diff options
| -rw-r--r-- | NEWS | 4 | ||||
| -rw-r--r-- | TODO.txt | 1 | ||||
| -rw-r--r-- | driver.c | 2 | ||||
| -rw-r--r-- | fetchmail.h | 4 | ||||
| -rw-r--r-- | fetchmail.man | 35 | ||||
| -rw-r--r-- | imap.c | 38 | ||||
| -rw-r--r-- | options.c | 4 | ||||
| -rw-r--r-- | pop3.c | 4 | ||||
| -rw-r--r-- | rcfile_l.l | 1 | ||||
| -rw-r--r-- | socket.c | 48 | ||||
| -rw-r--r-- | socket.h | 2 |
11 files changed, 120 insertions, 23 deletions
@@ -125,6 +125,10 @@ fetchmail 6.3.5 (not yet released): or IMAP connection to TLS security with STLS/STARTTLS. * fetchmail now supports foo@example.org=bar user mappings for multidrop boxes. * switch setjmp/longjmp to sigsetjmp/siglongjmp +* IMAP now supports the EXTERNAL authentication method, courtesy of + Götz 'nimrill' Babin-Ebell, BerliOS patch #1095 with minor changes. +* The sslproto keywords are now case insensitive, courtesy of + Götz 'nimrill' Babin-Ebell, BerliOS patch #1095. # TRANSLATION UPDATES: * Russian/ru (Pavel Maryanov), Vietnamese/vi (Clytie Siddall) @@ -5,7 +5,6 @@ CODE: - check strict envelope N Received parsing, see mail from Admin Att on fetchmail-users - 6.3.4-pending-deletes.patch -- merge BerliOS IMAP AUTHENTICATE EXTERNAL patch - fetchmail -s with running daemon complains rather than silently restarting daemon @@ -1090,7 +1090,7 @@ static int do_session( /* Note: We pass the realhost name over for certificate verification. We may want to make this configurable */ if (ctl->use_ssl && SSLOpen(mailserver_socket,ctl->sslcert,ctl->sslkey,ctl->sslproto,ctl->sslcertck, - ctl->sslcertpath,ctl->sslfingerprint,realhost,ctl->server.pollname) == -1) + ctl->sslcertpath,ctl->sslfingerprint,realhost,ctl->server.pollname,&ctl->remotename) == -1) { report(stderr, GT_("SSL connection failed.\n")); err = PS_SOCKET; diff --git a/fetchmail.h b/fetchmail.h index cfe6a634..fec71d0b 100644 --- a/fetchmail.h +++ b/fetchmail.h @@ -81,6 +81,7 @@ char *strstr(const char *, const char *); #define A_GSSAPI 7 /* authenticate with GSSAPI */ #define A_SSH 8 /* authentication at session level */ #define A_MSN 9 /* same as NTLM with keyword MSN */ +#define A_EXTERNAL 10 /* external authentication (client cert) */ /* some protocols or authentication types (KERBEROS, GSSAPI, SSH) don't * require a password */ @@ -90,6 +91,7 @@ char *strstr(const char *, const char *); || (ctl)->server.authenticate == A_KERBEROS_V5 \ || (ctl)->server.authenticate == A_GSSAPI \ || (ctl)->server.authenticate == A_SSH \ + || (ctl)->server.authenticate == A_EXTERNAL \ || (ctl)->server.protocol == P_ETRN) /* @@ -119,6 +121,8 @@ char *strstr(const char *, const char *); #define DIGESTLEN 33 /* length of MD5 digest */ /* exit code values */ +/* NOTE THAT PS_SUCCESS MUST ALWAYS BE 0 - SOME PARTS OF THE CODE + * RELY ON THIS VALUE! */ #define PS_SUCCESS 0 /* successful receipt of messages */ #define PS_NOMAIL 1 /* no mail available */ #define PS_SOCKET 2 /* socket I/O woes */ diff --git a/fetchmail.man b/fetchmail.man index 8144bfba..7be2abdf 100644 --- a/fetchmail.man +++ b/fetchmail.man @@ -384,6 +384,10 @@ require it, some servers may request it but not require it, and some servers may not request it at all. It may be the same file as the private key (combined key and certificate file) but this is not recommended. +.sp +.B NOTE: +If you use client authentication, the user name is fetched from the +certificate's CommonName and overrides the name set with \-\-user. .TP .B \-\-sslkey <name> (Keyword: sslkey) @@ -402,11 +406,11 @@ server. This can cause some complications in daemon mode. .TP .B \-\-sslproto <name> (Keyword: sslproto) -Forces an SSL or TLS protocol. Possible values are '\fBssl2\fR', -\&'\fBssl3\fR', '\fBssl23\fR', and '\fBtls1\fR'. Try