feat(login): add parameters to prevent uneccesary connection request when the domain is unknown

chore(packaging): Use pkgconfig to compute cflags for wbxml2 instead of hardcoding them

ActiveSync/GNUmakefile

@@ -34,7 +34,7 @@ ActiveSync_RESOURCE_FILES +=		\
 ADDITIONAL_OBJCFLAGS += -Wno-deprecated-declarations
 ADDITIONAL_INCLUDE_DIRS += -I../SOPE/ -I../SoObjects/
 ADDITIONAL_LIB_DIRS += -L../SOPE/GDLContentStore/obj/ -L../SOPE/NGCards/obj/
-ADDITIONAL_INCLUDE_DIRS += -I/usr/include/libwbxml-1.0/
+ADDITIONAL_INCLUDE_DIRS += $(shell pkg-config --cflags libwbxml2)
 ADDITIONAL_LDFLAGS += -Wl,--no-as-needed -lwbxml2
 
 -include GNUmakefile.preamble

Documentation/SOGoInstallationGuide.asciidoc

@@ -806,6 +806,16 @@ Default value is `YES`, or enabled.
 authentication and global address books. Multiple sources can be
 specified as an array of dictionaries.
 
+|S |SOGoForbidUnknownDomainsAuth
+|Boolean. If set to `YES`, prevent user that try to connect with an unknown domain.
+The known domains are set in parameter `SOGoDomainAllowed` and/or the domains listed in a <<multi-domains-configuration, Multi-domains Configuration>>. Default value is `NO`.
+
+Obiously, if your users can connect without specifying a domain, let this parameter to `NO`.
+
+|S |SOGoDomainAllowed
+|Parameter used to define which domains SOGo should allowed during a connection request. This parameter is an array of strings.
+
+
 |S |SOGoPasswordRecoveryEnabled
 |Boolean enable password recovery with secret question or secondary e-mail. Default value is `NO`.
 
@@ -2824,6 +2834,8 @@ like this:
 }
 ----
 
+[[multi-domains-configuration]]
+
 Multi-domains Configuration
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

SoObjects/SOGo/SOGoSystemDefaults.h

@@ -36,6 +36,8 @@ static const NSString *kDisableSharingCalendar = @"Calendar";
 + (SOGoSystemDefaults *) sharedSystemDefaults;
 
 - (NSArray *) domainIds;
+- (BOOL) forbidUnknownDomainsAuth;
+- (NSArray *) domainsAllowed;
 - (BOOL) enableDomainBasedUID;
 - (NSArray *) loginDomains;
 - (NSArray *) visibleDomainsForDomain: (NSString *) domain;

SoObjects/SOGo/SOGoSystemDefaults.m

@@ -258,7 +258,8 @@ _injectConfigurationFromFile (NSMutableDictionary *defaultsDict,
 
 - (NSArray *) domainIds
 {
-  return [[self dictionaryForKey: @"domains"] allKeys];
+  NSDictionary *domains = [self dictionaryForKey: @"domains"];
+  return [domains allKeys];
 }
 
 - (BOOL) enableDomainBasedUID
@@ -266,6 +267,16 @@ _injectConfigurationFromFile (NSMutableDictionary *defaultsDict,
   return [self boolForKey: @"SOGoEnableDomainBasedUID"];
 }
 
+- (BOOL) forbidUnknownDomainsAuth
+{
+  return [self boolForKey: @"SOGoForbidUnknownDomainsAuth"];
+}
+
+- (NSArray *) domainsAllowed
+{
+  return [NSMutableArray arrayWithArray: [self stringArrayForKey: @"SOGoDomainAllowed"]];
+}
+
 - (NSArray *) loginDomains
 {
   NSMutableArray *filteredLoginDomains;

SoObjects/SOGo/SOGoUserManager.m

@@ -607,10 +607,48 @@ static const NSString *kObfuscatedSecondaryEmailKey = @"obfuscatedSecondaryEmail
         {
           *_domain = [username substringFromIndex: r.location+1];
 
