Revert "Removing CRAM-MD5 mechanism"

modules/imap/hm-imap.php

@@ -96,6 +96,9 @@ class Hm_IMAP extends Hm_IMAP_Cache {
         /* convert folder names to utf7 */
         public $utf7_folders = true;
 
+        /* defaults to LOGIN, CRAM-MD5 also supported but experimental */
+        public $auth = false;
+
         /* search character set to use. can be US-ASCII, UTF-8, or '' */
         public $search_charset = '';
 
@@ -243,6 +246,20 @@ public function authenticate($username, $password) {
                 $this->starttls();
             }
             switch (strtolower($this->auth)) {
+
+                case 'cram-md5':
+                    $this->banner = $this->fgets(1024);
+                    $cram1 = 'AUTHENTICATE CRAM-MD5'."\r\n";
+                    $this->send_command($cram1);
+                    $response = $this->get_response();
+                    $challenge = base64_decode(substr(trim($response[0]), 1));
+                    $pass = str_repeat(chr(0x00), (64-strlen($password)));
+                    $ipad = str_repeat(chr(0x36), 64);
+                    $opad = str_repeat(chr(0x5c), 64);
+                    $digest = bin2hex(pack("H*", md5(($pass ^ $opad).pack("H*", md5(($pass ^ $ipad).$challenge)))));
+                    $challenge_response = base64_encode($username.' '.$digest);
+                    fputs($this->handle, $challenge_response."\r\n");
+                    break;
                 case 'xoauth2':
                     $challenge = 'user='.$username.chr(1).'auth=Bearer '.$password.chr(1).chr(1);
                     $command = 'AUTHENTICATE XOAUTH2 '.base64_encode($challenge)."\r\n";

modules/smtp/hm-smtp.php

@@ -108,6 +108,10 @@ function __construct($conf) {
         if (!$this->tls) {
             $this->starttls = true;
         }
+        $this->request_auths = array('cram-md5', 'login', 'plain');
+        if (isset($conf['auth'])) {
+            array_unshift($this->request_auths, $conf['auth']);
+        }
         $this->auth = true;
         if (isset($conf['no_auth'])) {
             $this->auth = false;
@@ -327,6 +331,23 @@ function authenticate($username, $password, $mech) {
                 $command = 'AUTH XOAUTH2 '.base64_encode($challenge);
                 $this->send_command($command);
                 break;
+            case 'cram-md5':
+                $command = 'AUTH CRAM-MD5';
+                $this->send_command($command);
+                $response = $this->get_response();
+                if (empty($response) || !isset($response[0][1][0]) || $this->compare_response($response,'334') != 0) {
+                    $result = 'FATAL: SMTP server does not support AUTH CRAM-MD5';
+                }
+                else {
+                    $challenge = base64_decode(trim($response[0][1][0]));
+                    $password .= str_repeat(chr(0x00), (64-strlen($password)));
+                    $ipad = str_repeat(chr(0x36), 64);
+                    $opad = str_repeat(chr(0x5c), 64);
+                    $digest = bin2hex(pack('H*', md5(($password ^ $opad).pack('H*', md5(($password ^ $ipad).$challenge)))));
+                    $command = base64_encode($username.' '.$digest);
+                    $this->send_command($command);
+                }
+                break;
             case 'ntlm':
                 $command = 'AUTH NTLM '.$this->build_ntlm_type_one();
                 $this->send_command($command);

tests/phpunit/imap_commands.php

@@ -1,6 +1,9 @@
 <?php
 return array(
 
+    'A1 CAPABILITY' =>
+        "* CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN AUTH=CRAM-MD5\r\n",
+
     'A3 CAPABILITY' =>
         "* CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=".
         "REFERENCES THREAD=REFS THREAD=ORDEREDSUBJECT MULTIAPPEND URL-PARTIAL CATENATE UNSELECT CHILDREN NAMESPACE UIDPLUS ".
@@ -21,6 +24,9 @@
     'A5 ENABLE QRESYNC' =>
         "* ENABLED QRESYNC\r\nA4 OK Enabled (0.001 + 0.000 secs).\r\n",
 
+    'A2 AUTHENTICATE CRAM-MD5' =>
+        "+ PDBFOTRCMUMwMkY5NDFFEFU2QkM5MjVFMUITFCMjZAbG9naW5wcm94eTZiLLmFsaWNlLml0Pg==\r\n",
+
     'dGVzdHVzZXIgNTRmMDgwM2FhZTA2MzVmOWM3Y2M0YWVmZTUzODYzZTU=' =>
         "A2 OK authentication successful\r\n",
 

tests/phpunit/modules/imap/hm-imap.php

@@ -83,6 +83,17 @@ public function test_authenticate_login() {
         $res = $this->debug();
         $this->assertEquals('Logged in successfully as testuser', $res['debug'][2]);
     }
+    /**
+     * @preserveGlobalState disabled
+     * @runInSeparateProcess
+     */
+    public function test_authenticate_cram() {
+        $this->reset();
+        $this->config['auth'] = 'cram-md5';
+        $this->connect();
+        $res = $this->debug();
+        $this->assertEquals('Logged in successfully as testuser', $res['debug'][2]);
+    }
     /**
      * @preserveGlobalState disabled
      * @runInSeparateProcess