Re: [9fans] factotum apop protocol is incorrect

[David Presotto <presotto@closedmind.org>]

[-- Attachment #1: Type: text/plain, Size: 177 bytes --]

I really dinna want to change %H.  The logical thing there would be to
have a %h and a %H but little 'h' is already taken as a flag.

I'll just fix apop with your suggestion.

[-- Attachment #2: Type: message/rfc822, Size: 2775 bytes --]

From: Richard Miller <miller@hamnavoe.demon.co.uk>
To: 9fans@cse.psu.edu
Subject: [9fans] factotum apop protocol is incorrect
Date: Fri, 12 Dec 2003 19:47:35 0000
Message-ID: <b07c2ff1dcb618953620ac173286d274@hamnavoe.com>

RFC1939 introduces the 'APOP name digest' command for
challenge-response authentication to a POP3 mail server, and says:
"The digest parameter ...  is sent in hexadecimal format, using
lower-case ASCII characters."

Factotum's proto=apop implementation encodes the digest as
upper-case hexadecimal.

Probably most POP3 servers can handle both, but I've just hit
an unforgiving one.

Possible fixes:

In /sys/src/cmd/auth/factotum/apop.c, replace
		sprint(s->resp, "%.*H", MD5dlen, digest);
with something like
		for(i=0; i<MD5dlen; i++)
			sprint(&s->resp[2*i], "%.2x", digest[i]);

or in /sys/src/libc/port/u16.c, replace
	static char t16e[] = "0123456789ABCDEF";
with
	static char t16e[] = "0123456789abcdef";

The latter has a more widespread effect, but it arguably makes the %H
format conform to its documentation.  The man page for print(2) makes
a distinction between "hexadecimal" and "upper case hexadecimal" for
%x and %X respectively.  enc16(2) just says %H means "base 16 (i.e.
hexadecimal)", so one might expect it to be lower case.

-- Richard Miller