login-proxy.c revision 0dffa25d211be541ee3c953b23566a1a990789df
/* Copyright (c) 2004-2016 Dovecot authors, see the included COPYING file */
#include "login-common.h"
#include "ioloop.h"
#include "istream.h"
#include "ostream.h"
#include "llist.h"
#include "str.h"
#include "str-sanitize.h"
#include "time-util.h"
#include "master-service.h"
#include "ipc-server.h"
#include "mail-user-hash.h"
#include "client-common.h"
#include "ssl-proxy.h"
#include "login-proxy-state.h"
#include "login-proxy.h"
#define MAX_PROXY_INPUT_SIZE 4096
#define OUTBUF_THRESHOLD 1024
#define LOGIN_PROXY_DIE_IDLE_SECS 2
#define LOGIN_PROXY_IPC_PATH "ipc-proxy"
#define LOGIN_PROXY_IPC_NAME "proxy"
#define KILLED_BY_ADMIN_REASON "Kicked by admin"
#define KILLED_BY_DIRECTOR_REASON "Kicked via director"
#define KILLED_BY_SHUTDOWN_REASON "Process shutting down"
#define PROXY_IMMEDIATE_FAILURE_SECS 30
#define PROXY_CONNECT_RETRY_MSECS 1000
#define PROXY_DISCONNECT_INTERVAL_MSECS 100
struct login_proxy {
struct ssl_proxy *ssl_server_proxy;
struct login_proxy_record *state_rec;
char *host;
unsigned int connect_timeout_msecs;
unsigned int notify_refresh_secs;
unsigned int reconnect_count;
bool connected:1;
bool destroying:1;
bool disconnecting:1;
bool delayed_disconnect:1;
bool num_waiting_connections_updated:1;
};
static struct login_proxy_state *proxy_state;
static struct ipc_server *login_proxy_ipc_server;
static void
ATTR_NULL(2);
static void
ATTR_NULL(2);
{
if (errstr[0] != '\0')
}
if (server)
else
}
{
const char *errstr;
}
{
const char *errstr;
}
{
unsigned char buf[OUTBUF_THRESHOLD];
/* client's output buffer is already quite full.
don't send more until we're below threshold. */
return;
}
if (ret < 0) {
return;
}
}
{
const unsigned char *data;
/* proxy's output buffer is already quite full.
don't send more until we're below threshold. */
return;
}
return;
}
else
}
{
/* we're already disconnected from server. either wait for
disconnection timeout or for client to disconnect itself. */
else {
}
}
{
return 1;
}
/* there's again space in proxy's output buffer, so we can
read more from client. */
}
return 1;
}
{
return 1;
}
/* there's again space in client's output buffer, so we can
read more from proxy. */
}
return 1;
}
{
}
{
}
{
/* there was a successful connection done since we started
connecting. perhaps this is just a temporary one-off
failure. */
} else {
}
}
static void
{
} else {
}
if (proxy->reconnect_count > 0)
}
}
{
(void)login_proxy_connect(proxy);
}
{
if (since_started_msecs < 0)
return FALSE; /* time moved backwards */
if (left_msecs <= 0)
return FALSE;
proxy->reconnect_count++;
return TRUE;
}
{
if (errno != 0) {
if (!proxy_try_reconnect(proxy)) {
}
return;
}
if (login_proxy_starttls(proxy) < 0) {
return;
}
} else {
}
}
{
}
{
/* first connect to this IP. don't start immediately failing
the check below. */
}
rec->num_waiting_connections != 0) {
/* the server is down. fail immediately */
"proxy(%s): Host %s:%u is down",
return -1;
}
return -1;
}
if (proxy->connect_timeout_msecs != 0) {
}
return 0;
}
const struct login_proxy_settings *set,
{
struct login_proxy *proxy;
return -1;
}
"proxy(%s): TTL reached zero - "
return -1;
}
"proxy(%s): BUG: host %s is not an IP "
"(auth should have changed it)",
} else {
if (login_proxy_connect(proxy) < 0)
return -1;
}
return 0;
}
{
if (!proxy->num_waiting_connections_updated) {
}
}
}
{
if (proxy->delayed_disconnect) {
}
}
{
const unsigned int max_delay =
struct timeval disconnect_time_offset;
int delay_msecs;
if (rec->num_disconnects_since_ts == 0) {
/* start from a slightly random timestamp. this way all proxy
processes will disconnect at slightly different times to
spread the load. */
}
/* we were already lazily disconnecting this */
return 0;
}
if (max_delay == 0) {
/* delaying is disabled */
return 0;
}
rec->num_delayed_client_disconnects == 0) {
/* wait delaying until we have 1 second's worth of clients
disconnected */
return 0;
}
/* see at which time we should be disconnecting the client.
do it in 100ms intervals so the timeouts are triggered together. */
if (delay_msecs <= 0) {
/* we already reached the time */
return 0;
}
return delay_msecs;
}
static void ATTR_NULL(2)
bool delayed)
{
const char *ipstr;
unsigned int delay_ms = 0;
if (proxy->destroying)
return;
/* we'll disconnect server side in any case. */
/* detached proxy */
if (delayed)
"proxy(%s): disconnecting %s%s%s",
} else {
}
if (delay_ms == 0)
else {
}
}
static void ATTR_NULL(2)
{
}
static void ATTR_NULL(2)
{
}
{
}
{
return FALSE;
return FALSE;
return FALSE;
}
{
}
{
return proxy->server_output;
}
{
}
{
}
{
}
{
}
{
const unsigned char *data;
/* send all pending client input to proxy */
if (size != 0)
/* from now on, just do dummy proxying */
if (proxy->notify_refresh_secs != 0) {
}
if (login_proxy_ipc_server == NULL) {
}
}
static int login_proxy_ssl_handshaked(void *context)
{
return 0;
"proxy: Received invalid SSL certificate from %s:%u: %s",
"proxy: SSL certificate not received from %s:%u",
"proxy: hostname doesn't match SSL certificate at %s:%u",
} else {
return 0;
}
return -1;
}
{
int fd;
if (fd < 0) {
"proxy: SSL handshake failed to %s:%u",
return -1;
}
return 0;
}
{
}
void login_proxy_kill_idle(void)
{
unsigned int stop_msecs;
else {
}
}
}
static void
{
unsigned int count = 0;
return;
}
count++;
}
}
count++;
}
}
}
{
}
static void
{
return;
}
/* optional except_ip parameter specifies that we're not killing the
connections that are proxying to the except_ip backend */
return;
}
count++;
}
}
count++;
}
}
}
static void
struct login_proxy *proxy)
{
T_BEGIN {
const char *reply;
} T_END;
}
static void
{
struct login_proxy *proxy;
}
{
args++;
else
}
void login_proxy_init(const char *proxy_notify_pipe_path)
{
}
void login_proxy_deinit(void)
{
struct login_proxy *proxy;
while (login_proxies != NULL) {
}
while (login_proxies_disconnecting != NULL)
if (login_proxy_ipc_server != NULL)
}