external/ibm-public/postfix/dist/src/xsasl/xsasl_cyrus_server.c

   1 /*      $NetBSD$        */
   2
   3 /*++
   4 /* NAME
   5 /*      xsasl_cyrus_server 3
   6 /* SUMMARY
   7 /*      Cyrus SASL server-side plug-in
   8 /* SYNOPSIS
   9 /*      #include <xsasl_cyrus_server.h>
  10 /*
  11 /*      XSASL_SERVER_IMPL *xsasl_cyrus_server_init(server_type, path_info)
  12 /*      const char *server_type;
  13 /*      const char *path_info;
  14 /* DESCRIPTION
  15 /*      This module implements the Cyrus SASL server-side authentication
  16 /*      plug-in.
  17 /*
  18 /*      xsasl_cyrus_server_init() initializes the Cyrus SASL library and
  19 /*      returns an implementation handle that can be used to generate
  20 /*      SASL server instances.
  21 /*
  22 /*      Arguments:
  23 /* .IP server_type
  24 /*      The server type (cyrus). This argument is ignored, but it
  25 /*      could be used when one implementation provides multiple
  26 /*      variants.
  27 /* .IP path_info
  28 /*      The base name of the SASL server configuration file (example:
  29 /*      smtpd becomes /usr/lib/sasl2/smtpd.conf).
  30 /* DIAGNOSTICS
  31 /*      Fatal: out of memory.
  32 /*
  33 /*      Panic: interface violation.
  34 /*
  35 /*      Other: the routines log a warning and return an error result
  36 /*      as specified in xsasl_server(3).
  37 /* LICENSE
  38 /* .ad
  39 /* .fi
  40 /*      The Secure Mailer license must be distributed with this software.
  41 /* AUTHOR(S)
  42 /*      Initial implementation by:
  43 /*      Till Franke
  44 /*      SuSE Rhein/Main AG
  45 /*      65760 Eschborn, Germany
  46 /*
  47 /*      Adopted by:
  48 /*      Wietse Venema
  49 /*      IBM T.J. Watson Research
  50 /*      P.O. Box 704
  51 /*      Yorktown Heights, NY 10598, USA
  52 /*--*/
  53
  54 /* System library. */
  55
  56 #include <sys_defs.h>
  57 #include <stdlib.h>
  58 #include <string.h>
  59
  60 /* Utility library. */
  61
  62 #include <msg.h>
  63 #include <mymalloc.h>
  64 #include <name_mask.h>
  65 #include <stringops.h>
  66
  67 /* Global library. */
  68
  69 #include <mail_params.h>
  70
  71 /* Application-specific. */
  72
  73 #include <xsasl.h>
  74 #include <xsasl_cyrus.h>
  75 #include <xsasl_cyrus_common.h>
  76
  77 #if defined(USE_SASL_AUTH) && defined(USE_CYRUS_SASL)
  78
  79 #include <sasl.h>
  80 #include <saslutil.h>
  81
  82 /*
  83  * Silly little macros.
  84  */
  85 #define STR(s)  vstring_str(s)
  86
  87  /*
  88   * Macros to handle API differences between SASLv1 and SASLv2. Specifics:
  89   *
  90   * The SASL_LOG_* constants were renamed in SASLv2.
  91   *
  92   * SASLv2's sasl_server_new takes two new parameters to specify local and
  93   * remote IP addresses for auth mechs that use them.
  94   *
  95   * SASLv2's sasl_server_start and sasl_server_step no longer have the errstr
  96   * parameter.
  97   *
  98   * SASLv2's sasl_decode64 function takes an extra parameter for the length of
  99   * the output buffer.
 100   *
 101   * The other major change is that SASLv2 now takes more responsibility for
 102   * deallocating memory that it allocates internally.  Thus, some of the
 103   * function parameters are now 'const', to make sure we don't try to free
 104   * them too.  This is dealt with in the code later on.
