acl-mailbox-list.c revision 925915badca5cf87bf45050c2fcc103534bef71a
e59faf65ce864fe95dc00f5d52b8323cdbd0608aTimo Sirainen/* Copyright (c) 2006-2010 Dovecot authors, see the included COPYING file */
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen#include "lib.h"
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen#include "array.h"
ef50336eefcb9ba99f73c6af37420eaf8857a39bTimo Sirainen#include "str.h"
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen#include "imap-match.h"
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen#include "mailbox-tree.h"
e7ca5f820d6a1a8fe549a2966ac707a60e055ef4Timo Sirainen#include "mail-namespace.h"
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen#include "mailbox-list-private.h"
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen#include "acl-api-private.h"
81e6e1ef0feef60644a4c4b745d82a4c98223affTimo Sirainen#include "acl-cache.h"
81e6e1ef0feef60644a4c4b745d82a4c98223affTimo Sirainen#include "acl-shared-storage.h"
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen#include "acl-plugin.h"
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen#define MAILBOX_FLAG_MATCHED 0x40000000
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainenstruct acl_mailbox_list_iterate_context {
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen struct mailbox_list_iterate_context ctx;
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen struct mailbox_list_iterate_context *super_ctx;
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen struct mailbox_tree_context *lookup_boxes;
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen struct mailbox_info info;
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen struct imap_match_glob *glob;
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen char sep;
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen unsigned int simple_star_glob:1;
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen};
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainenstatic const char *acl_storage_right_names[ACL_STORAGE_RIGHT_COUNT] = {
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen MAIL_ACL_LOOKUP,
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen MAIL_ACL_READ,
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen MAIL_ACL_WRITE,
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen MAIL_ACL_WRITE_SEEN,
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen MAIL_ACL_WRITE_DELETED,
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen MAIL_ACL_INSERT,
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen MAIL_ACL_POST,
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen MAIL_ACL_EXPUNGE,
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen MAIL_ACL_CREATE,
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen MAIL_ACL_DELETE,
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen MAIL_ACL_ADMIN
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen};
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainenstruct acl_mailbox_list_module acl_mailbox_list_module =
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen MODULE_CONTEXT_INIT(&mailbox_list_module_register);
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen
e7ca5f820d6a1a8fe549a2966ac707a60e055ef4Timo Sirainenstruct acl_backend *acl_mailbox_list_get_backend(struct mailbox_list *list)
e7ca5f820d6a1a8fe549a2966ac707a60e055ef4Timo Sirainen{
e7ca5f820d6a1a8fe549a2966ac707a60e055ef4Timo Sirainen struct acl_mailbox_list *alist = ACL_LIST_CONTEXT(list);
e7ca5f820d6a1a8fe549a2966ac707a60e055ef4Timo Sirainen
e7ca5f820d6a1a8fe549a2966ac707a60e055ef4Timo Sirainen return alist->rights.backend;
e7ca5f820d6a1a8fe549a2966ac707a60e055ef4Timo Sirainen}
e7ca5f820d6a1a8fe549a2966ac707a60e055ef4Timo Sirainen
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainenint acl_mailbox_list_have_right(struct mailbox_list *list, const char *name,
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen bool parent, unsigned int acl_storage_right_idx,
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen bool *can_see_r)
e7ca5f820d6a1a8fe549a2966ac707a60e055ef4Timo Sirainen{
da9f6acdcb303d0fe5160b669668aedf39c8f45aTimo Sirainen struct acl_mailbox_list *alist = ACL_LIST_CONTEXT(list);
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen struct acl_backend *backend = alist->rights.backend;
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen const unsigned int *idx_arr = alist->rights.acl_storage_right_idx;
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen struct acl_object *aclobj;
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen int ret, ret2;
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen aclobj = !parent ?
