|
 |
b9abc1 |
commit 26dcfb2d7176b78e70757aa5d01951a28ca217c7
|
|
|
b9abc1 |
Author: Alexey Melnikov <alexey.melnikov@isode.com>
|
|
|
b9abc1 |
Date: Fri Jul 5 16:37:59 2013 +0100
|
|
|
b9abc1 |
|
|
|
b9abc1 |
Treat SCRAM-SHA-1/DIGEST-MD5 as more secure than PLAIN when selecting the best client side SASL mechanism
|
|
|
b9abc1 |
|
|
|
b9abc1 |
Both SCRAM-SHA-1 & DIGEST-MD5 are lacking SASL_SEC_PASS_CREDENTIALS security
|
|
|
b9abc1 |
flag, which prevented them from being chosen over PLAIN when PLAIN is selected
|
|
|
b9abc1 |
as the best mechanism first. For example the problem can be observed when
|
|
|
b9abc1 |
the server advertises "PLAIN DIGEST-MD5 SCRAM-SHA-1" (PLAIN just has to be
|
|
|
b9abc1 |
returned before SCRAM/DIGEST.)
|
|
|
b9abc1 |
|
|
|
b9abc1 |
Cyrus SASL bug # 3793
|
|
|
b9abc1 |
|
|
|
b9abc1 |
diff --git a/lib/client.c b/lib/client.c
|
|
|
b9abc1 |
index 62dfb0b..31fe346 100644
|
|
|
b9abc1 |
--- a/lib/client.c
|
|
|
b9abc1 |
+++ b/lib/client.c
|
|
|
b9abc1 |
@@ -658,6 +658,20 @@ _sasl_cbinding_disp(sasl_client_params_t *cparams,
|
|
|
b9abc1 |
return SASL_OK;
|
|
|
b9abc1 |
}
|
|
|
b9abc1 |
|
|
|
b9abc1 |
+static int
|
|
|
b9abc1 |
+_sasl_are_current_security_flags_worse_then_best(unsigned best_security_flags,
|
|
|
b9abc1 |
+ unsigned current_security_flags)
|
|
|
b9abc1 |
+{
|
|
|
b9abc1 |
+ /* We don't qualify SASL_SEC_PASS_CREDENTIALS as "secure" flag */
|
|
|
b9abc1 |
+ best_security_flags &= ~SASL_SEC_PASS_CREDENTIALS;
|
|
|
b9abc1 |
+
|
|
|
b9abc1 |
+ if ((current_security_flags ^ best_security_flags) & best_security_flags) {
|
|
|
b9abc1 |
+ return 1;
|
|
|
b9abc1 |
+ } else {
|
|
|
b9abc1 |
+ return 0;
|
|
|
b9abc1 |
+ }
|
|
|
b9abc1 |
+}
|
|
|
b9abc1 |
+
|
|
|
b9abc1 |
/* select a mechanism for a connection
|
|
|
b9abc1 |
* mechlist -- mechanisms server has available (punctuation ignored)
|
|
|
b9abc1 |
* secret -- optional secret from previous session
|
|
|
b9abc1 |
@@ -823,8 +837,9 @@ int sasl_client_start(sasl_conn_t *conn,
|
|
|
b9abc1 |
*/
|
|
|
b9abc1 |
|
|
|
b9abc1 |
if (bestm &&
|
|
|
b9abc1 |
- ((m->m.plug->security_flags ^ bestm->m.plug->security_flags) &
|
|
|
b9abc1 |
- bestm->m.plug->security_flags)) {
|
|
|
b9abc1 |
+ _sasl_are_current_security_flags_worse_then_best(
|
|
|
b9abc1 |
+ bestm->m.plug->security_flags,
|
|
|
b9abc1 |
+ m->m.plug->security_flags)) {
|
|
|
b9abc1 |
break;
|
|
|
b9abc1 |
}
|
|
|
b9abc1 |
|