Re: [PATCH v1] send-email: provide whitelist of SMTP AUTH mechanisms

2015-08-03 Thread Junio C Hamano
Jan Viktorin writes: > I didn't find a way how to determine what mechanisms are supported by SASL. Ok, forget the suggested approach, then X-<. -- To unsubscribe from this list: send the line "unsubscribe git" in the body of a message to majord...@vger.kernel.org More majordomo info at http://v

Re: [PATCH v1] send-email: provide whitelist of SMTP AUTH mechanisms

2015-08-03 Thread Jan Viktorin
On Sun, 02 Aug 2015 11:28:49 -0700 Junio C Hamano wrote: > Jan Viktorin writes: > > > Authen::SASL gives: > > > > No SASL mechanism found > > at /usr/share/perl5/vendor_perl/Authen/SASL.pm line 77. > > at /usr/share/perl5/core_perl/Net/SMTP.pm line 207. > > > > The SASL library does not check

Re: [PATCH v1] send-email: provide whitelist of SMTP AUTH mechanisms

2015-08-02 Thread Junio C Hamano
Jan Viktorin writes: > Authen::SASL gives: > > No SASL mechanism found > at /usr/share/perl5/vendor_perl/Authen/SASL.pm line 77. > at /usr/share/perl5/core_perl/Net/SMTP.pm line 207. > > The SASL library does not check validity of mechanisms' > names (or I did not find it). It just tries to loa

Re: [PATCH v1] send-email: provide whitelist of SMTP AUTH mechanisms

2015-08-02 Thread Junio C Hamano
Eric Sunshine writes: > What I was really asking was whether this sort of checking really > belongs in git-send-email or if it is better left to Net::SMTP (and > Authen::SASL) to do so since they are in better positions to know what > is valid and what is not. If the Perl module(s) generate suita

Re: [PATCH v1] send-email: provide whitelist of SMTP AUTH mechanisms

2015-08-02 Thread Jan Viktorin
Authen::SASL gives: No SASL mechanism found at /usr/share/perl5/vendor_perl/Authen/SASL.pm line 77. at /usr/share/perl5/core_perl/Net/SMTP.pm line 207. The SASL library does not check validity of mechanisms' names (or I did not find it). It just tries to load one that matches both the ours and

Re: [PATCH v1] send-email: provide whitelist of SMTP AUTH mechanisms

2015-08-02 Thread Eric Sunshine
On Sat, Aug 1, 2015 at 2:19 PM, Jan Viktorin wrote: > On Sat, 1 Aug 2015 05:33:28 -0400 Eric Sunshine > wrote: >> On Fri, Jul 31, 2015 at 7:33 PM, Jan Viktorin >> wrote: >> At the very least, you will also want to update the documentation >> (Documentation/git-send-email.txt) and, if possible,

Re: [PATCH v1] send-email: provide whitelist of SMTP AUTH mechanisms

2015-08-01 Thread Jan Viktorin
Hello Brian, thanks for your note. I think, I will remove the check of list of mechanisms and put there a regex check. On Sat, 1 Aug 2015 16:49:59 + "brian m. carlson" wrote: > On Sat, Aug 01, 2015 at 01:33:37AM +0200, Jan Viktorin wrote: > > + # Do not allow arbitrary strings. > > + my

Re: [PATCH v1] send-email: provide whitelist of SMTP AUTH mechanisms

2015-08-01 Thread Jan Viktorin
Hello Eric, thanks for comments. I've described the orignal problem before I tried to fix it: https://groups.google.com/forum/#!topic/git-users/PxtiVxAapUU So, *this patch* was necessary to apply for me to send *this patch* to the mailing list. Later, I've tried git-send-email (without this pa

Re: [PATCH v1] send-email: provide whitelist of SMTP AUTH mechanisms

2015-08-01 Thread brian m. carlson
On Sat, Aug 01, 2015 at 01:33:37AM +0200, Jan Viktorin wrote: > + # Do not allow arbitrary strings. > + my ($filtered_auth) = ""; > + foreach ("PLAIN", "LOGIN", "CRAM-MD5", "DIGEST-MD5") { On my system, GSSAPI is also available, and it does indeed work, as I'm not prompted for a passwo

Re: [PATCH v1] send-email: provide whitelist of SMTP AUTH mechanisms

2015-08-01 Thread Eric Sunshine
On Fri, Jul 31, 2015 at 7:33 PM, Jan Viktorin wrote: > When sending an e-mail, the client and server must > agree on an authentication mechanism. Some servers > (due to misconfiguration or a bug) denies valid s/denies/deny/ > credentials for certain mechanisms. In this patch, > a new option --sm

[PATCH v1] send-email: provide whitelist of SMTP AUTH mechanisms

2015-07-31 Thread Jan Viktorin
When sending an e-mail, the client and server must agree on an authentication mechanism. Some servers (due to misconfiguration or a bug) denies valid credentials for certain mechanisms. In this patch, a new option --smtp-auth and configuration entry smtpauth are introduced. If smtp_auth is defined