auth-request-handler.c revision fda2c460c58f50bf035680187be606542a8c1dac
76b43e4417bab52e913da39b5f5bc2a130d3f149Timo Sirainen/* Copyright (C) 2005 Timo Sirainen */
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen auth_request_callback_t *callback, void *context,
657afb33796f8216c568ad813627da89970760beTimo Sirainen pool = pool_alloconly_create("auth request handler", 4096);
657afb33796f8216c568ad813627da89970760beTimo Sirainen handler = p_new(pool, struct auth_request_handler, 1);
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen handler->requests = hash_create(default_pool, pool, 0, NULL, NULL);
3ccab0bac68040f179a7de45c516cec258e28fdbTimo Sirainenvoid auth_request_handler_unref(struct auth_request_handler **_handler)
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen struct auth_request_handler *handler = *_handler;
3ccab0bac68040f179a7de45c516cec258e28fdbTimo Sirainen /* notify parent that we're done with all requests */
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainenvoid auth_request_handler_set(struct auth_request_handler *handler,
70905e51a5148bd5613cb04720807177474a2496Timo Sirainenstatic void auth_request_handler_remove(struct auth_request_handler *handler,
657afb33796f8216c568ad813627da89970760beTimo Sirainen hash_remove(handler->requests, POINTER_CAST(request->id));
657afb33796f8216c568ad813627da89970760beTimo Sirainenvoid auth_request_handler_check_timeouts(struct auth_request_handler *handler)
657afb33796f8216c568ad813627da89970760beTimo Sirainen if (request->last_access + AUTH_REQUEST_TIMEOUT < ioloop_time)
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen auth_request_handler_remove(handler, request);
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainenstatic const char *get_client_extra_fields(struct auth_request *request)
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen if (auth_stream_is_empty(request->extra_fields))
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen extra_fields = auth_stream_reply_export(request->extra_fields);
662a9000b1788f1cdf765e6b1c89df9a42cc3e32Timo Sirainen /* we only wish to remove all fields prefixed with "userdb_" */
bbf81c8fc6f21382707673dc6bd7b87ffc27981bTimo Sirainen for (src = dest = 0; fields[src] != NULL; src++) {
1e0bdb2d0fa7bbd0a0a254754680f6c6d0195333Timo Sirainen if (strncmp(fields[src], "userdb_", 7) != 0) {
226259ee6fb9830dafc1a5ba1e95bf5a4345b406Timo Sirainen if (!seen_pass && strncmp(fields[src], "pass=", 5) == 0)
1e0bdb2d0fa7bbd0a0a254754680f6c6d0195333Timo Sirainen if (request->proxy && !seen_pass && request->mech_password != NULL) {
662a9000b1788f1cdf765e6b1c89df9a42cc3e32Timo Sirainen /* we're proxying - send back the password that was
662a9000b1788f1cdf765e6b1c89df9a42cc3e32Timo Sirainen sent by user (not the password in passdb). */
226259ee6fb9830dafc1a5ba1e95bf5a4345b406Timo Sirainen str_printfa(str, "\tpass=%s", request->mech_password);
ccef83820a01bb37ad48653a05a9c5aa6560826aTimo Sirainenstatic void auth_callback(struct auth_request *request,
ccef83820a01bb37ad48653a05a9c5aa6560826aTimo Sirainen struct auth_request_handler *handler = request->context;
ccef83820a01bb37ad48653a05a9c5aa6560826aTimo Sirainen str = t_str_new(128 + MAX_BASE64_ENCODED_SIZE(reply_size));
226259ee6fb9830dafc1a5ba1e95bf5a4345b406Timo Sirainen handler->callback(str_c(str), handler->context);
2872c818f9c6704609f4d67d984b033a63e3a108Timo Sirainen str_printfa(str, "OK\t%u\tuser=%s", request->id, request->user);
2872c818f9c6704609f4d67d984b033a63e3a108Timo Sirainen if (request->no_login || handler->master_callback == NULL) {
2872c818f9c6704609f4d67d984b033a63e3a108Timo Sirainen /* this request doesn't have to wait for master
2872c818f9c6704609f4d67d984b033a63e3a108Timo Sirainen process to pick it up. delete it */
226259ee6fb9830dafc1a5ba1e95bf5a4345b406Timo Sirainen auth_request_handler_remove(handler, request);
2872c818f9c6704609f4d67d984b033a63e3a108Timo Sirainen handler->callback(str_c(str), handler->context);
2872c818f9c6704609f4d67d984b033a63e3a108Timo Sirainen /* we came here from flush_failures() */
2872c818f9c6704609f4d67d984b033a63e3a108Timo Sirainen handler->callback(str_c(str), handler->context);