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen acl_object_init_from_name(backend, name) :
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen acl_object_init_from_parent(backend, name);
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen ret = acl_object_have_right(aclobj, idx_arr[acl_storage_right_idx]);
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen if (can_see_r != NULL) {
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen ret2 = acl_object_have_right(aclobj,
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen idx_arr[ACL_STORAGE_RIGHT_LOOKUP]);
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen if (ret2 < 0)
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen ret = -1;
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen *can_see_r = ret2 > 0;
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen }
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen acl_object_deinit(&aclobj);
da9f6acdcb303d0fe5160b669668aedf39c8f45aTimo Sirainen
da9f6acdcb303d0fe5160b669668aedf39c8f45aTimo Sirainen if (ret < 0)
da9f6acdcb303d0fe5160b669668aedf39c8f45aTimo Sirainen mailbox_list_set_internal_error(list);
da9f6acdcb303d0fe5160b669668aedf39c8f45aTimo Sirainen return ret;
e7ca5f820d6a1a8fe549a2966ac707a60e055ef4Timo Sirainen}
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainenstatic void
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainenacl_mailbox_try_list_fast(struct acl_mailbox_list_iterate_context *ctx)
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen{
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen struct acl_mailbox_list *alist = ACL_LIST_CONTEXT(ctx->ctx.list);
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen struct acl_backend *backend = alist->rights.backend;
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen const unsigned int *idxp;
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen const struct acl_mask *acl_mask;
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen struct acl_mailbox_list_context *nonowner_list_ctx;
ef50336eefcb9ba99f73c6af37420eaf8857a39bTimo Sirainen struct mail_namespace *ns = ctx->ctx.list->ns;
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainen struct mailbox_list_iter_update_context update_ctx;
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen const char *name;
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen string_t *vname = NULL;
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen int ret;
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainen if ((ctx->ctx.flags & (MAILBOX_LIST_ITER_RAW_LIST |
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainen MAILBOX_LIST_ITER_SELECT_SUBSCRIBED)) != 0)
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainen return;
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen
36aa287d32a78048d66cff024a8f7e848c45a8bfTimo Sirainen if (ns->type == NAMESPACE_PUBLIC) {
36aa287d32a78048d66cff024a8f7e848c45a8bfTimo Sirainen /* mailboxes in public namespace should all be listable to
36aa287d32a78048d66cff024a8f7e848c45a8bfTimo Sirainen someone. we don't benefit from fast listing. */
36aa287d32a78048d66cff024a8f7e848c45a8bfTimo Sirainen return;
36aa287d32a78048d66cff024a8f7e848c45a8bfTimo Sirainen }
36aa287d32a78048d66cff024a8f7e848c45a8bfTimo Sirainen
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen /* if this namespace's default rights contain LOOKUP, we'll need to
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen go through all mailboxes in any case. */
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen idxp = alist->rights.acl_storage_right_idx + ACL_STORAGE_RIGHT_LOOKUP;
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen if (acl_backend_get_default_rights(backend, &acl_mask) < 0 ||
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen acl_cache_mask_isset(acl_mask, *idxp))
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainen return;
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen /* no LOOKUP right by default, we can optimize this */
c07e35cfc9587fc7589cbc1db0daeeb828456b2bTimo Sirainen vname = t_str_new(256);
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainen memset(&update_ctx, 0, sizeof(update_ctx));
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainen update_ctx.iter_ctx = &ctx->ctx;
44fda09101a94883f45b8a6214628e541550cebcTimo Sirainen update_ctx.glob =
44fda09101a94883f45b8a6214628e541550cebcTimo Sirainen imap_match_init(pool_datastack_create(), "*",
eb64c3586d854cddd693f0b811d897399076a441Timo Sirainen (ns->flags & NAMESPACE_FLAG_INBOX_USER) != 0,
44fda09101a94883f45b8a6214628e541550cebcTimo Sirainen ctx->sep);
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainen update_ctx.match_parents = TRUE;
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen update_ctx.tree_ctx = mailbox_tree_init(ctx->sep);
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen nonowner_list_ctx = acl_backend_nonowner_lookups_iter_init(backend);
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen while ((ret = acl_backend_nonowner_lookups_iter_next(nonowner_list_ctx,
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen &name)) > 0) {
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen if (vname != NULL)
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen name = mail_namespace_get_vname(ns, vname, name);
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen mailbox_list_iter_update(&update_ctx, name);
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen }
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen acl_backend_nonowner_lookups_iter_deinit(&nonowner_list_ctx);
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen if (ret == 0)
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen ctx->lookup_boxes = update_ctx.tree_ctx;
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen else
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen mailbox_tree_deinit(&update_ctx.tree_ctx);
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen}
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainenstatic struct mailbox_list_iterate_context *
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainenacl_mailbox_list_iter_init_shared(struct mailbox_list *list,
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen const char *const *patterns,
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen enum mailbox_list_iter_flags flags)
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen{
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen struct acl_mailbox_list *alist = ACL_LIST_CONTEXT(list);
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen struct mailbox_list_iterate_context *ctx;
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen int ret;
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen /* before listing anything add namespaces for all users
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen who may have visible mailboxes */
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen ret = acl_shared_namespaces_add(list->ns);
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen ctx = alist->module_ctx.super.iter_init(list, patterns, flags);
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen if (ret < 0)
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen ctx->failed = TRUE;
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen return ctx;
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen}
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainenstatic struct mailbox_list_iterate_context *
d92f33f13830ba23d814342bf3ea8db721a15bb1Timo Sirainenacl_mailbox_list_iter_init(struct mailbox_list *list,
d92f33f13830ba23d814342bf3ea8db721a15bb1Timo Sirainen const char *const *patterns,
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen enum mailbox_list_iter_flags flags)
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen{
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen struct acl_mailbox_list *alist = ACL_LIST_CONTEXT(list);
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen struct acl_mailbox_list_iterate_context *ctx;
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen const char *p;
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen unsigned int i;
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen bool inboxcase;
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen ctx = i_new(struct acl_mailbox_list_iterate_context, 1);
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen ctx->ctx.list = list;
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen ctx->ctx.flags = flags;
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen
eb64c3586d854cddd693f0b811d897399076a441Timo Sirainen inboxcase = (list->ns->flags & NAMESPACE_FLAG_INBOX_USER) != 0;
c07e35cfc9587fc7589cbc1db0daeeb828456b2bTimo Sirainen ctx->sep = list->ns->sep;
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen ctx->glob = imap_match_init_multiple(default_pool, patterns,
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen inboxcase, ctx->sep);
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen /* see if all patterns have only a single '*' and it's at the end.
