Patch: forcing SSL before auth

[Leena Heino]

On Mon, 10 Aug 2015, Bron Gondwana wrote:

> On Mon, Aug 10, 2015, at 21:05, Carlos Velasco wrote:
>>
>> El 10/08/2015 a las 7:42, Leena Heino escribió:
>>> Attached is a patch to add CA certificate options to cyradm. The patch
>>> does not change the dafault functionality in cyradm it only adds
>>> the missing CA certificate options and documentation.
>>>
>>> This is a refinement to the patch that Carlos Velasco patch has sent.
>>>
>>> This patch can be applied to Cyrus imapd 2.4, 2.5 and git master branches.
>>
>> Can't see the attachment ;)
>
> :) Yeah - that might be handy to have!  Ellie has said that she'll have a look at it tomorrow.
> (in our team meeting 30 min ago), so it would be handy to have the attachment!

It seems that mail program did not attach the patch. I'll try to 
send it again.

-- 
   Leena Heino              University of Tampere / Computer Centre
   ( liinu at uta.fi )      ( http://www.uta.fi/laitokset/tkk )
-------------- next part --------------
diff -Naur cyrus-imapd-2.5.5.orig/perl/imap/IMAP/Shell.pm cyrus-imapd-2.5.5/perl/imap/IMAP/Shell.pm
--- cyrus-imapd-2.5.5.orig/perl/imap/IMAP/Shell.pm	2015-08-10 04:01:26.000000000 +0300
+++ cyrus-imapd-2.5.5/perl/imap/IMAP/Shell.pm	2015-08-10 08:30:21.988057250 +0300
@@ -444,9 +444,9 @@
 # programs, as opposed to things expected from within a program.)
 sub shell {
   my ($server, $port, $authz, $auth, $systemrc, $userrc, $dorc, $mech, $pw,
-      $tlskey, $notls) =
+      $tlskey, $notls, $cacert, $capath) =
     ('', 143, undef, $ENV{USER} || $ENV{LOGNAME}, '/usr/local/etc/cyradmrc.pl',
-     "$ENV{HOME}/.cyradmrc.pl", 1, undef, undef, undef, undef);
+     "$ENV{HOME}/.cyradmrc.pl", 1, undef, undef, undef, undef, undef, undef);
   GetOptions('user|u=s' => \$auth,
 	     'authz|z=s' => \$authz,
 	     'rc|r!' => \$dorc,
@@ -458,6 +458,8 @@
 	     'password|w=s' => \$pw,
   	     'tlskey|t:s' => \$tlskey,
   	     'notls' => \$notls,
+  	     'cafile=s' => \$cacert,
+  	     'cadir=s' => \$capath,
 	     'help|h' => sub { cyradm_usage(); exit(0); },
 	     'version|v' => sub { cyradm_version(); exit(0); }
 	    );
@@ -478,7 +480,8 @@
 			  -rock => \$cyradm});
     $cyradm->authenticate(-authz => $authz, -user => $auth,
 			  -mechanism => $mech, -password => $pw,
-			  -tlskey => $tlskey, -notls => $notls)
+			  -tlskey => $tlskey, -notls => $notls,
+			  -cafile => $cacert, -cadir => $capath)
       or die "cyradm: cannot authenticate to server with $mech as $auth\n";
   }
   my $fstk = [*STDIN, *STDOUT, *STDERR];
@@ -507,6 +510,11 @@
   --userrc <file>       Use user configuration <file>
   --port <port>         Connect to server on <port>
   --auth <mechanism>    Authenticate with <mechanism>
+  --tlskey <keyfile>    Use certicate with keyfile to authentica with server
+  --notls               Disable StartTLS negotiation
+  --cafile <cacertfile> Use CA certificate file to validate server certificate
+  --cadir <cacertdirectory> Use CA certificate directory to validate
+                            server certificate
   --help                This help message
   --version             The version of Cyrus IMAP this utility is a part of
 
@@ -834,9 +842,19 @@
 	$want = '-notls';
 	next;
       }
+      if ($opt ne '' && '-cafile' =~ /^\Q$opt/ || $opt eq '--cafile') {
+	$want = '-cafile';
+	next;
+      }
+      if ($opt ne '' && '-cadir' =~ /^\Q$opt/ || $opt eq '--cadir') {
+	$want = '-cadir';
+	next;
+      }
       if ($opt =~ /^-/) {
 	die "usage: authenticate [-minssf N] [-maxssf N] [-mechanisms STR]\n".
-	    "                    [-service name] [-tlskey keyfile] [-notls] [user]\n";
+	    "                    [-service name] [-tlskey keyfile] [-notls] [user]\n".
+	    "                    [-cafile cacertfile] [-cadir cacertdir]\n".
+	    "                    [user]\n";
       }
     }
     if ($opt =~ /^-/) {
@@ -852,7 +870,9 @@
   if (@nargv > 1) {
     if (Cyrus::IMAP::havetls()) {
       die "usage: authenticate [-minssf N] [-maxssf N] [-mechanisms STR]\n".
-          "                    [-service name] [-tlskey keyfile] [-notls] [user]\n";
+          "                    [-service name] [-tlskey keyfile] [-notls] [user]\n".
+          "                    [-cafile cacertfile] [-cadir cacertdir]\n".
+          "                    [user]\n";
     } else {
       die "usage: authenticate [-minssf N] [-maxssf N] [-mechanisms STR]\n".
           "                    [-service name] [user]\n";
diff -Naur cyrus-imapd-2.5.5.orig/perl/imap/cyradm.sh cyrus-imapd-2.5.5/perl/imap/cyradm.sh
--- cyrus-imapd-2.5.5.orig/perl/imap/cyradm.sh	2015-08-10 04:01:26.000000000 +0300
+++ cyrus-imapd-2.5.5/perl/imap/cyradm.sh	2015-08-10 08:30:52.291138450 +0300
@@ -53,6 +53,7 @@
 
   $ cyradm [--user user] [--[no]rc] [--systemrc file] [--userrc file] \
   > [--port n] [--auth mechanism] [--tlskey keyfile] [--notls] \
+  > [--cafile cacertfile] [--cadir cacertdir] \
   > [--server] server
 
 but possibly