 105   */
 106
 107 #if SASL_VERSION_MAJOR < 2
 108 /* SASL version 1.x */
 109 #define SASL_SERVER_NEW(srv, fqdn, rlm, lport, rport, cb, secflags, pconn) \
 110         sasl_server_new(srv, fqdn, rlm, cb, secflags, pconn)
 111 #define SASL_SERVER_START(conn, mech, clin, clinlen, srvout, srvoutlen, err) \
 112         sasl_server_start(conn, mech, clin, clinlen, srvout, srvoutlen, err)
 113 #define SASL_SERVER_STEP(conn, clin, clinlen, srvout, srvoutlen, err) \
 114         sasl_server_step(conn, clin, clinlen, srvout, srvoutlen, err)
 115 #define SASL_DECODE64(in, inlen, out, outmaxlen, outlen) \
 116         sasl_decode64(in, inlen, out, outlen)
 117 typedef char *MECHANISM_TYPE;
 118 typedef unsigned MECHANISM_COUNT_TYPE;
 119 typedef char *SERVEROUT_TYPE;
 120 typedef void *VOID_SERVEROUT_TYPE;
 121
 122 #endif
 123
 124 #if SASL_VERSION_MAJOR >= 2
 125 /* SASL version > 2.x */
 126 #define SASL_SERVER_NEW(srv, fqdn, rlm, lport, rport, cb, secflags, pconn) \
 127         sasl_server_new(srv, fqdn, rlm, lport, rport, cb, secflags, pconn)
 128 #define SASL_SERVER_START(conn, mech, clin, clinlen, srvout, srvoutlen, err) \
 129         sasl_server_start(conn, mech, clin, clinlen, srvout, srvoutlen)
 130 #define SASL_SERVER_STEP(conn, clin, clinlen, srvout, srvoutlen, err) \
 131         sasl_server_step(conn, clin, clinlen, srvout, srvoutlen)
 132 #define SASL_DECODE64(in, inlen, out, outmaxlen, outlen) \
 133         sasl_decode64(in, inlen, out, outmaxlen, outlen)
 134 typedef const char *MECHANISM_TYPE;
 135 typedef int MECHANISM_COUNT_TYPE;
 136 typedef const char *SERVEROUT_TYPE;
 137 typedef const void *VOID_SERVEROUT_TYPE;
 138
 139 #endif
 140
 141  /*
 142   * The XSASL_CYRUS_SERVER object is derived from the generic XSASL_SERVER
 143   * object.
 144   */
 145 typedef struct {
 146     XSASL_SERVER xsasl;                 /* generic members, must be first */
 147     VSTREAM *stream;                    /* client-server connection */
 148     sasl_conn_t *sasl_conn;             /* SASL context */
 149     VSTRING *decoded;                   /* decoded challenge or response */
 150     char   *username;                   /* authenticated user */
 151     char   *mechanism_list;             /* applicable mechanisms */
 152 } XSASL_CYRUS_SERVER;
 153
 154  /*
 155   * Forward declarations.
 156   */
 157 static void xsasl_cyrus_server_done(XSASL_SERVER_IMPL *);
 158 static XSASL_SERVER *xsasl_cyrus_server_create(XSASL_SERVER_IMPL *,
 159                                                 XSASL_SERVER_CREATE_ARGS *);
 160 static void xsasl_cyrus_server_free(XSASL_SERVER *);
 161 static int xsasl_cyrus_server_first(XSASL_SERVER *, const char *,
 162                                             const char *, VSTRING *);
 163 static int xsasl_cyrus_server_next(XSASL_SERVER *, const char *, VSTRING *);
 164 static int xsasl_cyrus_server_set_security(XSASL_SERVER *, const char *);
 165 static const char *xsasl_cyrus_server_get_mechanism_list(XSASL_SERVER *);
 166 static const char *xsasl_cyrus_server_get_username(XSASL_SERVER *);
 167
 168  /*
 169   * SASL callback interface structure. These call-backs have no per-session
 170   * context.
