generateMessageID: appended the substring following the last '@'
without sanitizing it, so a sender value such as 'Doe, John <a@b>'
produced 'Message-Id: <uuid@b>>' with a duplicated closing bracket on
calendar invitations. A nil domain also left the message-id
unterminated.
The domain part is now cut at the first address delimiter or
whitespace - a domain is a single token, and anything else would
allow header injection through generated message-ids.
Fixes#6201
the trailing while loop reuses the regex variable, which by then points at the
angular brace pattern whenever stripAngular is YES. that pattern has two
capture groups while the loop substitutes $1@im****$3, so NSRegularExpression
raises NSInvalidArgumentException and the NS_HANDLER swallows it.
give the @import pattern its own variable and use it in both the replacement
and the loop. the replacement also used the template of the block above, which
dropped the whole style element instead of masking the @import in place, so
test_stringWithoutHTMLInjection failed. it passes again, and a case with
stripAngular YES covers the loop.
Requires libsodium ≥ 1.0.9 to be present at compile time.
Thus, the following distributions will have support for at least
ARGON2i:
* rhel ≥ 7 (with EPEL enabled)
* Debian ≥ 9 (stretch)
* Ubuntu ≥ Bionic (18.04)
Fixes#4895
Extend NSData+Crypto to support PBKDF2 with SHA1 HMAC as dovecot
is using it since v2.3.0.
The format hashed passwords is {PBKDF2}$1$<salt>$<rounds>$<hashed value in hex>
The implementation of pkcs#5 PBKDF2 is taken from openbsd (with minor
adjustments) as OpenSSL and GnuTLS would require quite new versions to
support this hash.
Dovecot promotes the use of BLF-CRYPT as a hashing scheme [1].
However, as not all libc-crypt() implementations support this scheme,
use the implementation added in a previous commit.
Also, update the references to the dovecot implementation and a small
test case for testing the blowfish implementation.
[1] https://doc.dovecot.org/configuration_manual/authentication/password_schemes/Fixes#4958
Hadrien Blanc
smizrahi
Hivert Quentin
Jan Kahmen
Jordi Mallach
Francis Lachapelle
Nicolas Höft
Ludovic Marcotte
Patrice Levesque
Euan Thoms
Luc Charland
Jeroen Dekkers