X-Git-Url: http://pileus.org/git/?a=blobdiff_plain;f=pop3.c;h=f8796731286fa36daa3d476f8a2752fed17c77ec;hb=98cfcef26048bba06975e68a1aad05a8bac0d65d;hp=a994f992d1641151f874a9c0bc24f485e2bc15f0;hpb=dbb179567dd2e850e0e8327a823d21ee311db823;p=~andy%2Ffetchmail

diff --git a/pop3.c b/pop3.c
index a994f992..f8796731 100644
--- a/pop3.c
+++ b/pop3.c
@@ -262,12 +262,60 @@ static void set_peek_capable(struct query *ctl)
     peek_capable = !ctl->fetchall;
 }
 
+static int do_apop(int sock, struct query *ctl, char *greeting)
+{
+    char *start, *end;
+
+    /* build MD5 digest from greeting timestamp + password */
+    /* find start of timestamp */
+    start = strchr(greeting, '<');
+    if (!start) {
+	if (ctl->server.authenticate == A_APOP || outlevel >= O_DEBUG) {
+	    report(ctl->server.authenticate == A_APOP ? stderr : stdout,
+		    GT_("Required APOP timestamp not found in greeting\n"));
+	}
+	return PS_AUTHFAIL;
+    }
+
+    /* find end of timestamp */
+    end = strchr(start + 1, '>');
+
+    if (!end || end == start + 1) {
+	report(stderr,
+		GT_("Timestamp syntax error in greeting\n"));
+	return(PS_AUTHFAIL);
+    } else {
+	*++end = '\0';
+    }
+
+    /* SECURITY: 2007-03-17
+     * Strictly validating the presented challenge for RFC-822
+     * conformity (it must be a msg-id in terms of that standard) is
+     * supposed to make attacks against the MD5 implementation
+     * harder[1]
+     *
+     * [1] "Security vulnerability in APOP authentication",
+     *     Gaëtan Leurent, fetchmail-devel, 2007-03-17 */
+    if (!rfc822_valid_msgid((unsigned char *)start)) {
+	report(stderr,
+		GT_("Invalid APOP timestamp.\n"));
+	return PS_AUTHFAIL;
+    }
+
+    /* copy timestamp and password into digestion buffer */
+    char *msg = (char *)xmalloc((end-start+1) + strlen(ctl->password) + 1);
+    strcpy(msg,start);
+    strcat(msg,ctl->password);
+    strcpy((char *)ctl->digest, MD5Digest((unsigned char *)msg));
+    free(msg);
+
+    return gen_transact(sock, "APOP %s %s", ctl->remotename, (char *)ctl->digest);
+}
+
 static int pop3_getauth(int sock, struct query *ctl, char *greeting)
 /* apply for connection authorization */
 {
     int ok;
-    char *start,*end;
-    char *msg;
 #ifdef OPIE_ENABLE
     char *challenge;
 #endif /* OPIE_ENABLE */
@@ -314,9 +362,9 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting)
      *
      * Matthias Andree
      */
-    if (peek_capable && strstr(greeting, "Maillennium POP3/PROXY server")) {
+    if (peek_capable && strstr(greeting, "Maillennium POP3")) {
 	if ((ctl->server.workarounds & WKA_TOP) == 0) {
-	    report(stdout, GT_("Warning: \"Maillennium POP3/PROXY server\" found, using RETR command instead of TOP.\n"));
+	    report(stdout, GT_("Warning: \"Maillennium POP3\" found, using RETR command instead of TOP.\n"));
 	    ctl->server.workarounds |= WKA_TOP;
 	}
 	peek_capable = 0;
@@ -335,8 +383,12 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting)
         ctl->server.sdps = TRUE;
 #endif /* SDPS_ENABLE */
 
+    /* this is a leftover from the times 6.3.X and older when APOP was a
+     * "protocol" (P_APOP) rather than an authenticator (A_APOP),
+     * however, the switch is still useful because we can break; after
+     * an authenticator failed. */
    switch (ctl->server.protocol) {
-    case P_POP3:
+   case P_POP3:
 #ifdef RPA_ENABLE
 	/* XXX FIXME: AUTH probing (RFC1734) should become global */
 	/* CompuServe POP3 Servers as of 990730 want AUTH first for RPA */
@@ -517,31 +569,39 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting)
 #endif /* OPIE_ENABLE */
 
