ported from mozilla: Bug 1538409 - implement oAuth authentication for POP accounts r=benc a=mkmelin (f6219b04be)

2026-08-15 08:53:07 +09:00 · 2024-09-21 18:23:52 +08:00 · 2024-09-21 18:23:52 +08:00 · 08feac8e97
commit 08feac8e97
parent 2dfde2a62e
6 changed files with 212 additions and 35 deletions
--- a/mailnews/base/prefs/content/am-server.js
+++ b/mailnews/base/prefs/content/am-server.js
@ -30,10 +30,12 @@ function onInit(aPageId, aServerId)
  if (serverType == "imap")
    setupImapDeleteUI(aServerId);

-  // TLS Cert (External) and OAuth2 are only supported on IMAP.
 #ifdef MOZ_MAILNEWS_OAUTH2
-  document.getElementById("authMethod-oauth2").hidden = (serverType != "imap");
+  // OAuth2 are only supported on IMAP and POP.
+  document.getElementById("authMethod-oauth2").hidden =
+    serverType != "imap" && serverType != "pop3";
 #endif
+  // TLS Cert (External) and OAuth2 are only supported on IMAP.
  document.getElementById("authMethod-external").hidden = (serverType != "imap");

  // "STARTTLS, if available" is vulnerable to MITM attacks so we shouldn't
--- a/mailnews/base/prefs/content/am-smtp.js
+++ b/mailnews/base/prefs/content/am-smtp.js
@ -5,6 +5,9 @@

 Components.utils.import("resource://gre/modules/Services.jsm");
 Components.utils.import("resource:///modules/mailServices.js");
+#ifdef MOZ_MAILNEWS_OAUTH2
+Components.utils.import("resource:///modules/OAuth2Providers.js");
+#endif

 var gSmtpServerListWindow =
 {
@ -155,9 +158,19 @@ var gSmtpServerListWindow =
        Components.utils.reportError("Warning: unknown value for smtpserver... authMethod: " +
          aServer.authMethod);
    }
-    if (authStr)
+    if (authStr) {
+#ifdef MOZ_MAILNEWS_OAUTH2
+      let details = OAuth2Providers.getHostnameDetails(aServer.hostname);
+      if (!details) {
+        document
+          .getElementById("authMethod-oauth2")
+          .toggleAttribute("disabled", true);
+      }
+#endif
+
      document.getElementById("authMethodValue").value =
          this.mBundle.getString(authStr);
+    }
  },

  refreshServerList: function(aServerKeyToSelect, aFocusList)
--- a/mailnews/base/util/OAuth2Providers.jsm
+++ b/mailnews/base/util/OAuth2Providers.jsm
@ -13,16 +13,20 @@ var {classes: Cc, interfaces: Ci, results: Cr, utils: Cu} = Components;
 var kHostnames = new Map([
  ["imap.googlemail.com", ["accounts.google.com", "https://mail.google.com/"]],
  ["smtp.googlemail.com", ["accounts.google.com", "https://mail.google.com/"]],
+  ["pop.googlemail.com", ["accounts.google.com", "https://mail.google.com/"]],
  ["imap.gmail.com", ["accounts.google.com", "https://mail.google.com/"]],
  ["smtp.gmail.com", ["accounts.google.com", "https://mail.google.com/"]],
+  ["pop.gmail.com", ["accounts.google.com", "https://mail.google.com/"]],

  ["imap.mail.ru", ["o2.mail.ru", "mail.imap"]],
  ["smtp.mail.ru", ["o2.mail.ru", "mail.imap"]],

  ["imap.mail.yahoo.com", ["login.yahoo.com", "mail-w"]],
+  ["pop.mail.yahoo.com", ["login.yahoo.com", "mail-w"]],
  ["smtp.mail.yahoo.com", ["login.yahoo.com", "mail-w"]],

  ["imap.aol.com", ["login.aol.com", "mail-w"]],
+  ["pop.aol.com", ["login.aol.com", "mail-w"]],
  ["smtp.aol.com", ["login.aol.com", "mail-w"]],

