X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/040721f2bc088d5e717c0475975ed6158352dce6..4e910c01eea401e36044816744691789ef4656fa:/src/src/auths/spa.c

diff --git a/src/src/auths/spa.c b/src/src/auths/spa.c
index 4d435a411..378d4f602 100644
--- a/src/src/auths/spa.c
+++ b/src/src/auths/spa.c
@@ -261,109 +261,103 @@ auth_spa_client(
   uschar *buffer,                        /* buffer for reading response */
   int buffsize)                          /* size of buffer */
 {
-       auth_spa_options_block *ob =
-               (auth_spa_options_block *)(ablock->options_block);
-       SPAAuthRequest   request;
-       SPAAuthChallenge challenge;
-       SPAAuthResponse  response;
-       char msgbuf[2048];
-       char *domain = NULL;
-       char *username, *password;
-
-       /* Code added by PH to expand the options */
-
-       *buffer = 0;    /* Default no message when cancelled */
-
-       username = CS expand_string(ob->spa_username);
-       if (username == NULL)
-         {
-         if (expand_string_forcedfail) return CANCELLED;
-         string_format(buffer, buffsize, "expansion of \"%s\" failed in %s "
-           "authenticator: %s", ob->spa_username, ablock->name,
-           expand_string_message);
-         return ERROR;
-         }
-
-       password = CS expand_string(ob->spa_password);
-       if (password == NULL)
-         {
-         if (expand_string_forcedfail) return CANCELLED;
-         string_format(buffer, buffsize, "expansion of \"%s\" failed in %s "
-           "authenticator: %s", ob->spa_password, ablock->name,
-           expand_string_message);
-         return ERROR;
-         }
-
-       if (ob->spa_domain != NULL)
-         {
-         domain = CS expand_string(ob->spa_domain);
-         if (domain == NULL)
-           {
-           if (expand_string_forcedfail) return CANCELLED;
-           string_format(buffer, buffsize, "expansion of \"%s\" failed in %s "
-             "authenticator: %s", ob->spa_domain, ablock->name,
-             expand_string_message);
-           return ERROR;
-           }
-         }
-
-       /* Original code */
-
-    if (smtp_write_command(outblock, FALSE, "AUTH %s\r\n",
-         ablock->public_name) < 0)
-               return FAIL_SEND;
-
-       /* wait for the 3XX OK message */
-       if (!smtp_read_response(inblock, (uschar *)buffer, buffsize, '3', timeout))
-               return FAIL;
-
-       DSPA("\n\n%s authenticator: using domain %s\n\n",
-               ablock->name, domain);
-
-       spa_build_auth_request (&request, CS username, domain);
-       spa_bits_to_base64 (US msgbuf, (unsigned char*)&request,
-               spa_request_length(&request));
-
-       DSPA("\n\n%s authenticator: sending request (%s)\n\n", ablock->name,
-               msgbuf);
-
-       /* send the encrypted password */
-       if (smtp_write_command(outblock, FALSE, "%s\r\n", msgbuf) < 0)
-               return FAIL_SEND;
-
-       /* wait for the auth challenge */
-       if (!smtp_read_response(inblock, (uschar *)buffer, buffsize, '3', timeout))
-               return FAIL;
-
-       /* convert the challenge into the challenge struct */
-       DSPA("\n\n%s authenticator: challenge (%s)\n\n",
-               ablock->name, buffer + 4);
-       spa_base64_to_bits ((char *)(&challenge), sizeof(challenge), (const char *)(buffer + 4));
-
-       spa_build_auth_response (&challenge, &response,
-               CS username, CS password);
-       spa_bits_to_base64 (US msgbuf, (unsigned char*)&response,
-               spa_request_length(&response));
-       DSPA("\n\n%s authenticator: challenge response (%s)\n\n", ablock->name,
-               msgbuf);
-
-       /* send the challenge response */
-       if (smtp_write_command(outblock, FALSE, "%s\r\n", msgbuf) < 0)
-               return FAIL_SEND;
-
