auth-settings.c revision bcb4e51a409d94ae670de96afb8483a4f7855294
7cb128dc4cae2a03a742f63ba7afee23c78e3af0Phil Carmody/* Copyright (c) 2005-2018 Dovecot authors, see the included COPYING file */
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen#include "lib.h"
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen#include "array.h"
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen#include "hash-method.h"
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen#include "settings-parser.h"
d39a04db2f4d0599cb9b5f03a9aa10a3c234453cTimo Sirainen#include "master-service-private.h"
f7423cbbd9dea363a5df18ebb96da055a977ae79Timo Sirainen#include "master-service-settings.h"
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen#include "service-settings.h"
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen#include "auth-settings.h"
a3fe8c0c54d87822f4b4f8f0d10caac611861b2bTimo Sirainen
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen#include <stddef.h>
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen
c99fe55d4535d839a6ad0735c4719e076a1adb2cTimo Sirainenstatic bool auth_settings_check(void *_set, pool_t pool, const char **error_r);
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainenstatic bool auth_passdb_settings_check(void *_set, pool_t pool, const char **error_r);
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainenstatic bool auth_userdb_settings_check(void *_set, pool_t pool, const char **error_r);
7891c8e6debdcfec552cb1beea2a0230fe89957bTimo Sirainen
5a6343181a5183b1ae1c39d40fc5a1deb3b840d9Timo Sirainen/* <settings checks> */
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainenstatic struct file_listener_settings auth_unix_listeners_array[] = {
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen { "login/login", 0666, "", "" },
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen { "token-login/tokenlogin", 0666, "", "" },
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen { "auth-login", 0600, "$default_internal_user", "" },
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen { "auth-client", 0600, "$default_internal_user", "" },
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen { "auth-userdb", 0666, "$default_internal_user", "" },
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen { "auth-master", 0600, "", "" }
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen};
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainenstatic struct file_listener_settings *auth_unix_listeners[] = {
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen &auth_unix_listeners_array[0],
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen &auth_unix_listeners_array[1],
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen &auth_unix_listeners_array[2],
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen &auth_unix_listeners_array[3],
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen &auth_unix_listeners_array[4],
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen &auth_unix_listeners_array[5]
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen};
cf0ad1a0bddb0787f3d7b408a96d721a8b2a98a3Timo Sirainenstatic buffer_t auth_unix_listeners_buf = {
cf0ad1a0bddb0787f3d7b408a96d721a8b2a98a3Timo Sirainen auth_unix_listeners, sizeof(auth_unix_listeners), { NULL, }
cf0ad1a0bddb0787f3d7b408a96d721a8b2a98a3Timo Sirainen};
cf0ad1a0bddb0787f3d7b408a96d721a8b2a98a3Timo Sirainen/* </settings checks> */
cf0ad1a0bddb0787f3d7b408a96d721a8b2a98a3Timo Sirainen
86791365b10f45982c88e70f2eb94fd6c3fea151Timo Sirainenstruct service_settings auth_service_settings = {
86791365b10f45982c88e70f2eb94fd6c3fea151Timo Sirainen .name = "auth",
86791365b10f45982c88e70f2eb94fd6c3fea151Timo Sirainen .protocol = "",
86791365b10f45982c88e70f2eb94fd6c3fea151Timo Sirainen .type = "",
4d4d6d4745682790c20d759ba93dbea46b812c5dTimo Sirainen .executable = "auth",
4d4d6d4745682790c20d759ba93dbea46b812c5dTimo Sirainen .user = "$default_internal_user",
bd20ef9d5c639faf470912ab94e6e6627d3eaebaTimo Sirainen .group = "",
cf0ad1a0bddb0787f3d7b408a96d721a8b2a98a3Timo Sirainen .privileged_group = "",
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen .extra_groups = "",
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .chroot = "",
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen
104318260228780a5c6b3181b3401e8e504e2776Timo Sirainen .drop_priv_before_exec = FALSE,
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .process_min_avail = 0,
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .process_limit = 1,
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .client_limit = 0,
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .service_count = 0,
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .idle_kill = 0,
b437874782ad048daa155e0ac863c2326c3f5e43Timo Sirainen .vsz_limit = (uoff_t)-1,
b437874782ad048daa155e0ac863c2326c3f5e43Timo Sirainen
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .unix_listeners = { { &auth_unix_listeners_buf,
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen sizeof(auth_unix_listeners[0]) } },
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .fifo_listeners = ARRAY_INIT,
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .inet_listeners = ARRAY_INIT,
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen
f46363f428d8f2784146d36692b21936a48a7006Timo Sirainen .process_limit_1 = TRUE
f46363f428d8f2784146d36692b21936a48a7006Timo Sirainen};
f46363f428d8f2784146d36692b21936a48a7006Timo Sirainen
f46363f428d8f2784146d36692b21936a48a7006Timo Sirainen/* <settings checks> */
