summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--doc/doc-txt/ChangeLog9
-rw-r--r--doc/doc-txt/NewStuff14
-rw-r--r--src/src/globals.c5
-rw-r--r--src/src/structs.h3
-rw-r--r--src/src/transports/smtp.c29
-rw-r--r--test/confs/345574
-rw-r--r--test/confs/346574
-rw-r--r--test/log/345512
-rw-r--r--test/log/346512
-rw-r--r--test/scripts/3450-plaintext-GnuTLS/345512
-rw-r--r--test/scripts/3460-plaintext-OpenSSL/346512
-rw-r--r--test/stdout/20222
-rw-r--r--test/stdout/34074
13 files changed, 251 insertions, 11 deletions
diff --git a/doc/doc-txt/ChangeLog b/doc/doc-txt/ChangeLog
index 6a8e4d1e1..cd802708e 100644
--- a/doc/doc-txt/ChangeLog
+++ b/doc/doc-txt/ChangeLog
@@ -1,4 +1,4 @@
-$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.512 2007/06/14 14:18:19 ph10 Exp $
+$Cambridge: exim/doc/doc-txt/ChangeLog,v 1.513 2007/06/18 13:57:49 ph10 Exp $
Change log file for Exim from version 4.21
-------------------------------------------
@@ -50,6 +50,13 @@ PH/03 The body_linecount and body_zerocount variables are now exported in the
PH/04 Added the $dnslist_matched variable.
+PH/05 Unset $tls_cipher and $tls_peerdn before making a connection as a client.
+ This means they are set thereafter only if the connection becomes
+ encrypted.
+
+PH/06 Added the client_condition to authenticators so that some can be skipped
+ by clients under certain conditions.
+
Exim version 4.67
-----------------
diff --git a/doc/doc-txt/NewStuff b/doc/doc-txt/NewStuff
index a63027364..7e0c472ec 100644
--- a/doc/doc-txt/NewStuff
+++ b/doc/doc-txt/NewStuff
@@ -1,4 +1,4 @@
-$Cambridge: exim/doc/doc-txt/NewStuff,v 1.148 2007/06/14 14:18:19 ph10 Exp $
+$Cambridge: exim/doc/doc-txt/NewStuff,v 1.149 2007/06/18 13:57:49 ph10 Exp $
New Features in Exim
--------------------
@@ -31,6 +31,18 @@ Version 4.68
If this condition succeeds, the value in $dnslist_matched might be
192.168.6.7 (for example).
+ 3. Authenticators now have a client_condition option. When Exim is running as
+ a client, it skips an authenticator whose client_condition expansion yields
+ "0", "no", or "false". This can be used, for example, to skip plain text
+ authenticators when the connection is not encrypted by a setting such as:
+
+ client_condition = ${if !eq{$tls_cipher}{}}
+
+ Note that the 4.67 documentation states that $tls_cipher contains the
+ cipher used for incoming messages. In fact, during SMTP delivery, it
+ contains the cipher used for the delivery. The same is true for
+ $tls_peerdn.
+
Version 4.67
------------
diff --git a/src/src/globals.c b/src/src/globals.c
index 7b14f7b93..7d34c6699 100644
--- a/src/src/globals.c
+++ b/src/src/globals.c
@@ -1,4 +1,4 @@
-/* $Cambridge: exim/src/src/globals.c,v 1.73 2007/06/14 14:18:19 ph10 Exp $ */
+/* $Cambridge: exim/src/src/globals.c,v 1.74 2007/06/18 13:57:50 ph10 Exp $ */
/*************************************************
* Exim - an Internet mail transport agent *
@@ -32,6 +32,8 @@ static void dummy(int x) { dummy(x-1); }
data blocks and hence have the opt_public flag set. */
optionlist optionlist_auths[] = {
+ { "client_condition", opt_stringptr | opt_public,
+ (void *)(offsetof(auth_instance, client_condition)) },
{ "driver", opt_stringptr | opt_public,
(void *)(offsetof(auth_instance, driver_name)) },
{ "public_name", opt_stringptr | opt_public,
@@ -327,6 +329,7 @@ auth_instance auth_defaults = {
NULL, /* private options block pointer */
NULL, /* driver_name */
NULL, /* advertise_condition */
+ NULL, /* client_condition */
NULL, /* public_name */
