The current implementation for PLAIN in imap-send works just fine
if using curl, but if attempted to use for OpenSSL, it is treated
as an invalid mechanism. The default implementation for OpenSSL is
IMAP LOGIN command rather than AUTH PLAIN. Since AUTH PLAIN is
still used today by many email providers in form of app passwords,
lets add an implementation that can use AUTH PLAIN if specified.
Signed-off-by: Aditya Garg <gargaditya08@xxxxxxxx>
---
Documentation/config/imap.adoc | 4 +-
imap-send.c | 82 +++++++++++++++++++++++++++++++++-
2 files changed, 83 insertions(+), 3 deletions(-)
diff --git a/Documentation/config/imap.adoc b/Documentation/config/imap.adoc
index 29b998d5ff..7c8b2dcce4 100644
--- a/Documentation/config/imap.adoc
+++ b/Documentation/config/imap.adoc
@@ -40,6 +40,6 @@ imap.authMethod::
Specify the authentication method for authenticating with the IMAP server.
If Git was built with the NO_CURL option, or if your curl version is older
than 7.34.0, or if you're running git-imap-send with the `--no-curl`
- option, the only supported methods are `CRAM-MD5`, `OAUTHBEARER` and
- `XOAUTH2`. If this is not set then `git imap-send` uses the basic IMAP
+ option, the only supported methods are `PLAIN`, `CRAM-MD5`, `OAUTHBEARER`
+ and `XOAUTH2`. If this is not set then `git imap-send` uses the basic IMAP
plaintext `LOGIN` command.
diff --git a/imap-send.c b/imap-send.c
index 829e957abd..38f09f1f02 100644
--- a/imap-send.c
+++ b/imap-send.c
@@ -139,6 +139,7 @@ enum CAPABILITY {
LITERALPLUS,
NAMESPACE,
STARTTLS,
+ AUTH_PLAIN,
AUTH_CRAM_MD5,
AUTH_OAUTHBEARER,
AUTH_XOAUTH2,
@@ -150,6 +151,7 @@ static const char *cap_list[] = {
"LITERAL+",
"NAMESPACE",
"STARTTLS",
+ "AUTH=PLAIN",
"AUTH=CRAM-MD5",
"AUTH=OAUTHBEARER",
"AUTH=XOAUTH2",
@@ -851,6 +853,41 @@ static char hexchar(unsigned int b)
}
#define ENCODED_SIZE(n) (4 * DIV_ROUND_UP((n), 3))
+static char *plain_base64(const char *user, const char *pass)
+{
+ int user_len = strlen(user);
+ int pass_len = strlen(pass);
+ int raw_len = 1 + user_len + 1 + pass_len;
+ int b64_len;
+ char *raw, *b64;
+
+ /*
+ * Compose the PLAIN string
+ *
+ * The username and password are combined to one string and base64 encoded.
+ * "\0user\0pass"
+ *
+ * The method has been described in RFC4616.
+ *
+ * https://datatracker.ietf.org/doc/html/rfc4616
+ */
+ raw = xmallocz(raw_len);
+ raw[0] = '\0';
+ memcpy(raw + 1, user, user_len);
+ raw[1 + user_len] = '\0';
+ memcpy(raw + 2 + user_len, pass, pass_len);
+
+ b64 = xmallocz(ENCODED_SIZE(raw_len));
+ b64_len = EVP_EncodeBlock((unsigned char *)b64, (unsigned char *)raw, raw_len);
+ free(raw);
+
+ if (b64_len < 0) {
+ free(b64);
+ return NULL;
+ }
+ return b64;
+}
+
static char *cram(const char *challenge_64, const char *user, const char *pass)
{
int i, resp_len, encoded_len, decoded_len;
@@ -951,6 +988,26 @@ static char *xoauth2_base64(const char *user, const char *access_token)
return b64;
}
+static int auth_plain(struct imap_store *ctx, const char *prompt UNUSED)
+{
+ int ret;
+ char *b64;
+
+ b64 = plain_base64(ctx->cfg->user, ctx->cfg->pass);
+ if (!b64)
+ return error("PLAIN: base64 encoding failed");
+
+ /* Send the base64-encoded response */
+ ret = socket_write(&ctx->imap->buf.sock, b64, strlen(b64));
+ if (ret != (int)strlen(b64)) {
+ free(b64);
+ return error("IMAP error: sending PLAIN response failed");
+ }
+
+ free(b64);
+ return 0;
+}
+
static int auth_oauthbearer(struct imap_store *ctx, const char *prompt UNUSED)
{
int ret;
@@ -1001,6 +1058,7 @@ static char *cram(const char *challenge_64 UNUSED,
"you have to build git-imap-send with OpenSSL library.");
}
+#define auth_plain NULL
#define auth_oauthbearer NULL
#define auth_xoauth2 NULL
@@ -1198,7 +1256,29 @@ static struct imap_store *imap_open_store(struct imap_server_conf *srvc, const c
if (srvc->auth_method) {
struct imap_cmd_cb cb;
- if (!strcmp(srvc->auth_method, "CRAM-MD5")) {
+ if (!strcmp(srvc->auth_method, "PLAIN")) {
+ if (!CAP(AUTH_PLAIN)) {
+ fprintf(stderr, "You specified "
+ "PLAIN as authentication method, "
+ "but %s doesn't support it.\n", srvc->host);
+ goto bail;
+ }
+
+ #ifdef NO_OPENSSL
+ fprintf(stderr, "You are trying to use PLAIN authentication mechanism "
+ "with OpenSSL library, but its support has not been compiled in.");
+ goto bail;
+ #endif
+
+ /* PLAIN */
+
+ memset(&cb, 0, sizeof(cb));
+ cb.cont = auth_plain;
+ if (imap_exec(ctx, &cb, "AUTHENTICATE PLAIN") != RESP_OK) {
+ fprintf(stderr, "IMAP error: AUTHENTICATE PLAIN failed\n");
+ goto bail;
+ }
+ } else if (!strcmp(srvc->auth_method, "CRAM-MD5")) {
if (!CAP(AUTH_CRAM_MD5)) {
fprintf(stderr, "You specified "
"CRAM-MD5 as authentication method, "
--
2.49.0.639.gf77f2423e1