-          if (![[[SOGoSystemDefaults sharedSystemDefaults] domainIds] containsObject: *_domain])
+          if (![[sd domainIds] containsObject: *_domain])
             *_domain = nil;
         }
     }
+  
+  // If the domains is unknwon we reject the auth
+  if([sd forbidUnknownDomainsAuth])
+  {
+    NSArray *domainsAllowed, *domainsKnown;
+    NSString *userDomain;
+    NSRange  r;
+    BOOL allowed = NO;
+    if(!*_domain)
+    {
+      r = [username rangeOfString: @"@"];
+      if(r.location != NSNotFound)
+        userDomain = [username substringFromIndex: r.location+1];
+      else
+        userDomain = nil;
+    }
+    else
+      userDomain = *_domain;
+
+    if(!userDomain)
+    {
+      [self errorWithFormat: @"User attempt to login without domain"];
+      return allowed;
+    }
+
+
+    if((domainsAllowed = [sd domainsAllowed]) && [domainsAllowed containsObject: userDomain])
+      allowed = YES;
+    if((domainsKnown = [sd domainIds]) && [domainsKnown containsObject: userDomain])
+      allowed = YES;
+
+    if([domainsKnown length] == 0 && [domainsAllowed length] == 0)
+      [self errorWithFormat: @"SOGoForbidUnknownDomainsAuth is set but sogo don't know any domains"];
+    else if(!allowed)
+      [self errorWithFormat: @"User domain is unknown or not allowed: %@", userDomain];
+    
+    return allowed;
+  }
 
   // We check the fail count per user in memcache (per server). If the
   // fail count reaches X in Y minutes, we deny immediately the

Tests/spec/CalDAVPreventInvitationsSpec.js

@@ -13,6 +13,10 @@ let utility, user, attendee1, attendee1Delegate
 let userCalendar, attendee1Calendar, attendee1DelegateCalendar
 let icsName, icsList, vcalendar
 
+beforeAll(function () {
+  jasmine.DEFAULT_TIMEOUT_INTERVAL = config.timeout || 10000;
+});
+
 describe('PreventInvitations', function() {
 
   const _getEvent = async function(client, calendarName, filename, expectedCode = 200) {

Tests/spec/CalDAVPropertiesSpec.js

@@ -2,6 +2,10 @@ import config from '../lib/config'
 import WebDAV from '../lib/WebDAV'
 import TestUtility from '../lib/utilities'
 
+beforeAll(function () {
+  jasmine.DEFAULT_TIMEOUT_INTERVAL = config.timeout || 10000;
+});
+
 describe('read and set calendar properties', function() {
   const webdav = new WebDAV(config.username, config.password)
   const utility = new TestUtility(webdav)

Tests/spec/CalDAVSchedulingSpec.js

@@ -3,6 +3,10 @@ import WebDAV from '../lib/WebDAV'
 import TestUtility from '../lib/utilities'
 import ICAL from 'ical.js'
 
+beforeAll(function () {
+  jasmine.DEFAULT_TIMEOUT_INTERVAL = config.timeout || 10000;
+});
+
 describe('CalDAV Scheduling', function() {
   const webdav = new WebDAV(config.username, config.password)
   const webdav_su = new WebDAV(config.superuser, config.superuser_password)
@@ -933,5 +937,5 @@ describe('CalDAV Scheduling', function() {
 
     vcalendarInvitationAttendee = await _getEvent(webdavAttendee1, attendee1Calendar, icsName, 404)
     vcalendarInvitationDelegate = await _getEvent(webdavAttendee1Delegate, attendee1DelegateCalendar, icsName, 404)
-  }, 10000) // increase timeout for this long test
+  }) // increase timeout for this long test
 })

Tests/spec/CardDAVSpec.js

@@ -70,6 +70,10 @@ X-AIM:pseudo aim
 END:VCARD`
 }
 
+beforeAll(function () {
+  jasmine.DEFAULT_TIMEOUT_INTERVAL = config.timeout || 10000;
+});
+
 describe('CardDAV extensions', function() {
   const webdav = new WebDAV(config.username, config.password)
   const webdav_su = new WebDAV(config.superuser, config.superuser_password)
@@ -232,7 +236,7 @@ describe('CardDAV extensions', function() {
     expect(emails)
       .withContext(`Returned vCard has email of ${config.attendee1_username} (${config.attendee1})`)
       .toContain(config.attendee1)
-  }, 10000) // increase timeout for this long test
+  }) // increase timeout for this long test
 
