test-nocreate: Don't use run_test and run_prog together.

[nmh] / sbr / netsec.c

diff --git a/sbr/netsec.c b/sbr/netsec.c
index 599045223b300767ec1e4ec41a353f9ad40c66a3..43d636790a0f11ebbf0ad4a3f10fa44205725797 100644 (file)
--- a/sbr/netsec.c
+++ b/sbr/netsec.c
@@ -71,6 +71,8 @@ struct _netsec_context {
     unsigned int ns_outbuflen; /* Output buffer data length */
     unsigned int ns_outbufsize;        /* Output buffer size */
     char *sasl_mech;           /* User-requested mechanism */
     unsigned int ns_outbuflen; /* Output buffer data length */
     unsigned int ns_outbufsize;        /* Output buffer size */
     char *sasl_mech;           /* User-requested mechanism */

+    char *sasl_chosen_mech;    /* Mechanism chosen by SASL */
+    netsec_sasl_callback sasl_proto_cb; /* SASL callback we use */

 #ifdef OAUTH_SUPPORT
     char *oauth_service;       /* OAuth2 service name */
 #endif /* OAUTH_SUPPORT */
 #ifdef OAUTH_SUPPORT
     char *oauth_service;       /* OAuth2 service name */
 #endif /* OAUTH_SUPPORT */


@@ -78,11 +80,9 @@ struct _netsec_context {
     char *sasl_hostname;       /* Hostname we've connected to */
     sasl_conn_t *sasl_conn;    /* SASL connection context */
     sasl_ssf_t sasl_ssf;       /* SASL Security Strength Factor */
     char *sasl_hostname;       /* Hostname we've connected to */
     sasl_conn_t *sasl_conn;    /* SASL connection context */
     sasl_ssf_t sasl_ssf;       /* SASL Security Strength Factor */

-    netsec_sasl_callback sasl_proto_cb; /* SASL callback we use */

     sasl_callback_t *sasl_cbs; /* Callbacks used by SASL */
     nmh_creds_t sasl_creds;    /* Credentials (username/password) */
     sasl_secret_t *sasl_secret;        /* SASL password structure */
     sasl_callback_t *sasl_cbs; /* Callbacks used by SASL */
     nmh_creds_t sasl_creds;    /* Credentials (username/password) */
     sasl_secret_t *sasl_secret;        /* SASL password structure */

-    char *sasl_chosen_mech;    /* Mechanism chosen by SASL */

     int sasl_seclayer;         /* If true, SASL security layer is enabled */
     char *sasl_tmpbuf;         /* Temporary read buffer for decodes */
     size_t sasl_maxbufsize;    /* Maximum negotiated SASL buffer size */
     int sasl_seclayer;         /* If true, SASL security layer is enabled */
     char *sasl_tmpbuf;         /* Temporary read buffer for decodes */
     size_t sasl_maxbufsize;    /* Maximum negotiated SASL buffer size */


@@ -99,20 +99,35 @@ struct _netsec_context {
 
 static int netsec_fillread(netsec_context *ns_context, char **errstr);
 
 
 static int netsec_fillread(netsec_context *ns_context, char **errstr);
 

+/*
+ * Code to check the ASCII content of a byte array.
+ */
+
+static int checkascii(const unsigned char *byte, size_t len);
+

 /*
  * How this code works, in general.
  *
 /*
  * How this code works, in general.
  *

- * _If_ we are using no encryption or SASL encryption, then we buffer the
- * network data through ns_inbuffer and ns_outbuffer.  That should be
- * relatively self-explanatory.
+ * _If_ we are using no encryption then we buffer the network data
+ * through ns_inbuffer and ns_outbuffer.  That should be relatively
+ * self-explanatory.

  *
  *

- * If we are using SSL for encryption, then use a buffering BIO for output
- * (that just easier).  Still do buffering for reads; when we need more
- * data we call the BIO_read() function to fill our local buffer.
+ * If we use encryption, then ns_inbuffer and ns_outbuffer contain the
+ * cleartext data.  When it comes time to send the encrypted data on the
+ * (either from a flush or the buffer is full) we either use BIO_write()
+ * for TLS or sasl_encode() (followed by a write() for Cyrus-SASL.  For
+ * reads we either use BIO_read() (TLS) or do a network read into a
+ * temporary buffer and use sasl_decode() (Cyrus-SASL).  Note that if
+ * negotiate TLS then we disable SASL encryption.

  *
  *

- * For SASL, we make use of (for now) the Cyrus-SASL library.  For some
- * mechanisms, we implement those mechanisms directly since the Cyrus SASL
- * library doesn't support them (like OAuth).
+ * We used to use a buffering BIO for the reads/writes for TLS, but it
+ * ended up being complicated to special-case the buffering for everything
+ * except TLS, so the buffering is now unified, no matter which encryption
+ * method is being used (even none).
+ *
+ * For SASL authentication, we make use of (for now) the Cyrus-SASL
+ * library.  For some mechanisms, we implement those mechanisms directly
+ * since the Cyrus SASL library doesn't support them (like OAuth).

