diff options
| author | Phil Pennock <pdp@exim.org> | 2012-03-21 01:38:57 -0700 |
|---|---|---|
| committer | Phil Pennock <pdp@exim.org> | 2012-03-21 01:38:57 -0700 |
| commit | c7955b11ec2f588b346b0bcdbd1e2fa1b55b1630 (patch) | |
| tree | 0e8d52de0161e0fd7885dc061582ed220a8dfd7c /src | |
| parent | b98bb9ac90bfc9c812c4c660fe017284ee222686 (diff) | |
heimdal_gssapi: accept SASL with empty authzid
Saw this happening with Apple Mail; accept it, dup the GSS Display Name
Diffstat (limited to 'src')
| -rw-r--r-- | src/src/auths/heimdal_gssapi.c | 25 |
1 files changed, 18 insertions, 7 deletions
diff --git a/src/src/auths/heimdal_gssapi.c b/src/src/auths/heimdal_gssapi.c index 9021509dd..e01789e31 100644 --- a/src/src/auths/heimdal_gssapi.c +++ b/src/src/auths/heimdal_gssapi.c @@ -412,10 +412,10 @@ auth_heimdal_gssapi_server(auth_instance *ablock, uschar *initial_data) error_out = FAIL; goto ERROR_OUT; } - if (gbufdesc_out.length < 5) { + if (gbufdesc_out.length < 4) { HDEBUG(D_auth) debug_printf("gssapi: final message too short; " - "need flags, buf sizes and authzid\n"); + "need flags, buf sizes and optional authzid\n"); error_out = FAIL; goto ERROR_OUT; } @@ -434,14 +434,17 @@ auth_heimdal_gssapi_server(auth_instance *ablock, uschar *initial_data) /* Identifiers: The SASL provided identifier is an unverified authzid. - GSSAPI provides us with a verified identifier. + GSSAPI provides us with a verified identifier, but it might be empty + for some clients. */ /* $auth2 is authzid requested at SASL layer */ - expand_nlength[2] = gbufdesc_out.length - 4; - auth_vars[1] = expand_nstring[2] = - string_copyn((US gbufdesc_out.value) + 4, expand_nlength[2]); - expand_nmax = 2; + if (gbufdesc_out.length > 4) { + expand_nlength[2] = gbufdesc_out.length - 4; + auth_vars[1] = expand_nstring[2] = + string_copyn((US gbufdesc_out.value) + 4, expand_nlength[2]); + expand_nmax = 2; + } gss_release_buffer(&min_stat, &gbufdesc_out); EmptyBuf(gbufdesc_out); @@ -464,6 +467,14 @@ auth_heimdal_gssapi_server(auth_instance *ablock, uschar *initial_data) auth_vars[0] = expand_nstring[1] = string_copyn(gbufdesc_out.value, gbufdesc_out.length); + if (expand_nmax == 0) { /* should be: authzid was empty */ + expand_nmax = 2; + expand_nlength[2] = expand_nlength[1]; + auth_vars[1] = expand_nstring[2] = string_copyn(expand_nstring[1], expand_nlength[1]); + HDEBUG(D_auth) + debug_printf("heimdal SASL: empty authzid, set to dup of GSSAPI display name\n"); + } + HDEBUG(D_auth) debug_printf("heimdal SASL: happy with client request\n" " auth1 (verified GSSAPI display-name): \"%s\"\n" |