   // CARDDAV:addressbook-multiget Report
   // https://datatracker.ietf.org/doc/html/rfc6352#section-8.7

Tests/spec/ConfigSpec.js

@@ -1,5 +1,9 @@
 import config from '../lib/config'
 
+beforeAll(function () {
+  jasmine.DEFAULT_TIMEOUT_INTERVAL = config.timeout || 10000;
+});
+
 describe('config tests', function() {
 
   it('required configuration parameters', async function() {

Tests/spec/DAVAddressBookAclSpec.js

@@ -2,6 +2,10 @@ import config from '../lib/config'
 import WebDAV from '../lib/WebDAV'
 import TestUtility from '../lib/utilities'
 
+beforeAll(function () {
+  jasmine.DEFAULT_TIMEOUT_INTERVAL = config.timeout || 10000;
+});
+
 describe('create, read, modify, delete tasks for regular user', function() {
   const webdav = new WebDAV(config.username, config.password)
   const webdav_su = new WebDAV(config.superuser, config.superuser_password)

Tests/spec/DAVCalendarAclSpec.js

@@ -2,6 +2,10 @@ import config from '../lib/config'
 import WebDAV from '../lib/WebDAV'
 import TestUtility from '../lib/utilities'
 
+beforeAll(function () {
+  jasmine.DEFAULT_TIMEOUT_INTERVAL = config.timeout || 10000;
+});
+
 describe('create, read, modify, delete events for regular user', function() {
   const webdav = new WebDAV(config.username, config.password)
   const webdav_su = new WebDAV(config.superuser, config.superuser_password)

Tests/spec/DAVCalendarAppleiCalSpec.js

@@ -10,6 +10,10 @@ import TestUtility from '../lib/utilities'
  * additional calendars.
  */
 
+beforeAll(function () {
+  jasmine.DEFAULT_TIMEOUT_INTERVAL = config.timeout || 10000;
+});
+
 describe('Apple iCal', function() {
   const webdav = new WebDAV(config.username, config.password)
   const webdav_su = new WebDAV(config.superuser, config.superuser_password)
@@ -229,5 +233,5 @@ describe('Apple iCal', function() {
       .toBe(0)
 
     await webdav_su.deleteObject(otherResource)
-  }, 10000) // increase timeout for this long test
+  }) // increase timeout for this long test
 })

Tests/spec/DAVCalendarClassificationSpec.js

@@ -1,6 +1,10 @@
 import config from '../lib/config'
 import { default as WebDAV, DAVInverse } from '../lib/WebDAV'
 
+beforeAll(function () {
+  jasmine.DEFAULT_TIMEOUT_INTERVAL = config.timeout || 10000;
+});
+
 describe('calendar classification', function() {
   const webdav = new WebDAV(config.username, config.password)
 
@@ -35,7 +39,7 @@ describe('calendar classification', function() {
       expect(status)
           .withContext('Setting an invalid classification')
           .toBe(403)
-    })
+  })
 
   it('setting a valid classification', async function() {
     for (let component of ['events', 'tasks']) {

Tests/spec/DAVCalendarPublicAclSpec.js

@@ -2,6 +2,10 @@ import config from '../lib/config'
 import WebDAV from '../lib/WebDAV'
 import TestUtility from '../lib/utilities'
 
+beforeAll(function () {
+  jasmine.DEFAULT_TIMEOUT_INTERVAL = config.timeout || 10000;
+});
+
 describe('public access', function() {
   const webdav = new WebDAV(config.username, config.password)
   const webdav_anon = new WebDAV()

Tests/spec/DAVCalendarSuperUserAclSpec.js

@@ -2,6 +2,10 @@ import config from '../lib/config'
 import WebDAV from '../lib/WebDAV'
 import TestUtility from '../lib/utilities'
 
+beforeAll(function () {
+  jasmine.DEFAULT_TIMEOUT_INTERVAL = config.timeout || 10000;
+});
+
 describe('DAVCalendarSuperUserAcl', function() {
   const webdav = new WebDAV(config.username, config.password)
   const webdav_su = new WebDAV(config.superuser, config.superuser_password)