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen /* remove the request from requests-list */
226259ee6fb9830dafc1a5ba1e95bf5a4345b406Timo Sirainen auth_request_handler_remove(handler, request);
226259ee6fb9830dafc1a5ba1e95bf5a4345b406Timo Sirainen /* passdb specifically requested not to delay the
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen handler->callback(str_c(str), handler->context);
226259ee6fb9830dafc1a5ba1e95bf5a4345b406Timo Sirainen /* failure. don't announce it immediately to avoid
226259ee6fb9830dafc1a5ba1e95bf5a4345b406Timo Sirainen a) timing attacks, b) flooding */
0fec6dfc23e568bae53f03c9491df7f64473dd67Timo Sirainen /* NOTE: request may be destroyed now */
226259ee6fb9830dafc1a5ba1e95bf5a4345b406Timo Sirainenstatic void auth_request_handler_auth_fail(struct auth_request_handler *handler,
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen auth_request_log_info(request, request->mech->mech_name, "%s", reason);
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen str_printfa(reply, "FAIL\t%u\treason=%s", request->id, reason);
226259ee6fb9830dafc1a5ba1e95bf5a4345b406Timo Sirainen handler->callback(str_c(reply), handler->context);
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen auth_request_handler_remove(handler, request);
226259ee6fb9830dafc1a5ba1e95bf5a4345b406Timo Sirainenbool auth_request_handler_auth_begin(struct auth_request_handler *handler,
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen const char *const *list, *name, *arg, *initial_resp;
708ea1c397d89586af66c97d74c907f3f2b95134Timo Sirainen unsigned int id;
e5dec382163b476bed16dbf7eb470913a9bbdbe1Timo Sirainen /* <id> <mechanism> [...] */
226259ee6fb9830dafc1a5ba1e95bf5a4345b406Timo Sirainen "sent broken AUTH request", handler->client_pid);
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen id = (unsigned int)strtoul(list[0], NULL, 10);
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen /* unsupported mechanism */
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen i_error("BUG: Authentication client %u requested unsupported "
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen "authentication mechanism %s", handler->client_pid,
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen request = auth_request_new(handler->auth, mech, auth_callback, handler);
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen /* parse optional parameters */
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen else if (strcmp(name, "valid-client-cert") == 0)
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen /* this must be the last parameter */
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen "sent AUTH parameters after 'resp'",
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen "didn't specify service in request",
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen hash_insert(handler->requests, POINTER_CAST(id), request);
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen if (request->auth->ssl_require_client_cert && !valid_client_cert) {
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen /* we fail without valid certificate */
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen auth_request_handler_auth_fail(handler, request,
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen "Client didn't present valid SSL certificate");
70c181da837ed85fc5b0426c010b65609bda5329Timo Sirainen buf = buffer_create_dynamic(pool_datastack_create(),
382c7aec3e3449ed8271c2a202b67cefaa31dc8eTimo Sirainen if (base64_decode(initial_resp, len, NULL, buf) < 0) {
382c7aec3e3449ed8271c2a202b67cefaa31dc8eTimo Sirainen auth_request_handler_auth_fail(handler, request,
382c7aec3e3449ed8271c2a202b67cefaa31dc8eTimo Sirainen "Invalid base64 data in initial response");
382c7aec3e3449ed8271c2a202b67cefaa31dc8eTimo Sirainen /* handler is referenced until auth_callback is called. */
382c7aec3e3449ed8271c2a202b67cefaa31dc8eTimo Sirainen auth_request_initial(request, initial_resp_data, initial_resp_len);
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainenbool auth_request_handler_auth_continue(struct auth_request_handler *handler,
