Fix IMAP password shrouding.

svn path=/trunk/; revision=1712

diff --git a/NEWS b/NEWS
index 278e730cb227602d843b3d2dcb7d8e2b1a3790c4..421ec376bda3f93ae526701ec5e213f70f0f45bd 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -12,9 +12,16 @@
   "X-Fetchmail-ID" header in fetched messages for debugging.
 * Total byte count in status message?
 * -U/--userdefault option to specify postmaster overriding USER.
+* imap_canonicalize screws up password shrouding.
 
                                Release Notes:
 
+------------------------------------------------------------------------------
+fetchmail-4.4.1 ():
+* We now properly shroud IMAP passwords containing ", \, and SP.
+
+There are 273 people on fetchmail-friends and 160 on fetchmail-announce.
+
 ------------------------------------------------------------------------------
 fetchmail-4.4.0 (Mon Mar 16 14:57:38 EST 1998):
 * Fix bug that prevented graceful exit from POP3 validation on wrong password.

diff --git a/driver.c b/driver.c
index e8c51017fa0643b453fbfdcd76408b5d503f2a93..aa908ecdc861ea0377ca393d53d0d3cc2550a8e6 100644 (file)
--- a/driver.c
+++ b/driver.c
@@ -105,9 +105,9 @@ char tag[TAGLEN];
 static int tagnum;
 #define GENSYM (sprintf(tag, "A%04d", ++tagnum % TAGMOD), tag)
 
-static char *shroud;   /* string to shroud in debug output, if  non-NULL */
-static int mytimeout;  /* value of nonreponse timeout */
-static int msglen;     /* actual message length */
+static char shroud[PASSWORDLEN];       /* string to shroud in debug output */
+static int mytimeout;                  /* value of nonreponse timeout */
+static int msglen;                     /* actual message length */
 
 /* use these to track what was happening when the nonresponse timer fired */
 #define GENERAL_WAIT   0       /* unknown wait type */
@@ -1891,9 +1891,12 @@ const struct method *proto;      /* protocol method table */
        /* try to get authorized to fetch mail */
        if (protocol->getauth)
        {
-           shroud = ctl->password;
+           if (protocol->password_canonify)
+               (protocol->password_canonify)(shroud, ctl->password);
+           else
+               strcpy(shroud, ctl->password);
+
            ok = (protocol->getauth)(sock, ctl, buf);
-           shroud = (char *)NULL;
            if (ok != 0)
            {
                if (ok == PS_LOCKBUSY)

diff --git a/etrn.c b/etrn.c
index 09da776b335e24d15dfb2184fc936522e044b952..7deb43126dcc749543bb020ef7256870beb2d593 100644 (file)
--- a/etrn.c
+++ b/etrn.c
@@ -120,6 +120,7 @@ const static struct method etrn =
     FALSE,             /* this is not a tagged protocol */
     FALSE,             /* this does not use a message delimiter */
     etrn_ok,           /* parse command response */
+    NULL,              /* no password canonicalization */
     NULL,              /* no need to get authentication */
     etrn_getrange,     /* initialize message sending */
     NULL,              /* we cannot get a list of sizes */

diff --git a/fetchmail.h b/fetchmail.h
index 3c3246ab8f04cec1118bbf1d0554630089dca3c6..4f01557dcef23bfeae307522b84ca7d341041132 100644 (file)
--- a/fetchmail.h
+++ b/fetchmail.h
@@ -208,6 +208,7 @@ struct method
     flag tagged;               /* if true, generate & expect command tags */
     flag delimited;            /* if true, accept "." message delimiter */
     int (*parse_response)();   /* response_parsing function */
+    int (*password_canonify)();        /* canonicalize password */
     int (*getauth)();          /* authorization fetcher */
     int (*getrange)();         /* get message range to fetch */
     int (*getsizes)();         /* get sizes of messages */

diff --git a/imap.c b/imap.c
index 29ce0de9805d624385879277c0e5b3dd8c034343..227565cda40e21207e97aecb60cc16d45b358005 100644 (file)
--- a/imap.c
+++ b/imap.c
@@ -568,18 +568,13 @@ static int do_gssauth(int sock, char *hostname, char *username)
 }      
 #endif /* GSSAPI */
 