b437874782ad048daa155e0ac863c2326c3f5e43Timo Sirainenstatic struct file_listener_settings auth_worker_unix_listeners_array[] = {
b437874782ad048daa155e0ac863c2326c3f5e43Timo Sirainen { "auth-worker", 0600, "$default_internal_user", "" }
b437874782ad048daa155e0ac863c2326c3f5e43Timo Sirainen};
b437874782ad048daa155e0ac863c2326c3f5e43Timo Sirainenstatic struct file_listener_settings *auth_worker_unix_listeners[] = {
b437874782ad048daa155e0ac863c2326c3f5e43Timo Sirainen &auth_worker_unix_listeners_array[0]
ccf50662cc02b5e703039a4ff7f91a4470e25b71Timo Sirainen};
ccf50662cc02b5e703039a4ff7f91a4470e25b71Timo Sirainenstatic buffer_t auth_worker_unix_listeners_buf = {
ccf50662cc02b5e703039a4ff7f91a4470e25b71Timo Sirainen auth_worker_unix_listeners, sizeof(auth_worker_unix_listeners), { NULL, }
ccf50662cc02b5e703039a4ff7f91a4470e25b71Timo Sirainen};
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen/* </settings checks> */
b437874782ad048daa155e0ac863c2326c3f5e43Timo Sirainen
71df09024cea5f2faa93da3bb9513ee96ba6bf22Timo Sirainenstruct service_settings auth_worker_service_settings = {
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .name = "auth-worker",
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .protocol = "",
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .type = "",
cf0ad1a0bddb0787f3d7b408a96d721a8b2a98a3Timo Sirainen .executable = "auth -w",
cf0ad1a0bddb0787f3d7b408a96d721a8b2a98a3Timo Sirainen .user = "",
cf0ad1a0bddb0787f3d7b408a96d721a8b2a98a3Timo Sirainen .group = "",
cf0ad1a0bddb0787f3d7b408a96d721a8b2a98a3Timo Sirainen .privileged_group = "",
cf0ad1a0bddb0787f3d7b408a96d721a8b2a98a3Timo Sirainen .extra_groups = "",
cf0ad1a0bddb0787f3d7b408a96d721a8b2a98a3Timo Sirainen .chroot = "",
cf0ad1a0bddb0787f3d7b408a96d721a8b2a98a3Timo Sirainen
cf0ad1a0bddb0787f3d7b408a96d721a8b2a98a3Timo Sirainen .drop_priv_before_exec = FALSE,
f158d9a303bb15a6848ca276c9391c7ca52e452bTimo Sirainen
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .process_min_avail = 0,
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .process_limit = 0,
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .client_limit = 1,
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .service_count = 1,
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .idle_kill = 0,
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .vsz_limit = (uoff_t)-1,
7fe37c2b0e4cd2a39896ab16e47eb418a59e3934Timo Sirainen
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .unix_listeners = { { &auth_worker_unix_listeners_buf,
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen sizeof(auth_worker_unix_listeners[0]) } },
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .fifo_listeners = ARRAY_INIT,
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .inet_listeners = ARRAY_INIT
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen};
a3fe8c0c54d87822f4b4f8f0d10caac611861b2bTimo Sirainen
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen#undef DEF
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen#define DEF(type, name) \
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen { type, #name, offsetof(struct auth_passdb_settings, name), NULL }
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainenstatic const struct setting_define auth_passdb_setting_defines[] = {
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen DEF(SET_STR, name),
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen DEF(SET_STR, driver),
78fa3c578c14ee8a612f86cf73b6181c7f16463fTimo Sirainen DEF(SET_STR, args),
0c22bef8f5b35c645de8affd8746307fc53bd222Timo Sirainen DEF(SET_STR, default_fields),
0c22bef8f5b35c645de8affd8746307fc53bd222Timo Sirainen DEF(SET_STR, override_fields),
78fa3c578c14ee8a612f86cf73b6181c7f16463fTimo Sirainen DEF(SET_STR, mechanisms),
78fa3c578c14ee8a612f86cf73b6181c7f16463fTimo Sirainen DEF(SET_STR, username_filter),
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen DEF(SET_ENUM, skip),
78fa3c578c14ee8a612f86cf73b6181c7f16463fTimo Sirainen DEF(SET_ENUM, result_success),
78fa3c578c14ee8a612f86cf73b6181c7f16463fTimo Sirainen DEF(SET_ENUM, result_failure),
78fa3c578c14ee8a612f86cf73b6181c7f16463fTimo Sirainen DEF(SET_ENUM, result_internalfail),
8451c4b5afc1ff5366438b2766f75b592c33e1ecTimo Sirainen
8451c4b5afc1ff5366438b2766f75b592c33e1ecTimo Sirainen DEF(SET_BOOL, deny),
8451c4b5afc1ff5366438b2766f75b592c33e1ecTimo Sirainen DEF(SET_BOOL, pass),
8451c4b5afc1ff5366438b2766f75b592c33e1ecTimo Sirainen DEF(SET_BOOL, master),
8451c4b5afc1ff5366438b2766f75b592c33e1ecTimo Sirainen DEF(SET_ENUM, auth_verbose),
8451c4b5afc1ff5366438b2766f75b592c33e1ecTimo Sirainen
8451c4b5afc1ff5366438b2766f75b592c33e1ecTimo Sirainen SETTING_DEFINE_LIST_END
8451c4b5afc1ff5366438b2766f75b592c33e1ecTimo Sirainen};
78fa3c578c14ee8a612f86cf73b6181c7f16463fTimo Sirainen
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainenstatic const struct auth_passdb_settings auth_passdb_default_settings = {
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .name = "",
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .driver = "",
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .args = "",
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .default_fields = "",
ca4526e3b5fbf5ea3dd477a2098522a44c9ac52cTimo Sirainen .override_fields = "",
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .mechanisms = "",
40a8e6948d662339c0c5e2c7abfb84ae7c1803fdTimo Sirainen .username_filter = "",
d6b3cfd855c0eebed68be50d3111de1b5a6afeb0Timo Sirainen