NULL, /* set_id */
NULL, /* server_mail_auth_condition */
diff --git a/src/src/structs.h b/src/src/structs.h
index 71d9d3a68..cc0e521b7 100644
--- a/src/src/structs.h
+++ b/src/src/structs.h
@@ -1,4 +1,4 @@
-/* $Cambridge: exim/src/src/structs.h,v 1.15 2007/01/08 10:50:18 ph10 Exp $ */
+/* $Cambridge: exim/src/src/structs.h,v 1.16 2007/06/18 13:57:50 ph10 Exp $ */
/*************************************************
* Exim - an Internet mail transport agent *
@@ -362,6 +362,7 @@ typedef struct auth_instance {
void *options_block; /* Pointer to private options */
uschar *driver_name; /* Must be first */
uschar *advertise_condition; /* Are we going to advertise this?*/
+ uschar *client_condition; /* Should the client try this? */
uschar *public_name; /* Advertised name */
uschar *set_id; /* String to set as authenticated id */
uschar *mail_auth_condition; /* Condition for AUTH on MAIL command */
diff --git a/src/src/transports/smtp.c b/src/src/transports/smtp.c
index 2fce7bab2..537f32aa5 100644
--- a/src/src/transports/smtp.c
+++ b/src/src/transports/smtp.c
@@ -1,4 +1,4 @@
-/* $Cambridge: exim/src/src/transports/smtp.c,v 1.36 2007/02/08 15:16:19 ph10 Exp $ */
+/* $Cambridge: exim/src/src/transports/smtp.c,v 1.37 2007/06/18 13:57:50 ph10 Exp $ */
/*************************************************
* Exim - an Internet mail transport agent *
@@ -789,7 +789,8 @@ return yield;
/* If continue_hostname is not null, we get here only when continuing to
deliver down an existing channel. The channel was passed as the standard
-input.
+input. TLS is never active on a passed channel; the previous process always
+closes it down before passing the connection on.
Otherwise, we have to make a connection to the remote host, and do the
initial protocol exchange.
@@ -886,6 +887,11 @@ outblock.ptr = outbuffer;
outblock.cmd_count = 0;
outblock.authenticating = FALSE;
+/* Reset the parameters of a TLS session. */
+
+tls_cipher = NULL;
+tls_peerdn = NULL;
+
/* If an authenticated_sender override has been specified for this transport
instance, expand it. If the expansion is forced to fail, and there was already
an authenticated_sender for this message, the original value will be used.
@@ -1233,14 +1239,25 @@ if (continue_hostname == NULL
DEBUG(D_transport) debug_printf("scanning authentication mechanisms\n");
/* Scan the configured authenticators looking for one which is configured
- for use as a client and whose name matches an authentication mechanism
- supported by the server. If one is found, attempt to authenticate by
- calling its client function. */
+ for use as a client, which is not suppressed by client_condition, and
+ whose name matches an authentication mechanism supported by the server.
+ If one is found, attempt to authenticate by calling its client function.
+ */
for (au = auths; !smtp_authenticated && au != NULL; au = au->next)
{
uschar *p = names;
- if (!au->client) continue;
+ if (!au->client ||
+ (au->client_condition != NULL &&
+ !expand_check_condition(au->client_condition, au->name,
+ US"client authenticator")))
+ {
+ DEBUG(D_transport) debug_printf("skipping %s authenticator: %s\n",
+ au->name,
+ (au->client)? "client_condition is false" :
+ "not configured as a client");
+ continue;
+ }
/* Loop to scan supported server mechanisms */
diff --git a/test/confs/3455 b/test/confs/3455
new file mode 100644
index 000000000..274de6316
--- /dev/null
+++ b/test/confs/3455
@@ -0,0 +1,74 @@
+# Exim test configuration 3455
+
+HOSTS_AVOID_TLS=