 171   */
 172 #define NO_CALLBACK_CONTEXT     0
 173
 174 static sasl_callback_t callbacks[] = {
 175     {SASL_CB_LOG, &xsasl_cyrus_log, NO_CALLBACK_CONTEXT},
 176     {SASL_CB_LIST_END, 0, 0}
 177 };
 178
 179 /* xsasl_cyrus_server_init - create implementation handle */
 180
 181 XSASL_SERVER_IMPL *xsasl_cyrus_server_init(const char *unused_server_type,
 182                                                    const char *path_info)
 183 {
 184     const char *myname = "xsasl_cyrus_server_init";
 185     XSASL_SERVER_IMPL *xp;
 186     int     sasl_status;
 187
 188 #if SASL_VERSION_MAJOR >= 2 && (SASL_VERSION_MINOR >= 2 \
 189     || (SASL_VERSION_MINOR == 1 && SASL_VERSION_STEP >= 19))
 190     int     sasl_major;
 191     int     sasl_minor;
 192     int     sasl_step;
 193
 194     /*
 195      * DLL hell guard.
 196      */
 197     sasl_version_info((const char **) 0, (const char **) 0,
 198                       &sasl_major, &sasl_minor,
 199                       &sasl_step, (int *) 0);
 200     if (sasl_major != SASL_VERSION_MAJOR
 201 #if 0
 202         || sasl_minor != SASL_VERSION_MINOR
 203         || sasl_step != SASL_VERSION_STEP
 204 #endif
 205         ) {
 206         msg_warn("incorrect SASL library version. "
 207               "Postfix was built with include files from version %d.%d.%d, "
 208                  "but the run-time library version is %d.%d.%d",
 209                  SASL_VERSION_MAJOR, SASL_VERSION_MINOR, SASL_VERSION_STEP,
 210                  sasl_major, sasl_minor, sasl_step);
 211         return (0);
 212     }
 213 #endif
 214
 215     if (*var_cyrus_conf_path) {
 216 #ifdef SASL_PATH_TYPE_CONFIG                    /* Cyrus SASL 2.1.22 */
 217         if (sasl_set_path(SASL_PATH_TYPE_CONFIG,
 218                           var_cyrus_conf_path) != SASL_OK)
 219             msg_warn("failed to set Cyrus SASL configuration path: \"%s\"",
 220                      var_cyrus_conf_path);
 221 #else
 222         msg_warn("%s is not empty, but setting the Cyrus SASL configuration "
 223                  "path is not supported with SASL library version %d.%d.%d",
 224                  VAR_CYRUS_CONF_PATH, SASL_VERSION_MAJOR,
 225                  SASL_VERSION_MINOR, SASL_VERSION_STEP);
 226 #endif
 227     }
 228
 229     /*
 230      * Initialize the library: load SASL plug-in routines, etc.
 231      */
 232     if (msg_verbose)
 233         msg_info("%s: SASL config file is %s.conf", myname, path_info);
 234     if ((sasl_status = sasl_server_init(callbacks, path_info)) != SASL_OK) {
 235         msg_warn("SASL per-process initialization failed: %s",
 236                  xsasl_cyrus_strerror(sasl_status));
 237         return (0);
 238     }
 239
 240     /*
 241      * Return a generic XSASL_SERVER_IMPL object. We don't need to extend it
 242      * with our own methods or data.
