auth-master.c revision 9261dbf0675204898c6557591c7aa376e23a52b2
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen/* Copyright (c) 2005-2010 Dovecot authors, see the included COPYING file */
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen#include "lib.h"
16f816d3f3c32ae3351834253f52ddd0212bcbf3Timo Sirainen#include "lib-signals.h"
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen#include "array.h"
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen#include "ioloop.h"
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen#include "eacces-error.h"
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen#include "network.h"
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen#include "istream.h"
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen#include "ostream.h"
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen#include "str.h"
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen#include "auth-master.h"
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen#include <stdlib.h>
bb10ebcf076c959c752f583746d83805d7686df8Timo Sirainen#include <unistd.h>
bb10ebcf076c959c752f583746d83805d7686df8Timo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen#define AUTH_PROTOCOL_MAJOR 1
190237ce467d2389dfb809874b0fec86d3c7968dTimo Sirainen#define AUTH_PROTOCOL_MINOR 0
1e47cfede3a0b62654105daab00e97b5d660bc6bTimo Sirainen
41e1c7380edda701719d8ce1fb4d465d2ec4c84dTimo Sirainen#define AUTH_REQUEST_TIMEOUT_SECS 30
41e1c7380edda701719d8ce1fb4d465d2ec4c84dTimo Sirainen#define AUTH_MASTER_IDLE_SECS 60
8f7b00599e73fe71b1d2c6c65f8ae98aac1b23fbTimo Sirainen
8f7b00599e73fe71b1d2c6c65f8ae98aac1b23fbTimo Sirainen#define MAX_INBUF_SIZE 8192
8f7b00599e73fe71b1d2c6c65f8ae98aac1b23fbTimo Sirainen#define MAX_OUTBUF_SIZE 1024
bb10ebcf076c959c752f583746d83805d7686df8Timo Sirainen
bb10ebcf076c959c752f583746d83805d7686df8Timo Sirainen#define DEFAULT_USERDB_LOOKUP_PREFIX "userdb lookup"
bb10ebcf076c959c752f583746d83805d7686df8Timo Sirainen
bb10ebcf076c959c752f583746d83805d7686df8Timo Sirainenstruct auth_master_connection {
bb10ebcf076c959c752f583746d83805d7686df8Timo Sirainen char *auth_socket_path;
bb10ebcf076c959c752f583746d83805d7686df8Timo Sirainen enum auth_master_flags flags;
bb10ebcf076c959c752f583746d83805d7686df8Timo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen int fd;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen struct ioloop *ioloop;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen struct io *io;
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen struct istream *input;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen struct ostream *output;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen struct timeout *to;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen const char *prefix;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen unsigned int request_counter;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen bool (*reply_callback)(const char *cmd, const char *const *args,
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen void *context);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen void *reply_context;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen unsigned int sent_handshake:1;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen unsigned int handshaked:1;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen unsigned int aborted:1;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen};
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainenstruct auth_master_lookup_ctx {
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen struct auth_master_connection *conn;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen const char *user;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen const char *expected_reply;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen int return_value;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen pool_t pool;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen const char **fields;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen};
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainenstruct auth_master_user_list_ctx {
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen struct auth_master_connection *conn;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen pool_t pool;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen ARRAY_TYPE(const_string) users;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen const char *const *user_strings;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen unsigned int idx, user_count;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen bool failed;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen};
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainenstatic void auth_input(struct auth_master_connection *conn);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainenstruct auth_master_connection *
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainenauth_master_init(const char *auth_socket_path, enum auth_master_flags flags)
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen{
