POP3: autoprobe NTLM.

diff --git a/NEWS b/NEWS
index e7b4a1ef1de00a280e099b2b7218a372c2cdd4a1..3d0c5d333db72e2f39dd596e4e90dad048379b17 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -106,6 +106,7 @@ fetchmail-6.3.18 (not yet released):
 * When encountering incorrect headers, fetchmail will refer to the bad-header
   option in the manpage. BerliOS Bug #17272, change suggested by Björn Voigt.
 * Fetchmail now decodes and reports GSSAPI status codes upon errors.
+* Fetchmail now autoprobes NTLM for POP3.
 
 # TRANSLATION UPDATES
   [zh_CN] Chinese/simplified (Ji Zheng-Yu)

diff --git a/fetchmail.man b/fetchmail.man
index 2f5268273e9e697ad788595e7488399369899d7a..442bf4d6d6382a8d3a5b3db3f3f0aa6952e64a0c 100644 (file)
--- a/fetchmail.man
+++ b/fetchmail.man
@@ -918,8 +918,8 @@ excruciating exactness, \fBkerberos_v4\fP), \fBgssapi\fP,
 When \fBany\fP (the default) is specified, fetchmail tries
 first methods that don't require a password (EXTERNAL, GSSAPI, KERBEROS\ IV,
 KERBEROS\ 5); then it looks for methods that mask your password
-(CRAM-MD5, X\-OTP - note that NTLM and MSN are not autoprobed for POP3
-and MSN is only supported for POP3); and only if the server doesn't
+(CRAM-MD5, NTLM, X\-OTP - note that MSN is only supported for POP3, but not
+autoprobed); and only if the server doesn't
 support any of those will it ship your password en clair.  Other values
 may be used to force various authentication methods
 (\fBssh\fP suppresses authentication and is thus useful for IMAP PREAUTH).

diff --git a/pop3.c b/pop3.c
index 5148c25d50b8fd9625f738a1d4e12ae91d2a8945..fd3e5b5d9d63513c3953bfbbca5fc353e4ca1b27 100644 (file)
--- a/pop3.c
+++ b/pop3.c
@@ -52,6 +52,9 @@ static flag has_cram = FALSE;
 #ifdef OPIE_ENABLE
 flag has_otp = FALSE;
 #endif /* OPIE_ENABLE */
+#ifdef NTLM_ENABLE
+flag has_ntlm = FALSE;
+#endif /* NTLM_ENABLE */
 #ifdef SSL_ENABLE
 static flag has_stls = FALSE;
 #endif /* SSL_ENABLE */
@@ -209,6 +212,9 @@ static int capa_probe(int sock)
 #ifdef OPIE_ENABLE
     has_otp = FALSE;
 #endif /* OPIE_ENABLE */
+#ifdef NTLM_ENABLE
+    has_ntlm = FALSE;
+#endif /* NTLM_ENABLE */
 
     ok = gen_transact(sock, "CAPA");
     if (ok == PS_SUCCESS)
@@ -220,22 +226,32 @@ static int capa_probe(int sock)
        {
            if (DOTLINE(buffer))
                break;
+
 #ifdef SSL_ENABLE
            if (strstr(buffer, "STLS"))
                has_stls = TRUE;
 #endif /* SSL_ENABLE */
+
 #if defined(GSSAPI)
            if (strstr(buffer, "GSSAPI"))
                has_gssapi = TRUE;
 #endif /* defined(GSSAPI) */
+
 #if defined(KERBEROS_V4)
            if (strstr(buffer, "KERBEROS_V4"))
                has_kerberos = TRUE;
 #endif /* defined(KERBEROS_V4)  */
+
 #ifdef OPIE_ENABLE
            if (strstr(buffer, "X-OTP"))
                has_otp = TRUE;
 #endif /* OPIE_ENABLE */
+
+#ifdef NTLM_ENABLE
+           if (strstr(buffer, "NTLM"))
+               has_ntlm = TRUE;
+#endif /* NTLM_ENABLE */
+
            if (strstr(buffer, "CRAM-MD5"))
                has_cram = TRUE;
        }
@@ -328,22 +344,7 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting)
         ctl->server.sdps = TRUE;
 #endif /* SDPS_ENABLE */
 
-#ifdef NTLM_ENABLE
-    /* MSN servers require the use of NTLM (MSN) authentication */
-    if (!strcasecmp(ctl->server.pollname, "pop3.email.msn.com") ||
-           ctl->server.authenticate == A_MSN)
-       return (do_pop3_ntlm(sock, ctl, 1) == 0) ? PS_SUCCESS : PS_AUTHFAIL;
-    if (ctl->server.authenticate == A_NTLM)
-       return (do_pop3_ntlm(sock, ctl, 0) == 0) ? PS_SUCCESS : PS_AUTHFAIL;
-#else
-    if (ctl->server.authenticate == A_NTLM || ctl->server.authenticate == A_MSN)
-    {
-       report(stderr,
-          GT_("Required NTLM capability not compiled into fetchmail\n"));
-    }
-#endif
-
-    switch (ctl->server.protocol) {
+   switch (ctl->server.protocol) {
     case P_POP3:
 #ifdef RPA_ENABLE
        /* XXX FIXME: AUTH probing (RFC1734) should become global */
@@ -542,7 +543,25 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting)
        }
 #endif /* OPIE_ENABLE */
 
-       if (ctl->server.authenticate == A_CRAM_MD5 || 
+#ifdef NTLM_ENABLE
+    /* MSN servers require the use of NTLM (MSN) authentication */
+    if (!strcasecmp(ctl->server.pollname, "pop3.email.msn.com") ||
+           ctl->server.authenticate == A_MSN)
+       return (do_pop3_ntlm(sock, ctl, 1) == 0) ? PS_SUCCESS : PS_AUTHFAIL;
+    if (ctl->server.authenticate == A_NTLM || (has_ntlm && ctl->server.authenticate == A_ANY)) {
+       ok = do_pop3_ntlm(sock, ctl, 0);
+        if (ok == 0 || ctl->server.authenticate != A_ANY)
+           break;
+    }
+#else
+    if (ctl->server.authenticate == A_NTLM || ctl->server.authenticate == A_MSN)
+    {
+       report(stderr,
+          GT_("Required NTLM capability not compiled into fetchmail\n"));
+    }
+#endif
+
+       if (ctl->server.authenticate == A_CRAM_MD5 || 
            (has_cram && ctl->server.authenticate == A_ANY))
        {
            ok = do_cram_md5(sock, "AUTH", ctl, NULL);