Tests/spec/DAVContactsCategoriesSpec.js

@@ -1,6 +1,10 @@
 import config from '../lib/config'
 import { default as WebDAV, DAVInverse } from '../lib/WebDAV'
 
+beforeAll(function () {
+  jasmine.DEFAULT_TIMEOUT_INTERVAL = config.timeout || 10000;
+});
+
 describe('contacts categories', function() {
   const webdav = new WebDAV(config.username, config.password)
 

Tests/spec/DAVPublicAccessSpec.js

@@ -1,6 +1,10 @@
 import config from '../lib/config'
 import WebDAV from '../lib/WebDAV'
 
+beforeAll(function () {
+  jasmine.DEFAULT_TIMEOUT_INTERVAL = config.timeout || 10000;
+});
+
 describe('public access', function() {
   const webdav_anon = new WebDAV()
 

Tests/spec/HTTPCalendarSpec.js

@@ -3,6 +3,10 @@ import WebDAV from '../lib/WebDAV'
 
 let webdav, resource
 
+beforeAll(function () {
+  jasmine.DEFAULT_TIMEOUT_INTERVAL = config.timeout || 10000;
+});
+
 describe('HTTP Calendar', function() {
 
   beforeAll(async function() {

Tests/spec/HTTPPreferencesSpec.js

@@ -3,6 +3,10 @@ import Preferences from '../lib/Preferences'
 
 const prefs = new Preferences(config.username, config.password)
 
+beforeAll(function () {
+  jasmine.DEFAULT_TIMEOUT_INTERVAL = config.timeout || 10000;
+});
+
 describe('preferences', function() {
 
   // preferencesTest

Tests/spec/MailDAVSpec.js

@@ -152,6 +152,10 @@ let msg3Size = 720
 let webdav, utility
 let user, resource, mailboxesList
 
+beforeAll(function () {
+  jasmine.DEFAULT_TIMEOUT_INTERVAL = config.timeout || 10000;
+});
+
 // DAVMailCollectionTest
 
 describe('MailDAV', function() {

Tests/spec/SieveSpec.js

@@ -6,6 +6,10 @@ import ManageSieve from '../lib/ManageSieve'
 
 let prefs, webdav, utility, manageSieve, user
 
+beforeAll(function () {
+  jasmine.DEFAULT_TIMEOUT_INTERVAL = config.timeout || 10000;
+});
+
 describe('Sieve', function() {
 
   async function _getSogoSieveScript() {

Tests/spec/SogoToolSpec.js

@@ -5,6 +5,10 @@ const os = require('os')
 const path = require('path')
 const { execSync } = require('child_process')
 
+beforeAll(function () {
+  jasmine.DEFAULT_TIMEOUT_INTERVAL = config.timeout || 10000;
+});
+
 describe('sogo-tool tests', function() {
   let tmpdir, isRoot
 

Tests/spec/WebDAVSpec.js

@@ -2,6 +2,10 @@ import config from '../lib/config'
 import WebDAV from '../lib/WebDAV'
 import TestUtility from '../lib/utilities'
 
+beforeAll(function () {
+  jasmine.DEFAULT_TIMEOUT_INTERVAL = config.timeout || 10000;
+});
+
 describe('WebDAV', function() {
   var webdav
   var utility

Tests/spec/WebDavSyncSpec.js

@@ -3,6 +3,10 @@ import WebDAV from '../lib/WebDAV'
 import { DAVNamespace, DAVNamespaceShorthandMap } from 'tsdav'
 import convert from 'xml-js'
 
+beforeAll(function () {
+  jasmine.DEFAULT_TIMEOUT_INTERVAL = config.timeout || 10000;
+});
+
 describe('webdav sync', function() {
   const webdav = new WebDAV(config.username, config.password)
   const webdav_su = new WebDAV(config.superuser, config.superuser_password)

packaging/debian/rules

@@ -73,6 +73,11 @@ ifeq ($(DIST_CODENAME), noble)
 MFA_CONFIG=--enable-mfa
 endif
 
+# All other cases
+ifeq ($(MFA_CONFIG),)
+MFA_CONFIG=--enable-mfa
+endif
+
 include /etc/GNUstep/GNUstep.conf
 include /usr/share/GNUstep/Makefiles/common.make