  ["outlook.office365.com", [
--- a/mailnews/imap/src/nsImapProtocol.cpp
+++ b/mailnews/imap/src/nsImapProtocol.cpp
@ -5618,6 +5618,11 @@ void nsImapProtocol::InitPrefAuthMethods(int32_t authMethodPrefValue)
            kHasAuthGssApiCapability |
            kHasAuthNTLMCapability | kHasAuthMSNCapability;
        break;
+#ifdef MOZ_MAILNEWS_OAUTH2
+      case nsMsgAuthMethod::OAuth2:
+        m_prefAuthMethods = kHasXOAuth2Capability;
+        break;
+#endif
      default:
        NS_ASSERTION(false, "IMAP: authMethod pref invalid");
        // TODO log to error console
@ -5632,9 +5637,6 @@ void nsImapProtocol::InitPrefAuthMethods(int32_t authMethodPrefValue)
            kHasAuthNTLMCapability | kHasAuthMSNCapability |
 #ifdef MOZ_MAILNEWS_OAUTH2
            kHasAuthExternalCapability | kHasXOAuth2Capability;
-        break;
-      case nsMsgAuthMethod::OAuth2:
-        m_prefAuthMethods = kHasXOAuth2Capability;
 #else
            kHasAuthExternalCapability;
 #endif
@ -5643,13 +5645,16 @@ void nsImapProtocol::InitPrefAuthMethods(int32_t authMethodPrefValue)
    }

 #ifdef MOZ_MAILNEWS_OAUTH2
-    if (m_prefAuthMethods & kHasXOAuth2Capability)
+    if (m_prefAuthMethods & kHasXOAuth2Capability) {
      mOAuth2Support = new mozilla::mailnews::OAuth2ThreadHelper(aServer);
-
-    // Disable OAuth2 support if we don't have the prefs installed.
-    if (m_prefAuthMethods & kHasXOAuth2Capability &&
-        (!mOAuth2Support || !mOAuth2Support->SupportsOAuth2()))
-      m_prefAuthMethods &= ~kHasXOAuth2Capability;
+      if (!mOAuth2Support || !mOAuth2Support->SupportsOAuth2()) {
+        // Disable OAuth2 support if we don't have the prefs installed.
+        m_prefAuthMethods &= ~kHasXOAuth2Capability;
+        mOAuth2Support = nullptr;
+        MOZ_LOG(IMAP, LogLevel::Warning,
+                ("IMAP: no OAuth2 support for this server."));
+      }
+    }
 #endif

    NS_ASSERTION(m_prefAuthMethods != kCapabilityUndefined,
@ -5706,17 +5711,17 @@ nsresult nsImapProtocol::ChooseAuthMethod()
    m_currentAuthMethod = kHasAuthOldLoginCapability;
  else
  {
-    MOZ_LOG(IMAP, LogLevel::Debug, ("no remaining auth method"));
+    MOZ_LOG(IMAP, LogLevel::Debug, ("No remaining auth method"));
    m_currentAuthMethod = kCapabilityUndefined;
    return NS_ERROR_FAILURE;
  }
-  MOZ_LOG(IMAP, LogLevel::Debug, ("trying auth method 0x%llx", m_currentAuthMethod));
+  MOZ_LOG(IMAP, LogLevel::Debug, ("Trying auth method 0x%llx", m_currentAuthMethod));
  return NS_OK;
 }

 void nsImapProtocol::MarkAuthMethodAsFailed(eIMAPCapabilityFlags failedAuthMethod)
 {
-  MOZ_LOG(IMAP, LogLevel::Debug, ("marking auth method 0x%llx failed", failedAuthMethod));
+  MOZ_LOG(IMAP, LogLevel::Debug, ("Marking auth method 0x%llx failed", failedAuthMethod));
  m_failedAuthMethods |= failedAuthMethod;
 }

@ -8594,7 +8599,7 @@ nsImapProtocol::OnPromptCanceled()

 bool nsImapProtocol::TryToLogon()
 {
-  MOZ_LOG(IMAP, LogLevel::Debug, ("try to log in"));
+  MOZ_LOG(IMAP, LogLevel::Debug, ("Try to log in"));
  NS_ENSURE_TRUE(m_imapServerSink, false);
  bool loginSucceeded = false;
  bool skipLoop = false;
--- a/mailnews/local/src/nsPop3Protocol.cpp
+++ b/mailnews/local/src/nsPop3Protocol.cpp
@ -440,6 +440,9 @@ NS_IMPL_RELEASE_INHERITED(nsPop3Protocol, nsMsgProtocol)