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen we can use it to do some optimizations. */
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen ctx->simple_star_glob = TRUE;
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen for (i = 0; patterns[i] != NULL; i++) {
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen p = strchr(patterns[i], '*');
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen if (p == NULL || p[1] != '\0') {
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen ctx->simple_star_glob = FALSE;
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen break;
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen }
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen }
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen /* Try to avoid reading ACLs from all mailboxes by getting a smaller
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen list of mailboxes that have even potential to be visible. If we
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen couldn't get such a list, we'll go through all mailboxes. */
19e8adccba16ff419f5675b1575358c2956dce83Timo Sirainen T_BEGIN {
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen acl_mailbox_try_list_fast(ctx);
19e8adccba16ff419f5675b1575358c2956dce83Timo Sirainen } T_END;
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainen ctx->super_ctx = alist->module_ctx.super.
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainen iter_init(list, patterns, flags);
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen return &ctx->ctx;
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen}
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen
61e84692827b6a64912343f515c984853021483aTimo Sirainenstatic const struct mailbox_info *
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainenacl_mailbox_list_iter_next_info(struct acl_mailbox_list_iterate_context *ctx)
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen{
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen struct acl_mailbox_list *alist = ACL_LIST_CONTEXT(ctx->ctx.list);
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainen const struct mailbox_info *info;
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen
925915badca5cf87bf45050c2fcc103534bef71aTimo Sirainen while ((info = alist->module_ctx.super.iter_next(ctx->super_ctx)) != NULL) {
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen /* if we've a list of mailboxes with LOOKUP rights, skip the
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen mailboxes not in the list (since we know they can't be
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen visible to us). */
925915badca5cf87bf45050c2fcc103534bef71aTimo Sirainen if (ctx->lookup_boxes == NULL ||
925915badca5cf87bf45050c2fcc103534bef71aTimo Sirainen mailbox_tree_lookup(ctx->lookup_boxes, info->name) != NULL)
925915badca5cf87bf45050c2fcc103534bef71aTimo Sirainen break;
925915badca5cf87bf45050c2fcc103534bef71aTimo Sirainen if (ctx->ctx.list->ns->user->mail_debug) {
925915badca5cf87bf45050c2fcc103534bef71aTimo Sirainen i_debug("acl: Mailbox not in dovecot-acl-list: %s",
925915badca5cf87bf45050c2fcc103534bef71aTimo Sirainen info->name);
925915badca5cf87bf45050c2fcc103534bef71aTimo Sirainen }
925915badca5cf87bf45050c2fcc103534bef71aTimo Sirainen }
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainen return info;
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainen}
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainen
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainenstatic const char *
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainenacl_mailbox_list_iter_get_name(struct mailbox_list_iterate_context *ctx,
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainen const char *name)
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainen{
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainen struct mail_namespace *ns = ctx->list->ns;
d7d3f11df97aa1e816964399a07c2ef23e573abbTimo Sirainen unsigned int len;
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainen
c07e35cfc9587fc7589cbc1db0daeeb828456b2bTimo Sirainen name = mail_namespace_get_storage_name(ns, name);
d7d3f11df97aa1e816964399a07c2ef23e573abbTimo Sirainen len = strlen(name);
980061e0c19e1b2db1ff736002ce8809cba62886Timo Sirainen if (len > 0 && name[len-1] == ns->real_sep) {
d7d3f11df97aa1e816964399a07c2ef23e573abbTimo Sirainen /* name ends with separator. this can happen if doing e.g.