  */
 
 /*
  */
 
 /*


@@ -122,8 +137,9 @@ static int netsec_fillread(netsec_context *ns_context, char **errstr);
 netsec_context *
 netsec_init(void)
 {
 netsec_context *
 netsec_init(void)
 {

-    netsec_context *nsc = mh_xmalloc(sizeof(*nsc));
+    netsec_context *nsc;

 
 

+    NEW(nsc);

     nsc->ns_readfd = -1;
     nsc->ns_writefd = -1;
     nsc->ns_snoop = 0;
     nsc->ns_readfd = -1;
     nsc->ns_writefd = -1;
     nsc->ns_snoop = 0;


@@ -141,6 +157,8 @@ netsec_init(void)
     nsc->ns_outptr = nsc->ns_outbuffer;
     nsc->ns_outbuflen = 0;
     nsc->sasl_mech = NULL;
     nsc->ns_outptr = nsc->ns_outbuffer;
     nsc->ns_outbuflen = 0;
     nsc->sasl_mech = NULL;

+    nsc->sasl_chosen_mech = NULL;
+    nsc->sasl_proto_cb = NULL;

 #ifdef OAUTH_SUPPORT
     nsc->oauth_service = NULL;
 #endif /* OAUTH_SUPPORT */
 #ifdef OAUTH_SUPPORT
     nsc->oauth_service = NULL;
 #endif /* OAUTH_SUPPORT */


@@ -150,7 +168,6 @@ netsec_init(void)
     nsc->sasl_cbs = NULL;
     nsc->sasl_creds = NULL;
     nsc->sasl_secret = NULL;
     nsc->sasl_cbs = NULL;
     nsc->sasl_creds = NULL;
     nsc->sasl_secret = NULL;

-    nsc->sasl_chosen_mech = NULL;

     nsc->sasl_ssf = 0;
     nsc->sasl_seclayer = 0;
     nsc->sasl_tmpbuf = NULL;
     nsc->sasl_ssf = 0;
     nsc->sasl_seclayer = 0;
     nsc->sasl_tmpbuf = NULL;


@@ -171,41 +188,28 @@ netsec_init(void)
 void
 netsec_shutdown(netsec_context *nsc, int closeflag)
 {
 void
 netsec_shutdown(netsec_context *nsc, int closeflag)
 {

-    if (nsc->ns_userid)
-       free(nsc->ns_userid);
-    if (nsc->ns_inbuffer)
-       free(nsc->ns_inbuffer);
-    if (nsc->ns_outbuffer)
-       free(nsc->ns_outbuffer);
-    if (nsc->sasl_mech)
-       free(nsc->sasl_mech);
+    mh_xfree(nsc->ns_userid);
+    mh_xfree(nsc->ns_inbuffer);
+    mh_xfree(nsc->ns_outbuffer);
+    mh_xfree(nsc->sasl_mech);
+    mh_xfree(nsc->sasl_chosen_mech);

 #ifdef OAUTH_SERVICE
 #ifdef OAUTH_SERVICE

-    if (nsc->oauth_service)
-       free(nsc->oauth_service);
+    mh_xfree(nsc->oauth_service);

 #endif /* OAUTH_SERVICE */
 #ifdef CYRUS_SASL
     if (nsc->sasl_conn)
        sasl_dispose(&nsc->sasl_conn);
 #endif /* OAUTH_SERVICE */
 #ifdef CYRUS_SASL
     if (nsc->sasl_conn)
        sasl_dispose(&nsc->sasl_conn);

-    if (nsc->sasl_hostname)
-       free(nsc->sasl_hostname);
-    if (nsc->sasl_cbs)
-       free(nsc->sasl_cbs);
-    if (nsc->sasl_creds) {
-       if (nsc->sasl_creds->password)
-           memset(nsc->sasl_creds->password, 0,
-                  strlen(nsc->sasl_creds->password));
-       free(nsc->sasl_creds);
-    }
+    mh_xfree(nsc->sasl_hostname);
+    mh_xfree(nsc->sasl_cbs);
+    if (nsc->sasl_creds)
+       nmh_credentials_free(nsc->sasl_creds);

     if (nsc->sasl_secret) {
        if (nsc->sasl_secret->len > 0) {
            memset(nsc->sasl_secret->data, 0, nsc->sasl_secret->len);
        }
        free(nsc->sasl_secret);
     }
     if (nsc->sasl_secret) {
        if (nsc->sasl_secret->len > 0) {
            memset(nsc->sasl_secret->data, 0, nsc->sasl_secret->len);
        }
        free(nsc->sasl_secret);
     }