40a8e6948d662339c0c5e2c7abfb84ae7c1803fdTimo Sirainen .skip = "never:authenticated:unauthenticated",
40a8e6948d662339c0c5e2c7abfb84ae7c1803fdTimo Sirainen .result_success = "return-ok:return:return-fail:continue:continue-ok:continue-fail",
40a8e6948d662339c0c5e2c7abfb84ae7c1803fdTimo Sirainen .result_failure = "continue:return:return-ok:return-fail:continue-ok:continue-fail",
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen .result_internalfail = "continue:return:return-ok:return-fail:continue-ok:continue-fail",
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .deny = FALSE,
cd2ed64888b42b481cde6bb9548c8520516fa3e9Timo Sirainen .pass = FALSE,
a3fe8c0c54d87822f4b4f8f0d10caac611861b2bTimo Sirainen .master = FALSE,
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .auth_verbose = "default:yes:no"
a3fe8c0c54d87822f4b4f8f0d10caac611861b2bTimo Sirainen};
a3fe8c0c54d87822f4b4f8f0d10caac611861b2bTimo Sirainen
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainenconst struct setting_parser_info auth_passdb_setting_parser_info = {
e6b4168ba670d9e51ea7877661def039ae6b53c3Timo Sirainen .defines = auth_passdb_setting_defines,
a10ed8c47534b4c6b6bf2711ccfe577e720a47b4Timo Sirainen .defaults = &auth_passdb_default_settings,
e6b4168ba670d9e51ea7877661def039ae6b53c3Timo Sirainen
e6b4168ba670d9e51ea7877661def039ae6b53c3Timo Sirainen .type_offset = offsetof(struct auth_passdb_settings, name),
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .struct_size = sizeof(struct auth_passdb_settings),
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen
8ae72ad7d0c69e972cfa65d1e2ce4e3e9a8b765cTimo Sirainen .parent_offset = (size_t)-1,
01230de017cd273de41143d88e9c18df1243ae8aTimo Sirainen .parent = &auth_setting_parser_info,
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen .check_func = auth_passdb_settings_check
6efdbeab167483597bef087f70ea852d1256a082Timo Sirainen};
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen
6efdbeab167483597bef087f70ea852d1256a082Timo Sirainen#undef DEF
6efdbeab167483597bef087f70ea852d1256a082Timo Sirainen#define DEF(type, name) \
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen { type, #name, offsetof(struct auth_userdb_settings, name), NULL }
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainenstatic const struct setting_define auth_userdb_setting_defines[] = {
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen DEF(SET_STR, name),
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen DEF(SET_STR, driver),
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen DEF(SET_STR, args),
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen DEF(SET_STR, default_fields),
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen DEF(SET_STR, override_fields),
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen DEF(SET_ENUM, skip),
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen DEF(SET_ENUM, result_success),
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen DEF(SET_ENUM, result_failure),
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen DEF(SET_ENUM, result_internalfail),
f7423cbbd9dea363a5df18ebb96da055a977ae79Timo Sirainen
f7423cbbd9dea363a5df18ebb96da055a977ae79Timo Sirainen DEF(SET_ENUM, auth_verbose),
f7423cbbd9dea363a5df18ebb96da055a977ae79Timo Sirainen
f7423cbbd9dea363a5df18ebb96da055a977ae79Timo Sirainen SETTING_DEFINE_LIST_END
f7423cbbd9dea363a5df18ebb96da055a977ae79Timo Sirainen};
f7423cbbd9dea363a5df18ebb96da055a977ae79Timo Sirainen
f7423cbbd9dea363a5df18ebb96da055a977ae79Timo Sirainenstatic const struct auth_userdb_settings auth_userdb_default_settings = {
32b78da5dfbbf6a06b3dbdc9278c60b55714f9bcTimo Sirainen /* NOTE: when adding fields, update also auth.c:userdb_dummy_set */
32b78da5dfbbf6a06b3dbdc9278c60b55714f9bcTimo Sirainen .name = "",
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .driver = "",
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .args = "",
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .default_fields = "",
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen .override_fields = "",
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen
ca4526e3b5fbf5ea3dd477a2098522a44c9ac52cTimo Sirainen .skip = "never:found:notfound",
ca4526e3b5fbf5ea3dd477a2098522a44c9ac52cTimo Sirainen .result_success = "return-ok:return:return-fail:continue:continue-ok:continue-fail",
ca4526e3b5fbf5ea3dd477a2098522a44c9ac52cTimo Sirainen .result_failure = "continue:return:return-ok:return-fail:continue-ok:continue-fail",
ca4526e3b5fbf5ea3dd477a2098522a44c9ac52cTimo Sirainen .result_internalfail = "continue:return:return-ok:return-fail:continue-ok:continue-fail",
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen .auth_verbose = "default:yes:no"
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen};
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainenconst struct setting_parser_info auth_userdb_setting_parser_info = {
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen .defines = auth_userdb_setting_defines,
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen .defaults = &auth_userdb_default_settings,
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen .type_offset = offsetof(struct auth_userdb_settings, name),
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen .struct_size = sizeof(struct auth_userdb_settings),
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen .parent_offset = (size_t)-1,
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen .parent = &auth_setting_parser_info,
