#include <h/mts.h>
#include <h/signals.h>
#include <h/utils.h>
+#include <h/oauth.h>
#ifdef CYRUS_SASL
#include <sasl/sasl.h>
#define SM_DOT 600 /* see above */
#define SM_QUIT 30
#define SM_CLOS 10
-#ifdef CYRUS_SASL
#define SM_AUTH 45
-#endif /* CYRUS_SASL */
static int sm_addrs = 0;
static int sm_alarmed = 0;
static FILE *sm_rfp = NULL;
static FILE *sm_wfp = NULL;
+static int next_line_encoded = 0;
+
#ifdef CYRUS_SASL
/*
* Some globals needed by SASL
* static prototypes
*/
static int smtp_init (char *, char *, char *, int, int, int, int, int,
- char *, char *, int);
+ char *, char *, const char *, int);
static int sendmail_init (char *, char *, int, int, int, int, int,
char *, char *);
static int sm_rerror (int);
static void alrmser (int);
static char *EHLOset (char *);
+static char *prepare_for_display (const char *, int *);
static int sm_fwrite(char *, int);
static int sm_fputs(char *);
static int sm_fputc(int);
static void sm_fflush(void);
static int sm_fgets(char *, int, FILE *);
+static int sm_auth_xoauth2(const char *, const char *, int);
#ifdef CYRUS_SASL
/*
int
sm_init (char *client, char *server, char *port, int watch, int verbose,
- int debug, int sasl, int saslssf, char *saslmech, char *user, int tls)
+ int debug, int sasl, int saslssf, char *saslmech, char *user,
+ const char *oauth_svc, int tls)
{
if (sm_mts == MTS_SMTP)
return smtp_init (client, server, port, watch, verbose,
- debug, sasl, saslssf, saslmech, user, tls);
+ debug, sasl, saslssf, saslmech, user,
+ oauth_svc, tls);
else
return sendmail_init (client, server, watch, verbose,
debug, sasl, saslssf, saslmech, user);
static int
smtp_init (char *client, char *server, char *port, int watch, int verbose,
int debug,
- int sasl, int saslssf, char *saslmech, char *user, int tls)
+ int sasl, int saslssf, char *saslmech, char *user,
+ const char *oauth_svc, int tls)
{
int result, sd1, sd2;
-#ifdef CYRUS_SASL
- char *server_mechs;
-#else /* CYRUS_SASL */
+#ifndef CYRUS_SASL
NMH_UNUSED (sasl);
NMH_UNUSED (saslssf);
NMH_UNUSED (saslmech);
*/
if (sasl) {
+ char *server_mechs;
if (! (server_mechs = EHLOset("AUTH"))) {
sm_end(NOTOK);
return sm_ierror("SMTP server does not support SASL");
saslmech, server_mechs);
}
- if (sm_auth_sasl(user, saslssf, saslmech ? saslmech : server_mechs,
+ /* Don't call sm_auth_sasl() for XAUTH2 with -sasl. Instead, call
+ sm_auth_xoauth2() below. */
+ if (oauth_svc == NULL &&
+ sm_auth_sasl(user, saslssf, saslmech ? saslmech : server_mechs,
server) != RP_OK) {
sm_end(NOTOK);
return NOTOK;
}
#endif /* CYRUS_SASL */
+ if (oauth_svc != NULL) {
+ char *server_mechs;
+ if ((server_mechs = EHLOset("AUTH")) == NULL
+ || stringdex("XOAUTH2", server_mechs) == -1) {
+ sm_end(NOTOK);
+ return sm_ierror("SMTP server does not support SASL XOAUTH2");
+ }
+ if (sm_auth_xoauth2(user, oauth_svc, debug) != RP_OK) {
+ sm_end(NOTOK);
+ return NOTOK;
+ }
+ }
+
send_options: ;
if (watch && EHLOset ("XVRB"))
smtalk (SM_HELO, "VERB on");
}
#endif /* CYRUS_SASL */
+/* https://developers.google.com/gmail/xoauth2_protocol */
+static int
+sm_auth_xoauth2(const char *user, const char *oauth_svc, int snoop)
+{
+ const char *xoauth_client_res;
+ int status;
+
+#ifdef OAUTH_SUPPORT
+ xoauth_client_res = mh_oauth_do_xoauth(user, oauth_svc,
+ snoop ? stderr : NULL);
+
+ if (xoauth_client_res == NULL) {
+ return sm_ierror("Internal error: mh_oauth_do_xoauth() returned NULL");
+ }
+#else
+ NMH_UNUSED(user);
+ NMH_UNUSED(snoop);
+ adios(NULL, "sendfrom built without OAUTH_SUPPORT, "
+ "so oauth_svc %s is not supported", oauth_svc);
+#endif /* OAUTH_SUPPORT */
+
+ status = smtalk(SM_AUTH, "AUTH XOAUTH2 %s", xoauth_client_res);
+ if (status == 235) {
+ /* It worked! */
+ return RP_OK;
+ }
+
+ /*
+ * Status is 334 and sm_reply.text contains base64-encoded JSON. As far as
+ * epg can tell, no matter the error, the JSON is always the same:
+ * {"status":"400","schemes":"Bearer","scope":"https://mail.google.com/"}
+ * I tried these errors:
+ * - garbage token
+ * - expired token
+ * - wrong scope
+ * - wrong username
+ */
+ /* Then we're supposed to send an empty response ("\r\n"). */
+ smtalk(SM_AUTH, "");
+ /*
+ * And now we always get this, again, no matter the error:
+ * 535-5.7.8 Username and Password not accepted. Learn more at
+ * 535 5.7.8 http://support.google.com/mail/bin/answer.py?answer=14257
+ */
+ return RP_BHST;
+}
+
static int
sm_ierror (char *fmt, ...)