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen unsigned int id;
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen i_error("BUG: Authentication client sent broken CONT request");
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen request = hash_lookup(handler->requests, POINTER_CAST(id));
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen str_printfa(reply, "FAIL\t%u\treason=Timeouted", id);
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen handler->callback(str_c(reply), handler->context);
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen /* accept input only once after mechanism has sent a CONT reply */
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen auth_request_handler_auth_fail(handler, request,
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen "Unexpected continuation");
657afb33796f8216c568ad813627da89970760beTimo Sirainen buf = buffer_create_dynamic(pool_datastack_create(),
6ef7e31619edfaa17ed044b45861d106a86191efTimo Sirainen if (base64_decode(data, data_len, NULL, buf) < 0) {
6ef7e31619edfaa17ed044b45861d106a86191efTimo Sirainen auth_request_handler_auth_fail(handler, request,
657afb33796f8216c568ad813627da89970760beTimo Sirainen "Invalid base64 data in continued response");
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen /* handler is referenced until auth_callback is called. */
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen auth_request_continue(request, buf->data, buf->used);
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainenstatic void userdb_callback(enum userdb_result result,
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen struct auth_request_handler *handler = request->context;
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen i_assert(request->state == AUTH_REQUEST_STATE_USERDB);
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen str_printfa(str, "NOTFOUND\t%u", request->id);
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen str_append(str, auth_stream_reply_export(reply));
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen handler->master_callback(str_c(str), request->master);
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen auth_master_connection_unref(&request->master);
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainenvoid auth_request_handler_master_request(struct auth_request_handler *handler,
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen unsigned int id,
226259ee6fb9830dafc1a5ba1e95bf5a4345b406Timo Sirainen request = hash_lookup(handler->requests, POINTER_CAST(client_id));
615c4aba4cc0b17eefba3263b85972adaba04586Timo Sirainen handler->master_callback(str_c(reply), master);
0f39a57760d93cddbce3ca43096d78e0fe2f42fdTimo Sirainen auth_request_handler_remove(handler, request);
226259ee6fb9830dafc1a5ba1e95bf5a4345b406Timo Sirainen if (request->state != AUTH_REQUEST_STATE_FINISHED ||
0f39a57760d93cddbce3ca43096d78e0fe2f42fdTimo Sirainen i_error("Master requested unfinished authentication request "
226259ee6fb9830dafc1a5ba1e95bf5a4345b406Timo Sirainen handler->master_callback(str_c(reply), master);
226259ee6fb9830dafc1a5ba1e95bf5a4345b406Timo Sirainen /* the request isn't being referenced anywhere anymore,
226259ee6fb9830dafc1a5ba1e95bf5a4345b406Timo Sirainen so we can do a bit of kludging.. replace the request's
7e078be0d6f12ca56860641d36e3c517e3046895Timo Sirainen old client_id with master's id. */
226259ee6fb9830dafc1a5ba1e95bf5a4345b406Timo Sirainen /* master and handler are referenced until userdb_callback i
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen auth_request_lookup_user(request, userdb_callback);
657afb33796f8216c568ad813627da89970760beTimo Sirainen auth_request = buffer_get_modifiable_data(auth_failures_buf, &size);
226259ee6fb9830dafc1a5ba1e95bf5a4345b406Timo Sirainen for (i = 0; i < size; i++) {
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen i_assert(auth_request[i]->state == AUTH_REQUEST_STATE_FINISHED);
226259ee6fb9830dafc1a5ba1e95bf5a4345b406Timo Sirainenstatic void auth_failure_timeout(void *context __attr_unused__)
66d2db642fe24d555d113ba463e446b038d476efTimo Sirainen auth_failures_buf = buffer_create_dynamic(default_pool, 1024);