d7d3f11df97aa1e816964399a07c2ef23e573abbTimo Sirainen LIST "" foo/% and it lists "foo/". */
d7d3f11df97aa1e816964399a07c2ef23e573abbTimo Sirainen name = t_strndup(name, len-1);
d7d3f11df97aa1e816964399a07c2ef23e573abbTimo Sirainen }
d7d3f11df97aa1e816964399a07c2ef23e573abbTimo Sirainen return name;
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen}
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainenstatic bool
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Siraineniter_is_listing_all_children(struct acl_mailbox_list_iterate_context *ctx)
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen{
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen const char *child;
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen /* If all patterns (with '.' separator) are in "name*", "name.*" or
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen "%.*" style format, simple_star_glob=TRUE and we can easily test
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen this by simply checking if name/child mailbox matches. */
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen child = t_strdup_printf("%s%cx", ctx->info.name, ctx->sep);
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen return ctx->simple_star_glob &&
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen imap_match(ctx->glob, child) == IMAP_MATCH_YES;
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen}
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainenstatic bool
ecff11c6c8418a365da4e2b154327d52de2aa563Timo Siraineniter_mailbox_has_visible_children(struct acl_mailbox_list_iterate_context *ctx,
ecff11c6c8418a365da4e2b154327d52de2aa563Timo Sirainen bool only_nonpatterns)
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen{
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen struct mailbox_list_iterate_context *iter;
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen const struct mailbox_info *info;
a8de8d06e459b4725cc4d1637a2baf00cab73924Timo Sirainen string_t *pattern;
a8de8d06e459b4725cc4d1637a2baf00cab73924Timo Sirainen const char *prefix;
a8de8d06e459b4725cc4d1637a2baf00cab73924Timo Sirainen unsigned int i, prefix_len;
a8de8d06e459b4725cc4d1637a2baf00cab73924Timo Sirainen bool stars = FALSE, ret = FALSE;
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen /* do we have child mailboxes with LOOKUP right that don't match
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen the list pattern? */
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen if (ctx->lookup_boxes != NULL) {
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen /* we have a list of mailboxes with LOOKUP rights. before
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen starting the slow list iteration, check check first
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen if there even are any children with LOOKUP rights. */
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen struct mailbox_node *node;
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen node = mailbox_tree_lookup(ctx->lookup_boxes, ctx->info.name);
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen i_assert(node != NULL);
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen if (node->children == NULL)
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen return FALSE;
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen }
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen
a8de8d06e459b4725cc4d1637a2baf00cab73924Timo Sirainen /* if mailbox name has '*' characters in it, they'll conflict with the
a8de8d06e459b4725cc4d1637a2baf00cab73924Timo Sirainen LIST wildcard. replace then with '%' and verify later that all
a8de8d06e459b4725cc4d1637a2baf00cab73924Timo Sirainen results have the correct prefix. */
a8de8d06e459b4725cc4d1637a2baf00cab73924Timo Sirainen pattern = t_str_new(128);
a8de8d06e459b4725cc4d1637a2baf00cab73924Timo Sirainen for (i = 0; ctx->info.name[i] != '\0'; i++) {
a8de8d06e459b4725cc4d1637a2baf00cab73924Timo Sirainen if (ctx->info.name[i] != '*')
a8de8d06e459b4725cc4d1637a2baf00cab73924Timo Sirainen str_append_c(pattern, ctx->info.name[i]);
a8de8d06e459b4725cc4d1637a2baf00cab73924Timo Sirainen else {
a8de8d06e459b4725cc4d1637a2baf00cab73924Timo Sirainen stars = TRUE;
a8de8d06e459b4725cc4d1637a2baf00cab73924Timo Sirainen str_append_c(pattern, '%');
a8de8d06e459b4725cc4d1637a2baf00cab73924Timo Sirainen }
a8de8d06e459b4725cc4d1637a2baf00cab73924Timo Sirainen }
0a167fd961775cb203f862a3a6bc5e55ce8e76c9Timo Sirainen if (i > 0 && ctx->info.name[i-1] != ctx->sep)
0a167fd961775cb203f862a3a6bc5e55ce8e76c9Timo Sirainen str_append_c(pattern, ctx->sep);
a8de8d06e459b4725cc4d1637a2baf00cab73924Timo Sirainen str_append_c(pattern, '*');
a8de8d06e459b4725cc4d1637a2baf00cab73924Timo Sirainen prefix = str_c(pattern);
a8de8d06e459b4725cc4d1637a2baf00cab73924Timo Sirainen prefix_len = str_len(pattern) - 1;
a8de8d06e459b4725cc4d1637a2baf00cab73924Timo Sirainen
c07e35cfc9587fc7589cbc1db0daeeb828456b2bTimo Sirainen iter = mailbox_list_iter_init(ctx->ctx.list, str_c(pattern),
c07e35cfc9587fc7589cbc1db0daeeb828456b2bTimo Sirainen MAILBOX_LIST_ITER_RETURN_NO_FLAGS);
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen while ((info = mailbox_list_iter_next(iter)) != NULL) {
ecff11c6c8418a365da4e2b154327d52de2aa563Timo Sirainen if (only_nonpatterns &&
ecff11c6c8418a365da4e2b154327d52de2aa563Timo Sirainen imap_match(ctx->glob, info->name) == IMAP_MATCH_YES) {
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen /* at least one child matches also the original list
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen patterns. we don't need to show this mailbox. */
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen ret = FALSE;
