 0 || ctl->server.authenticate != A_ANY)
-	    break;
-    }
+	/* MSN servers require the use of NTLM (MSN) authentication */
+	if (!strcasecmp(ctl->server.pollname, "pop3.email.msn.com") ||
+		ctl->server.authenticate == A_MSN)
+	    return (do_pop3_ntlm(sock, ctl, 1) == 0) ? PS_SUCCESS : PS_AUTHFAIL;
+	if (ctl->server.authenticate == A_NTLM || (has_ntlm && ctl->server.authenticate == A_ANY)) {
+	    ok = do_pop3_ntlm(sock, ctl, 0);
+	    if (ok == 0 || ctl->server.authenticate != A_ANY)
+		break;
+	}
 #else
-    if (ctl->server.authenticate == A_NTLM || ctl->server.authenticate == A_MSN)
-    {
-	report(stderr,
-	   GT_("Required NTLM capability not compiled into fetchmail\n"));
-    }
+	if (ctl->server.authenticate == A_NTLM || ctl->server.authenticate == A_MSN)
+	{
+	    report(stderr,
+		    GT_("Required NTLM capability not compiled into fetchmail\n"));
+	}
 #endif
 
- 	if (ctl->server.authenticate == A_CRAM_MD5 || 
-	    (has_cram && ctl->server.authenticate == A_ANY))
+	if (ctl->server.authenticate == A_CRAM_MD5 ||
+		(has_cram && ctl->server.authenticate == A_ANY))
 	{
 	    ok = do_cram_md5(sock, "AUTH", ctl, NULL);
 	    if (ok == PS_SUCCESS || ctl->server.authenticate != A_ANY)
 		break;
 	}
 
+	if (ctl->server.authenticate == A_APOP
+		    || ctl->server.authenticate == A_ANY)
+	{
+	    ok = do_apop(sock, ctl, greeting);
+	    if (ok == PS_SUCCESS || ctl->server.authenticate != A_ANY)
+		break;
+	}
+
 	/* ordinary validation, no one-time password or RPA */ 
 	if ((ok = gen_transact(sock, "USER %s", ctl->remotename)))
 	    break;
@@ -596,52 +659,6 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting)
 	shroud[0] = '\0';
 	break;
 
-    case P_APOP:
-	/* build MD5 digest from greeting timestamp + password */
-	/* find start of timestamp */
-	for (start = greeting;  *start != 0 && *start != '<';  start++)
-	    continue;
-	if (*start == 0) {
-	    report(stderr,
-		   GT_("Required APOP timestamp not found in greeting\n"));
-	    return(PS_AUTHFAIL);
-	}
-
-	/* find end of timestamp */
-	for (end = start;  *end != 0  && *end != '>';  end++)
-	    continue;
-	if (*end == 0 || end == start + 1) {
-	    report(stderr, 
-		   GT_("Timestamp syntax error in greeting\n"));
-	    return(PS_AUTHFAIL);
-	}
-	else
-	    *++end = '\0';
-
-	/* SECURITY: 2007-03-17
-	 * Strictly validating the presented challenge for RFC-822
-	 * conformity (it must be a msg-id in terms of that standard) is
-	 * supposed to make attacks against the MD5 implementation
-	 * harder[1]
-	 *
-	 * [1] "Security vulnerability in APOP authentication",
-	 *     Gaëtan Leurent, fetchmail-devel, 2007-03-17 */
-	if (!rfc822_valid_msgid((unsigned char *)start)) {
-	    report(stderr,
-		    GT_("Invalid APOP timestamp.\n"));
-	    return PS_AUTHFAIL;
-	}
-
-	/* copy timestamp and password into digestion buffer */
-	msg = (char *)xmalloc((end-start+1) + strlen(ctl->password) + 1);
-	strcpy(msg,start);
-	strcat(msg,ctl->password);
-	strcpy((char *)ctl->digest, MD5Digest((unsigned char *)msg));
-	free(msg);
-
-	ok = gen_transact(sock, "APOP %s %s", ctl->remotename, (char *)ctl->digest);
-	break;
-
     default:
 	report(stderr, GT_("Undefined protocol request in POP3_auth\n"));
 	ok = PS_ERROR;
@@ -669,22 +686,6 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting)
 	return(ok);
     }
 