 243      */
 244     xp = (XSASL_SERVER_IMPL *) mymalloc(sizeof(*xp));
 245     xp->create = xsasl_cyrus_server_create;
 246     xp->done = xsasl_cyrus_server_done;
 247     return (xp);
 248 }
 249
 250 /* xsasl_cyrus_server_done - dispose of implementation */
 251
 252 static void xsasl_cyrus_server_done(XSASL_SERVER_IMPL *impl)
 253 {
 254     myfree((char *) impl);
 255     sasl_done();
 256 }
 257
 258 /* xsasl_cyrus_server_create - create server instance */
 259
 260 static XSASL_SERVER *xsasl_cyrus_server_create(XSASL_SERVER_IMPL *unused_impl,
 261                                              XSASL_SERVER_CREATE_ARGS *args)
 262 {
 263     const char *myname = "xsasl_cyrus_server_create";
 264     char   *server_address;
 265     char   *client_address;
 266     sasl_conn_t *sasl_conn = 0;
 267     XSASL_CYRUS_SERVER *server = 0;
 268     int     sasl_status;
 269
 270     if (msg_verbose)
 271         msg_info("%s: SASL service=%s, realm=%s",
 272                  myname, args->service, args->user_realm ?
 273                  args->user_realm : "(null)");
 274
 275     /*
 276      * The optimizer will eliminate code duplication and/or dead code.
 277      */
 278 #define XSASL_CYRUS_SERVER_CREATE_ERROR_RETURN(x) \
 279     do { \
 280         if (server) { \
 281             xsasl_cyrus_server_free(&server->xsasl); \
 282         } else { \
 283             if (sasl_conn) \
 284                 sasl_dispose(&sasl_conn); \
 285         } \
 286         return (x); \
 287     } while (0)
 288
 289     /*
 290      * Set up a new server context.
 291      */
 292 #define NO_SECURITY_LAYERS      (0)
 293 #define NO_SESSION_CALLBACKS    ((sasl_callback_t *) 0)
 294 #define NO_AUTH_REALM           ((char *) 0)
 295
 296 #if SASL_VERSION_MAJOR >= 2 && defined(USE_SASL_IP_AUTH)
 297
 298     /*
 299      * Get IP addresses of local and remote endpoints for SASL.
 300      */
 301 #error "USE_SASL_IP_AUTH is not implemented"
 302
 303 #else
 304
 305     /*
 306      * Don't give any IP address information to SASL.  SASLv1 doesn't use it,
 307      * and in SASLv2 this will disable any mechanisms that do.
 308      */
 309     server_address = 0;
 310     client_address = 0;
 311 #endif
 312
 313     if ((sasl_status =
 314          SASL_SERVER_NEW(args->service, var_myhostname,
 315                          args->user_realm ? args->user_realm : NO_AUTH_REALM,
 316                          server_address, client_address,
 317                          NO_SESSION_CALLBACKS, NO_SECURITY_LAYERS,
 318                          &sasl_conn)) != SASL_OK) {
 319         msg_warn("SASL per-connection server initialization: %s",
 320                  xsasl_cyrus_strerror(sasl_status));
 321         XSASL_CYRUS_SERVER_CREATE_ERROR_RETURN(0);
 322     }
 323
 324     /*
 325      * Extend the XSASL_SERVER object with our own data. We use long-lived
 326      * conversion buffers rather than local variables to avoid memory leaks
 327      * in case of read/write timeout or I/O error.
 328      */
 329     server = (XSASL_CYRUS_SERVER *) mymalloc(sizeof(*server));
 330     server->xsasl.free = xsasl_cyrus_server_free;
 331     server->xsasl.first = xsasl_cyrus_server_first;
 332     server->xsasl.next = xsasl_cyrus_server_next;
 333     server->xsasl.get_mechanism_list = xsasl_cyrus_server_get_mechanism_list;
 334     server->xsasl.get_username = xsasl_cyrus_server_get_username;
 335     server->stream = args->stream;
 336     server->sasl_conn = sasl_conn;
 337     server->decoded = vstring_alloc(20);
 338     server->username = 0;
 339     server->mechanism_list = 0;
 340
 341     if (xsasl_cyrus_server_set_security(&server->xsasl, args->security_options)
 342         != XSASL_AUTH_OK)
 343         XSASL_CYRUS_SERVER_CREATE_ERROR_RETURN(0);
 344
 345     return (&server->xsasl);
 346 }
 347
 348 /* xsasl_cyrus_server_set_security - set security properties */
 349
 350 static int xsasl_cyrus_server_set_security(XSASL_SERVER *xp,
 351                                                    const char *sasl_opts_val)
 352 {
 353     XSASL_CYRUS_SERVER *server = (XSASL_CYRUS_SERVER *) xp;
 354     sasl_security_properties_t sec_props;
 355     int     sasl_status;
 356
 357     /*
 358      * Security options. Some information can be found in the sasl.h include
 359      * file.