+
+exim_path = EXIM_PATH
+host_lookup_order = bydns
+primary_hostname = myhost.test.ex
+rfc1413_query_timeout = 0s
+spool_directory = DIR/spool
+log_file_path = DIR/spool/log/%slog
+gecos_pattern = ""
+gecos_name = CALLER_NAME
+
+# ----- Main settings -----
+
+acl_smtp_rcpt = accept
+
+domainlist local_domains = test.ex
+
+log_selector = +smtp_no_mail
+
+queue_only = true
+
+tls_advertise_hosts = *
+tls_certificate = DIR/aux-fixed/cert1
+tls_privatekey = DIR/aux-fixed/cert1
+
+
+# ----- Authenticators -----
+
+begin authenticators
+
+plain:
+ driver = plaintext
+ public_name = PLAIN
+ server_condition = "\
+ ${if and {{eq{$2}{userx}}{eq{$3}{secret1}}}{yes}{no}}"
+ server_set_id = $2
+ client_condition = ${if !eq {$tls_cipher}{}}
+ client_send = ^userx^secret1
+
+login:
+ driver = plaintext
+ public_name = LOGIN
+ server_prompts = User Name : Password
+ server_condition = "\
+ ${if and {{eq{$auth1}{usery}}{eq{$auth2}{secret2}}}{yes}{no}}"
+ server_set_id = $auth1
+ client_send = : usery : secret2
+
+
+# ----- Routers -----
+
+begin routers
+
+r1:
+ driver = accept
+ transport = t1
+
+
+# ----- Transports -----
+
+begin transports
+
+t1:
+ driver = smtp
+ hosts = 127.0.0.1
+ port = PORT_D
+ hosts_avoid_tls = HOSTS_AVOID_TLS
+ hosts_require_auth = *
+ allow_localhost
+
+
+# End
diff --git a/test/confs/3465 b/test/confs/3465
new file mode 100644
index 000000000..adadeb059
--- /dev/null
+++ b/test/confs/3465
@@ -0,0 +1,74 @@
+# Exim test configuration 3465
+
+HOSTS_AVOID_TLS=
+
+exim_path = EXIM_PATH
+host_lookup_order = bydns
+primary_hostname = myhost.test.ex
+rfc1413_query_timeout = 0s
+spool_directory = DIR/spool
+log_file_path = DIR/spool/log/%slog
+gecos_pattern = ""
+gecos_name = CALLER_NAME
+
+# ----- Main settings -----
+
+acl_smtp_rcpt = accept
+
+domainlist local_domains = test.ex
+
+log_selector = +smtp_no_mail
+
+queue_only = true
+
+tls_advertise_hosts = *
+tls_certificate = DIR/aux-fixed/cert1
+tls_privatekey = DIR/aux-fixed/cert1
+
+
+# ----- Authenticators -----
+
+begin authenticators
+
+plain:
+ driver = plaintext
+ public_name = PLAIN
+ server_condition = "\
+ ${if and {{eq{$2}{userx}}{eq{$3}{secret1}}}{yes}{no}}"
+ server_set_id = $2
+ client_condition = ${if !eq {$tls_cipher}{}}
+ client_send = ^userx^secret1
+
+login:
+ driver = plaintext
+ public_name = LOGIN
+ server_prompts = User Name : Password
+ server_condition = "\
+ ${if and {{eq{$auth1}{usery}}{eq{$auth2}{secret2}}}{yes}{no}}"
+ server_set_id = $auth1
+ client_send = : usery : secret2
+
+
+# ----- Routers -----
+
+begin routers
+
+r1:
+ driver = accept
+ transport = t1
+
+
+# ----- Transports -----
+
+begin transports
+
+t1:
+ driver = smtp
+ hosts = 127.0.0.1
+ port = PORT_D
+ hosts_avoid_tls = HOSTS_AVOID_TLS
+ hosts_require_auth = *
+ allow_localhost
+
+
+# End
diff --git a/test/log/3455 b/test/log/3455
new file mode 100644
index 000000000..7e5853647
--- /dev/null
+++ b/test/log/3455
@@ -0,0 +1,12 @@
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
+1999-03-02 09:44:33 Start queue run: pid=pppp -qf
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtpsa X=TLS-1.0:RSA_AES_256_CBC_SHA1:32 A=plain:userx S=sss id=E10HmaX-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmaX-0005vi-00 => userz@test.ex R=r1 T=t1 H=127.0.0.1 [127.0.0.1] X=TLS-1.0:RSA_AES_256_CBC_SHA1:32
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 End queue run: pid=pppp -qf
+1999-03-02 09:44:33 Start queue run: pid=pppp -qf