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen break;
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen }
a8de8d06e459b4725cc4d1637a2baf00cab73924Timo Sirainen if (!stars || strncmp(info->name, prefix, prefix_len) == 0)
a8de8d06e459b4725cc4d1637a2baf00cab73924Timo Sirainen ret = TRUE;
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen }
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen (void)mailbox_list_iter_deinit(&iter);
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen return ret;
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen}
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainenstatic int
0b219481c3b695a18ba5801aa4843cf4d532dd86Timo Sirainenacl_mailbox_list_info_is_visible(struct acl_mailbox_list_iterate_context *ctx)
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen{
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen#define PRESERVE_MAILBOX_FLAGS (MAILBOX_SUBSCRIBED | MAILBOX_CHILD_SUBSCRIBED)
0b219481c3b695a18ba5801aa4843cf4d532dd86Timo Sirainen struct mailbox_info *info = &ctx->info;
ef50336eefcb9ba99f73c6af37420eaf8857a39bTimo Sirainen const char *acl_name;
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen int ret;
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen if ((ctx->ctx.flags & MAILBOX_LIST_ITER_RAW_LIST) != 0) {
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen /* skip ACL checks. */
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen return 1;
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen }
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainen acl_name = acl_mailbox_list_iter_get_name(&ctx->ctx, info->name);
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen ret = acl_mailbox_list_have_right(ctx->ctx.list, acl_name, FALSE,
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen ACL_STORAGE_RIGHT_LOOKUP,
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen NULL);
ecff11c6c8418a365da4e2b154327d52de2aa563Timo Sirainen if (ret != 0) {
0a167fd961775cb203f862a3a6bc5e55ce8e76c9Timo Sirainen if ((ctx->ctx.flags & MAILBOX_LIST_ITER_RETURN_NO_FLAGS) != 0) {
0a167fd961775cb203f862a3a6bc5e55ce8e76c9Timo Sirainen /* don't waste time checking if there are visible
0a167fd961775cb203f862a3a6bc5e55ce8e76c9Timo Sirainen children, but also don't return incorrect flags */
0a167fd961775cb203f862a3a6bc5e55ce8e76c9Timo Sirainen info->flags &= ~MAILBOX_CHILDREN;
0a167fd961775cb203f862a3a6bc5e55ce8e76c9Timo Sirainen } else if ((info->flags & MAILBOX_CHILDREN) != 0 &&
0a167fd961775cb203f862a3a6bc5e55ce8e76c9Timo Sirainen !iter_mailbox_has_visible_children(ctx, FALSE)) {
ecff11c6c8418a365da4e2b154327d52de2aa563Timo Sirainen info->flags &= ~MAILBOX_CHILDREN;
ecff11c6c8418a365da4e2b154327d52de2aa563Timo Sirainen info->flags |= MAILBOX_NOCHILDREN;
ecff11c6c8418a365da4e2b154327d52de2aa563Timo Sirainen }
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen return ret;
ecff11c6c8418a365da4e2b154327d52de2aa563Timo Sirainen }
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen /* no permission to see this mailbox */
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen if ((ctx->ctx.flags & MAILBOX_LIST_ITER_SELECT_SUBSCRIBED) != 0) {
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen /* we're listing subscribed mailboxes. this one or its child
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen is subscribed, so we'll need to list it. but since we don't
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen have LOOKUP right, we'll need to show it as nonexistent. */
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen i_assert((info->flags & PRESERVE_MAILBOX_FLAGS) != 0);
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen info->flags = MAILBOX_NONEXISTENT |
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen (info->flags & PRESERVE_MAILBOX_FLAGS);
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen return 1;
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen }
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen if (!iter_is_listing_all_children(ctx) &&
ecff11c6c8418a365da4e2b154327d52de2aa563Timo Sirainen iter_mailbox_has_visible_children(ctx, TRUE)) {
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen /* no child mailboxes match the list pattern(s), but mailbox
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen has visible children. we'll need to show this as
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen non-existent. */
ecff11c6c8418a365da4e2b154327d52de2aa563Timo Sirainen info->flags = MAILBOX_NONEXISTENT | MAILBOX_CHILDREN |
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen (info->flags & PRESERVE_MAILBOX_FLAGS);
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen return 1;
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen }
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen return 0;
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen}
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainenstatic const struct mailbox_info *
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainenacl_mailbox_list_iter_next(struct mailbox_list_iterate_context *_ctx)
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen{
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen struct acl_mailbox_list_iterate_context *ctx =
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen (struct acl_mailbox_list_iterate_context *)_ctx;
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen const struct mailbox_info *info;
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen int ret;
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen while ((info = acl_mailbox_list_iter_next_info(ctx)) != NULL) {