 360      */
 361     memset(&sec_props, 0, sizeof(sec_props));
 362     sec_props.min_ssf = 0;
 363     sec_props.max_ssf = 0;                      /* don't allow real SASL
 364                                                  * security layer */
 365     if (*sasl_opts_val == 0) {
 366         sec_props.security_flags = 0;
 367     } else {
 368         sec_props.security_flags =
 369             xsasl_cyrus_security_parse_opts(sasl_opts_val);
 370         if (sec_props.security_flags == 0) {
 371             msg_warn("bad per-session SASL security properties");
 372             return (XSASL_AUTH_FAIL);
 373         }
 374     }
 375     sec_props.maxbufsize = 0;
 376     sec_props.property_names = 0;
 377     sec_props.property_values = 0;
 378
 379     if ((sasl_status = sasl_setprop(server->sasl_conn, SASL_SEC_PROPS,
 380                                     &sec_props)) != SASL_OK) {
 381         msg_warn("SASL per-connection security setup; %s",
 382                  xsasl_cyrus_strerror(sasl_status));
 383         return (XSASL_AUTH_FAIL);
 384     }
 385     return (XSASL_AUTH_OK);
 386 }
 387
 388 /* xsasl_cyrus_server_get_mechanism_list - get available mechanisms */
 389
 390 static const char *xsasl_cyrus_server_get_mechanism_list(XSASL_SERVER *xp)
 391 {
 392     const char *myname = "xsasl_cyrus_server_get_mechanism_list";
 393     XSASL_CYRUS_SERVER *server = (XSASL_CYRUS_SERVER *) xp;
 394     MECHANISM_TYPE mechanism_list;
 395     MECHANISM_COUNT_TYPE mechanism_count;
 396     int     sasl_status;
 397
 398     /*
 399      * Get the list of authentication mechanisms.
 400      */
 401 #define UNSUPPORTED_USER        ((char *) 0)
 402 #define IGNORE_MECHANISM_LEN    ((unsigned *) 0)
 403
 404     if ((sasl_status = sasl_listmech(server->sasl_conn, UNSUPPORTED_USER,
 405                                      "", " ", "",
 406                                      &mechanism_list,
 407                                      IGNORE_MECHANISM_LEN,
 408                                      &mechanism_count)) != SASL_OK) {
 409         msg_warn("%s: %s", myname, xsasl_cyrus_strerror(sasl_status));
 410         return (0);
 411     }
 412     if (mechanism_count <= 0) {
 413         msg_warn("%s: no applicable SASL mechanisms", myname);
 414         return (0);
 415     }
 416     server->mechanism_list = mystrdup(mechanism_list);
 417 #if SASL_VERSION_MAJOR < 2
 418     /* SASL version 1 doesn't free memory that it allocates. */
 419     free(mechanism_list);
 420 #endif
 421     return (server->mechanism_list);
 422 }
 423
 424 /* xsasl_cyrus_server_free - destroy server instance */
 425
 426 static void xsasl_cyrus_server_free(XSASL_SERVER *xp)
 427 {
 428     XSASL_CYRUS_SERVER *server = (XSASL_CYRUS_SERVER *) xp;
 429
 430     sasl_dispose(&server->sasl_conn);
 431     vstring_free(server->decoded);
 432     if (server->username)
 433         myfree(server->username);
 434     if (server->mechanism_list)
 435         myfree(server->mechanism_list);
 436     myfree((char *) server);
 437 }
 438
 439 /* xsasl_cyrus_server_auth_response - encode server first/next response */
 440
 441 static int xsasl_cyrus_server_auth_response(int sasl_status,
 442                                                     SERVEROUT_TYPE serverout,
 443                                                     unsigned serveroutlen,
 444                                                     VSTRING *reply)
 445 {
 446     const char *myname = "xsasl_cyrus_server_auth_response";
 447     unsigned enc_length;
 448     unsigned enc_length_out;
 449
 450     /*
 451      * Encode the server first/next non-error response; otherwise return the
 452      * unencoded error text that corresponds to the SASL error status.