-    if (nsc->sasl_chosen_mech)
-       free(nsc->sasl_chosen_mech);
-    if (nsc->sasl_tmpbuf)
-       free(nsc->sasl_tmpbuf);
+    mh_xfree(nsc->sasl_tmpbuf);

 #endif /* CYRUS_SASL */
 #ifdef TLS_SUPPORT
     if (nsc->ssl_io)
 #endif /* CYRUS_SASL */
 #ifdef TLS_SUPPORT
     if (nsc->ssl_io)


@@ -286,11 +290,12 @@ void
 netsec_b64_snoop_decoder(netsec_context *nsc, const char *string, size_t len,
                         void *context)
 {
 netsec_b64_snoop_decoder(netsec_context *nsc, const char *string, size_t len,
                         void *context)
 {

-    const char *decoded;
+    unsigned char *decoded;

     size_t decodedlen;
     size_t decodedlen;

+    int offset;

     NMH_UNUSED(nsc);
 
     NMH_UNUSED(nsc);
 

-    int offset = context ? *((int *) context) : 0;
+    offset = context ? *((int *) context) : 0;

 
     if (offset > 0) {
        /*
 
     if (offset > 0) {
        /*


@@ -302,16 +307,48 @@ netsec_b64_snoop_decoder(netsec_context *nsc, const char *string, size_t len,
     }
 
     if (decodeBase64(string, &decoded, &decodedlen, 1, NULL) == OK) {
     }
 
     if (decodeBase64(string, &decoded, &decodedlen, 1, NULL) == OK) {

-       char *hexified;
-       hexify((const unsigned char *) decoded, decodedlen, &hexified);
-       fprintf(stderr, "b64<%s>\n", hexified);
-       free(hexified);
-       free((char *) decoded);
+       /*
+        * Some mechanisms produce large binary tokens, which aren't really
+        * readable.  So let's do a simple heuristic.  If the token is greater
+        * than 100 characters _and_ the first 100 bytes are more than 50%
+        * non-ASCII, then don't print the decoded buffer, just the
+        * base64 text.
+        */
+       if (decodedlen > 100 && !checkascii(decoded, 100)) {
+           fprintf(stderr, "%.*s\n", (int) len, string);
+       } else {
+           char *hexified;
+           hexify(decoded, decodedlen, &hexified);
+           fprintf(stderr, "b64<%s>\n", hexified);
+           free(hexified);
+       }
+       free(decoded);

     } else {
        fprintf(stderr, "%.*s\n", (int) len, string);
     }
 }
 
     } else {
        fprintf(stderr, "%.*s\n", (int) len, string);
     }
 }
 

+/*
+ * If the ASCII content is > 50%, return 1
+ */
+
+static int
+checkascii(const unsigned char *bytes, size_t len)
+{
+    size_t count = 0, half = len / 2;
+
+    while (len-- > 0) {
+       if (isascii(*bytes) && isprint(*bytes) && ++count > half)
+           return 1;
+       bytes++;
+       /* No chance by this point */
+       if (count + len < half)
+           return 0;
+    }
+
+    return 0;
+}
+

 /*
  * Set the read timeout for this connection
  */
 /*
  * Set the read timeout for this connection
  */


@@ -371,11 +408,12 @@ netsec_read(netsec_context *nsc, void *buffer, size_t size, char **errstr)
  *
  * - Unlike every other function, we return a pointer to the
  *   existing buffer.  This pointer is valid until you call another
  *
  * - Unlike every other function, we return a pointer to the
  *   existing buffer.  This pointer is valid until you call another

- *   read functiona again.
- * - We NUL-terminated the buffer right at the end, before the terminator.
+ *   read function again.
+ * - We NUL-terminate the buffer right at the end, before the CR-LF terminator.

  * - Technically we look for a LF; if we find a CR right before it, then
  *   we back up one.
  * - Technically we look for a LF; if we find a CR right before it, then
  *   we back up one.

- * - If your data may contain embedded NULs, this won't work.
+ * - If your data may contain embedded NULs, this won't work.  You should
+ *   be using netsec_read() in that case.

