diff options
| author | Sergey Kandaurov <pluknet@nginx.com> | 2025-07-07 23:48:44 +0400 |
|---|---|---|
| committer | pluknet <pluknet@nginx.com> | 2025-08-13 18:20:34 +0400 |
| commit | 9c02c84a7443f3d736a1a5eb3f596de9af8a0c9c (patch) | |
| tree | 389d42d2be0efeb3a292a71f8280d287a713cc30 /src | |
| parent | 765642b86e0df1b5ef37f42522be7d08d95909c9 (diff) | |
| download | nginx-9c02c84a7443f3d736a1a5eb3f596de9af8a0c9c.tar.gz nginx-9c02c84a7443f3d736a1a5eb3f596de9af8a0c9c.tar.bz2 | |
Mail: reset stale auth credentials with "smtp_auth none;".
They might be reused in a session if an SMTP client proceeded
unauthenticated after previous invalid authentication attempts.
This could confuse an authentication server when passing stale
credentials along with "Auth-Method: none".
The condition to send the "Auth-Salt" header is similarly refined.
Diffstat (limited to 'src')
| -rw-r--r-- | src/mail/ngx_mail_auth_http_module.c | 5 | ||||
| -rw-r--r-- | src/mail/ngx_mail_smtp_handler.c | 3 |
2 files changed, 7 insertions, 1 deletions
diff --git a/src/mail/ngx_mail_auth_http_module.c b/src/mail/ngx_mail_auth_http_module.c index 27f64b92e..4ca6d6e24 100644 --- a/src/mail/ngx_mail_auth_http_module.c +++ b/src/mail/ngx_mail_auth_http_module.c @@ -1321,7 +1321,10 @@ ngx_mail_auth_http_create_request(ngx_mail_session_t *s, ngx_pool_t *pool, b->last = ngx_copy(b->last, passwd.data, passwd.len); *b->last++ = CR; *b->last++ = LF; - if (s->auth_method != NGX_MAIL_AUTH_PLAIN && s->salt.len) { + if ((s->auth_method == NGX_MAIL_AUTH_APOP + || s->auth_method == NGX_MAIL_AUTH_CRAM_MD5) + && s->salt.len) + { b->last = ngx_cpymem(b->last, "Auth-Salt: ", sizeof("Auth-Salt: ") - 1); b->last = ngx_copy(b->last, s->salt.data, s->salt.len); diff --git a/src/mail/ngx_mail_smtp_handler.c b/src/mail/ngx_mail_smtp_handler.c index e68ceedfd..1e26c2c8d 100644 --- a/src/mail/ngx_mail_smtp_handler.c +++ b/src/mail/ngx_mail_smtp_handler.c @@ -782,6 +782,9 @@ ngx_mail_smtp_mail(ngx_mail_session_t *s, ngx_connection_t *c) ngx_str_set(&s->out, smtp_ok); + ngx_str_null(&s->login); + ngx_str_null(&s->passwd); + return NGX_OK; } |