 NS_INTERFACE_MAP_BEGIN(nsPop3Protocol)
  NS_INTERFACE_MAP_ENTRY(nsIPop3Protocol)
+#ifdef MOZ_MAILNEWS_OAUTH2
+  NS_INTERFACE_MAP_ENTRY(msgIOAuth2ModuleListener)
+#endif
  NS_INTERFACE_MAP_ENTRY(nsIMsgAsyncPromptListener)
 NS_INTERFACE_MAP_END_INHERITING(nsMsgProtocol)

@ -490,6 +493,18 @@ nsresult nsPop3Protocol::Initialize(nsIURI * aURL)
      mailnewsUrl->GetServer(getter_AddRefs(server));
      NS_ENSURE_TRUE(server, NS_MSG_INVALID_OR_MISSING_SERVER);

+#ifdef MOZ_MAILNEWS_OAUTH2
+      // Query for OAuth2 support. If the POP server preferences don't allow
+      // for OAuth2, then don't carry around the OAuth2 module any longer
+      // since we won't need it.
+      mOAuth2Support = do_CreateInstance(MSGIOAUTH2MODULE_CONTRACTID);
+        if (mOAuth2Support) {
+        bool supportsOAuth = false;
+        mOAuth2Support->InitFromMail(server, &supportsOAuth);
+        if (!supportsOAuth) mOAuth2Support = nullptr;
+      }
+#endif
+
      rv = server->GetSocketType(&m_socketType);
      NS_ENSURE_SUCCESS(rv,rv);

@ -1362,10 +1377,9 @@ int32_t nsPop3Protocol::Pop3SendData(const char * dataBuffer, bool aSuppressLogg
  return -1;
 }

-/*
+/**
 * POP3 AUTH extension
 */
-
 int32_t nsPop3Protocol::SendAuth()
 {
  MOZ_LOG(POP3LOGMODULE, LogLevel::Debug, (POP3LOG("SendAuth()")));
@ -1437,6 +1451,10 @@ int32_t nsPop3Protocol::AuthResponse(nsIInputStream* inputStream,
        SetCapFlag(POP3_HAS_AUTH_PLAIN);
    else if (!PL_strcasecmp (line, "LOGIN"))
        SetCapFlag(POP3_HAS_AUTH_LOGIN);
+#ifdef MOZ_MAILNEWS_OAUTH2
+    else if (!PL_strcasecmp(line, "XOAUTH2"))
+        SetCapFlag(POP3_HAS_AUTH_XOAUTH2);
+#endif

    PR_Free(line);
    return 0;
@ -1546,6 +1564,11 @@ int32_t nsPop3Protocol::CapaResponse(nsIInputStream* inputStream,
        if (responseLine.Find("MSN", CaseInsensitiveCompare) >= 0)
          SetCapFlag(POP3_HAS_AUTH_NTLM|POP3_HAS_AUTH_MSN);

+#ifdef MOZ_MAILNEWS_OAUTH2
+        if (responseLine.Find("XOAUTH2", CaseInsensitiveCompare) >= 0)
+          SetCapFlag(POP3_HAS_AUTH_XOAUTH2|POP3_HAS_AUTH_MSN);
+#endif
+
        m_pop3Server->SetPop3CapabilityFlags(m_pop3ConData->capability_flags);
    }