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen .check_func = auth_userdb_settings_check
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen};
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen/* we're kind of kludging here to avoid "auth_" prefix in the struct fields */
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen#undef DEF
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen#undef DEF_NOPREFIX
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen#undef DEFLIST
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen#define DEF(type, name) \
d4845c4245638fd6f02dc0cb92c3465fae763cbbTimo Sirainen { type, "auth_"#name, offsetof(struct auth_settings, name), NULL }
d4845c4245638fd6f02dc0cb92c3465fae763cbbTimo Sirainen#define DEF_NOPREFIX(type, name) \
d4845c4245638fd6f02dc0cb92c3465fae763cbbTimo Sirainen { type, #name, offsetof(struct auth_settings, name), NULL }
d4845c4245638fd6f02dc0cb92c3465fae763cbbTimo Sirainen#define DEFLIST(field, name, defines) \
d4845c4245638fd6f02dc0cb92c3465fae763cbbTimo Sirainen { SET_DEFLIST, name, offsetof(struct auth_settings, field), defines }
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainenstatic const struct setting_define auth_setting_defines[] = {
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen DEF(SET_STR, mechanisms),
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen DEF(SET_STR, realms),
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen DEF(SET_STR, default_realm),
0161376aac025266d8654577c4b9ce371ffc87eaTimo Sirainen DEF(SET_SIZE, cache_size),
0161376aac025266d8654577c4b9ce371ffc87eaTimo Sirainen DEF(SET_TIME, cache_ttl),
0161376aac025266d8654577c4b9ce371ffc87eaTimo Sirainen DEF(SET_TIME, cache_negative_ttl),
0161376aac025266d8654577c4b9ce371ffc87eaTimo Sirainen DEF(SET_STR, username_chars),
0161376aac025266d8654577c4b9ce371ffc87eaTimo Sirainen DEF(SET_STR, username_translation),
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen DEF(SET_STR, username_format),
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen DEF(SET_STR, master_user_separator),
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen DEF(SET_STR, anonymous_username),
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen DEF(SET_STR, krb5_keytab),
b7b9d4be2a1ff399026a5d6feeffd3a048f22be0Timo Sirainen DEF(SET_STR, gssapi_hostname),
b7b9d4be2a1ff399026a5d6feeffd3a048f22be0Timo Sirainen DEF(SET_STR, winbind_helper_path),
b7b9d4be2a1ff399026a5d6feeffd3a048f22be0Timo Sirainen DEF(SET_STR, proxy_self),
b7b9d4be2a1ff399026a5d6feeffd3a048f22be0Timo Sirainen DEF(SET_TIME, failure_delay),
b7b9d4be2a1ff399026a5d6feeffd3a048f22be0Timo Sirainen
b7b9d4be2a1ff399026a5d6feeffd3a048f22be0Timo Sirainen DEF(SET_STR, policy_server_url),
c444eeaa2866152cf62652698aa11b125e8454bcTimo Sirainen DEF(SET_STR, policy_server_api_header),
f158d9a303bb15a6848ca276c9391c7ca52e452bTimo Sirainen DEF(SET_UINT, policy_server_timeout_msecs),
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen DEF(SET_STR, policy_hash_mech),
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen DEF(SET_STR, policy_hash_nonce),
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen DEF(SET_STR, policy_request_attributes),
578ef2538ccf42e2a48234c24a8b709397101d88Timo Sirainen DEF(SET_BOOL, policy_reject_on_fail),
578ef2538ccf42e2a48234c24a8b709397101d88Timo Sirainen DEF(SET_UINT, policy_hash_truncate),
578ef2538ccf42e2a48234c24a8b709397101d88Timo Sirainen
578ef2538ccf42e2a48234c24a8b709397101d88Timo Sirainen DEF(SET_BOOL, stats),
9b0f6b90ff8d1d6efd718b0d7cbe01b2454e9fd6Timo Sirainen DEF(SET_BOOL, verbose),
9b0f6b90ff8d1d6efd718b0d7cbe01b2454e9fd6Timo Sirainen DEF(SET_BOOL, debug),
578ef2538ccf42e2a48234c24a8b709397101d88Timo Sirainen DEF(SET_BOOL, debug_passwords),
578ef2538ccf42e2a48234c24a8b709397101d88Timo Sirainen DEF(SET_STR, verbose_passwords),
578ef2538ccf42e2a48234c24a8b709397101d88Timo Sirainen DEF(SET_BOOL, ssl_require_client_cert),
578ef2538ccf42e2a48234c24a8b709397101d88Timo Sirainen DEF(SET_BOOL, ssl_username_from_cert),
578ef2538ccf42e2a48234c24a8b709397101d88Timo Sirainen DEF(SET_BOOL, use_winbind),
578ef2538ccf42e2a48234c24a8b709397101d88Timo Sirainen
578ef2538ccf42e2a48234c24a8b709397101d88Timo Sirainen DEF(SET_UINT, worker_max_count),
578ef2538ccf42e2a48234c24a8b709397101d88Timo Sirainen
9b0f6b90ff8d1d6efd718b0d7cbe01b2454e9fd6Timo Sirainen DEFLIST(passdbs, "passdb", &auth_passdb_setting_parser_info),
9b0f6b90ff8d1d6efd718b0d7cbe01b2454e9fd6Timo Sirainen DEFLIST(userdbs, "userdb", &auth_userdb_setting_parser_info),
9b0f6b90ff8d1d6efd718b0d7cbe01b2454e9fd6Timo Sirainen
9b0f6b90ff8d1d6efd718b0d7cbe01b2454e9fd6Timo Sirainen DEF_NOPREFIX(SET_STR, base_dir),
9b0f6b90ff8d1d6efd718b0d7cbe01b2454e9fd6Timo Sirainen DEF_NOPREFIX(SET_BOOL, verbose_proctitle),
9b0f6b90ff8d1d6efd718b0d7cbe01b2454e9fd6Timo Sirainen DEF_NOPREFIX(SET_UINT, first_valid_uid),
9b0f6b90ff8d1d6efd718b0d7cbe01b2454e9fd6Timo Sirainen DEF_NOPREFIX(SET_UINT, last_valid_uid),
9b0f6b90ff8d1d6efd718b0d7cbe01b2454e9fd6Timo Sirainen DEF_NOPREFIX(SET_UINT, first_valid_gid),
9b0f6b90ff8d1d6efd718b0d7cbe01b2454e9fd6Timo Sirainen DEF_NOPREFIX(SET_UINT, last_valid_gid),
9b0f6b90ff8d1d6efd718b0d7cbe01b2454e9fd6Timo Sirainen
9b0f6b90ff8d1d6efd718b0d7cbe01b2454e9fd6Timo Sirainen DEF_NOPREFIX(SET_STR, ssl_client_ca_dir),
9b0f6b90ff8d1d6efd718b0d7cbe01b2454e9fd6Timo Sirainen DEF_NOPREFIX(SET_STR, ssl_client_ca_file),
9b0f6b90ff8d1d6efd718b0d7cbe01b2454e9fd6Timo Sirainen
9b0f6b90ff8d1d6efd718b0d7cbe01b2454e9fd6Timo Sirainen SETTING_DEFINE_LIST_END