 453      *
 454      * Regarding the hairy expression below: output from sasl_encode64() comes
 455      * in multiples of four bytes for each triple of input bytes, plus four
 456      * bytes for any incomplete last triple, plus one byte for the null
 457      * terminator.
 458      */
 459     if (sasl_status == SASL_OK) {
 460         vstring_strcpy(reply, "");
 461         return (XSASL_AUTH_DONE);
 462     } else if (sasl_status == SASL_CONTINUE) {
 463         if (msg_verbose)
 464             msg_info("%s: uncoded server challenge: %.*s",
 465                      myname, (int) serveroutlen, serverout);
 466         enc_length = ((serveroutlen + 2) / 3) * 4 + 1;
 467         VSTRING_RESET(reply);                   /* Fix 200512 */
 468         VSTRING_SPACE(reply, enc_length);
 469         if ((sasl_status = sasl_encode64(serverout, serveroutlen,
 470                                          STR(reply), vstring_avail(reply),
 471                                          &enc_length_out)) != SASL_OK)
 472             msg_panic("%s: sasl_encode64 botch: %s",
 473                       myname, xsasl_cyrus_strerror(sasl_status));
 474         return (XSASL_AUTH_MORE);
 475     } else {
 476         if (sasl_status == SASL_NOUSER)         /* privacy */
 477             sasl_status = SASL_BADAUTH;
 478         vstring_strcpy(reply, xsasl_cyrus_strerror(sasl_status));
 479         return (XSASL_AUTH_FAIL);
 480     }
 481 }
 482
 483 /* xsasl_cyrus_server_first - per-session authentication */
 484
 485 int     xsasl_cyrus_server_first(XSASL_SERVER *xp, const char *sasl_method,
 486                                   const char *init_response, VSTRING *reply)
 487 {
 488     const char *myname = "xsasl_cyrus_server_first";
 489     XSASL_CYRUS_SERVER *server = (XSASL_CYRUS_SERVER *) xp;
 490     char   *dec_buffer;
 491     unsigned dec_length;
 492     unsigned reply_len;
 493     unsigned serveroutlen;
 494     int     sasl_status;
 495     SERVEROUT_TYPE serverout = 0;
 496     int     xsasl_status;
 497
 498 #if SASL_VERSION_MAJOR < 2
 499     const char *errstr = 0;
 500
 501 #endif
 502
 503 #define IFELSE(e1,e2,e3) ((e1) ? (e2) : (e3))
 504
 505     if (msg_verbose)
 506         msg_info("%s: sasl_method %s%s%s", myname, sasl_method,
 507                  IFELSE(init_response, ", init_response ", ""),
 508                  IFELSE(init_response, init_response, ""));
 509
 510     /*
 511      * SASL authentication protocol start-up. Process any initial client
 512      * response that was sent along in the AUTH command.
