sendmail / Re: Cyrus SASL 2.1.28 testing

Dear all,

the change in include/sasl.h

-#define SASL_SEC_MAXIMUM          0x00FF
+#define SASL_SEC_MAXIMUM          0xFFFF

breaks sendmail=E2=80=99s AuthOptions, when it has the =E2=80=9CA=E2=80=9D =
flag set.


Following text is for users compiling Sendmail using unreleased Cyrus
SASL.

Sendmail/sendmail.h has these definitions:
# define SASL_AUTH_AUTH 0x1000 /* use auth=3D only if authenticated */
# if SASL >=3D 20101
#  define SASL_SEC_MASK SASL_SEC_MAXIMUM
# endif

and SASL_SEC_MAXIMUM is 0xFFFF.

The =E2=80=9CA=E2=80=9D flag sets sets the 0x1000 bit in SASLOpts and later=
 calls:
ssp.security_flags =3D SASLOpts & SASL_SEC_MASK;

Now within Cyrus SASL code the 0x1000 bit is set for security_flags.

lib/server.c:mech_permitted() has this code:

/* do we want to special case SASL_SEC_PASS_CREDENTIALS? nah.. */
if ((myflags &=3D (myflags ^ plug->security_flags)) !=3D 0) {
  sasl_seterror(conn, SASL_NOLOG,
                  "security flags do not match required");
  return (myflags & SASL_SEC_NOPLAINTEXT) ? SASL_ENCRYPT : SASL_NOMECH;
}

myflags has values like 4112 or 4113, where the 0x1000 bit is set.=20
This flag is not cleared, so no mechanism have the required
security_flags.  In turn, on EHLO sendmail prints no 250-AUTH line, as
no mechanism matches the security criteria.

Removing the A Option from AuthOption solves the problem.  Appending a
zero to =E2=80=9C# define SASL_AUTH_AUTH 0x1000=E2=80=9D might also help.

Greetings
  =D0=94=D0=B8=D0=BB=D1=8F=D0=BD

On Tue, 2021-11-16 at 14:50 -0800, Quanah Gibson-Mount wrote:
> Hi everyone,
>=20
> The cyrus-sasl-2.1 branch is ready for testing for the proposed
>  2.1.28
> Cyrus SASL release.=C2=A0 For those who know how to build from source, it
>  would
> be great if you can test and verify things work as expected.=C2=A0 If you
>  have a
> kerberos based environment that makes use of SASL/GSSAPI for a
>  variety of
> purposes, please note that in any feedback.
>=20
> A general list of fixed issues for this release can be found at:
>=20
> <https://github.com/cyrusimap/cyrus-sasl/milestone/2?closed=3D1>
>=20
> Thanks in advance!
>=20
> Regards,
> Quanah
>=20
> --
>=20
> Quanah Gibson-Mount
> Product Architect
> Symas Corporation
> Packaged, certified, and supported LDAP solutions powered by
> OpenLDAP:
> <http://www.symas.com>

------------------------------------------
Cyrus: SASL
Permalink: https://cyrus.topicbox.com/groups/sasl/T12590cab045ba314-M83aad5=
4a0f32a8060b84588e
Delivery options: https://cyrus.topicbox.com/groups/sasl/subscription