9b0f6b90ff8d1d6efd718b0d7cbe01b2454e9fd6Timo Sirainen};
9b0f6b90ff8d1d6efd718b0d7cbe01b2454e9fd6Timo Sirainen
9b0f6b90ff8d1d6efd718b0d7cbe01b2454e9fd6Timo Sirainenstatic const struct auth_settings auth_default_settings = {
e0740628f6ca05f4bc79a9d8a90b650f4d38d4d0Timo Sirainen .mechanisms = "plain",
e0740628f6ca05f4bc79a9d8a90b650f4d38d4d0Timo Sirainen .realms = "",
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .default_realm = "",
e52f55c08f6f1b4fbc5765bf6aa9c7daee0785c3Timo Sirainen .cache_size = 0,
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .cache_ttl = 60*60,
c6335901c67a4c9365319190a111a2168f3b06f5Timo Sirainen .cache_negative_ttl = 60*60,
c6335901c67a4c9365319190a111a2168f3b06f5Timo Sirainen .username_chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ01234567890.-_@",
e52f55c08f6f1b4fbc5765bf6aa9c7daee0785c3Timo Sirainen .username_translation = "",
e52f55c08f6f1b4fbc5765bf6aa9c7daee0785c3Timo Sirainen .username_format = "%Lu",
e52f55c08f6f1b4fbc5765bf6aa9c7daee0785c3Timo Sirainen .master_user_separator = "",
6d2b3ce2c6ef62334985ece4f0ab8b154e0e9560Timo Sirainen .anonymous_username = "anonymous",
6d2b3ce2c6ef62334985ece4f0ab8b154e0e9560Timo Sirainen .krb5_keytab = "",
6d2b3ce2c6ef62334985ece4f0ab8b154e0e9560Timo Sirainen .gssapi_hostname = "",
6d2b3ce2c6ef62334985ece4f0ab8b154e0e9560Timo Sirainen .winbind_helper_path = "/usr/bin/ntlm_auth",
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen .proxy_self = "",
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen .failure_delay = 2,
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen
ca4526e3b5fbf5ea3dd477a2098522a44c9ac52cTimo Sirainen .policy_server_url = "",
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .policy_server_api_header = "",
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .policy_server_timeout_msecs = 2000,
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .policy_hash_mech = "sha256",
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen .policy_hash_nonce = "",
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen .policy_request_attributes = "login=%{orig_username} pwhash=%{hashed_password} remote=%{rip} device_id=%{client_id} protocol=%s",
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen .policy_reject_on_fail = FALSE,
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen .policy_hash_truncate = 12,
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen .stats = FALSE,
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen .verbose = FALSE,
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen .debug = FALSE,
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen .debug_passwords = FALSE,
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen .verbose_passwords = "no",
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen .ssl_require_client_cert = FALSE,
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen .ssl_username_from_cert = FALSE,
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen .ssl_client_ca_dir = "",
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen .ssl_client_ca_file = "",
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .use_winbind = FALSE,
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .worker_max_count = 30,
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .passdbs = ARRAY_INIT,
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen .userdbs = ARRAY_INIT,
ca4526e3b5fbf5ea3dd477a2098522a44c9ac52cTimo Sirainen
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen .base_dir = PKG_RUNDIR,
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen .verbose_proctitle = FALSE,
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen .first_valid_uid = 500,
a10ed8c47534b4c6b6bf2711ccfe577e720a47b4Timo Sirainen .last_valid_uid = 0,
a10ed8c47534b4c6b6bf2711ccfe577e720a47b4Timo Sirainen .first_valid_gid = 1,
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen .last_valid_gid = 0,
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen};
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainenconst struct setting_parser_info auth_setting_parser_info = {
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen .module_name = "auth",
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen .defines = auth_setting_defines,
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen .defaults = &auth_default_settings,
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen .type_offset = (size_t)-1,
f5e1d3d6b34ec152aa1ff15c7bd3d3552e9227eaTimo Sirainen .struct_size = sizeof(struct auth_settings),
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen .parent_offset = (size_t)-1,
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen .check_func = auth_settings_check
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen};
deb06d37292d9112d74bdf80cfebb92ab5151679Timo Sirainen
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen/* <settings checks> */
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainenstatic bool
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainenauth_settings_set_self_ips(struct auth_settings *set, pool_t pool,
3f603ef00e35fca21605afa0ad8d76e94fee2b96Timo Sirainen const char **error_r)
3f603ef00e35fca21605afa0ad8d76e94fee2b96Timo Sirainen{
3f603ef00e35fca21605afa0ad8d76e94fee2b96Timo Sirainen const char *const *tmp;
3f603ef00e35fca21605afa0ad8d76e94fee2b96Timo Sirainen ARRAY(struct ip_addr) ips_array;
3f603ef00e35fca21605afa0ad8d76e94fee2b96Timo Sirainen struct ip_addr *ips;
3f603ef00e35fca21605afa0ad8d76e94fee2b96Timo Sirainen unsigned int ips_count;