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen struct auth_master_connection *conn;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen conn = i_new(struct auth_master_connection, 1);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen conn->auth_socket_path = i_strdup(auth_socket_path);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen conn->fd = -1;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen conn->flags = flags;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen conn->prefix = DEFAULT_USERDB_LOOKUP_PREFIX;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen return conn;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen}
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainenstatic void auth_connection_close(struct auth_master_connection *conn)
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen{
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen if (conn->to != NULL)
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen timeout_remove(&conn->to);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen if (conn->fd != -1) {
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen if (close(conn->fd) < 0)
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen i_error("close(%s) failed: %m", conn->auth_socket_path);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen conn->fd = -1;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen }
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen conn->sent_handshake = FALSE;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen conn->handshaked = FALSE;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen}
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainenvoid auth_master_deinit(struct auth_master_connection **_conn)
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen{
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen struct auth_master_connection *conn = *_conn;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen *_conn = NULL;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen auth_connection_close(conn);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen i_free(conn->auth_socket_path);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen i_free(conn);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen}
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainenstatic void auth_request_lookup_abort(struct auth_master_connection *conn)
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen{
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen io_loop_stop(conn->ioloop);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen conn->aborted = TRUE;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen}
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainenstatic int auth_input_handshake(struct auth_master_connection *conn)
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen{
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen const char *line, *const *tmp;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen while ((line = i_stream_next_line(conn->input)) != NULL) {
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen tmp = t_strsplit(line, "\t");
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen if (strcmp(tmp[0], "VERSION") == 0 &&
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen tmp[1] != NULL && tmp[2] != NULL) {
2a6af811ea3de3cf9e2f15e446674dd21b0705f3Timo Sirainen if (strcmp(tmp[1], dec2str(AUTH_PROTOCOL_MAJOR)) != 0) {
2a6af811ea3de3cf9e2f15e446674dd21b0705f3Timo Sirainen i_error("userdb lookup: "
2a6af811ea3de3cf9e2f15e446674dd21b0705f3Timo Sirainen "Auth protocol version mismatch "
2a6af811ea3de3cf9e2f15e446674dd21b0705f3Timo Sirainen "(%s vs %d)", tmp[1],
055a42c6987f93fb88291f64813dfceb1b25895dTimo Sirainen AUTH_PROTOCOL_MAJOR);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen auth_request_lookup_abort(conn);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen return -1;
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen }
287ba82a8da3eaa473b5735d4eeac2fb4c5d8117Timo Sirainen } else if (strcmp(tmp[0], "SPID") == 0) {
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen conn->handshaked = TRUE;
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen break;
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen }
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen }
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen return 0;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen}
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainenstatic int parse_reply(const char *cmd, const char *const *args,
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen const char *expected_reply, const char *user, bool debug)
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen{
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen if (strcmp(cmd, expected_reply) == 0)
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen return 1;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen if (strcmp(cmd, "NOTFOUND") == 0)
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen return 0;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen if (strcmp(cmd, "FAIL") == 0) {
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen if (*args == NULL) {
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen i_error("user %s: Auth %s lookup failed",
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen user, expected_reply);
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen } else if (debug) {
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen i_debug("user %s: Auth %s lookup returned temporary failure: %s",