this if the default +Forces an SSL or TLS protocol. Possible values are '\fBSSL2\fR', +\&'\fBSSL3\fR', '\fBSSL23\fR', and '\fBTLS1\fR'. Try this if the default handshake does not work for your server. To defeat automatic TLSv1 negotiation when the server advertises STARTTLS or STLS, use \fB''\fR or -\&'\fBssl23\fR'. This option, even if the argument is the empty string, +\&'\fBSSL23\fR'. This option, even if the argument is the empty string, will also suppress the diagnostic 'SERVER: opportunistic upgrade to TLS.' message in verbose mode. The default is to try appropriate protocols depending on context. @@ -728,19 +732,22 @@ This option permits you to specify an authentication type (see USER AUTHENTICATION below for details). The possible values are \fBany\fR, \&\fBpassword\fR, \fBkerberos_v5\fR, \fBkerberos\fR (or, for excruciating exactness, \fBkerberos_v4\fR), \fBgssapi\fR, -\fBcram\-md5\fR, \fBotp\fR, \fBntlm\fR, \fBmsn\fR (only for POP3) and -\fBssh\fR. When \fBany\fR (the default) is specified, fetchmail tries -first methods that don't require a password (GSSAPI, KERBEROS\ IV, +\fBcram\-md5\fR, \fBotp\fR, \fBntlm\fR, \fBmsn\fR (only for POP3), +\fBexternal\fR (only IMAP) and \fBssh\fR. +When \fBany\fR (the default) is specified, fetchmail tries +first methods that don't require a password (EXTERNAL, GSSAPI, KERBEROS\ IV, KERBEROS\ 5); then it looks for methods that mask your password (CRAM-MD5, X\-OTP - note that NTLM and MSN are not autoprobed for POP3 and MSN is only supported for POP3); and only if the server doesn't support any of those will it ship your password en clair. Other values may be used to force various authentication methods -(\fBssh\fR suppresses authentication and is thus good for IMAP PREAUTH). +(\fBssh\fR suppresses authentication and is thus useful for IMAP PREAUTH). +(\fBexternal\fR suppresses authentication and is thus useful for IMAP EXTERNAL). Any value other than \fBpassword\fR, \fBcram\-md5\fR, \fBntlm\fR, \&\fBmsn\fR or \fBotp\fR suppresses fetchmail's normal inquiry for a password. Specify \fBssh\fR when you are using an end-to-end secure -connection such as an ssh tunnel; specify \fBgssapi\fR or +connection such as an ssh tunnel; specify \fBexternal\fR when you use +TLS with client authentication and specify \fBgssapi\fR or \&\fBkerberos_v4\fR if you are using a protocol variant that employs GSSAPI or K4. Choosing KPOP protocol automatically selects Kerberos authentication. This option does not work with ETRN. @@ -1009,6 +1016,13 @@ In this case you can declare the authentication value 'ssh' on that site entry to stop \fI.fetchmail\fR from asking you for a password when it starts up. .PP +If you use client authentication with \fITLS1\fR and your IMAP daemon +returns the \fIAUTH=EXTERNAL\fR response, fetchmail will notice this +and will use the authentication shortcut and will not send the +passphrase. In this case you can declare the authentication value 'external' + on that site to stop \fIfetchmail\fR from asking you for a password +when it starts up. +.PP If you are using POP3, and the server issues a one-time-password challenge conforming to RFC1938, \fIfetchmail\fR will use your password as a pass phrase to generate the required response. This @@ -1585,7 +1599,7 @@ tracepolls \& \& T{ Add poll tracing information to the Received header T} principal \& \& T{ -Set Kerberos principal (only useful with imap and kerberos) +Set Kerberos principal (only useful with IMAP and kerberos) T} esmtpname \& \& T{ Set name for RFC2554 authentication to the ESMTP server. @@ -1987,7 +2001,8 @@ Legal protocol identifiers for use with the 'protocol' keyword are: .PP Legal authentication types are 'any', 'password', 'kerberos', \&'kerberos_v4', 