Mercurial > hg > nginx

comparison src/mail/ngx_mail_pop3_module.c @ 9290:4538c1ffb0f8

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Mail: added support for XOAUTH2 and OAUTHBEARER authentication. This patch adds support for the OAUTHBEARER SASL mechanism as defined by RFC 7628, as well as pre-RFC XOAUTH2 SASL mechanism. For both mechanisms, the "Auth-User" header is set to the client identity obtained from the initial SASL response sent by the client, and the "Auth-Pass" header is set to the Bearer token itself. The auth server may return the "Auth-Error-SASL" header, which is passed to the client as an additional SASL challenge. It is expected to contain mechanism-specific error details, base64-encoded. After the client responds (with an empty SASL response for XAUTH2, or with "AQ==" dummy response for OAUTHBEARER), the error message from the "Auth-Status" header is sent. Based on a patch by Rob Mueller.
author Maxim Dounin <mdounin@mdounin.ru>
date Mon, 03 Jun 2024 18:03:11 +0300
parents dc955d274130
children
comparison
equal deleted inserted replaced
9289:20017bff0de8 9290:4538c1ffb0f8
28 static ngx_conf_bitmask_t ngx_mail_pop3_auth_methods[] = { 28 static ngx_conf_bitmask_t ngx_mail_pop3_auth_methods[] = {
29 { ngx_string("plain"), NGX_MAIL_AUTH_PLAIN_ENABLED }, 29 { ngx_string("plain"), NGX_MAIL_AUTH_PLAIN_ENABLED },
30 { ngx_string("apop"), NGX_MAIL_AUTH_APOP_ENABLED }, 30 { ngx_string("apop"), NGX_MAIL_AUTH_APOP_ENABLED },
31 { ngx_string("cram-md5"), NGX_MAIL_AUTH_CRAM_MD5_ENABLED }, 31 { ngx_string("cram-md5"), NGX_MAIL_AUTH_CRAM_MD5_ENABLED },
32 { ngx_string("external"), NGX_MAIL_AUTH_EXTERNAL_ENABLED }, 32 { ngx_string("external"), NGX_MAIL_AUTH_EXTERNAL_ENABLED },
33 { ngx_string("xoauth2"), NGX_MAIL_AUTH_XOAUTH2_ENABLED },
34 { ngx_string("oauthbearer"), NGX_MAIL_AUTH_OAUTHBEARER_ENABLED },
33 { ngx_null_string, 0 } 35 { ngx_null_string, 0 }
34 }; 36 };
35 37
36 38
37 static ngx_str_t ngx_mail_pop3_auth_methods_names[] = { 39 static ngx_str_t ngx_mail_pop3_auth_methods_names[] = {
38 ngx_string("PLAIN"), 40 ngx_string("PLAIN"),
39 ngx_string("LOGIN"), 41 ngx_string("LOGIN"),
40 ngx_null_string, /* APOP */ 42 ngx_null_string, /* APOP */
41 ngx_string("CRAM-MD5"), 43 ngx_string("CRAM-MD5"),
42 ngx_string("EXTERNAL"), 44 ngx_string("EXTERNAL"),
45 ngx_string("XOAUTH2"),
46 ngx_string("OAUTHBEARER"),
43 ngx_null_string /* NONE */ 47 ngx_null_string /* NONE */
44 }; 48 };
45 49
46 50
47 static ngx_mail_protocol_t ngx_mail_pop3_protocol = { 51 static ngx_mail_protocol_t ngx_mail_pop3_protocol = {
181 } 185 }
182 186
183 size += sizeof("SASL") - 1 + sizeof(CRLF) - 1; 187 size += sizeof("SASL") - 1 + sizeof(CRLF) - 1;
184 188
185 for (m = NGX_MAIL_AUTH_PLAIN_ENABLED, i = 0; 189 for (m = NGX_MAIL_AUTH_PLAIN_ENABLED, i = 0;
186 m <= NGX_MAIL_AUTH_EXTERNAL_ENABLED; 190 m < NGX_MAIL_AUTH_NONE_ENABLED;
187 m <<= 1, i++) 191 m <<= 1, i++)
188 { 192 {
189 if (ngx_mail_pop3_auth_methods_names[i].len == 0) { 193 if (ngx_mail_pop3_auth_methods_names[i].len == 0) {
190 continue; 194 continue;
191 } 195 }
212 } 216 }
213 217
214 p = ngx_cpymem(p, "SASL", sizeof("SASL") - 1); 218 p = ngx_cpymem(p, "SASL", sizeof("SASL") - 1);
215 219
216 for (m = NGX_MAIL_AUTH_PLAIN_ENABLED, i = 0; 220 for (m = NGX_MAIL_AUTH_PLAIN_ENABLED, i = 0;
217 m <= NGX_MAIL_AUTH_EXTERNAL_ENABLED; 221 m < NGX_MAIL_AUTH_NONE_ENABLED;
218 m <<= 1, i++) 222 m <<= 1, i++)
219 { 223 {
220 if (ngx_mail_pop3_auth_methods_names[i].len == 0) { 224 if (ngx_mail_pop3_auth_methods_names[i].len == 0) {
221 continue; 225 continue;
222 } 226 }
252 256
253 size = sizeof("+OK methods supported:" CRLF) - 1 257 size = sizeof("+OK methods supported:" CRLF) - 1
254 + sizeof("." CRLF) - 1; 258 + sizeof("." CRLF) - 1;
255 259
256 for (m = NGX_MAIL_AUTH_PLAIN_ENABLED, i = 0; 260 for (m = NGX_MAIL_AUTH_PLAIN_ENABLED, i = 0;
257 m <= NGX_MAIL_AUTH_EXTERNAL_ENABLED; 261 m < NGX_MAIL_AUTH_NONE_ENABLED;
258 m <<= 1, i++) 262 m <<= 1, i++)
259 { 263 {
260 if (ngx_mail_pop3_auth_methods_names[i].len == 0) { 264 if (ngx_mail_pop3_auth_methods_names[i].len == 0) {
261 continue; 265 continue;
262 } 266 }
277 281
278 p = ngx_cpymem(p, "+OK methods supported:" CRLF, 282 p = ngx_cpymem(p, "+OK methods supported:" CRLF,
279 sizeof("+OK methods supported:" CRLF) - 1); 283 sizeof("+OK methods supported:" CRLF) - 1);
280 284
281 for (m = NGX_MAIL_AUTH_PLAIN_ENABLED, i = 0; 285 for (m = NGX_MAIL_AUTH_PLAIN_ENABLED, i = 0;
282 m <= NGX_MAIL_AUTH_EXTERNAL_ENABLED; 286 m < NGX_MAIL_AUTH_NONE_ENABLED;
283 m <<= 1, i++) 287 m <<= 1, i++)
284 { 288 {
285 if (ngx_mail_pop3_auth_methods_names[i].len == 0) { 289 if (ngx_mail_pop3_auth_methods_names[i].len == 0) {
286 continue; 290 continue;
287 } 291 }