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen user, expected_reply, *args);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen }
bf045aa2e9c3846ecde84db303db6588b173bbaeTimo Sirainen return -1;
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen }
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen i_error("Unknown reply: %s", cmd);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen return -1;
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen}
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainenstatic bool auth_lookup_reply_callback(const char *cmd, const char *const *args,
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen void *context)
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen{
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen struct auth_master_lookup_ctx *ctx = context;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen unsigned int i, len;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen bool debug = (ctx->conn->flags & AUTH_MASTER_FLAG_DEBUG) != 0;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen io_loop_stop(ctx->conn->ioloop);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen ctx->return_value =
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen parse_reply(cmd, args, ctx->expected_reply, ctx->user, debug);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen len = str_array_length(args);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen if (ctx->return_value >= 0) {
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen ctx->fields = p_new(ctx->pool, const char *, len + 1);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen for (i = 0; i < len; i++)
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen ctx->fields[i] = p_strdup(ctx->pool, args[i]);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen } else {
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen /* put the reason string into first field */
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen ctx->fields = p_new(ctx->pool, const char *, 2);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen for (i = 0; i < len; i++) {
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen if (strncmp(args[i], "reason=", 7) == 0) {
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen ctx->fields[0] =
287ba82a8da3eaa473b5735d4eeac2fb4c5d8117Timo Sirainen p_strdup(ctx->pool, args[i] + 7);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen break;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen }
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen }
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen }
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen if (debug)
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen i_debug("auth input: %s", t_strarray_join(args, " "));
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen return TRUE;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen}
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen
190237ce467d2389dfb809874b0fec86d3c7968dTimo Sirainenstatic bool
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainenauth_handle_line(struct auth_master_connection *conn, const char *line)
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen{
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen const char *cmd, *const *args, *id, *wanted_id;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
2a6af811ea3de3cf9e2f15e446674dd21b0705f3Timo Sirainen args = t_strsplit(line, "\t");
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen cmd = *args; args++;
2a6af811ea3de3cf9e2f15e446674dd21b0705f3Timo Sirainen if (*args == NULL)
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen id = "";
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen else {
2a6af811ea3de3cf9e2f15e446674dd21b0705f3Timo Sirainen id = *args;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen args++;
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen }
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen wanted_id = dec2str(conn->request_counter);
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen if (strcmp(id, wanted_id) == 0)
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen return conn->reply_callback(cmd, args, conn->reply_context);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen if (strcmp(cmd, "CUID") == 0) {
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen i_error("%s: %s is an auth client socket. "
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen "It should be a master socket.",
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen conn->prefix, conn->auth_socket_path);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen } else {
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen i_error("%s: BUG: Unexpected input: %s", conn->prefix, line);
2a6af811ea3de3cf9e2f15e446674dd21b0705f3Timo Sirainen }
2a6af811ea3de3cf9e2f15e446674dd21b0705f3Timo Sirainen auth_request_lookup_abort(conn);
41bb0aa8e357876bc9a1916a37c9e3e78e5f8185Timo Sirainen return FALSE;
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen}
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainenstatic void auth_input(struct auth_master_connection *conn)
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen{
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen const char *line;