0b219481c3b695a18ba5801aa4843cf4d532dd86Timo Sirainen ctx->info = *info;
19e8adccba16ff419f5675b1575358c2956dce83Timo Sirainen T_BEGIN {
0b219481c3b695a18ba5801aa4843cf4d532dd86Timo Sirainen ret = acl_mailbox_list_info_is_visible(ctx);
19e8adccba16ff419f5675b1575358c2956dce83Timo Sirainen } T_END;
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen if (ret > 0)
721f9e3d2ca029b6bca93396801f3131e4e0e5f4Timo Sirainen break;
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen if (ret < 0) {
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen ctx->ctx.failed = TRUE;
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen return NULL;
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen }
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen /* skip to next one */
925915badca5cf87bf45050c2fcc103534bef71aTimo Sirainen if (ctx->ctx.list->ns->user->mail_debug) {
925915badca5cf87bf45050c2fcc103534bef71aTimo Sirainen i_debug("acl: No lookup right to mailbox: %s",
925915badca5cf87bf45050c2fcc103534bef71aTimo Sirainen info->name);
925915badca5cf87bf45050c2fcc103534bef71aTimo Sirainen }
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen }
1eb915768b58044845eb83eeafc9eb72c2e985ecTimo Sirainen return info == NULL ? NULL : &ctx->info;
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen}
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainenstatic int
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainenacl_mailbox_list_iter_deinit(struct mailbox_list_iterate_context *_ctx)
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen{
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen struct acl_mailbox_list_iterate_context *ctx =
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen (struct acl_mailbox_list_iterate_context *)_ctx;
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen struct acl_mailbox_list *alist = ACL_LIST_CONTEXT(_ctx->list);
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen int ret = ctx->ctx.failed ? -1 : 0;
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainen if (alist->module_ctx.super.iter_deinit(ctx->super_ctx) < 0)
5707c94de29af4645a93e0d36ffa57af5537172cTimo Sirainen ret = -1;
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen if (ctx->lookup_boxes != NULL)
a81e49899669137f9d7d1ba4c3130c9389cee530Timo Sirainen mailbox_tree_deinit(&ctx->lookup_boxes);
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen if (ctx->glob != NULL)
ef893433824a4e9a8e423cfc493b8423ae32ef0fTimo Sirainen imap_match_deinit(&ctx->glob);
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen i_free(ctx);
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen return ret;
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen}
2f122b4db3f0d4eeb59ff9d306e54b2009d72cf9Timo Sirainen
19e73bd0304722c6083c34daa0157c2214ec611fTimo Sirainenstatic int acl_mailbox_have_any_rights(struct acl_mailbox_list *alist,
19e73bd0304722c6083c34daa0157c2214ec611fTimo Sirainen const char *name)
19e73bd0304722c6083c34daa0157c2214ec611fTimo Sirainen{
19e73bd0304722c6083c34daa0157c2214ec611fTimo Sirainen struct acl_object *aclobj;
19e73bd0304722c6083c34daa0157c2214ec611fTimo Sirainen const char *const *rights;
19e73bd0304722c6083c34daa0157c2214ec611fTimo Sirainen int ret;
19e73bd0304722c6083c34daa0157c2214ec611fTimo Sirainen
19e73bd0304722c6083c34daa0157c2214ec611fTimo Sirainen aclobj = acl_object_init_from_name(alist->rights.backend, name);
19e73bd0304722c6083c34daa0157c2214ec611fTimo Sirainen ret = acl_object_get_my_rights(aclobj, pool_datastack_create(),
19e73bd0304722c6083c34daa0157c2214ec611fTimo Sirainen &rights);
19e73bd0304722c6083c34daa0157c2214ec611fTimo Sirainen acl_object_deinit(&aclobj);
19e73bd0304722c6083c34daa0157c2214ec611fTimo Sirainen
19e73bd0304722c6083c34daa0157c2214ec611fTimo Sirainen return ret < 0 ? -1 :
19e73bd0304722c6083c34daa0157c2214ec611fTimo Sirainen (*rights == NULL ? 0 : 1);
19e73bd0304722c6083c34daa0157c2214ec611fTimo Sirainen}
19e73bd0304722c6083c34daa0157c2214ec611fTimo Sirainen
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainenstatic int acl_get_mailbox_name_status(struct mailbox_list *list,
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen const char *name,
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen enum mailbox_name_status *status)
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen{
2caa8fdbada1a0804fa978bdffb27c89e452933eTimo Sirainen struct acl_mailbox_list *alist = ACL_LIST_CONTEXT(list);
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen int ret;
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen
19e73bd0304722c6083c34daa0157c2214ec611fTimo Sirainen T_BEGIN {
19e73bd0304722c6083c34daa0157c2214ec611fTimo Sirainen ret = acl_mailbox_have_any_rights(alist, name);
19e73bd0304722c6083c34daa0157c2214ec611fTimo Sirainen } T_END;
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen if (ret < 0)
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen return -1;
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen
8e371a3ce32bd64288786855b8ce0cb63f19f7d1Timo Sirainen if (alist->module_ctx.super.get_mailbox_name_status(list, name,
8e371a3ce32bd64288786855b8ce0cb63f19f7d1Timo Sirainen status) < 0)
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen return -1;
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen if (ret > 0)
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen return 0;
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen /* we shouldn't reveal this mailbox's existance */
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen switch (*status) {
a574952c01611899b8ecf81434dbbb3345f27518Timo Sirainen case MAILBOX_NAME_EXISTS_MAILBOX:
a574952c01611899b8ecf81434dbbb3345f27518Timo Sirainen case MAILBOX_NAME_EXISTS_DIR:
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen *status = MAILBOX_NAME_VALID;
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen break;
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen case MAILBOX_NAME_VALID:
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen case MAILBOX_NAME_INVALID:
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen break;
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen case MAILBOX_NAME_NOINFERIORS:
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen /* have to check if we are allowed to see the parent */
19e8adccba16ff419f5675b1575358c2956dce83Timo Sirainen T_BEGIN {
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen ret = acl_mailbox_list_have_right(list, name,
da9f6acdcb303d0fe5160b669668aedf39c8f45aTimo Sirainen TRUE, ACL_STORAGE_RIGHT_LOOKUP, NULL);
19e8adccba16ff419f5675b1575358c2956dce83Timo Sirainen } T_END;
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen
da9f6acdcb303d0fe5160b669668aedf39c8f45aTimo Sirainen if (ret < 0) {
da9f6acdcb303d0fe5160b669668aedf39c8f45aTimo Sirainen mailbox_list_set_internal_error(list);
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen return -1;
da9f6acdcb303d0fe5160b669668aedf39c8f45aTimo Sirainen }
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen if (ret == 0) {
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen /* no permission to see the parent */
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen *status = MAILBOX_NAME_VALID;
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen }
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen break;
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen }
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen return 0;
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen}
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen
3c493c276f599d9b9cd10764876d648003046954Timo Sirainenstatic int
3c493c276f599d9b9cd10764876d648003046954Timo Sirainenacl_mailbox_list_create_dir(struct mailbox_list *list, const char *name,
a91bd6256b33729531c33ff8bc66ee1ae95840f9Timo Sirainen enum mailbox_dir_create_type type)
3c493c276f599d9b9cd10764876d648003046954Timo Sirainen{
3c493c276f599d9b9cd10764876d648003046954Timo Sirainen struct acl_mailbox_list *alist = ACL_LIST_CONTEXT(list);
3c493c276f599d9b9cd10764876d648003046954Timo Sirainen int ret;
3c493c276f599d9b9cd10764876d648003046954Timo Sirainen
3c493c276f599d9b9cd10764876d648003046954Timo Sirainen /* we're looking up CREATE permission from our parent's rights */
3c493c276f599d9b9cd10764876d648003046954Timo Sirainen ret = acl_mailbox_list_have_right(list, name, TRUE,
3c493c276f599d9b9cd10764876d648003046954Timo Sirainen ACL_STORAGE_RIGHT_CREATE, NULL);
3c493c276f599d9b9cd10764876d648003046954Timo Sirainen if (ret <= 0) {
3c493c276f599d9b9cd10764876d648003046954Timo Sirainen if (ret < 0)
3c493c276f599d9b9cd10764876d648003046954Timo Sirainen return -1;
3c493c276f599d9b9cd10764876d648003046954Timo Sirainen /* Note that if user didn't have LOOKUP permission to parent
3c493c276f599d9b9cd10764876d648003046954Timo Sirainen mailbox, this may reveal the mailbox's existence to user.
3c493c276f599d9b9cd10764876d648003046954Timo Sirainen Can't help it. */
3c493c276f599d9b9cd10764876d648003046954Timo Sirainen mailbox_list_set_error(list, MAIL_ERROR_PERM,
3c493c276f599d9b9cd10764876d648003046954Timo Sirainen MAIL_ERRSTR_NO_PERMISSION);
3c493c276f599d9b9cd10764876d648003046954Timo Sirainen return -1;
3c493c276f599d9b9cd10764876d648003046954Timo Sirainen }
a91bd6256b33729531c33ff8bc66ee1ae95840f9Timo Sirainen return alist->module_ctx.super.create_mailbox_dir(list, name, type);
3c493c276f599d9b9cd10764876d648003046954Timo Sirainen}
3c493c276f599d9b9cd10764876d648003046954Timo Sirainen
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainenstatic void acl_mailbox_list_init_shared(struct mailbox_list *list)
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen{
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen struct acl_mailbox_list *alist;
539977f9257bd8985be5a8093658da266ae9cd19Timo Sirainen struct mailbox_list_vfuncs *v = list->vlast;
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen alist = p_new(list->pool, struct acl_mailbox_list, 1);
539977f9257bd8985be5a8093658da266ae9cd19Timo Sirainen alist->module_ctx.super = *v;
539977f9257bd8985be5a8093658da266ae9cd19Timo Sirainen list->vlast = &alist->module_ctx.super;
539977f9257bd8985be5a8093658da266ae9cd19Timo Sirainen v->iter_init = acl_mailbox_list_iter_init_shared;
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen MODULE_CONTEXT_SET(list, acl_mailbox_list_module, alist);
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen}
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainenstatic void acl_storage_rights_ctx_init(struct acl_storage_rights_context *ctx,
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen struct acl_backend *backend)
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen{
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen unsigned int i;
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen ctx->backend = backend;
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen for (i = 0; i < ACL_STORAGE_RIGHT_COUNT; i++) {
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen ctx->acl_storage_right_idx[i] =
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen acl_backend_lookup_right(backend,
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen acl_storage_right_names[i]);
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen }
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen}
2615df45a8027948a474abe5e817b34b0499c171Timo Sirainen
