login-settings.c revision 71b5ad1df203c906d46960b0400564609b97a6c8
32N/A/* Copyright (c) 2005-2009 Dovecot authors, see the included COPYING file */
32N/A
911N/A#include "common.h"
851N/A#include "hostpid.h"
32N/A#include "var-expand.h"
32N/A#include "settings-parser.h"
919N/A#include "master-service-settings.h"
919N/A#include "login-settings.h"
919N/A
919N/A#include <stddef.h>
919N/A#include <unistd.h>
919N/A
919N/Astatic bool login_settings_check(void *_set, pool_t pool, const char **error_r);
919N/A
919N/A#undef DEF
919N/A#define DEF(type, name) \
919N/A { type, #name, offsetof(struct login_settings, name), NULL }
919N/A
919N/Astatic const struct setting_define login_setting_defines[] = {
919N/A DEF(SET_STR, login_trusted_networks),
919N/A DEF(SET_STR_VARS, login_greeting),
919N/A DEF(SET_STR, login_log_format_elements),
919N/A DEF(SET_STR, login_log_format),
32N/A
32N/A DEF(SET_ENUM, ssl),
32N/A DEF(SET_STR, ssl_ca_file),
32N/A DEF(SET_STR, ssl_cert),
493N/A DEF(SET_STR, ssl_key),
32N/A DEF(SET_STR, ssl_key_password),
32N/A DEF(SET_STR, ssl_parameters_file),
851N/A DEF(SET_STR, ssl_cipher_list),
32N/A DEF(SET_STR, ssl_cert_username_field),
911N/A DEF(SET_BOOL, ssl_verify_client_cert),
911N/A DEF(SET_BOOL, ssl_require_client_cert),
911N/A DEF(SET_BOOL, ssl_username_from_cert),
911N/A DEF(SET_BOOL, verbose_ssl),
32N/A
32N/A DEF(SET_BOOL, disable_plaintext_auth),
32N/A DEF(SET_BOOL, verbose_auth),
32N/A DEF(SET_BOOL, auth_debug),
32N/A DEF(SET_BOOL, verbose_proctitle),
DEF(SET_UINT, mail_max_userip_connections),
SETTING_DEFINE_LIST_END
};
static const struct login_settings login_default_settings = {
MEMBER(login_trusted_networks) "",
MEMBER(login_greeting) PACKAGE_NAME" ready.",
MEMBER(login_log_format_elements) "user=<%u> method=%m rip=%r lip=%l %c",
MEMBER(login_log_format) "%$: %s",
MEMBER(ssl) "yes:no:required",
MEMBER(ssl_ca_file) "",
MEMBER(ssl_cert) "",
MEMBER(ssl_key) "",
MEMBER(ssl_key_password) "",
MEMBER(ssl_parameters_file) "ssl-parameters.dat",
MEMBER(ssl_cipher_list) "ALL:!LOW:!SSLv2:!EXP:!aNULL",
MEMBER(ssl_cert_username_field) "commonName",
MEMBER(ssl_verify_client_cert) FALSE,
MEMBER(ssl_require_client_cert) FALSE,
MEMBER(ssl_username_from_cert) FALSE,
MEMBER(verbose_ssl) FALSE,
MEMBER(disable_plaintext_auth) TRUE,
MEMBER(verbose_auth) FALSE,
MEMBER(auth_debug) FALSE,
MEMBER(verbose_proctitle) FALSE,
MEMBER(mail_max_userip_connections) 10
};
const struct setting_parser_info login_setting_parser_info = {
MEMBER(module_name) "login",
MEMBER(defines) login_setting_defines,
MEMBER(defaults) &login_default_settings,
MEMBER(type_offset) (size_t)-1,
MEMBER(struct_size) sizeof(struct login_settings),
MEMBER(parent_offset) (size_t)-1,
MEMBER(parent) NULL,
MEMBER(check_func) login_settings_check
};
static const struct setting_parser_info *default_login_set_roots[] = {
&login_setting_parser_info,
NULL
};
const struct setting_parser_info **login_set_roots = default_login_set_roots;
/* <settings checks> */
static int ssl_settings_check(void *_set ATTR_UNUSED, const char **error_r)
{
struct login_settings *set = _set;
#ifndef HAVE_SSL
*error_r = t_strdup_printf("SSL support not compiled in but ssl=%s",
set->ssl);
return FALSE;
#else
if (*set->ssl_cert == '\0') {