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen bool ret;
8f7b00599e73fe71b1d2c6c65f8ae98aac1b23fbTimo Sirainen
8f7b00599e73fe71b1d2c6c65f8ae98aac1b23fbTimo Sirainen switch (i_stream_read(conn->input)) {
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen case 0:
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen return;
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen case -1:
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen /* disconnected */
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen i_error("%s: Disconnected unexpectedly",
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen conn->prefix);
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen auth_request_lookup_abort(conn);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen return;
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen case -2:
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen /* buffer full */
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen i_error("%s: BUG: Received more than %d bytes",
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen conn->prefix, MAX_INBUF_SIZE);
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen auth_request_lookup_abort(conn);
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen return;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen }
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen if (!conn->handshaked) {
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen if (auth_input_handshake(conn) < 0)
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen return;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen }
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen while ((line = i_stream_next_line(conn->input)) != NULL) {
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen T_BEGIN {
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen ret = auth_handle_line(conn, line);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen } T_END;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen if (!ret)
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen return;
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen }
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen}
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainenstatic int auth_master_connect(struct auth_master_connection *conn)
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen{
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen int fd;
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen i_assert(conn->fd == -1);
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen /* max. 1 second wait here. */
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen fd = net_connect_unix_with_retries(conn->auth_socket_path, 1000);
9887c39c5ba429169389153ca99de49e084a73f0Timo Sirainen if (fd == -1) {
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen if (errno == EACCES) {
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen i_error("userdb lookup: %s",
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen eacces_error_get("connect",
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen conn->auth_socket_path));
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen } else {
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen i_error("userdb lookup: connect(%s) failed: %m",
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen conn->auth_socket_path);
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen }
9887c39c5ba429169389153ca99de49e084a73f0Timo Sirainen return -1;
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen }
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen conn->fd = fd;
41e1c7380edda701719d8ce1fb4d465d2ec4c84dTimo Sirainen return 0;
41e1c7380edda701719d8ce1fb4d465d2ec4c84dTimo Sirainen}
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainenstatic void auth_request_timeout(struct auth_master_connection *conn)
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen{
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen if (!conn->handshaked)
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen i_error("%s: Connecting timed out", conn->prefix);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen else
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen i_error("%s: Request timed out", conn->prefix);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen auth_request_lookup_abort(conn);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen}
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainenstatic void auth_idle_timeout(struct auth_master_connection *conn)
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen{
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen auth_connection_close(conn);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen}
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainenstatic void auth_master_set_io(struct auth_master_connection *conn)
287ba82a8da3eaa473b5735d4eeac2fb4c5d8117Timo Sirainen{
41e1c7380edda701719d8ce1fb4d465d2ec4c84dTimo Sirainen if (conn->to != NULL)
41e1c7380edda701719d8ce1fb4d465d2ec4c84dTimo Sirainen timeout_remove(&conn->to);
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen
41e1c7380edda701719d8ce1fb4d465d2ec4c84dTimo Sirainen conn->ioloop = io_loop_create();