86791365b10f45982c88e70f2eb94fd6c3fea151Timo Sirainen int ret;
86791365b10f45982c88e70f2eb94fd6c3fea151Timo Sirainen
86791365b10f45982c88e70f2eb94fd6c3fea151Timo Sirainen if (*set->proxy_self == '\0') {
86791365b10f45982c88e70f2eb94fd6c3fea151Timo Sirainen set->proxy_self_ips = p_new(pool, struct ip_addr, 1);
86791365b10f45982c88e70f2eb94fd6c3fea151Timo Sirainen return TRUE;
86791365b10f45982c88e70f2eb94fd6c3fea151Timo Sirainen }
ccf50662cc02b5e703039a4ff7f91a4470e25b71Timo Sirainen
ccf50662cc02b5e703039a4ff7f91a4470e25b71Timo Sirainen p_array_init(&ips_array, pool, 4);
ccf50662cc02b5e703039a4ff7f91a4470e25b71Timo Sirainen tmp = t_strsplit_spaces(set->proxy_self, " ");
ccf50662cc02b5e703039a4ff7f91a4470e25b71Timo Sirainen for (; *tmp != NULL; tmp++) {
ccf50662cc02b5e703039a4ff7f91a4470e25b71Timo Sirainen ret = net_gethostbyname(*tmp, &ips, &ips_count);
ccf50662cc02b5e703039a4ff7f91a4470e25b71Timo Sirainen if (ret != 0) {
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen *error_r = t_strdup_printf("auth_proxy_self_ips: "
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen "gethostbyname(%s) failed: %s",
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen *tmp, net_gethosterror(ret));
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen }
2e533fb1283b5f06a4063b519e47f1861c910386Timo Sirainen array_append(&ips_array, ips, ips_count);
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen }
d9515a2eaa94c8287188c38fc28028727671e729Timo Sirainen array_append_zero(&ips_array);
d9515a2eaa94c8287188c38fc28028727671e729Timo Sirainen set->proxy_self_ips = array_idx(&ips_array, 0);
d9515a2eaa94c8287188c38fc28028727671e729Timo Sirainen return TRUE;
d9515a2eaa94c8287188c38fc28028727671e729Timo Sirainen}
2e533fb1283b5f06a4063b519e47f1861c910386Timo Sirainen
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainenstatic bool
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainenauth_verify_verbose_password(struct auth_settings *set,
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen const char **error_r)
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen{
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen const char *p, *value = set->verbose_passwords;
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen unsigned int num;
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen p = strchr(value, ':');
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen if (p != NULL) {
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen if (str_to_uint(p+1, &num) < 0 || num == 0) {
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen *error_r = t_strdup_printf("auth_verbose_passwords: "
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen "Invalid truncation number: '%s'", p+1);
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen return FALSE;
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen }
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen value = t_strdup_until(value, p);
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen }
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen if (strcmp(value, "no") == 0)
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen return TRUE;
6efdbeab167483597bef087f70ea852d1256a082Timo Sirainen else if (strcmp(value, "plain") == 0)
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen return TRUE;
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen else if (strcmp(value, "sha1") == 0)
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen return TRUE;
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen else if (strcmp(value, "yes") == 0) {
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen /* just use it as alias for "plain" */
6efdbeab167483597bef087f70ea852d1256a082Timo Sirainen set->verbose_passwords = "plain";
96d19229e5f322411eb84446e5477d8170cfa5afTimo Sirainen return TRUE;
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen } else {
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen *error_r = "auth_verbose_passwords: Invalid value";
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen return FALSE;
d39a04db2f4d0599cb9b5f03a9aa10a3c234453cTimo Sirainen }
d39a04db2f4d0599cb9b5f03a9aa10a3c234453cTimo Sirainen}
d39a04db2f4d0599cb9b5f03a9aa10a3c234453cTimo Sirainen
d39a04db2f4d0599cb9b5f03a9aa10a3c234453cTimo Sirainenstatic bool auth_settings_check(void *_set, pool_t pool,
d39a04db2f4d0599cb9b5f03a9aa10a3c234453cTimo Sirainen const char **error_r)
17fe695b985e9d6e9dc39c05b24e6b3c3b7e1ba1Timo Sirainen{
047c00cd3f7f403672f81569413669238df8c15aTimo Sirainen struct auth_settings *set = _set;
17fe695b985e9d6e9dc39c05b24e6b3c3b7e1ba1Timo Sirainen const char *p;
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen if (set->debug_passwords)
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen set->debug = TRUE;
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen if (set->debug)
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen set->verbose = TRUE;
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen if (set->worker_max_count == 0) {
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen *error_r = "auth_worker_max_count must be above zero";
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen return FALSE;
8d7eb4104707c60ca7e9d0228b37c5133476907bTimo Sirainen }
8d7eb4104707c60ca7e9d0228b37c5133476907bTimo Sirainen
275385a2ecc58e41dc7df3ce3cd943caaa58c4d1Timo Sirainen if (set->cache_size > 0 && set->cache_size < 1024) {
8d7eb4104707c60ca7e9d0228b37c5133476907bTimo Sirainen /* probably a configuration error.