*error_r = "ssl enabled, but ssl_cert not set";
return FALSE;
}
if (*set->ssl_key == '\0') {
*error_r = "ssl enabled, but ssl_key not set";
return FALSE;
}
if (set->ssl_verify_client_cert && *set->ssl_ca_file == '\0') {
*error_r = "ssl_verify_client_cert set, but ssl_ca_file not";
return FALSE;
}
#ifndef CONFIG_BINARY
if (*set->ssl_ca_file != '\0' && access(set->ssl_ca_file, R_OK) < 0) {
*error_r = t_strdup_printf("ssl_ca_file: access(%s) failed: %m",
set->ssl_ca_file);
return FALSE;
}
#endif
return TRUE;
#endif
}
static bool login_settings_check(void *_set, pool_t pool, const char **error_r)
{
struct login_settings *set = _set;
set->log_format_elements_split =
p_strsplit(pool, set->login_log_format_elements, " ");
if (set->ssl_require_client_cert || set->ssl_username_from_cert) {
/* if we require valid cert, make sure we also ask for it */
set->ssl_verify_client_cert = TRUE;
}
if (strcmp(set->ssl, "no") == 0) {
/* disabled */
} else if (strcmp(set->ssl, "yes") == 0) {
if (!ssl_settings_check(set, error_r))
return FALSE;
} else if (strcmp(set->ssl, "required") == 0) {
if (!ssl_settings_check(set, error_r))
return FALSE;
set->disable_plaintext_auth = TRUE;
} else {
*error_r = t_strdup_printf("Unknown ssl setting value: %s",
set->ssl);
return FALSE;
}
return TRUE;
}
/* </settings checks> */
static const struct var_expand_table *
login_set_var_expand_table(const struct master_service_settings_input *input)
{
static struct var_expand_table static_tab[] = {
{ 'l', NULL, "lip" },
{ 'r', NULL, "rip" },
{ 'p', NULL, "pid" },
{ 's', NULL, "service" },
{ '\0', NULL, "hostname" },
{ '\0', NULL, NULL }
};
struct var_expand_table *tab;
tab = t_malloc(sizeof(static_tab));
memcpy(tab, static_tab, sizeof(static_tab));
tab[0].value = net_ip2addr(&input->local_ip);
tab[1].value = net_ip2addr(&input->remote_ip);
tab[2].value = my_pid;
tab[3].value = input->service;
tab[4].value = my_hostname;
return tab;
}
struct login_settings *
login_settings_read(struct master_service *service, pool_t pool,
const struct ip_addr *local_ip,
const struct ip_addr *remote_ip,
const char *local_host,
void ***other_settings_r)
{
struct master_service_settings_input input;
const char *error;
void **sets;
unsigned int i;
memset(&input, 0, sizeof(input));
input.roots = login_set_roots;
input.module = login_process_name;
input.service = login_protocol;
input.local_host = local_host;
if (local_ip != NULL)
input.local_ip = *local_ip;
if (remote_ip != NULL)
input.remote_ip = *remote_ip;
/* this function always clears the previous settings pool. since we're
doing per-connection lookups, we always need to duplicate the
settings using another pool. */
if (master_service_settings_read(service, &input, &error) < 0)
i_fatal("Error reading configuration: %s", error);
sets = master_service_settings_get_others(service);
for (i = 0; sets[i] != NULL; i++) {
sets[i] = settings_dup(input.roots[i], sets[i], pool);
if (!settings_check(input.roots[i], pool, sets[i], &error)) {
const char *name = input.roots[i]->module_name;
i_fatal("settings_check(%s) failed: %s",
name != NULL ? name : "unknown", error);
}
}
settings_var_expand(&login_setting_parser_info, sets[0], pool,
login_set_var_expand_table(&input));
*other_settings_r = sets + 1;
return sets[0];
}