41e1c7380edda701719d8ce1fb4d465d2ec4c84dTimo Sirainen conn->input = i_stream_create_fd(conn->fd, MAX_INBUF_SIZE, FALSE);
41e1c7380edda701719d8ce1fb4d465d2ec4c84dTimo Sirainen conn->output = o_stream_create_fd(conn->fd, MAX_OUTBUF_SIZE, FALSE);
190237ce467d2389dfb809874b0fec86d3c7968dTimo Sirainen conn->io = io_add(conn->fd, IO_READ, auth_input, conn);
1e47cfede3a0b62654105daab00e97b5d660bc6bTimo Sirainen conn->to = timeout_add(1000*AUTH_REQUEST_TIMEOUT_SECS,
1e47cfede3a0b62654105daab00e97b5d660bc6bTimo Sirainen auth_request_timeout, conn);
41e1c7380edda701719d8ce1fb4d465d2ec4c84dTimo Sirainen lib_signals_reset_ioloop();
41e1c7380edda701719d8ce1fb4d465d2ec4c84dTimo Sirainen}
41e1c7380edda701719d8ce1fb4d465d2ec4c84dTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainenstatic void auth_master_unset_io(struct auth_master_connection *conn,
41e1c7380edda701719d8ce1fb4d465d2ec4c84dTimo Sirainen struct ioloop *prev_ioloop)
9887c39c5ba429169389153ca99de49e084a73f0Timo Sirainen{
9887c39c5ba429169389153ca99de49e084a73f0Timo Sirainen io_loop_set_current(prev_ioloop);
41e1c7380edda701719d8ce1fb4d465d2ec4c84dTimo Sirainen lib_signals_reset_ioloop();
41e1c7380edda701719d8ce1fb4d465d2ec4c84dTimo Sirainen io_loop_set_current(conn->ioloop);
41e1c7380edda701719d8ce1fb4d465d2ec4c84dTimo Sirainen
2a6af811ea3de3cf9e2f15e446674dd21b0705f3Timo Sirainen timeout_remove(&conn->to);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen io_remove(&conn->io);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen i_stream_unref(&conn->input);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen o_stream_unref(&conn->output);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen io_loop_destroy(&conn->ioloop);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen if ((conn->flags & AUTH_MASTER_FLAG_NO_IDLE_TIMEOUT) == 0) {
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen conn->to = timeout_add(1000*AUTH_MASTER_IDLE_SECS,
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen auth_idle_timeout, conn);
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen }
16c89b1260c9d07c01c83a9219424d3727069b2eTimo Sirainen}
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainenstatic bool is_valid_string(const char *str)
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen{
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen const char *p;
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen /* make sure we're not sending any characters that have a special
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen meaning. */
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen for (p = str; *p != '\0'; p++) {
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen if (*p == '\t' || *p == '\n' || *p == '\r')
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen return FALSE;
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen }
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen return TRUE;
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen}
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainenstatic int auth_master_run_cmd(struct auth_master_connection *conn,
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen const char *cmd)
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen{
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen struct ioloop *prev_ioloop;
287ba82a8da3eaa473b5735d4eeac2fb4c5d8117Timo Sirainen const char *str;
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen if (conn->fd == -1) {
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen if (auth_master_connect(conn) < 0)
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen return -1;
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen }
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen prev_ioloop = current_ioloop;
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen auth_master_set_io(conn);
2a6af811ea3de3cf9e2f15e446674dd21b0705f3Timo Sirainen
2a6af811ea3de3cf9e2f15e446674dd21b0705f3Timo Sirainen o_stream_cork(conn->output);
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen if (!conn->sent_handshake) {
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen str = t_strdup_printf("VERSION\t%d\t%d\n",
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen AUTH_PROTOCOL_MAJOR, AUTH_PROTOCOL_MINOR);
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen o_stream_send_str(conn->output, str);
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen conn->sent_handshake = TRUE;
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen }
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen
faed8babca9914257f34fb2e603d74016d563b2dTimo Sirainen o_stream_send_str(conn->output, cmd);
o_stream_uncork(conn->output);
if (conn->output->stream_errno != 0) {
errno = conn->output->stream_errno;
i_error("write(auth socket) failed: %m");
} else {
io_loop_run(conn->ioloop);
}
auth_master_unset_io(conn, prev_ioloop);
if (conn->aborted) {
conn->aborted = FALSE;
auth_connection_close(conn);
return -1;
}
return 0;
}
static unsigned int
auth_master_next_request_id(struct auth_master_connection *conn)
{
if (++conn->request_counter == 0) {
/* avoid zero */
conn->request_counter++;
}
return conn->request_counter;
}
static void
auth_user_info_export(string_t *str, const struct auth_user_info *info)
{
str_append(str, "service=");
str_append(str, info->service);
if (info->local_ip.family != 0)