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtpa A=login:usery S=sss id=E10HmaX-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 => userz@test.ex R=r1 T=t1 H=127.0.0.1 [127.0.0.1]
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
+1999-03-02 09:44:33 End queue run: pid=pppp -qf
diff --git a/test/log/3465 b/test/log/3465
new file mode 100644
index 000000000..231636829
--- /dev/null
+++ b/test/log/3465
@@ -0,0 +1,12 @@
+1999-03-02 09:44:33 exim x.yz daemon started: pid=pppp, no queue runs, listening for SMTP on port 1225
+1999-03-02 09:44:33 10HmaX-0005vi-00 <= CALLER@myhost.test.ex U=CALLER P=local S=sss
+1999-03-02 09:44:33 Start queue run: pid=pppp -qf
+1999-03-02 09:44:33 10HmaY-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtpsa X=TLSv1:AES256-SHA:256 A=plain:userx S=sss id=E10HmaX-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmaX-0005vi-00 => userz@test.ex R=r1 T=t1 H=127.0.0.1 [127.0.0.1] X=TLSv1:AES256-SHA:256
+1999-03-02 09:44:33 10HmaX-0005vi-00 Completed
+1999-03-02 09:44:33 End queue run: pid=pppp -qf
+1999-03-02 09:44:33 Start queue run: pid=pppp -qf
+1999-03-02 09:44:33 10HmaZ-0005vi-00 <= CALLER@myhost.test.ex H=localhost (myhost.test.ex) [127.0.0.1] P=esmtpa A=login:usery S=sss id=E10HmaX-0005vi-00@myhost.test.ex
+1999-03-02 09:44:33 10HmaY-0005vi-00 => userz@test.ex R=r1 T=t1 H=127.0.0.1 [127.0.0.1]
+1999-03-02 09:44:33 10HmaY-0005vi-00 Completed
+1999-03-02 09:44:33 End queue run: pid=pppp -qf
diff --git a/test/scripts/3450-plaintext-GnuTLS/3455 b/test/scripts/3450-plaintext-GnuTLS/3455
new file mode 100644
index 000000000..52a93b50d
--- /dev/null
+++ b/test/scripts/3450-plaintext-GnuTLS/3455
@@ -0,0 +1,12 @@
+# TLS (client: test for encrypted before authenticating)
+exim -DSERVER=server -bd -oX PORT_D
+****
+exim userz@test.ex
+Message 1.
+****
+exim -qf
+****
+exim -qf -DHOSTS_AVOID_TLS=*
+****
+killdaemon
+no_msglog_check
diff --git a/test/scripts/3460-plaintext-OpenSSL/3465 b/test/scripts/3460-plaintext-OpenSSL/3465
new file mode 100644
index 000000000..52a93b50d
--- /dev/null
+++ b/test/scripts/3460-plaintext-OpenSSL/3465
@@ -0,0 +1,12 @@
+# TLS (client: test for encrypted before authenticating)
+exim -DSERVER=server -bd -oX PORT_D
+****
+exim userz@test.ex
+Message 1.
+****
+exim -qf
+****
+exim -qf -DHOSTS_AVOID_TLS=*
+****
+killdaemon
+no_msglog_check
diff --git a/test/stdout/2022 b/test/stdout/2022
index 4630f0897..b2f4a14f4 100644
--- a/test/stdout/2022
+++ b/test/stdout/2022
@@ -21,7 +21,7 @@ Succeeded in starting TLS
??? 214-
<<< 214-Commands supported:
??? 214
-<<< 214 AUTH STARTTLS HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP
+<<< 214 AUTH HELO EHLO MAIL RCPT DATA NOOP QUIT RSET HELP
>>> quit
??? 221
<<< 221 myhost.test.ex closing connection
diff --git a/test/stdout/3407 b/test/stdout/3407
index 274c68c1a..73fe5449e 100644
--- a/test/stdout/3407
+++ b/test/stdout/3407
@@ -1,5 +1,6 @@
a1 authenticator:
+client_condition =
driver = plaintext
public_name = PLAIN
server_advertise_condition =
@@ -12,6 +13,7 @@ client_send =
server_prompts =
a2 authenticator:
+client_condition =
driver = plaintext
public_name = PLAIN
server_advertise_condition =
@@ -24,6 +26,7 @@ client_send =
server_prompts =
a3 authenticator:
+client_condition =
driver = plaintext
public_name = LOGIN
server_advertise_condition =
@@ -36,6 +39,7 @@ client_send =
server_prompts =
a4 authenticator:
+client_condition =
driver = plaintext
public_name = LOGIN
server_advertise_condition =
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-24 17:59:55 +0000