Add netsec_get_sasl_ssf().

Add the function netsec_get_sasl_ssf(), which retrieves the SSF
(strength security factor) negotiated as part of the SASL exchange.

diff --git a/h/netsec.h b/h/netsec.h
index b115ed7..3e7975b 100644 (file)
--- a/h/netsec.h
+++ b/h/netsec.h
@@ -285,10 +285,12 @@ enum sasl_message_type {
  *                       this point SASL exchange should have completed
  *                       and we should get a message back from the server
  *                       telling us whether or not authentication is
  *                       this point SASL exchange should have completed
  *                       and we should get a message back from the server
  *                       telling us whether or not authentication is

- *                       successful.  All buffer parameters are NULL.
+ *                       successful; the plugin should return OK/NOTOK
+ *                       to indicate whether or not the authentication
+ *                       was successful.  All buffer parameters are NULL.

  * NETSEC_SASL_CANCEL  - Generate a protocol message that cancels the
  * NETSEC_SASL_CANCEL  - Generate a protocol message that cancels the

- *                       SASL protocol exchange; outdata/outdatasize
- *                       should contain this message.
+ *                       SASL protocol exchange; the plugin should
+ *                       send this message.  All buffer parameters are NULL.

  *
  * The callback should return OK on success, NOTOK on failure.  Depending
  * at the point of the authentication exchange, the callback may be asked
  *
  * The callback should return OK on success, NOTOK on failure.  Depending
  * at the point of the authentication exchange, the callback may be asked


@@ -358,6 +360,24 @@ int netsec_negotiate_sasl(netsec_context *ns_context, const char *mechlist,
 
 char *netsec_get_sasl_mechanism(netsec_context *ns_context) PURE;
 
 
 char *netsec_get_sasl_mechanism(netsec_context *ns_context) PURE;
 

+/*
+ * Returns the SASL strength security factor (SSF) for the negotiated
+ * authentication mechanism.
+ *
+ * The exact meaning of the SSF depends on the mechanism chosen, but in
+ * general:
+ *
+ * 0   - No encryption or integrity protection via SASL.
+ * 1   - Integrity protection only.
+ * >1  - Encryption
+ *
+ * The SSF is distinct from any encryption that is negotiated by TLS;
+ * if TLS is negotiated then the netsec SASL code will automatically disable
+ * any attempt to negotiate a security layer and thus the SSF will be 0.
+ */
+
+int netsec_get_sasl_ssf(netsec_context *ns_context) PURE;
+

 /*
  * Set the OAuth service name used to retrieve the OAuth parameters from
  * user's profile.  Just calling this function is not enough to guarantee
 /*
  * Set the OAuth service name used to retrieve the OAuth parameters from
  * user's profile.  Just calling this function is not enough to guarantee

diff --git a/sbr/netsec.c b/sbr/netsec.c
index 3b546a3..ab49046 100644 (file)
--- a/sbr/netsec.c
+++ b/sbr/netsec.c
@@ -1479,6 +1479,20 @@ netsec_get_sasl_mechanism(netsec_context *nsc)
     return nsc->sasl_chosen_mech;
 }
 
     return nsc->sasl_chosen_mech;
 }
 

+/*
+ * Return the negotiated SASL strength security factor (SSF)
+ */
+
+int
+netsec_get_sasl_ssf(netsec_context *nsc)
+{
+#ifdef CYRUS_SASL
+    return nsc->sasl_ssf;
+#else /* CYRUS_SASL */
+    return 0;
+#endif /* CYRUS_SASL */
+}
+

 /*
  * Set an OAuth2 service name, if we support it.
  */
 /*
  * Set an OAuth2 service name, if we support it.
  */