-       /* If we receive a success response from the server, authentication
-       has succeeded. There may be more data to send, but is there any point
-       in provoking an error here? */
-       if (smtp_read_response(inblock, US buffer, buffsize, '2', timeout))
-               return OK;
-
-       /* Not a success response. If errno != 0 there is some kind of transmission
-       error. Otherwise, check the response code in the buffer. If it starts with
-       '3', more data is expected. */
-       if (errno != 0 || buffer[0] != '3')
-               return FAIL;
-
-       return FAIL;
+auth_spa_options_block *ob =
+       (auth_spa_options_block *)(ablock->options_block);
+SPAAuthRequest   request;
+SPAAuthChallenge challenge;
+SPAAuthResponse  response;
+char msgbuf[2048];
+char *domain = NULL;
+char *username, *password;
+
+/* Code added by PH to expand the options */
+
+*buffer = 0;    /* Default no message when cancelled */
+
+if (!(username = CS expand_string(ob->spa_username)))
+  {
+  if (expand_string_forcedfail) return CANCELLED;
+  string_format(buffer, buffsize, "expansion of \"%s\" failed in %s "
+   "authenticator: %s", ob->spa_username, ablock->name,
+   expand_string_message);
+  return ERROR;
+  }
+
+if (!(password = CS expand_string(ob->spa_password)))
+  {
+  if (expand_string_forcedfail) return CANCELLED;
+  string_format(buffer, buffsize, "expansion of \"%s\" failed in %s "
+   "authenticator: %s", ob->spa_password, ablock->name,
+   expand_string_message);
+  return ERROR;
+  }
+
+if (ob->spa_domain)
+  {
+  if (!(domain = CS expand_string(ob->spa_domain)))
+    {
+    if (expand_string_forcedfail) return CANCELLED;
+    string_format(buffer, buffsize, "expansion of \"%s\" failed in %s "
+		  "authenticator: %s", ob->spa_domain, ablock->name,
+		  expand_string_message);
+    return ERROR;
+    }
+  }
+
+/* Original code */
+
+if (smtp_write_command(outblock, SCMD_FLUSH, "AUTH %s\r\n",
+    ablock->public_name) < 0)
+  return FAIL_SEND;
+
+/* wait for the 3XX OK message */
+if (!smtp_read_response(inblock, (uschar *)buffer, buffsize, '3', timeout))
+  return FAIL;
+
+DSPA("\n\n%s authenticator: using domain %s\n\n", ablock->name, domain);
+
+spa_build_auth_request (&request, CS username, domain);
+spa_bits_to_base64 (US msgbuf, (unsigned char*)&request,
+       spa_request_length(&request));
+
+DSPA("\n\n%s authenticator: sending request (%s)\n\n", ablock->name, msgbuf);
+
+/* send the encrypted password */
+if (smtp_write_command(outblock, SCMD_FLUSH, "%s\r\n", msgbuf) < 0)
+  return FAIL_SEND;
+
+/* wait for the auth challenge */
+if (!smtp_read_response(inblock, (uschar *)buffer, buffsize, '3', timeout))
+  return FAIL;
+
+/* convert the challenge into the challenge struct */
+DSPA("\n\n%s authenticator: challenge (%s)\n\n", ablock->name, buffer + 4);
+spa_base64_to_bits ((char *)(&challenge), sizeof(challenge), (const char *)(buffer + 4));
+
+spa_build_auth_response (&challenge, &response, CS username, CS password);
+spa_bits_to_base64 (US msgbuf, (unsigned char*)&response,
+       spa_request_length(&response));
+DSPA("\n\n%s authenticator: challenge response (%s)\n\n", ablock->name, msgbuf);
+
+/* send the challenge response */
+if (smtp_write_command(outblock, SCMD_FLUSH, "%s\r\n", msgbuf) < 0)
+       return FAIL_SEND;
+
+/* If we receive a success response from the server, authentication
+has succeeded. There may be more data to send, but is there any point
+in provoking an error here? */
+
+if (smtp_read_response(inblock, US buffer, buffsize, '2', timeout))
+  return OK;
+
+/* Not a success response. If errno != 0 there is some kind of transmission
+error. Otherwise, check the response code in the buffer. If it starts with
+'3', more data is expected. */
+
+if (errno != 0 || buffer[0] != '3')
+  return FAIL;
+
+return FAIL;
 }
 
 /* End of spa.c */