str_printfa(str, "\tlip=%s", net_ip2addr(&info->local_ip));
if (info->local_port != 0)
str_printfa(str, "\tlport=%d", info->local_port);
if (info->remote_ip.family != 0)
str_printfa(str, "\trip=%s", net_ip2addr(&info->remote_ip));
if (info->remote_port != 0)
str_printfa(str, "\trport=%d", info->remote_port);
}
int auth_master_user_lookup(struct auth_master_connection *conn,
const char *user, const struct auth_user_info *info,
pool_t pool, const char **username_r,
const char *const **fields_r)
{
struct auth_master_lookup_ctx ctx;
string_t *str;
if (!is_valid_string(user) || !is_valid_string(info->service)) {
/* non-allowed characters, the user can't exist */
*username_r = NULL;
*fields_r = NULL;
return 0;
}
memset(&ctx, 0, sizeof(ctx));
ctx.conn = conn;
ctx.return_value = -1;
ctx.pool = pool;
ctx.expected_reply = "USER";
ctx.user = user;
conn->reply_callback = auth_lookup_reply_callback;
conn->reply_context = &ctx;
str = t_str_new(128);
str_printfa(str, "USER\t%u\t%s\t",
auth_master_next_request_id(conn), user);
auth_user_info_export(str, info);
str_append_c(str, '\n');
conn->prefix = t_strdup_printf("userdb lookup(%s)", user);
(void)auth_master_run_cmd(conn, str_c(str));
conn->prefix = DEFAULT_USERDB_LOOKUP_PREFIX;
if (ctx.return_value <= 0 || ctx.fields[0] == NULL) {
*username_r = NULL;
*fields_r = ctx.fields != NULL ? ctx.fields :
p_new(pool, const char *, 1);
if (ctx.return_value > 0) {
i_error("Userdb lookup didn't return username");
ctx.return_value = -1;
}
} else {
*username_r = ctx.fields[0];
*fields_r = ctx.fields + 1;
}
return ctx.return_value;
}
void auth_user_fields_parse(const char *const *fields, pool_t pool,
struct auth_user_reply *reply_r)
{
memset(reply_r, 0, sizeof(*reply_r));
reply_r->uid = (uid_t)-1;
reply_r->gid = (gid_t)-1;
p_array_init(&reply_r->extra_fields, pool, 64);
for (; *fields != NULL; fields++) {
if (strncmp(*fields, "uid=", 4) == 0) {
if (str_to_uid(*fields + 4, &reply_r->uid) < 0)
i_error("Invalid uid in reply");
} else if (strncmp(*fields, "gid=", 4) == 0) {
if (str_to_gid(*fields + 4, &reply_r->gid) < 0)
i_error("Invalid gid in reply");
} else if (strncmp(*fields, "home=", 5) == 0)
reply_r->home = p_strdup(pool, *fields + 5);
else if (strncmp(*fields, "chroot=", 7) == 0)
reply_r->chroot = p_strdup(pool, *fields + 7);
else {
const char *field = p_strdup(pool, *fields);
array_append(&reply_r->extra_fields, &field, 1);
}
}
}
int auth_master_pass_lookup(struct auth_master_connection *conn,
const char *user, const struct auth_user_info *info,
pool_t pool, const char *const **fields_r)
{
struct auth_master_lookup_ctx ctx;
string_t *str;
if (!is_valid_string(user) || !is_valid_string(info->service)) {
/* non-allowed characters, the user can't exist */
*fields_r = NULL;
return 0;
}
memset(&ctx, 0, sizeof(ctx));
ctx.conn = conn;
ctx.return_value = -1;
ctx.pool = pool;
ctx.expected_reply = "PASS";
ctx.user = user;
conn->reply_callback = auth_lookup_reply_callback;
conn->reply_context = &ctx;
str = t_str_new(128);
str_printfa(str, "PASS\t%u\t%s\t",
auth_master_next_request_id(conn), user);
auth_user_info_export(str, info);
str_append_c(str, '\n');
conn->prefix = t_strdup_printf("passdb lookup(%s)", user);
(void)auth_master_run_cmd(conn, str_c(str));
conn->prefix = DEFAULT_USERDB_LOOKUP_PREFIX;
*fields_r = ctx.fields != NULL ? ctx.fields :
p_new(pool, const char *, 1);
return ctx.return_value;
}
static bool
auth_user_list_reply_callback(const char *cmd, const char *const *args,
void *context)
{
struct auth_master_user_list_ctx *ctx = context;
const char *user;
if (strcmp(cmd, "DONE") == 0) {
io_loop_stop(ctx->conn->ioloop);
if (args[0] != NULL && strcmp(args[0], "fail") == 0) {
i_error("User listing returned failure");
ctx->failed = TRUE;
}
return TRUE;
}
if (strcmp(cmd, "LIST") == 0 && args[0] != NULL) {
/* we'll just read all the users into memory. otherwise we'd
have to use a separate connection for listing and there's
a higher chance of a failure since the connection could be
open to dovecot-auth for a long time. */
user = p_strdup(ctx->pool, args[0]);
array_append(&ctx->users, &user, 1);
return TRUE;
}
return FALSE;
}
struct auth_master_user_list_ctx *
auth_master_user_list_init(struct auth_master_connection *conn)
{
struct auth_master_user_list_ctx *ctx;
const char *str;
pool_t pool;
pool = pool_alloconly_create("auth master user list", 10240);
ctx = p_new(pool, struct auth_master_user_list_ctx, 1);
ctx->pool = pool;
ctx->conn = conn;
i_array_init(&ctx->users, 128);
conn->reply_callback = auth_user_list_reply_callback;
conn->reply_context = ctx;
str = t_strdup_printf("LIST\t%u\n", auth_master_next_request_id(conn));
conn->prefix = "userdb list";
if (auth_master_run_cmd(conn, str) < 0)
ctx->failed = TRUE;
ctx->user_strings = array_get(&ctx->users, &ctx->user_count);
conn->prefix = DEFAULT_USERDB_LOOKUP_PREFIX;
return ctx;
}
const char *auth_master_user_list_next(struct auth_master_user_list_ctx *ctx)
{
if (ctx->idx == ctx->user_count)
return NULL;
return ctx->user_strings[ctx->idx++];
}
unsigned int auth_master_user_list_count(struct auth_master_user_list_ctx *ctx)
{
return ctx->user_count;
}
int auth_master_user_list_deinit(struct auth_master_user_list_ctx **_ctx)
{
struct auth_master_user_list_ctx *ctx = *_ctx;
int ret = ctx->failed ? -1 : 0;
*_ctx = NULL;
array_free(&ctx->users);
pool_unref(&ctx->pool);
return ret;
}