Skip to content

Commit 7591d94

Browse files
authored
bpo-27820: Fix AUTH LOGIN logic in smtplib.SMTP (GH-24118)
* Fix auth_login logic (bpo-27820) * Also fix a longstanding bug in the SimSMTPChannel.found_terminator() method that causes inability to test SMTP AUTH with initial_response_ok=False.
1 parent ba251c2 commit 7591d94

File tree

3 files changed

+65
-3
lines changed

3 files changed

+65
-3
lines changed

Lib/smtplib.py

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@
6464
CRLF = "\r\n"
6565
bCRLF = b"\r\n"
6666
_MAXLINE = 8192 # more than 8 times larger than RFC 821, 4.5.3
67+
_MAXCHALLENGE = 5 # Maximum number of AUTH challenges sent
6768

6869
OLDSTYLE_AUTH = re.compile(r"auth=(.*)", re.I)
6970

@@ -248,6 +249,7 @@ def __init__(self, host='', port=0, local_hostname=None,
248249
self.esmtp_features = {}
249250
self.command_encoding = 'ascii'
250251
self.source_address = source_address
252+
self._auth_challenge_count = 0
251253

252254
if host:
253255
(code, msg) = self.connect(host, port)
@@ -633,14 +635,23 @@ def auth(self, mechanism, authobject, *, initial_response_ok=True):
633635
if initial_response is not None:
634636
response = encode_base64(initial_response.encode('ascii'), eol='')
635637
(code, resp) = self.docmd("AUTH", mechanism + " " + response)
638+
self._auth_challenge_count = 1
636639
else:
637640
(code, resp) = self.docmd("AUTH", mechanism)
641+
self._auth_challenge_count = 0
638642
# If server responds with a challenge, send the response.
639-
if code == 334:
643+
while code == 334:
644+
self._auth_challenge_count += 1
640645
challenge = base64.decodebytes(resp)
641646
response = encode_base64(
642647
authobject(challenge).encode('ascii'), eol='')
643648
(code, resp) = self.docmd(response)
649+
# If server keeps sending challenges, something is wrong.
650+
if self._auth_challenge_count > _MAXCHALLENGE:
651+
raise SMTPException(
652+
"Server AUTH mechanism infinite loop. Last response: "
653+
+ repr((code, resp))
654+
)
644655
if code in (235, 503):
645656
return (code, resp)
646657
raise SMTPAuthenticationError(code, resp)
@@ -662,7 +673,7 @@ def auth_plain(self, challenge=None):
662673
def auth_login(self, challenge=None):
663674
""" Authobject to use with LOGIN authentication. Requires self.user and
664675
self.password to be set."""
665-
if challenge is None:
676+
if challenge is None or self._auth_challenge_count < 2:
666677
return self.user
667678
else:
668679
return self.password

Lib/test/test_smtplib.py

Lines changed: 44 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -785,7 +785,7 @@ def found_terminator(self):
785785
except ResponseException as e:
786786
self.smtp_state = self.COMMAND
787787
self.push('%s %s' % (e.smtp_code, e.smtp_error))
788-
return
788+
return
789789
super().found_terminator()
790790

791791

@@ -851,6 +851,11 @@ def _auth_login(self, arg=None):
851851
self._authenticated(self._auth_login_user, password == sim_auth[1])
852852
del self._auth_login_user
853853

854+
def _auth_buggy(self, arg=None):
855+
# This AUTH mechanism will 'trap' client in a neverending 334
856+
# base64 encoded 'BuGgYbUgGy'
857+
self.push('334 QnVHZ1liVWdHeQ==')
858+
854859
def _auth_cram_md5(self, arg=None):
855860
if arg is None:
856861
self.push('334 {}'.format(sim_cram_md5_challenge))
@@ -1069,6 +1074,44 @@ def testAUTH_LOGIN(self):
10691074
self.assertEqual(resp, (235, b'Authentication Succeeded'))
10701075
smtp.close()
10711076

1077+
def testAUTH_LOGIN_initial_response_ok(self):
1078+
self.serv.add_feature("AUTH LOGIN")
1079+
with smtplib.SMTP(HOST, self.port, local_hostname='localhost',
1080+
timeout=support.LOOPBACK_TIMEOUT) as smtp:
1081+
smtp.user, smtp.password = sim_auth
1082+
smtp.ehlo("test_auth_login")
1083+
resp = smtp.auth("LOGIN", smtp.auth_login, initial_response_ok=True)
1084+
self.assertEqual(resp, (235, b'Authentication Succeeded'))
1085+
1086+
def testAUTH_LOGIN_initial_response_notok(self):
1087+
self.serv.add_feature("AUTH LOGIN")
1088+
with smtplib.SMTP(HOST, self.port, local_hostname='localhost',
1089+
timeout=support.LOOPBACK_TIMEOUT) as smtp:
1090+
smtp.user, smtp.password = sim_auth
1091+
smtp.ehlo("test_auth_login")
1092+
resp = smtp.auth("LOGIN", smtp.auth_login, initial_response_ok=False)
1093+
self.assertEqual(resp, (235, b'Authentication Succeeded'))
1094+
1095+
def testAUTH_BUGGY(self):
1096+
self.serv.add_feature("AUTH BUGGY")
1097+
1098+
def auth_buggy(challenge=None):
1099+
self.assertEqual(b"BuGgYbUgGy", challenge)
1100+
return "\0"
1101+
1102+
smtp = smtplib.SMTP(
1103+
HOST, self.port, local_hostname='localhost',
1104+
timeout=support.LOOPBACK_TIMEOUT
1105+
)
1106+
try:
1107+
smtp.user, smtp.password = sim_auth
1108+
smtp.ehlo("test_auth_buggy")
1109+
expect = r"^Server AUTH mechanism infinite loop.*"
1110+
with self.assertRaisesRegex(smtplib.SMTPException, expect) as cm:
1111+
smtp.auth("BUGGY", auth_buggy, initial_response_ok=False)
1112+
finally:
1113+
smtp.close()
1114+
10721115
@hashlib_helper.requires_hashdigest('md5')
10731116
def testAUTH_CRAM_MD5(self):
10741117
self.serv.add_feature("AUTH CRAM-MD5")
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
Fixed long-standing bug of smtplib.SMTP where doing AUTH LOGIN with
2+
initial_response_ok=False will fail.
3+
4+
The cause is that SMTP.auth_login _always_ returns a password if provided
5+
with a challenge string, thus non-compliant with the standard for AUTH
6+
LOGIN.
7+
8+
Also fixes bug with the test for smtpd.

0 commit comments

Comments
 (0)