  */
 
 char *
  */
 
 char *


@@ -403,11 +441,11 @@ retry:
            if (nsc->ns_snoop) {
 #ifdef CYRUS_SASL
                if (nsc->sasl_seclayer)
            if (nsc->ns_snoop) {
 #ifdef CYRUS_SASL
                if (nsc->sasl_seclayer)

-                   fprintf(stderr, "(sasl-encrypted) ");
+                   fprintf(stderr, "(sasl-decrypted) ");

 #endif /* CYRUS_SASL */
 #ifdef TLS_SUPPORT
                if (nsc->tls_active)
 #endif /* CYRUS_SASL */
 #ifdef TLS_SUPPORT
                if (nsc->tls_active)

-                   fprintf(stderr, "(tls-encrypted) ");
+                   fprintf(stderr, "(tls-decrypted) ");

 #endif /* TLS_SUPPORT */
                fprintf(stderr, "<= ");
                if (nsc->ns_snoop_cb)
 #endif /* TLS_SUPPORT */
                fprintf(stderr, "<= ");
                if (nsc->ns_snoop_cb)


@@ -469,7 +507,9 @@ netsec_fillread(netsec_context *nsc, char **errstr)
        nsc->ns_inptr = nsc->ns_inbuffer;
     }
 
        nsc->ns_inptr = nsc->ns_inbuffer;
     }
 

+#if defined(CYRUS_SASL) || defined(TLS_SUPPORT)

 retry:
 retry:

+#endif /* CYRUS_SASL || TLS_SUPPORT */

     /*
      * If we are using TLS and there's anything pending, then skip the
      * select call
     /*
      * If we are using TLS and there's anything pending, then skip the
      * select call


@@ -507,10 +547,38 @@ retry:
         */
     }
 
         */
     }
 

+    /*
+     * Some explanation:
+     *
+     * startoffset is the offset from the beginning of the input
+     * buffer to data that is in our input buffer, but has not yet
+     * been consumed.  This can be non-zero if functions like
+     * netsec_readline() leave leftover data.
+     *
+     * remaining is the remaining amount of unconsumed data in the input
+     * buffer.
+     *
+     * end is a pointer to the end of the valid data + 1; it's where
+     * the next read should go.
+     */
+

     startoffset = nsc->ns_inptr - nsc->ns_inbuffer;
     remaining = nsc->ns_inbufsize - (startoffset + nsc->ns_inbuflen);
     end = nsc->ns_inptr + nsc->ns_inbuflen;
 
     startoffset = nsc->ns_inptr - nsc->ns_inbuffer;
     remaining = nsc->ns_inbufsize - (startoffset + nsc->ns_inbuflen);
     end = nsc->ns_inptr + nsc->ns_inbuflen;
 

+    /*
+     * If we're past the halfway point in our read buffers, shuffle everything
+     * back to the beginning.
+     */
+
+    if (startoffset > nsc->ns_inbufsize / 2) {
+       memmove(nsc->ns_inbuffer, nsc->ns_inptr, nsc->ns_inbuflen);
+       nsc->ns_inptr = nsc->ns_inbuffer;
+       startoffset = 0;
+       remaining = nsc->ns_inbufsize - nsc->ns_inbuflen;
+       end = nsc->ns_inptr + nsc->ns_inbuflen;
+    }
+

     /*
      * If we are using TLS, then just read via the BIO.  But we still
      * use our local buffer.
     /*
      * If we are using TLS, then just read via the BIO.  But we still
      * use our local buffer.


@@ -519,13 +587,39 @@ retry:
     if (nsc->tls_active) {
        rc = BIO_read(nsc->ssl_io, end, remaining);
        if (rc == 0) {
     if (nsc->tls_active) {
        rc = BIO_read(nsc->ssl_io, end, remaining);
        if (rc == 0) {

+           SSL *ssl;
+           int errcode;
+
+           /*
+            * Check to see if we're supposed to retry; if so,
+            * then go back and read again.
+            */
+
+           if (BIO_should_retry(nsc->ssl_io))
+               goto retry;
+

            /*
            /*

-            * Either EOF, or possibly an error.  Either way, it was probably
-            * unexpected, so treat as error.
+            * Okay, fine.  Get the real error out of the SSL context.

             */
             */

-           netsec_err(errstr, "TLS peer aborted connection");
+
+           if (BIO_get_ssl(nsc->ssl_io, &ssl) < 1) {
+               netsec_err(errstr, "SSL_read() returned 0, but cannot "
+                          "retrieve SSL context");
+               return NOTOK;
+           }
+
+           errcode = SSL_get_error(ssl, rc);
+           if (errcode == SSL_ERROR_ZERO_RETURN) {
+               netsec_err(errstr, "TLS peer closed remote connection");
+           } else {
+               netsec_err(errstr, "TLS network read failed: %s",
+                          ERR_error_string(ERR_peek_last_error(), NULL));
+           }
+           if (nsc->ns_snoop)
+               ERR_print_errors_fp(stderr);

            return NOTOK;
            return NOTOK;

-       } else if (rc < 0) {
+       }
+        if (rc < 0) {

            /* Definitely an error */
            netsec_err(errstr, "Read on TLS connection failed: %s",
                       ERR_error_string(ERR_get_error(), NULL));
            /* Definitely an error */
            netsec_err(errstr, "Read on TLS connection failed: %s",
                       ERR_error_string(ERR_get_error(), NULL));


@@ -611,16 +705,6 @@ retry:
 #endif /* CYRUS_SASL */
        nsc->ns_inbuflen += rc;
 