@ -1628,6 +1651,11 @@ void nsPop3Protocol::InitPrefAuthMethods(int32_t authMethodPrefValue)
    case nsMsgAuthMethod::GSSAPI:
      m_prefAuthMethods = POP3_HAS_AUTH_GSSAPI;
      break;
+#ifdef MOZ_MAILNEWS_OAUTH2
+    case nsMsgAuthMethod::OAuth2:
+      m_prefAuthMethods = POP3_HAS_AUTH_XOAUTH2;
+      break;
+#endif
    case nsMsgAuthMethod::secure:
      m_prefAuthMethods = POP3_HAS_AUTH_APOP |
          POP3_HAS_AUTH_CRAM_MD5 | POP3_HAS_AUTH_GSSAPI |
@ -1641,14 +1669,26 @@ void nsPop3Protocol::InitPrefAuthMethods(int32_t authMethodPrefValue)
      // fall to any
      MOZ_FALLTHROUGH;
    case nsMsgAuthMethod::anything:
-      m_prefAuthMethods = POP3_HAS_AUTH_USER |
-          POP3_HAS_AUTH_LOGIN | POP3_HAS_AUTH_PLAIN |
-          POP3_HAS_AUTH_CRAM_MD5 | POP3_HAS_AUTH_APOP |
-          POP3_HAS_AUTH_GSSAPI |
+      m_prefAuthMethods =
+          POP3_HAS_AUTH_USER | POP3_HAS_AUTH_LOGIN | POP3_HAS_AUTH_PLAIN |
+          POP3_HAS_AUTH_CRAM_MD5 | POP3_HAS_AUTH_APOP | POP3_HAS_AUTH_GSSAPI |
+#ifdef MOZ_MAILNEWS_OAUTH2
+          POP3_HAS_AUTH_NTLM | POP3_HAS_AUTH_MSN | POP3_HAS_AUTH_XOAUTH2;
+#else
          POP3_HAS_AUTH_NTLM | POP3_HAS_AUTH_MSN;
+#endif
+
      // TODO needed?
      break;
  }
+
+#ifdef MOZ_MAILNEWS_OAUTH2
+  // Only enable OAuth2 support if we can do the lookup.
+  if ((m_prefAuthMethods & POP3_HAS_AUTH_XOAUTH2) && !mOAuth2Support) {
+    m_prefAuthMethods &= ~POP3_HAS_AUTH_XOAUTH2;  // disable it
+  }
+#endif
+
  NS_ASSERTION(m_prefAuthMethods != POP3_AUTH_MECH_UNDEFINED,
      "POP: InitPrefAuthMethods() didn't work");
 }
@ -1665,12 +1705,44 @@ nsresult nsPop3Protocol::ChooseAuthMethod()
  MOZ_LOG(POP3LOGMODULE, LogLevel::Debug,
          (POP3LOG("POP auth: server caps 0x%X, pref 0x%X, failed 0x%X, avail caps 0x%X"),
           GetCapFlags(), m_prefAuthMethods, m_failedAuthMethods, availCaps));
+#ifdef MOZ_MAILNEWS_OAUTH2
  MOZ_LOG(POP3LOGMODULE, LogLevel::Debug,
          (POP3LOG("(GSSAPI = 0x%X, CRAM = 0x%X, APOP = 0x%X, NTLM = 0x%X, "
-           "MSN =  0x%X, PLAIN = 0x%X, LOGIN = 0x%X, USER/PASS = 0x%X)"),
+                   "MSN = 0x%X, PLAIN = 0x%X, LOGIN = 0x%X, USER/PASS = 0x%X, "
+                   "XOAUTH2 = 0x%X)"),
+           POP3_HAS_AUTH_GSSAPI, POP3_HAS_AUTH_CRAM_MD5, POP3_HAS_AUTH_APOP,
+           POP3_HAS_AUTH_NTLM, POP3_HAS_AUTH_MSN, POP3_HAS_AUTH_PLAIN,
+           POP3_HAS_AUTH_LOGIN, POP3_HAS_AUTH_USER, POP3_HAS_AUTH_XOAUTH2));
+#else
+  MOZ_LOG(POP3LOGMODULE, LogLevel::Debug,
+          (POP3LOG("(GSSAPI = 0x%X, CRAM = 0x%X, APOP = 0x%X, NTLM = 0x%X, "
+                   "MSN = 0x%X, PLAIN = 0x%X, LOGIN = 0x%X, USER/PASS = 0x%X)"),
           POP3_HAS_AUTH_GSSAPI, POP3_HAS_AUTH_CRAM_MD5, POP3_HAS_AUTH_APOP,
           POP3_HAS_AUTH_NTLM, POP3_HAS_AUTH_MSN, POP3_HAS_AUTH_PLAIN,
           POP3_HAS_AUTH_LOGIN, POP3_HAS_AUTH_USER));
+#endif
+
+#ifdef MOZ_MAILNEWS_OAUTH2
+  MOZ_LOG(POP3LOGMODULE, LogLevel::Debug,
+      (POP3LOG("(Ehabled - GSSAPI=%d, CRAM=%d, APOP=%d, NTLM=%d, "
+               "MSN=%d, PLAIN=%d, LOGIN=%d, USER/PASS=%d, "
+               "XOAUTH2=%d)"),
+       !!(POP3_HAS_AUTH_GSSAPI & availCaps),
+       !!(POP3_HAS_AUTH_CRAM_MD5 & availCaps),
+       !!(POP3_HAS_AUTH_APOP & availCaps), !!(POP3_HAS_AUTH_NTLM & availCaps),
+       !!(POP3_HAS_AUTH_MSN & availCaps), !!(POP3_HAS_AUTH_PLAIN & availCaps),
+       !!(POP3_HAS_AUTH_LOGIN & availCaps), !!(POP3_HAS_AUTH_USER & availCaps),
+       !!(POP3_HAS_AUTH_XOAUTH2 & availCaps)));
+#else
+  MOZ_LOG(POP3LOGMODULE, LogLevel::Debug,
+      (POP3LOG("(Ehabled - GSSAPI=%d, CRAM=%d, APOP=%d, NTLM=%d, "
+               "MSN=%d, PLAIN=%d, LOGIN=%d, USER/PASS=%d)"),
+       !!(POP3_HAS_AUTH_GSSAPI & availCaps),
+       !!(POP3_HAS_AUTH_CRAM_MD5 & availCaps),
+       !!(POP3_HAS_AUTH_APOP & availCaps), !!(POP3_HAS_AUTH_NTLM & availCaps),
+       !!(POP3_HAS_AUTH_MSN & availCaps), !!(POP3_HAS_AUTH_PLAIN & availCaps),
+       !!(POP3_HAS_AUTH_LOGIN & availCaps), !!(POP3_HAS_AUTH_USER & availCaps)));
+#endif