-static char *canonicalize_imap_password(char *passwd)
+int imap_canonicalize(char *result, char *passwd)
 /* encode an IMAP password as per RFC1730's quoting conventions */
 {
-    char *result;
     int i, j;
 
-    result = malloc(2*strlen(passwd));
-    if (!result)
-       return 0;
-
-    j=0;
-    for (i=0; i<strlen(passwd); ++i)
+    j = 0;
+    for (i = 0; i < strlen(passwd); i++)
     {
        if ((passwd[i] == '\\') || (passwd[i] == '"'))
            result[j++] = '\\';
@@ -587,13 +582,14 @@ static char *canonicalize_imap_password(char *passwd)
     }
     result[j] = '\0';
 
-    return(result);
+    return(i);
 }
 
 int imap_getauth(int sock, struct query *ctl, char *greeting)
 /* apply for connection authorization */
 {
     int ok = 0;
+    char       password[PASSWORDLEN*2];
 
     /* probe to see if we're running IMAP4 and can use RFC822.PEEK */
     capabilities[0] = '\0';
@@ -684,20 +680,10 @@ int imap_getauth(int sock, struct query *ctl, char *greeting)
     };
 #endif /* __UNUSED__ */
 
-    /* try to get authorized in the ordinary (AUTH=LOGIN) way */
-    {
-       char *newpass = canonicalize_imap_password(ctl->password);
-       
-       if (!newpass)
-          return(PS_AUTHFAIL); /* should report error better!!!! */
-       
-       ok = gen_transact(sock, "LOGIN \"%s\" \"%s\"", ctl->remotename,newpass);
-       
-       free(newpass);
-    
-       if (ok)
-          return(ok);
-    }
+    imap_canonicalize(password, ctl->password);
+    ok = gen_transact(sock, "LOGIN \"%s\" \"%s\"", ctl->remotename, password);
+    if (ok)
+       return(ok);
     
     return(PS_SUCCESS);
 }
@@ -996,6 +982,7 @@ const static struct method imap =
     TRUE,              /* this is a tagged protocol */
     FALSE,             /* no message delimiter */
     imap_ok,           /* parse command response */
+    imap_canonicalize, /* deal with embedded slashes and spaces */
     imap_getauth,      /* get authorization */
     imap_getrange,     /* query range of messages */
     imap_getsizes,     /* get sizes of messages (used for --limit option */

diff --git a/pop2.c b/pop2.c
index 0f920ee307a37b18258792565a97dded19ab782f..ee0e7809d7a56c97cf613da6bdddd3de81f6d17e 100644 (file)
--- a/pop2.c
+++ b/pop2.c
@@ -131,6 +131,7 @@ const static struct method pop2 =
     FALSE,                             /* this is not a tagged protocol */
     FALSE,                             /* does not use message delimiter */
     pop2_ok,                           /* parse command response */
+    NULL,                              /* no password canonicalization */
     pop2_getauth,                      /* get authorization */
     pop2_getrange,                     /* query range of messages */
     NULL,                              /* no way to get sizes */

diff --git a/pop3.c b/pop3.c
index b03efdff2250c7418a9d3854415aca293634dcee..9502d10467d00b36ac247653678f5a2863d94931 100644 (file)
--- a/pop3.c
+++ b/pop3.c
@@ -535,6 +535,7 @@ const static struct method pop3 =
     FALSE,             /* this is not a tagged protocol */
     TRUE,              /* this uses a message delimiter */
     pop3_ok,           /* parse command response */
+    NULL,              /* no password canonicalization */
     pop3_getauth,      /* get authorization */
     pop3_getrange,     /* query range of messages */
     pop3_getsizes,     /* we can get a list of sizes */