-/* Disable the sleep. Based on patch by Brian Candler 2004-04-19/2004-11-08,
- * accepted by Matthias Andree.
- *
- * Rationale: the server must have locked the spool before returning +OK;
- * this sleep just wastes time and hence, for modem and GSM CSD users, money. */
-#ifdef WANT_BOGUS
-    /*
-     * Empirical experience shows some server/OS combinations
-     * may need a brief pause even after any lockfiles on the
-     * server are released, to give the server time to finish
-     * copying back very large mailfolders from the temp-file...
-     * this is only ever an issue with extremely large mailboxes.
-     */
-    sleep(3); /* to be _really_ safe, probably need sleep(5)! */
-#endif
-
     /* we're approved */
     return(PS_SUCCESS);
 }
@@ -830,16 +831,10 @@ static int pop3_getrange(int sock,
     } else
 	return(ok);
 
-    /*
-     * Newer, RFC-1725/1939-conformant POP servers may not have the LAST
-     * command.  We work as hard as possible to hide this, but it makes
-     * counting new messages intrinsically quadratic in the worst case.
-     */
+    /* unless fetching all mail, get UID list (UIDL) */
     last = 0;
     *newp = -1;
-    /* if there are messages, and UIDL is desired, use UIDL
-     * also use UIDL if fetchall is unset */
-    if (*countp > 0 && (!ctl->fetchall || ctl->server.uidl))
+    if (*countp > 0)
     {
 	int fastuidl;
 	char id [IDLEN+1];
@@ -862,23 +857,6 @@ static int pop3_getrange(int sock,
 	else
 	    dofastuidl = 0;
 
-	if (!ctl->server.uidl) {
-	    gen_send(sock, "LAST");
-	    ok = pop3_ok(sock, buf);
-	} else
-	    ok = 1;
-
-	if (ok == 0)
-	{
-	    /* scan LAST reply */
-	    if (sscanf(buf, "%d", &last) == 0)
-	    {
-		report(stderr, GT_("protocol error\n"));
-		return(PS_ERROR);
-	    }
-	    *newp = (*countp - last);
-	}
-	else
 	{
 	    /* do UIDL */
 	    if (dofastuidl)
@@ -886,8 +864,10 @@ static int pop3_getrange(int sock,
 	    /* grab the mailbox's UID list */
 	    if (gen_transact(sock, "UIDL") != 0)
 	    {
+		if (!ctl->fetchall) {
 		    report(stderr, GT_("protocol error while fetching UIDLs\n"));
 		    return(PS_ERROR);
+		}
 	    }
 	    else
 	    {
@@ -940,8 +920,11 @@ static int pop3_getrange(int sock,
 			    old_rec = uid_db_insert(&ctl->oldsaved, id, UID_UNSEEN);
 
 			}
-			/* save the number */
-			if (new_rec->status == UID_UNSEEN || !ctl->keep) {
+			/*
+			 * save the number if it will be needed later on
+			 * (messsage will either be fetched or deleted)
+			 */
+			if (new_rec->status == UID_UNSEEN || ctl->flush) {
 			    set_uid_db_num(&ctl->oldsaved, old_rec, unum);
 			    set_uid_db_num(&ctl->newsaved, new_rec, unum);
 			}
@@ -1025,7 +1008,6 @@ static int pop3_is_old(int sock, struct query *ctl, int num)
 	    return(TRUE);
 
 	/* in fast uidl, we manipulate the old list only! */
-
 	if ((rec = find_uid_by_num(&ctl->oldsaved, num)))
 	{
 	    /* we already have the id! */