 #endif /* CYRUS_SASL */
        nsc->ns_inbuflen += rc;
 

-    /*
-     * If we're past the halfway point in our read buffers, shuffle everything
-     * back to the beginning.
-     */
-
-    if (startoffset > nsc->ns_inbufsize / 2) {
-       memmove(nsc->ns_inbuffer, nsc->ns_inptr, nsc->ns_inbuflen);
-       nsc->ns_inptr = nsc->ns_inbuffer;
-    }
-

     return OK;
 }
 
     return OK;
 }
 


@@ -734,19 +818,18 @@ retry:
                       "%d bytes, but our buffer size was only %d bytes",
                       rc, nsc->ns_outbufsize);
            return NOTOK;
                       "%d bytes, but our buffer size was only %d bytes",
                       rc, nsc->ns_outbufsize);
            return NOTOK;

-       } else {
-           /*
-            * Generate a flush (which may be inefficient, but hopefully
-            * it isn't) and then try again.
-            */
-           if (netsec_flush(nsc, errstr) != OK)
-               return NOTOK;
-           /*
-            * After this, outbuffer should == outptr, so we shouldn't
-            * hit this next time around.
-            */
-           goto retry;

        }
        }

+        /*
+         * Generate a flush (which may be inefficient, but hopefully
+         * it isn't) and then try again.
+         */
+        if (netsec_flush(nsc, errstr) != OK)
+            return NOTOK;
+        /*
+         * After this, outbuffer should == outptr, so we shouldn't
+         * hit this next time around.
+         */
+        goto retry;

     }
 
     if (nsc->ns_snoop) {
     }
 
     if (nsc->ns_snoop) {


@@ -796,24 +879,6 @@ netsec_flush(netsec_context *nsc, char **errstr)
     unsigned int netoutlen = nsc->ns_outbuflen;
     int rc;
 
     unsigned int netoutlen = nsc->ns_outbuflen;
     int rc;
 

-    /*
-     * For TLS connections, just call BIO_flush(); we'll let TLS handle
-     * all of our output buffering.
-     */
-#ifdef TLS_SUPPORT
-    if (nsc->tls_active) {
-       rc = BIO_flush(nsc->ssl_io);
-
-       if (rc <= 0) {
-           netsec_err(errstr, "Error flushing TLS connection: %s",
-                      ERR_error_string(ERR_get_error(), NULL));
-           return NOTOK;
-       }
-
-       return OK;
-    }
-#endif /* TLS_SUPPORT */
-

     /*
      * Small optimization
      */
     /*
      * Small optimization
      */


@@ -924,16 +989,38 @@ netsec_set_sasl_params(netsec_context *nsc, const char *hostname,
        return NOTOK;
     }
 
        return NOTOK;
     }
 

-    nsc->sasl_mech = mechanism ? getcpy(mechanism) : NULL;
-    nsc->sasl_proto_cb = callback;
-    nsc->sasl_hostname = getcpy(hostname);
+    nsc->sasl_hostname = mh_xstrdup(hostname);

 
 

-    return OK;
-#else /* CYRUS_SASL */
-    netsec_err(errstr, "SASL is not supported");
+    /*
+     * Set up our credentials
+     */

 
 

-    return NOTOK;
+    nsc->sasl_creds = nmh_get_credentials(nsc->sasl_hostname, nsc->ns_userid);
+
+#else /* CYRUS_SASL */
+    NMH_UNUSED(hostname);
+    NMH_UNUSED(service);
+    NMH_UNUSED(errstr);

 #endif /* CYRUS_SASL */
 #endif /* CYRUS_SASL */

+
+    /*
+     * According to the RFC, mechanisms can only be uppercase letter, numbers,
+     * and a hypen or underscore.  So make sure we uppercase any letters
+     * in case the user passed in lowercase.
+     */
+
+    if (mechanism) {
+       char *p;
+       nsc->sasl_mech = mh_xstrdup(mechanism);
+
+       for (p = nsc->sasl_mech; *p; p++)
+           if (isascii((unsigned char) *p)) /* Leave non-ASCII lower alone. */
+               *p = toupper((unsigned char) *p);
+    }
+
+    nsc->sasl_proto_cb = callback;
+
+    return OK;

 }
 
 #ifdef CYRUS_SASL
 }
 
 #ifdef CYRUS_SASL


@@ -950,35 +1037,10 @@ int netsec_get_user(void *context, int id, const char **result,
     if (! result || (id != SASL_CB_USER && id != SASL_CB_AUTHNAME))
        return SASL_BADPARAM;
 
     if (! result || (id != SASL_CB_USER && id != SASL_CB_AUTHNAME))
        return SASL_BADPARAM;
 