86791365b10f45982c88e70f2eb94fd6c3fea151Timo Sirainen older versions used megabyte numbers */
86791365b10f45982c88e70f2eb94fd6c3fea151Timo Sirainen *error_r = t_strdup_printf("auth_cache_size value is too small "
86791365b10f45982c88e70f2eb94fd6c3fea151Timo Sirainen "(%"PRIuUOFF_T" bytes)",
86791365b10f45982c88e70f2eb94fd6c3fea151Timo Sirainen set->cache_size);
86791365b10f45982c88e70f2eb94fd6c3fea151Timo Sirainen return FALSE;
86791365b10f45982c88e70f2eb94fd6c3fea151Timo Sirainen }
86791365b10f45982c88e70f2eb94fd6c3fea151Timo Sirainen
86791365b10f45982c88e70f2eb94fd6c3fea151Timo Sirainen if (!auth_verify_verbose_password(set, error_r))
86791365b10f45982c88e70f2eb94fd6c3fea151Timo Sirainen return FALSE;
86791365b10f45982c88e70f2eb94fd6c3fea151Timo Sirainen
86791365b10f45982c88e70f2eb94fd6c3fea151Timo Sirainen if (*set->username_chars == '\0') {
8d7eb4104707c60ca7e9d0228b37c5133476907bTimo Sirainen /* all chars are allowed */
8d7eb4104707c60ca7e9d0228b37c5133476907bTimo Sirainen memset(set->username_chars_map, 1,
27a44fcfd8d19bffe0f267f20a2b5d3fe7600fddTimo Sirainen sizeof(set->username_chars_map));
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen } else {
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen for (p = set->username_chars; *p != '\0'; p++)
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen set->username_chars_map[(int)(uint8_t)*p] = 1;
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen }
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen if (*set->username_translation != '\0') {
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen p = set->username_translation;
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen for (; *p != '\0' && p[1] != '\0'; p += 2)
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen set->username_translation_map[(int)(uint8_t)*p] = p[1];
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen }
8d7eb4104707c60ca7e9d0228b37c5133476907bTimo Sirainen set->realms_arr =
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen (const char *const *)p_strsplit_spaces(pool, set->realms, " ");
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen if (*set->policy_server_url != '\0') {
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen if (*set->policy_hash_nonce == '\0') {
5512d420d826a2f9d4e7cb4e4919e1864fe688b0Timo Sirainen
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen *error_r = "auth_policy_hash_nonce must be set when policy server is used";
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen return FALSE;
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen }
5512d420d826a2f9d4e7cb4e4919e1864fe688b0Timo Sirainen const struct hash_method *digest = hash_method_lookup(set->policy_hash_mech);
5512d420d826a2f9d4e7cb4e4919e1864fe688b0Timo Sirainen if (digest == NULL) {
5512d420d826a2f9d4e7cb4e4919e1864fe688b0Timo Sirainen *error_r = "invalid auth_policy_hash_mech given";
5512d420d826a2f9d4e7cb4e4919e1864fe688b0Timo Sirainen return FALSE;
cf0ad1a0bddb0787f3d7b408a96d721a8b2a98a3Timo Sirainen }
5512d420d826a2f9d4e7cb4e4919e1864fe688b0Timo Sirainen if (set->policy_hash_truncate > 0 && set->policy_hash_truncate >= digest->digest_size*8) {
cf0ad1a0bddb0787f3d7b408a96d721a8b2a98a3Timo Sirainen *error_r = t_strdup_printf("policy_hash_truncate is not smaller than digest size (%u >= %u)",
cf0ad1a0bddb0787f3d7b408a96d721a8b2a98a3Timo Sirainen set->policy_hash_truncate,
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen digest->digest_size*8);
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen return FALSE;
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen }
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen }
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen if (!auth_settings_set_self_ips(set, pool, error_r))
cbcba924a745c938260fd39cb284175b75f8eaf2Timo Sirainen return FALSE;
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen return TRUE;
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen}
6fdfa4d4cf14d1d7764d7faa8258f112e39c8dbeTimo Sirainen
8b5c520883aa37bb55646286d375fdbae294d710Timo Sirainenstatic bool
8b5c520883aa37bb55646286d375fdbae294d710Timo Sirainenauth_passdb_settings_check(void *_set, pool_t pool ATTR_UNUSED,
5a6343181a5183b1ae1c39d40fc5a1deb3b840d9Timo Sirainen const char **error_r)
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen{
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen struct auth_passdb_settings *set = _set;
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen if (set->driver == NULL || *set->driver == '\0') {