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainenstatic void acl_mailbox_list_init_default(struct mailbox_list *list)
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen{
539977f9257bd8985be5a8093658da266ae9cd19Timo Sirainen struct mailbox_list_vfuncs *v = list->vlast;
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen struct acl_mailbox_list *alist;
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen if (list->mail_set->mail_full_filesystem_access) {
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen /* not necessarily, but safer to do this for now. */
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen i_fatal("mail_full_filesystem_access=yes is "
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen "incompatible with ACLs");
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen }
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen alist = p_new(list->pool, struct acl_mailbox_list, 1);
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen alist->module_ctx.super = *v;
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen list->vlast = &alist->module_ctx.super;
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen v->iter_init = acl_mailbox_list_iter_init;
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen v->iter_next = acl_mailbox_list_iter_next;
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen v->iter_deinit = acl_mailbox_list_iter_deinit;
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen v->get_mailbox_name_status = acl_get_mailbox_name_status;
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen v->create_mailbox_dir = acl_mailbox_list_create_dir;
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen MODULE_CONTEXT_SET(list, acl_mailbox_list_module, alist);
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen}
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainenvoid acl_mail_namespace_storage_added(struct mail_namespace *ns)
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen{
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen struct acl_user *auser = ACL_USER_CONTEXT(ns->user);
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen struct acl_mailbox_list *alist = ACL_LIST_CONTEXT(ns->list);
e7ca5f820d6a1a8fe549a2966ac707a60e055ef4Timo Sirainen struct acl_backend *backend;
81e6e1ef0feef60644a4c4b745d82a4c98223affTimo Sirainen const char *current_username, *owner_username;
a52bb32f47ea8e2c242189dcfe203a0749b62c77Timo Sirainen bool owner = TRUE;
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen
9298394f818e96140eef4eb942f6bcfbbef78859Timo Sirainen if (alist == NULL)
9298394f818e96140eef4eb942f6bcfbbef78859Timo Sirainen return;
9298394f818e96140eef4eb942f6bcfbbef78859Timo Sirainen
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen owner_username = ns->user->username;
81e6e1ef0feef60644a4c4b745d82a4c98223affTimo Sirainen current_username = auser->master_user;
e7ca5f820d6a1a8fe549a2966ac707a60e055ef4Timo Sirainen if (current_username == NULL)
e7ca5f820d6a1a8fe549a2966ac707a60e055ef4Timo Sirainen current_username = owner_username;
a52bb32f47ea8e2c242189dcfe203a0749b62c77Timo Sirainen else
a52bb32f47ea8e2c242189dcfe203a0749b62c77Timo Sirainen owner = strcmp(current_username, owner_username) == 0;
e7ca5f820d6a1a8fe549a2966ac707a60e055ef4Timo Sirainen
e7ca5f820d6a1a8fe549a2966ac707a60e055ef4Timo Sirainen /* We don't care about the username for non-private mailboxes.
e7ca5f820d6a1a8fe549a2966ac707a60e055ef4Timo Sirainen It's used only when checking if we're the mailbox owner. We never
e7ca5f820d6a1a8fe549a2966ac707a60e055ef4Timo Sirainen are for shared/public mailboxes. */
e7ca5f820d6a1a8fe549a2966ac707a60e055ef4Timo Sirainen if (ns->type != NAMESPACE_PRIVATE)
a52bb32f47ea8e2c242189dcfe203a0749b62c77Timo Sirainen owner = FALSE;
e7ca5f820d6a1a8fe549a2966ac707a60e055ef4Timo Sirainen
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen /* we need to know the storage when initializing backend */
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen backend = acl_backend_init(auser->acl_env, ns->list, current_username,
81e6e1ef0feef60644a4c4b745d82a4c98223affTimo Sirainen auser->groups, owner);
e7ca5f820d6a1a8fe549a2966ac707a60e055ef4Timo Sirainen if (backend == NULL)
e7ca5f820d6a1a8fe549a2966ac707a60e055ef4Timo Sirainen i_fatal("ACL backend initialization failed");
e7ca5f820d6a1a8fe549a2966ac707a60e055ef4Timo Sirainen acl_storage_rights_ctx_init(&alist->rights, backend);
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen}
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainenvoid acl_mailbox_list_created(struct mailbox_list *list)
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen{
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen struct acl_user *auser = ACL_USER_CONTEXT(list->ns->user);
0df9428baed48afaff90b4d4f03792d2fd756a43Timo Sirainen
0df9428baed48afaff90b4d4f03792d2fd756a43Timo Sirainen if (auser == NULL) {
0df9428baed48afaff90b4d4f03792d2fd756a43Timo Sirainen /* ACLs disabled for this user */
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen } else if ((list->ns->flags & NAMESPACE_FLAG_NOACL) != 0) {
dc7c35479b96456dcca68b7d8e1ae9b9beac1074Timo Sirainen /* no ACL checks for internal namespaces (lda, shared) */
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen if (list->ns->type == NAMESPACE_SHARED)
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen acl_mailbox_list_init_shared(list);
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen } else {
cb433472848dddf0a42aa7252eda6721559a7c72Timo Sirainen acl_mailbox_list_init_default(list);
cb5a43d2dd99db0037b3450701ed83df78bc90f5Timo Sirainen }
f9c7106cc05eedb57d1beee3ca3c47f49fafb172Timo Sirainen}