 513      */
 514     if (init_response) {
 515         reply_len = strlen(init_response);
 516         VSTRING_RESET(server->decoded);         /* Fix 200512 */
 517         VSTRING_SPACE(server->decoded, reply_len);
 518         if ((sasl_status = SASL_DECODE64(init_response, reply_len,
 519                                          dec_buffer = STR(server->decoded),
 520                                          vstring_avail(server->decoded),
 521                                          &dec_length)) != SASL_OK) {
 522             vstring_strcpy(reply, xsasl_cyrus_strerror(sasl_status));
 523             return (XSASL_AUTH_FORM);
 524         }
 525         if (msg_verbose)
 526             msg_info("%s: decoded initial response %s", myname, dec_buffer);
 527     } else {
 528         dec_buffer = 0;
 529         dec_length = 0;
 530     }
 531     sasl_status = SASL_SERVER_START(server->sasl_conn, sasl_method, dec_buffer,
 532                                     dec_length, &serverout,
 533                                     &serveroutlen, &errstr);
 534     xsasl_status = xsasl_cyrus_server_auth_response(sasl_status, serverout,
 535                                                     serveroutlen, reply);
 536 #if SASL_VERSION_MAJOR < 2
 537     /* SASL version 1 doesn't free memory that it allocates. */
 538     free(serverout);
 539 #endif
 540     return (xsasl_status);
 541 }
 542
 543 /* xsasl_cyrus_server_next - continue authentication */
 544
 545 static int xsasl_cyrus_server_next(XSASL_SERVER *xp, const char *request,
 546                                            VSTRING *reply)
 547 {
 548     const char *myname = "xsasl_cyrus_server_next";
 549     XSASL_CYRUS_SERVER *server = (XSASL_CYRUS_SERVER *) xp;
 550     unsigned dec_length;
 551     unsigned request_len;
 552     unsigned serveroutlen;
 553     int     sasl_status;
 554     SERVEROUT_TYPE serverout = 0;
 555     int     xsasl_status;
 556
 557 #if SASL_VERSION_MAJOR < 2
 558     const char *errstr = 0;
 559
 560 #endif
 561
 562     request_len = strlen(request);
 563     VSTRING_RESET(server->decoded);             /* Fix 200512 */
 564     VSTRING_SPACE(server->decoded, request_len);
 565     if ((sasl_status = SASL_DECODE64(request, request_len,
 566                                      STR(server->decoded),
 567                                      vstring_avail(server->decoded),
 568                                      &dec_length)) != SASL_OK) {
 569         vstring_strcpy(reply, xsasl_cyrus_strerror(sasl_status));
 570         return (XSASL_AUTH_FORM);
 571     }
 572     if (msg_verbose)
 573         msg_info("%s: decoded response: %.*s",
 574                  myname, (int) dec_length, STR(server->decoded));
 575     sasl_status = SASL_SERVER_STEP(server->sasl_conn, STR(server->decoded),
 576                                    dec_length, &serverout,
 577                                    &serveroutlen, &errstr);
 578     xsasl_status = xsasl_cyrus_server_auth_response(sasl_status, serverout,
 579                                                     serveroutlen, reply);
 580 #if SASL_VERSION_MAJOR < 2
 581     /* SASL version 1 doesn't free memory that it allocates. */
 582     free(serverout);
 583 #endif
 584     return (xsasl_status);
 585 }
 586
 587 /* xsasl_cyrus_server_get_username - get authenticated username */
 588
 589 static const char *xsasl_cyrus_server_get_username(XSASL_SERVER *xp)
 590 {
 591     const char *myname = "xsasl_cyrus_server_get_username";
 592     XSASL_CYRUS_SERVER *server = (XSASL_CYRUS_SERVER *) xp;
 593     VOID_SERVEROUT_TYPE serverout = 0;
 594     int     sasl_status;
 595
 596     /*
 597      * XXX Do not free(serverout).
 598      */
 599     sasl_status = sasl_getprop(server->sasl_conn, SASL_USERNAME, &serverout);
 600     if (sasl_status != SASL_OK || serverout == 0) {
 601         msg_warn("%s: sasl_getprop SASL_USERNAME botch: %s",
 602                  myname, xsasl_cyrus_strerror(sasl_status));
 603         return (0);
 604     }
 605     if (server->username)
 606         myfree(server->username);
 607     server->username = mystrdup(serverout);
 608     printable(server->username, '?');
 609     return (server->username);
 610 }
 611
 612 #endif