  if (POP3_HAS_AUTH_GSSAPI & availCaps)
    m_currentAuthMethod = POP3_HAS_AUTH_GSSAPI;
@ -1688,22 +1760,27 @@ nsresult nsPop3Protocol::ChooseAuthMethod()
    m_currentAuthMethod = POP3_HAS_AUTH_LOGIN;
  else if (POP3_HAS_AUTH_USER & availCaps)
    m_currentAuthMethod = POP3_HAS_AUTH_USER;
+#ifdef MOZ_MAILNEWS_OAUTH2
+  else if (POP3_HAS_AUTH_XOAUTH2 & availCaps)
+    m_currentAuthMethod = POP3_HAS_AUTH_XOAUTH2;
+#endif
+
  else
  {
    // there are no matching login schemes at all, per server and prefs
    m_currentAuthMethod = POP3_AUTH_MECH_UNDEFINED;
-    MOZ_LOG(POP3LOGMODULE, LogLevel::Debug, (POP3LOG("no auth method remaining")));
+    MOZ_LOG(POP3LOGMODULE, LogLevel::Debug, (POP3LOG("No auth method remaining")));
    return NS_ERROR_FAILURE;
  }
  MOZ_LOG(POP3LOGMODULE, LogLevel::Debug,
-          (POP3LOG("trying auth method 0x%X"), m_currentAuthMethod));
+          (POP3LOG("Trying auth method 0x%X"), m_currentAuthMethod));
  return NS_OK;
 }

 void nsPop3Protocol::MarkAuthMethodAsFailed(int32_t failedAuthMethod)
 {
  MOZ_LOG(POP3LOGMODULE, LogLevel::Debug,
-          (POP3LOG("marking auth method 0x%X failed"), failedAuthMethod));
+          (POP3LOG("Marking auth method 0x%X failed"), failedAuthMethod));
  m_failedAuthMethods |= failedAuthMethod;
 }