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen *error_r = "passdb is missing driver";
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen return FALSE;
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen }
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen if (set->pass && strcmp(set->result_success, "return-ok") != 0) {
d5eb47a791ec56149fd711cd8e44efc8babeaae5Timo Sirainen *error_r = "Obsolete pass=yes setting mixed with non-default result_success";
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen return FALSE;
d5eb47a791ec56149fd711cd8e44efc8babeaae5Timo Sirainen }
d5eb47a791ec56149fd711cd8e44efc8babeaae5Timo Sirainen return TRUE;
d5eb47a791ec56149fd711cd8e44efc8babeaae5Timo Sirainen}
d5eb47a791ec56149fd711cd8e44efc8babeaae5Timo Sirainen
d5eb47a791ec56149fd711cd8e44efc8babeaae5Timo Sirainenstatic bool
d5eb47a791ec56149fd711cd8e44efc8babeaae5Timo Sirainenauth_userdb_settings_check(void *_set, pool_t pool ATTR_UNUSED,
d5eb47a791ec56149fd711cd8e44efc8babeaae5Timo Sirainen const char **error_r)
d5eb47a791ec56149fd711cd8e44efc8babeaae5Timo Sirainen{
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen struct auth_userdb_settings *set = _set;
8d3278a82b964217d95c340ec6f82037cdc59d19Timo Sirainen
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen if (set->driver == NULL || *set->driver == '\0') {
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen *error_r = "userdb is missing driver";
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen return FALSE;
885e1b36da370a674c0fd3b85db53740d7dcbd9bTimo Sirainen }
885e1b36da370a674c0fd3b85db53740d7dcbd9bTimo Sirainen return TRUE;
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen}
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen/* </settings checks> */
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen
885e1b36da370a674c0fd3b85db53740d7dcbd9bTimo Sirainenstruct auth_settings *global_auth_settings;
885e1b36da370a674c0fd3b85db53740d7dcbd9bTimo Sirainen
885e1b36da370a674c0fd3b85db53740d7dcbd9bTimo Sirainenstruct auth_settings *
885e1b36da370a674c0fd3b85db53740d7dcbd9bTimo Sirainenauth_settings_read(const char *service, pool_t pool,
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen struct master_service_settings_output *output_r)
885e1b36da370a674c0fd3b85db53740d7dcbd9bTimo Sirainen{
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen static const struct setting_parser_info *set_roots[] = {
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen &auth_setting_parser_info,
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen NULL
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen };
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen struct master_service_settings_input input;
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen struct setting_parser_context *set_parser;
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen const char *error;
1ffb2afe6d7e8860a2231a4827078cf2ef9c22cdTimo Sirainen void **sets;
1ffb2afe6d7e8860a2231a4827078cf2ef9c22cdTimo Sirainen
1ffb2afe6d7e8860a2231a4827078cf2ef9c22cdTimo Sirainen i_zero(&input);
1ffb2afe6d7e8860a2231a4827078cf2ef9c22cdTimo Sirainen input.roots = set_roots;
1ffb2afe6d7e8860a2231a4827078cf2ef9c22cdTimo Sirainen input.module = "auth";
d4845c4245638fd6f02dc0cb92c3465fae763cbbTimo Sirainen input.service = service;
d4845c4245638fd6f02dc0cb92c3465fae763cbbTimo Sirainen if (master_service_settings_read(master_service, &input,
d4845c4245638fd6f02dc0cb92c3465fae763cbbTimo Sirainen output_r, &error) < 0)
d4845c4245638fd6f02dc0cb92c3465fae763cbbTimo Sirainen i_fatal("Error reading configuration: %s", error);
d4845c4245638fd6f02dc0cb92c3465fae763cbbTimo Sirainen
0161376aac025266d8654577c4b9ce371ffc87eaTimo Sirainen pool_ref(pool);
0161376aac025266d8654577c4b9ce371ffc87eaTimo Sirainen set_parser = settings_parser_dup(master_service->set_parser, pool);
0161376aac025266d8654577c4b9ce371ffc87eaTimo Sirainen if (!settings_parser_check(set_parser, pool, &error))
0161376aac025266d8654577c4b9ce371ffc87eaTimo Sirainen i_unreached();
0161376aac025266d8654577c4b9ce371ffc87eaTimo Sirainen
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen sets = master_service_settings_parser_get_others(master_service,
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen set_parser);
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen settings_parser_deinit(&set_parser);
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen return sets[0];
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen}
d176f84ce5ca2073f4dfbafb457b9c74f6bf0d76Timo Sirainen