 #ifdef NTLM_ENABLE
-    /* MSN servers require the use of NTLM (MSN) authentication */
-    if (!strcasecmp(ctl->server.pollname, "pop3.email.msn.com") ||
-	    ctl->server.authenticate == A_MSN)
-	return (do_pop3_ntlm(sock, ctl, 1) == 0) ? PS_SUCCESS : PS_AUTHFAIL;
-    if (ctl->server.authenticate == A_NTLM || (has_ntlm && ctl->server.authenticate == A_ANY)) {
-	ok = do_pop3_ntlm(sock, ctl, 0);
-        if (ok == 0 || ctl->server.authenticate != A_ANY)
-	    break;
-    }
+	/* MSN servers require the use of NTLM (MSN) authentication */
+	if (!strcasecmp(ctl->server.pollname, "pop3.email.msn.com") ||
+		ctl->server.authenticate == A_MSN)
+	    return (do_pop3_ntlm(sock, ctl, 1) == 0) ? PS_SUCCESS : PS_AUTHFAIL;
+	if (ctl->server.authenticate == A_NTLM || (has_ntlm && ctl->server.authenticate == A_ANY)) {
+	    ok = do_pop3_ntlm(sock, ctl, 0);
+	    if (ok == 0 || ctl->server.authenticate != A_ANY)
+		break;
+	}
 #else
-    if (ctl->server.authenticate == A_NTLM || ctl->server.authenticate == A_MSN)
-    {
-	report(stderr,
-	   GT_("Required NTLM capability not compiled into fetchmail\n"));
-    }
+	if (ctl->server.authenticate == A_NTLM || ctl->server.authenticate == A_MSN)
+	{
+	    report(stderr,
+		    GT_("Required NTLM capability not compiled into fetchmail\n"));
+	}
 #endif
 
- 	if (ctl->server.authenticate == A_CRAM_MD5 || 
-	    (has_cram && ctl->server.authenticate == A_ANY))
+	if (ctl->server.authenticate == A_CRAM_MD5 ||
+		(has_cram && ctl->server.authenticate == A_ANY))
 	{
 	    ok = do_cram_md5(sock, "AUTH", ctl, NULL);
 	    if (ok == PS_SUCCESS || ctl->server.authenticate != A_ANY)
 		break;
 	}
 
+	if (ctl->server.authenticate == A_APOP
+		    || ctl->server.authenticate == A_ANY)
+	{
+	    ok = do_apop(sock, ctl, greeting);
+	    if (ok == PS_SUCCESS || ctl->server.authenticate != A_ANY)
+		break;
+	}
+
 	/* ordinary validation, no one-time password or RPA */ 
 	if ((ok = gen_transact(sock, "USER %s", ctl->remotename)))
 	    break;
@@ -599,52 +659,6 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting)
 	shroud[0] = '\0';
 	break;
 
-    case P_APOP:
-	/* build MD5 digest from greeting timestamp + password */
-	/* find start of timestamp */
-	for (start = greeting;  *start != 0 && *start != '<';  start++)
-	    continue;
-	if (*start == 0) {
-	    report(stderr,
-		   GT_("Required APOP timestamp not found in greeting\n"));
-	    return(PS_AUTHFAIL);
-	}
-
-	/* find end of timestamp */
-	for (end = start;  *end != 0  && *end != '>';  end++)
-	    continue;
-	if (*end == 0 || end == start + 1) {
-	    report(stderr, 
-		   GT_("Timestamp syntax error in greeting\n"));
-	    return(PS_AUTHFAIL);
-	}
-	else
-	    *++end = '\0';
-
-	/* SECURITY: 2007-03-17
-	 * Strictly validating the presented challenge for RFC-822
-	 * conformity (it must be a msg-id in terms of that standard) is
-	 * supposed to make attacks against the MD5 implementation
-	 * harder[1]
-	 *
-	 * [1] "Security vulnerability in APOP authentication",
-	 *     Gaëtan Leurent, fetchmail-devel, 2007-03-17 */
-	if (!rfc822_valid_msgid((unsigned char *)start)) {
-	    report(stderr,
-		    GT_("Invalid APOP timestamp.\n"));
-	    return PS_AUTHFAIL;
-	}
-
-	/* copy timestamp and password into digestion buffer */
-	msg = (char *)xmalloc((end-start+1) + strlen(ctl->password) + 1);
-	strcpy(msg,start);
-	strcat(msg,ctl->password);
-	strcpy((char *)ctl->digest, MD5Digest((unsigned char *)msg));
-	free(msg);
-
-	ok = gen_transact(sock, "APOP %s %s", ctl->remotename, (char *)ctl->digest);
-	break;
-
     default:
 	report(stderr, GT_("Undefined protocol request in POP3_auth\n"));
 	ok = PS_ERROR;
@@ -672,22 +686,6 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting)
 	return(ok);
     }
 
-/* Disable the sleep. Based on patch by Brian Candler 2004-04-19/2004-11-08,
- * accepted by Matthias Andree.
- *
- * Rationale: the server must have locked the spool before returning +OK;
- * this sleep just wastes time and hence, for modem and GSM CSD users, money. */
-#ifdef WANT_BOGUS
-    /*
-     * Empirical experience shows some server/OS combinations
-     * may need a brief pause even after any lockfiles on the
-     * server are released, to give the server time to finish
-     * copying back very large mailfolders from the temp-file...
-     * this is only ever an issue with extremely large mailboxes.
-     */
-    sleep(3); /* to be _really_ safe, probably need sleep(5)! */
-#endif
-
     /* we're approved */
     return(PS_SUCCESS);
 }