@ -1712,7 +1789,7 @@ void nsPop3Protocol::MarkAuthMethodAsFailed(int32_t failedAuthMethod)
 */
 void nsPop3Protocol::ResetAuthMethods()
 {
-  MOZ_LOG(POP3LOGMODULE, LogLevel::Debug, (POP3LOG("resetting (failed) auth methods")));
+  MOZ_LOG(POP3LOGMODULE, LogLevel::Debug, (POP3LOG("Resetting (failed) auth methods")));
  m_currentAuthMethod = POP3_AUTH_MECH_UNDEFINED;
  m_failedAuthMethods = 0;
 }
@ -1821,6 +1898,13 @@ int32_t nsPop3Protocol::ProcessAuth()
        m_pop3ConData->command_succeeded = true;
        m_pop3ConData->next_state = POP3_NEXT_AUTH_STEP;
        break;
+#ifdef MOZ_MAILNEWS_OAUTH2
+      case POP3_HAS_AUTH_XOAUTH2:
+        MOZ_LOG(POP3LOGMODULE, LogLevel::Debug, (POP3LOG("POP XOAUTH2")));
+        m_pop3ConData->command_succeeded = true;
+        m_pop3ConData->next_state = POP3_AUTH_OAUTH2_RESPONSE;
+        break;
+#endif
      default:
        MOZ_LOG(POP3LOGMODULE, LogLevel::Error,
                (POP3LOG("POP: m_currentAuthMethod has unknown value")));
@ -1832,6 +1916,52 @@ int32_t nsPop3Protocol::ProcessAuth()
    return 0;
 }

+#ifdef MOZ_MAILNEWS_OAUTH2
+int32_t nsPop3Protocol::AuthOAuth2Response() {
+  if (!mOAuth2Support) {
+    return Error("pop3AuthMechNotSupported");
+  }
+  nsresult rv = mOAuth2Support->Connect(true, this);
+  if (NS_FAILED(rv)) {
+    MOZ_LOG(POP3LOGMODULE, LogLevel::Error,
+            (POP3LOG("OAuth2 authorizattion failed")));
+    return -1;
+  }
+  m_pop3ConData->pause_for_read = true;
+  return 0;
+}
+
+/** msgIOAuth2ModuleListener implementation */
+nsresult nsPop3Protocol::OnSuccess(const nsACString &aOAuth2String) {
+  MOZ_ASSERT(mOAuth2Support, "Can't do anything without OAuth2 support");
+  // Send the AUTH XOAUTH2 command, and then siphon us back to the regular
+  // authentication login stream.
+  nsAutoCString cmd;
+  cmd.AppendLiteral("AUTH XOAUTH2 ");
+  cmd += aOAuth2String;
+  cmd += CRLF;
+  m_pop3ConData->next_state = POP3_WAIT_FOR_RESPONSE;
+  m_pop3ConData->next_state_after_response = POP3_NEXT_AUTH_STEP;
+  m_pop3ConData->pause_for_read = true;
+  m_password_already_sent = true;
+  if (Pop3SendData(cmd.get(), true)) {
+    MOZ_LOG(POP3LOGMODULE, LogLevel::Error,
+            (POP3LOG("POP: XOAUTH2 authentication failed")));
+    m_pop3ConData->next_state = POP3_ERROR_DONE;
+  }
+  ProcessProtocolState(nullptr, nullptr, 0, 0);
+  return NS_OK;
+}
+
+/** msgIOAuth2ModuleListener implementation */
+nsresult nsPop3Protocol::OnFailure(nsresult aError) {
+  MOZ_LOG(POP3LOGMODULE, mozilla::LogLevel::Debug,
+          ("OAuth2 login error %08x", (uint32_t)aError));
+  m_pop3ConData->next_state = POP3_ERROR_DONE;
+  return ProcessProtocolState(nullptr, nullptr, 0, 0);
+}
+#endif
+
 /**
 * state POP3_NEXT_AUTH_STEP
 * This is called when we finished one auth step (e.g. sending username
@ -1846,7 +1976,7 @@ int32_t nsPop3Protocol::NextAuthStep()
        if (m_password_already_sent || // (also true for GSSAPI)
            m_currentAuthMethod == POP3_HAS_AUTH_NONE)
        {
-            MOZ_LOG(POP3LOGMODULE, LogLevel::Debug, (POP3LOG("login succeeded")));
+            MOZ_LOG(POP3LOGMODULE, LogLevel::Debug, (POP3LOG("Login succeeded")));
            m_nsIPop3Sink->SetUserAuthenticated(true);
            ClearFlag(POP3_PASSWORD_FAILED);
            if (m_pop3ConData->verify_logon)
@ -3851,6 +3981,12 @@ nsresult nsPop3Protocol::ProcessProtocolState(nsIURI * url, nsIInputStream * aIn
      status = AuthGSSAPIResponse(false);
      break;