-    if (nsc->ns_userid == NULL) {
-       /*
-        * Pass the 1 third argument to nmh_get_credentials() so that
-        * a defauly user if the -user switch wasn't supplied, and so
-        * that a default password will be supplied.  That's used when
-        * those values really don't matter, and only with legacy/.netrc,
-        * i.e., with a credentials profile entry.
-        */
-
-       if (nsc->sasl_creds == NULL) {
-           nsc->sasl_creds = mh_xmalloc(sizeof(*nsc->sasl_creds));
-           nsc->sasl_creds->user = NULL;
-           nsc->sasl_creds->password = NULL;
-       }
-
-       if (nmh_get_credentials(nsc->sasl_hostname, nsc->ns_userid, 1,
-                               nsc->sasl_creds) != OK)
-           return SASL_BADPARAM;
+    *result = nmh_cred_get_user(nsc->sasl_creds);

 
 

-       if (nsc->ns_userid != nsc->sasl_creds->user) {
-           if (nsc->ns_userid)
-               free(nsc->ns_userid);
-           nsc->ns_userid = getcpy(nsc->sasl_creds->user);
-       }
-    }
-
-    *result = nsc->ns_userid;

     if (len)
     if (len)

-       *len = strlen(nsc->ns_userid);
+       *len = strlen(*result);

 
     return SASL_OK;
 }
 
     return SASL_OK;
 }


@@ -992,6 +1054,7 @@ netsec_get_password(sasl_conn_t *conn, void *context, int id,
                    sasl_secret_t **psecret)
 {
     netsec_context *nsc = (netsec_context *) context;
                    sasl_secret_t **psecret)
 {
     netsec_context *nsc = (netsec_context *) context;

+    const char *password;

     int len;
 
     NMH_UNUSED(conn);
     int len;
 
     NMH_UNUSED(conn);


@@ -999,27 +1062,9 @@ netsec_get_password(sasl_conn_t *conn, void *context, int id,
     if (! psecret || id != SASL_CB_PASS)
        return SASL_BADPARAM;
 
     if (! psecret || id != SASL_CB_PASS)
        return SASL_BADPARAM;
 

-    if (nsc->sasl_creds == NULL) {
-       nsc->sasl_creds = mh_xmalloc(sizeof(*nsc->sasl_creds));
-       nsc->sasl_creds->user = NULL;
-       nsc->sasl_creds->password = NULL;
-    }
-
-    if (nsc->sasl_creds->password == NULL) {
-       /*
-        * Pass the 0 third argument to nmh_get_credentials() so
-        * that the default password isn't used.  With legacy/.netrc
-        * credentials support, we'll only get here if the -user
-        * switch to send(1)/post(8) wasn't used.
-        */
-
-       if (nmh_get_credentials(nsc->sasl_hostname, nsc->ns_userid, 0,
-                               nsc->sasl_creds) != OK) {
-           return SASL_BADPARAM;
-       }
-    }
+    password = nmh_cred_get_password(nsc->sasl_creds);

 
 

-    len = strlen(nsc->sasl_creds->password);
+    len = strlen(password);

 
     /*
      * sasl_secret_t includes 1 bytes for "data" already, so that leaves
 
     /*
      * sasl_secret_t includes 1 bytes for "data" already, so that leaves


@@ -1032,7 +1077,7 @@ netsec_get_password(sasl_conn_t *conn, void *context, int id,
        return SASL_NOMEM;
 
     (*psecret)->len = len;
        return SASL_NOMEM;
 
     (*psecret)->len = len;

-    strcpy((char *) (*psecret)->data, nsc->sasl_creds->password);
+    strcpy((char *) (*psecret)->data, password);

 
     nsc->sasl_secret = *psecret;
 
 
     nsc->sasl_secret = *psecret;
 


@@ -1060,7 +1105,9 @@ netsec_negotiate_sasl(netsec_context *nsc, const char *mechlist, char **errstr)
     unsigned char *xoauth_client_res;
     size_t xoauth_client_res_len;
 #endif /* OAUTH_SUPPORT */
     unsigned char *xoauth_client_res;
     size_t xoauth_client_res_len;
 #endif /* OAUTH_SUPPORT */

+#if defined CYRUS_SASL || defined OAUTH_SUPPORT

     int rc;
     int rc;

+#endif /* CYRUS_SASL || OAUTH_SUPPORT */

 
     /*
      * If we've been passed a requested mechanism, check our mechanism
 
     /*
      * If we've been passed a requested mechanism, check our mechanism


@@ -1105,7 +1152,7 @@ netsec_negotiate_sasl(netsec_context *nsc, const char *mechlist, char **errstr)
            return NOTOK;
        }
 
            return NOTOK;
        }
 

-       nsc->sasl_chosen_mech = getcpy(nsc->sasl_mech);
+       nsc->sasl_chosen_mech = mh_xstrdup(nsc->sasl_mech);

 
        if (mh_oauth_do_xoauth(nsc->ns_userid, nsc->oauth_service,
                               &xoauth_client_res, &xoauth_client_res_len,
 
        if (mh_oauth_do_xoauth(nsc->ns_userid, nsc->oauth_service,
                               &xoauth_client_res, &xoauth_client_res_len,