'kerberos_v5' and 'gssapi', 'cram\-md5', 'otp', 'msn' -(only for POP3), 'ntlm', 'ssh'. The 'password' type specifies +(only for POP3), 'ntlm', 'ssh', 'external' (only IMAP). +The 'password' type specifies authentication by normal transmission of a password (the password may be plain text or subject to protocol-specific encryption as in APOP); \&'kerberos' tells \fIfetchmail\fR to try to get a Kerberos ticket at the @@ -347,6 +347,24 @@ static void capa_probe(int sock, struct query *ctl) peek_capable = (imap_version >= IMAP4); } +static int do_authcert (int sock, char *command, const char *name) +/* do authentication "external" (authentication provided by client cert) */ +{ + char buf[256]; + + if (name && name[0]) + { + size_t len = strlen(name); + if ((len / 3) + ((len % 3) ? 4 : 0) < sizeof(buf)) + to64frombits (buf, name, strlen(name)); + else + return PS_AUTHFAIL; /* buffer too small. */ + } + else + buf[0]=0; + return gen_transact(sock, "%s EXTERNAL %s",command,buf); +} + static int imap_getauth(int sock, struct query *ctl, char *greeting) /* apply for connection authorization */ { @@ -378,7 +396,7 @@ static int imap_getauth(int sock, struct query *ctl, char *greeting) } #ifdef SSL_ENABLE - if ((!ctl->sslproto || !strcmp(ctl->sslproto,"tls1")) + if ((!ctl->sslproto || !strcasecmp(ctl->sslproto,"tls1")) && !ctl->use_ssl && strstr(capabilities, "STARTTLS")) { @@ -393,7 +411,7 @@ static int imap_getauth(int sock, struct query *ctl, char *greeting) if (ok == PS_SUCCESS && SSLOpen(sock,ctl->sslcert,ctl->sslkey,"tls1",ctl->sslcertck, ctl->sslcertpath,ctl->sslfingerprint, - realhost,ctl->server.pollname) == -1) + realhost,ctl->server.pollname,&ctl->remotename) == -1) { if (!ctl->sslproto && !ctl->wehaveauthed) { @@ -430,6 +448,22 @@ static int imap_getauth(int sock, struct query *ctl, char *greeting) */ ok = PS_AUTHFAIL; + if ((ctl->server.authenticate == A_ANY + || ctl->server.authenticate == A_EXTERNAL) + && strstr(capabilities, "AUTH=EXTERNAL")) + { + ok = do_authcert(sock, "AUTHENTICATE", ctl->remotename); + if (ok) + { + /* SASL cancellation of authentication */ + gen_send(sock, "*"); + if (ctl->server.authenticate != A_ANY) + return ok; + } else { + return ok; + } + } + #ifdef GSSAPI if ((ctl->server.authenticate == A_ANY || ctl->server.authenticate == A_GSSAPI) @@ -362,6 +362,8 @@ int parsecmdline (int argc /** argument count */, ctl->server.authenticate = A_KERBEROS_V4; else if (strcmp(optarg, "ssh") == 0) ctl->server.authenticate = A_SSH; + else if (strcasecmp(optarg, "external") == 0) + ctl->server.authenticate = A_EXTERNAL; else if (strcmp(optarg, "otp") == 0) ctl->server.authenticate = A_OTP; else if (strcmp(optarg, "opie") == 0) @@ -610,7 +612,7 @@ int parsecmdline (int argc /** argument count */, P(GT_(" --sslcertck do strict server certificate check (recommended)\n")); P(GT_(" --sslcertpath path to ssl certificates\n")); P(GT_(" --sslfingerprint fingerprint that must match that of the server's cert.\n")); - P(GT_(" --sslproto force ssl protocol (ssl2/ssl3/tls1)\n")); + P(GT_(" --sslproto force ssl protocol (SSL2/SSL3/TLS1)\n")); #endif P(GT_(" --plugin specify external command to open connection\n")); P(GT_(" --plugout specify external command to open smtp connection\n")); @@ -441,7 +441,7 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting) #ifdef SSL_ENABLE if (has_ssl && !ctl->use_ssl - && (!ctl->sslproto || !strcmp(ctl->sslproto,"tls1"))) + && (!ctl->sslproto || !strcasecmp(ctl->sslproto,"tls1"))) { char *realhost; @@ -453,7 +453,7 @@ static int pop3_getauth(int sock, struct query *ctl, char *greeting) if (ok == PS_SUCCESS && SSLOpen(sock,ctl->sslcert,ctl->sslkey,"tls1",ctl->sslcertck, ctl->sslcertpath,ctl->sslfingerprint, - realhost,ctl->server.pollname) == -1) + realhost,ctl->server.pollname,&ctl->remotename) == -1) { if (!ctl->sslproto && !ctl->wehaveauthed) { @@ -99,6 +99,7 @@ kerberos(_v)?4 { SETSTATE(0); yylval.proto = A_KERBEROS_V4; return AUTHTYPE;} kerberos(_v)?5 { SETSTATE(0); yylval.proto = A_KERBEROS_V5; return AUTHTYPE;} kerberos { SETSTATE(0); yylval.proto = A_KERBEROS_V4; return AUTHTYPE;} ssh { SETSTATE(0); yylval.proto = A_SSH; return AUTHTYPE;} +external { SETSTATE(0); yylval.proto = A_EXTERNAL; return AUTHTYPE;} (otp|opie) { SETSTATE(0); yylval.proto = A_OTP; return AUTHTYPE;} cram(-md5)? { SETSTATE(0); yylval.proto = A_CRAM_MD5; return AUTHTYPE;} msn { SETSTATE(0); yylval.proto = A_MSN; return AUTHTYPE;} @@ -810,12 +810,43 @@ static int SSL_ck_verify_callback( int ok_return, X509_STORE_CTX *ctx ) return SSL_verify_callback(ok_return, ctx, 1); } + +/* get commonName from certificate set in file. + * commonName is stored in buffer namebuffer, limited with namebufferlen + */ +static const char *SSLCertGetCN(const char *mycert, + char *namebuffer, size_t namebufferlen) +{ + const char *ret = NULL; + BIO *certBio = NULL; + X509 *x509_cert = NULL; + X509_NAME *certname = NULL; + + if (namebuffer && namebufferlen > 0) { + namebuffer[0] = 0x00; + certBio = BIO_new_file(mycert,"r"); + if (certBio) { + x509_cert = PEM_read_bio_X509(certBio,NULL,NULL,NULL); + BIO_free(certBio); + } + if (x509_cert) { + certname = X509_get_subject_name(x509_cert); + if (certname && + X509_NAME_get_text_by_NID(certname, NID_commonName, + namebuffer, namebufferlen) > 0) + ret = namebuffer; + X509_free(x509_cert); + } + } + return ret; +} + /* performs initial SSL handshake over the connected socket * uses SSL *ssl global variable, which is currently defined * in this file */ int SSLOpen(int sock, char *mycert, char *mykey, char *myproto, int certck, char *certpath, - char *fingerprint, char *servercname, char *label) + char *fingerprint, char *servercname, char *label, char **remotename) { struct stat randstat; int i; @@ -851,13 +882,13 @@ int SSLOpen(int sock, char *mycert, char *mykey, char *myproto, int certck, char /* Be picky and make sure the memory is cleared */ memset( _ssl_context, 0, sizeof( _ssl_context ) ); if(myproto) { - if(!strcmp("ssl2",myproto)) { + if(!strcasecmp("ssl2",myproto)) { _ctx = SSL_CTX_new(SSLv2_client_method()); - } else if(!strcmp("ssl3",myproto)) { + } else if(!strcasecmp("ssl3",myproto)) { _ctx = SSL_CTX_new(SSLv3_client_method()); - } else if(!strcmp("tls1",myproto)) { + } else if(!strcasecmp("tls1",myproto)) { _ctx = SSL_CTX_new(TLSv1_client_method()); - } else if (!strcmp("ssl23",myproto)) { + } else if (!strcasecmp("ssl23",myproto)) { myproto = NULL; } else { fprintf(stderr,GT_("Invalid SSL protocol '%s' specified, using default (SSLv23).\n"), myproto); @@ -906,10 +937,17 @@ int SSLOpen(int sock, char *mycert, char *mykey, char *myproto, int certck, char * he does NOT have a separate certificate and private key file then * assume that it's a combined key and certificate file. */ + char buffer[256]; + if( !mykey ) mykey = mycert; if( !mycert ) mycert = mykey; + + if (SSLCertGetCN(mycert, buffer, sizeof(buffer))) { + free(*remotename); + *remotename = xstrdup(buffer); + } SSL_use_certificate_file(_ssl_context[sock], mycert, SSL_FILETYPE_PEM); SSL_use_RSAPrivateKey_file(_ssl_context[sock], mykey, SSL_FILETYPE_PEM); } @@ -69,7 +69,7 @@ int UnixOpen(const char *path); #ifdef SSL_ENABLE int SSLOpen(int sock, char *mycert, char *mykey, char *myproto, int certck, char *certpath, - char *fingerprint, char *servercname, char *label); + char *fingerprint, char *servercname, char *label, char **remotename); #endif /* SSL_ENABLE */ #endif /* SOCKET__ */ |