{
}
if (sm_debug) {
+ char *decoded_buffer =
+ prepare_for_display (buffer, &next_line_encoded);
+
if (sasl_ssf)
printf("(sasl-encrypted) ");
if (tls_active)
printf("(tls-encrypted) ");
- printf ("=> %s\n", buffer);
+ printf ("=> %s\n", decoded_buffer);
+ free (decoded_buffer);
fflush (stdout);
}
for (more = FALSE; sm_rrecord ((char *) (bp = (unsigned char *) buffer),
&bc) != NOTOK ; ) {
if (sm_debug) {
+ char *decoded_buffer =
+ prepare_for_display (buffer, &next_line_encoded);
+
if (sasl_ssf > 0)
printf("(sasl-decrypted) ");
if (tls_active)
printf("(tls-decrypted) ");
- printf ("<= %s\n", buffer);
+ printf ("<= %s\n", decoded_buffer);
+ free (decoded_buffer);
fflush (stdout);
}
return 0;
}
+
+
+/*
+ * Detects, using heuristics, if an SMTP server or client response string
+ * contains a base64-encoded portion. If it does, decodes it and replaces
+ * any non-printable characters with a hex representation. Caller is
+ * responsible for free'ing return value. If the decode fails, a copy of
+ * the input string is returned.
+ */
+static
+char *
+prepare_for_display (const char *string, int *next_line_encoded) {
+ const char *start = NULL;
+ const char *decoded;
+ size_t decoded_len;
+ int prefix_len = -1;
+
+ if (strncmp (string, "AUTH ", 5) == 0) {
+ /* AUTH line: the mechanism isn't encoded. If there's an initial
+ response, it must be base64 encoded.. */
+ char *mechanism = strchr (string + 5, ' ');
+
+ if (mechanism != NULL) {
+ prefix_len = (int) (mechanism - string + 1);
+ } /* else no space following the mechanism, so no initial response */
+ *next_line_encoded = 0;
+ } else if (strncmp (string, "334 ", 4) == 0) {
+ /* 334 is the server's request for user or password. */
+ prefix_len = 4;
+ /* The next (client response) line must be base64 encoded. */
+ *next_line_encoded = 1;
+ } else if (*next_line_encoded) {
+ /* "next" line now refers to this line, which is a base64-encoded
+ client response. */
+ prefix_len = 0;
+ *next_line_encoded = 0;
+ } else {
+ *next_line_encoded = 0;
+ }
+
+ /* Don't attempt to decoded unencoded initial response ('=') or cancel
+ response ('*'). */
+ if (prefix_len > -1 &&
+ string[prefix_len] != '=' && string[prefix_len] != '*') {
+ start = string + prefix_len;
+ }
+
+ if (start && decodeBase64 (start, &decoded, &decoded_len, 1, NULL) == OK) {
+ char *hexified;
+ char *prefix = mh_xmalloc(prefix_len + 1);
+ char *display_string;
+
+ /* prefix is the beginning portion, which isn't base64 encoded. */
+ snprintf (prefix, prefix_len + 1, "%*s", prefix_len, string);
+ hexify ((const unsigned char *) decoded, decoded_len, &hexified);
+ /* Wrap the decoded portion in "b64<>". */
+ display_string = concat (prefix, "b64<", hexified, ">", NULL);
+ free (hexified);
+ free (prefix);
+ free ((char *) decoded);
+
+ return display_string;
+ } else {
+ return getcpy (string);
+ }
+}
projects / nmh / blobdiff