@@ -1135,7 +1182,8 @@ netsec_negotiate_sasl(netsec_context *nsc, const char *mechlist, char **errstr)
            /*
             * We're going to assume the error here is a JSON response;
             * we ignore it and send a blank message in response.  We should
            /*
             * We're going to assume the error here is a JSON response;
             * we ignore it and send a blank message in response.  We should

-            * then get either an +OK or -ERR
+            * then get a failure messages with a useful error.  We should
+            * NOT get a success message at this point.

             */
            free(*errstr);
            nsc->sasl_proto_cb(NETSEC_SASL_WRITE, NULL, 0, NULL, 0, NULL);
             */
            free(*errstr);
            nsc->sasl_proto_cb(NETSEC_SASL_WRITE, NULL, 0, NULL, 0, NULL);


@@ -1220,8 +1268,7 @@ netsec_negotiate_sasl(netsec_context *nsc, const char *mechlist, char **errstr)
        rc = sasl_client_step(nsc->sasl_conn, (char *) outbuf, outbuflen, NULL,
                              (const char **) &saslbuf, &saslbuflen);
 
        rc = sasl_client_step(nsc->sasl_conn, (char *) outbuf, outbuflen, NULL,
                              (const char **) &saslbuf, &saslbuflen);
 

-       if (outbuf)
-           free(outbuf);
+        mh_xfree(outbuf);

 
        if (rc != SASL_OK && rc != SASL_CONTINUE) {
            netsec_err(errstr, "SASL client negotiation failed: %s",
 
        if (rc != SASL_OK && rc != SASL_CONTINUE) {
            netsec_err(errstr, "SASL client negotiation failed: %s",


@@ -1324,7 +1371,18 @@ netsec_negotiate_sasl(netsec_context *nsc, const char *mechlist, char **errstr)
 
     return OK;
 #else
 
     return OK;
 #else

-    netsec_err(errstr, "SASL not supported");
+    /*
+     * If we're at this point, then either we have NEITHER OAuth2 or
+     * Cyrus-SASL compiled in, or have OAuth2 but didn't give the XOAUTH2
+     * mechanism on the command line.
+     */
+
+    if (! nsc->sasl_mech)
+       netsec_err(errstr, "SASL library support not available; please "
+                  "specify a SASL mechanism to use");
+    else
+       netsec_err(errstr, "No support for the %s SASL mechanism",
+                  nsc->sasl_mech);

 
     return NOTOK;
 #endif /* CYRUS_SASL */
 
     return NOTOK;
 #endif /* CYRUS_SASL */


@@ -1337,11 +1395,7 @@ netsec_negotiate_sasl(netsec_context *nsc, const char *mechlist, char **errstr)
 char *
 netsec_get_sasl_mechanism(netsec_context *nsc)
 {
 char *
 netsec_get_sasl_mechanism(netsec_context *nsc)
 {

-#ifdef CYRUS_SASL

     return nsc->sasl_chosen_mech;
     return nsc->sasl_chosen_mech;

-#else /* CYRUS_SASL */
-    return NULL;
-#endif /* CYRUS_SASL */

 }
 
 /*
 }
 
 /*


@@ -1355,6 +1409,8 @@ netsec_set_oauth_service(netsec_context *nsc, const char *service)
     nsc->oauth_service = getcpy(service);
     return OK;
 #else /* OAUTH_SUPPORT */
     nsc->oauth_service = getcpy(service);
     return OK;
 #else /* OAUTH_SUPPORT */

+    NMH_UNUSED(nsc);
+    NMH_UNUSED(service);

     return NOTOK;
 #endif /* OAUTH_SUPPORT */
 }
     return NOTOK;
 #endif /* OAUTH_SUPPORT */
 }


@@ -1366,8 +1422,8 @@ netsec_set_oauth_service(netsec_context *nsc, const char *service)
 int
 netsec_set_tls(netsec_context *nsc, int tls, char **errstr)
 {
 int
 netsec_set_tls(netsec_context *nsc, int tls, char **errstr)
 {

-    if (tls) {

 #ifdef TLS_SUPPORT
 #ifdef TLS_SUPPORT

+    if (tls) {

        SSL *ssl;
        BIO *rbio, *wbio, *ssl_bio;;
 
        SSL *ssl;
        BIO *rbio, *wbio, *ssl_bio;;
 


@@ -1427,12 +1483,11 @@ netsec_set_tls(netsec_context *nsc, int tls, char **errstr)
         * supplied socket.
         *
         * Then we create an SSL BIO, and assign our current SSL connection
         * supplied socket.
         *
         * Then we create an SSL BIO, and assign our current SSL connection

-        * to it.  We then create a buffer BIO and push it in front of our
-        * SSL BIO.  So the chain looks like:
+        * to it.  This is done so our code stays simple if we want to use
+        * any buffering BIOs (right now we do our own buffering).
+        * So the chain looks like:

         *
         *

-        * buffer BIO -> SSL BIO -> socket BIO.
-        *
-        * So writes and reads are buffered (we mostly care about writes).
+        * SSL BIO -> socket BIO.