+#ifdef MOZ_MAILNEWS_OAUTH2
+    case POP3_AUTH_OAUTH2_RESPONSE:
+      status = AuthOAuth2Response();
+      break;
+#endif
+
    case POP3_SEND_USERNAME:
      if (NS_FAILED(StartGetAsyncPassword(POP3_OBTAIN_PASSWORD_BEFORE_USERNAME)))
        status = -1;
--- a/mailnews/local/src/nsPop3Protocol.h
+++ b/mailnews/local/src/nsPop3Protocol.h
@ -22,6 +22,9 @@
 #include "nsIAuthModule.h"
 #include "nsITimer.h"
 #include "nsIMsgAsyncPrompter.h"
+#ifdef MOZ_MAILNEWS_OAUTH2
+#include "msgIOAuth2Module.h"
+#endif

 #include "prerror.h"
 #include "plhash.h"
@ -53,11 +56,6 @@ and change the POP3_QUIT_RESPONSE state to flush the newly committed deletes. */

 #define OUTPUT_BUFFER_SIZE 8192 // maximum size of command string

-/* structure to hold data pertaining to the active state of
- * a transfer in progress.
- *
- */
-
 enum Pop3CapabilityEnum {
    POP3_CAPABILITY_UNDEFINED   = 0x00000000,
    POP3_HAS_XSENDER            = 0x00000001,
@ -80,7 +78,8 @@ enum Pop3CapabilityEnum {
    POP3_HAS_RESP_CODES         = 0x00020000,
    POP3_HAS_AUTH_RESP_CODE     = 0x00040000,
    POP3_HAS_STLS               = 0x00080000,
-    POP3_HAS_AUTH_GSSAPI        = 0x00100000
+    POP3_HAS_AUTH_GSSAPI        = 0x00100000,
+    POP3_HAS_AUTH_XOAUTH2       = 0x00200000
 };

 // TODO use value > 0?
@ -153,7 +152,10 @@ enum Pop3StatesEnum {
    POP3_OBTAIN_PASSWORD_BEFORE_USERNAME,       // 47
    POP3_FINISH_OBTAIN_PASSWORD_BEFORE_USERNAME,// 48
    POP3_OBTAIN_PASSWORD_BEFORE_PASSWORD,       // 49
-    POP3_FINISH_OBTAIN_PASSWORD_BEFORE_PASSWORD // 50
+    POP3_FINISH_OBTAIN_PASSWORD_BEFORE_PASSWORD,// 50
+
+    POP3_SUSPENDED,                             // 51
+    POP3_AUTH_OAUTH2_RESPONSE,                  // 52
 };


@ -251,12 +253,18 @@ typedef struct _Pop3ConData {

 class nsPop3Protocol : public nsMsgProtocol,
                       public nsIPop3Protocol,
+#ifdef MOZ_MAILNEWS_OAUTH2
+                       public msgIOAuth2ModuleListener,
+#endif
                       public nsIMsgAsyncPromptListener
 {
 public:
  explicit nsPop3Protocol(nsIURI* aURL);

  NS_DECL_ISUPPORTS_INHERITED
+#ifdef MOZ_MAILNEWS_OAUTH2
+  NS_DECL_MSGIOAUTH2MODULELISTENER
+#endif
  NS_DECL_NSIPOP3PROTOCOL
  NS_DECL_NSIMSGASYNCPROMPTLISTENER

@ -365,6 +373,9 @@ private:
  int32_t NextAuthStep();
  int32_t AuthLogin();
  int32_t AuthLoginResponse();
+#ifdef MOZ_MAILNEWS_OAUTH2
+  int32_t AuthOAuth2Response();
+#endif
  int32_t AuthNtlm();
  int32_t AuthNtlmResponse();
  int32_t AuthGSSAPI();
@ -397,6 +408,12 @@ private:

  Pop3StatesEnum GetNextPasswordObtainState();
  nsresult RerunUrl();
+
+#ifdef MOZ_MAILNEWS_OAUTH2
+  // The support module for OAuth2 logon, only present if OAuth2 is enabled
+  // and working.
+  nsCOMPtr<msgIOAuth2Module> mOAuth2Support;
+#endif
 };

 #endif /* nsPop3Protocol_h__ */