         */
 
        rbio = BIO_new_socket(nsc->ns_readfd, BIO_NOCLOSE);
         */
 
        rbio = BIO_new_socket(nsc->ns_readfd, BIO_NOCLOSE);


@@ -1457,17 +1512,6 @@ netsec_set_tls(netsec_context *nsc, int tls, char **errstr)
        SSL_set_bio(ssl, rbio, wbio);
        SSL_set_connect_state(ssl);
 
        SSL_set_bio(ssl, rbio, wbio);
        SSL_set_connect_state(ssl);
 

-#if 0
-       nsc->ssl_io = BIO_new(BIO_f_buffer());
-
-       if (! nsc->ssl_io) {
-           netsec_err(errstr, "Unable to create a buffer BIO: %s",
-                      ERR_error_string(ERR_get_error(), NULL));
-           SSL_free(ssl);
-           return NOTOK;
-       }
-#endif
-

        ssl_bio = BIO_new(BIO_f_ssl());
 
        if (! ssl_bio) {
        ssl_bio = BIO_new(BIO_f_ssl());
 
        if (! ssl_bio) {


@@ -1478,24 +1522,23 @@ netsec_set_tls(netsec_context *nsc, int tls, char **errstr)
        }
 
        BIO_set_ssl(ssl_bio, ssl, BIO_CLOSE);
        }
 
        BIO_set_ssl(ssl_bio, ssl, BIO_CLOSE);

-#if 0
-       BIO_push(nsc->ssl_io, ssl_bio);
-#endif

        nsc->ssl_io = ssl_bio;
 
        nsc->ssl_io = ssl_bio;
 

-       return OK;
-    } else {
-       BIO_free_all(nsc->ssl_io);
-       nsc->ssl_io = NULL;
-

        return OK;
     }
        return OK;
     }

+    BIO_free_all(nsc->ssl_io);
+    nsc->ssl_io = NULL;
+

 #else /* TLS_SUPPORT */
 #else /* TLS_SUPPORT */

-       netsec_err(errstr, "TLS is not supported");
+    NMH_UNUSED(nsc);

 
 

+    if (tls) {
+       netsec_err(errstr, "TLS is not supported");

        return NOTOK;
     }
 #endif /* TLS_SUPPORT */
        return NOTOK;
     }
 #endif /* TLS_SUPPORT */

+
+    return OK;

 }
 
 /*
 }
 
 /*


@@ -1524,7 +1567,7 @@ netsec_negotiate_tls(netsec_context *nsc, char **errstr)
            fprintf(stderr, "WARNING: cannot determine SSL ciphers\n");
        } else {
            const SSL_CIPHER *cipher = SSL_get_current_cipher(ssl);
            fprintf(stderr, "WARNING: cannot determine SSL ciphers\n");
        } else {
            const SSL_CIPHER *cipher = SSL_get_current_cipher(ssl);

-           fprintf(stderr, "TLS negotation successful: %s(%d) %s\n",
+           fprintf(stderr, "TLS negotiation successful: %s(%d) %s\n",

                    SSL_CIPHER_get_name(cipher),
                    SSL_CIPHER_get_bits(cipher, NULL),
                    SSL_CIPHER_get_version(cipher));
                    SSL_CIPHER_get_name(cipher),
                    SSL_CIPHER_get_bits(cipher, NULL),
                    SSL_CIPHER_get_version(cipher));


@@ -1533,18 +1576,9 @@ netsec_negotiate_tls(netsec_context *nsc, char **errstr)
 
     nsc->tls_active = 1;
 
 
     nsc->tls_active = 1;
 

-    /*
-     * At this point, TLS has been activated; we're not going to use
-     * the output buffer, so free it now to save a little bit of memory.
-     */
-
-    if (nsc->ns_outbuffer) {
-       free(nsc->ns_outbuffer);
-       nsc->ns_outbuffer = NULL;
-    }
-

     return OK;
 #else /* TLS_SUPPORT */
     return OK;
 #else /* TLS_SUPPORT */

+    NMH_UNUSED(nsc);

     netsec_err(errstr, "TLS not supported");
 
     return NOTOK;
     netsec_err(errstr, "TLS not supported");
 
     return NOTOK;