dovecot/core-2.2: src/auth/auth-request.c annotate

annotate src/auth/auth-request.c @ 4533:92199dcb4018 HEAD

If we logged in with IPv6 address and allow_nets contained IPv4 address, we assert-crashed.

author	Timo Sirainen <tss@iki.fi>
date	Thu, 03 Aug 2006 19:21:01 +0300
parents	1174e508593d
children	dee19849654b

rev	line source
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	1 /* Copyright (C) 2002-2005 Timo Sirainen */
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	2
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	3 #include "common.h"
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	4 #include "ioloop.h"
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	5 #include "buffer.h"
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	6 #include "hash.h"
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	7 #include "str.h"
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	8 #include "safe-memset.h"
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	9 #include "str-sanitize.h"
4168 3f27bf7832a2 Added auth_username_format setting. Timo Sirainen <tss@iki.fi> parents: 4164 diff changeset	10 #include "strescape.h"
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	11 #include "var-expand.h"
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	12 #include "auth-request.h"
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	13 #include "auth-client-connection.h"
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	14 #include "auth-master-connection.h"
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	15 #include "passdb.h"
3166 e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	16 #include "passdb-blocking.h"
e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	17 #include "userdb-blocking.h"
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	18 #include "passdb-cache.h"
3918 40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	19 #include "password-scheme.h"
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	20
4078 265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	21 #include <stdlib.h>
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	22
3072 289a98ba5d95 Another try with API cleanup. Timo Sirainen <tss@iki.fi> parents: 3071 diff changeset	23 struct auth_request *
289a98ba5d95 Another try with API cleanup. Timo Sirainen <tss@iki.fi> parents: 3071 diff changeset	24 auth_request_new(struct auth auth, struct mech_module mech,
3074 3feb38ff17f5 Moving code around. Timo Sirainen <tss@iki.fi> parents: 3072 diff changeset	25 mech_callback_t callback, void context)
3072 289a98ba5d95 Another try with API cleanup. Timo Sirainen <tss@iki.fi> parents: 3071 diff changeset	26 {
289a98ba5d95 Another try with API cleanup. Timo Sirainen <tss@iki.fi> parents: 3071 diff changeset	27 struct auth_request *request;
289a98ba5d95 Another try with API cleanup. Timo Sirainen <tss@iki.fi> parents: 3071 diff changeset	28
289a98ba5d95 Another try with API cleanup. Timo Sirainen <tss@iki.fi> parents: 3071 diff changeset	29 request = mech->auth_new();
3171 8a3b57385eca Added state variable for auth_request and several assertions to make sure Timo Sirainen <tss@iki.fi> parents: 3167 diff changeset	30 request->state = AUTH_REQUEST_STATE_NEW;
3183 16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	31 request->passdb = auth->passdbs;
16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	32 request->userdb = auth->userdbs;
3072 289a98ba5d95 Another try with API cleanup. Timo Sirainen <tss@iki.fi> parents: 3071 diff changeset	33
289a98ba5d95 Another try with API cleanup. Timo Sirainen <tss@iki.fi> parents: 3071 diff changeset	34 request->refcount = 1;
3074 3feb38ff17f5 Moving code around. Timo Sirainen <tss@iki.fi> parents: 3072 diff changeset	35 request->created = ioloop_time;
3655 62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	36 request->credentials = -1;
3074 3feb38ff17f5 Moving code around. Timo Sirainen <tss@iki.fi> parents: 3072 diff changeset	37
3072 289a98ba5d95 Another try with API cleanup. Timo Sirainen <tss@iki.fi> parents: 3071 diff changeset	38 request->auth = auth;
289a98ba5d95 Another try with API cleanup. Timo Sirainen <tss@iki.fi> parents: 3071 diff changeset	39 request->mech = mech;
289a98ba5d95 Another try with API cleanup. Timo Sirainen <tss@iki.fi> parents: 3071 diff changeset	40 request->callback = callback;
3074 3feb38ff17f5 Moving code around. Timo Sirainen <tss@iki.fi> parents: 3072 diff changeset	41 request->context = context;
3072 289a98ba5d95 Another try with API cleanup. Timo Sirainen <tss@iki.fi> parents: 3071 diff changeset	42 return request;
289a98ba5d95 Another try with API cleanup. Timo Sirainen <tss@iki.fi> parents: 3071 diff changeset	43 }
289a98ba5d95 Another try with API cleanup. Timo Sirainen <tss@iki.fi> parents: 3071 diff changeset	44
3185 3089083e1d47 Handle USER requests from master connections. Timo Sirainen <tss@iki.fi> parents: 3183 diff changeset	45 struct auth_request auth_request_new_dummy(struct auth auth)
3089083e1d47 Handle USER requests from master connections. Timo Sirainen <tss@iki.fi> parents: 3183 diff changeset	46 {
3089083e1d47 Handle USER requests from master connections. Timo Sirainen <tss@iki.fi> parents: 3183 diff changeset	47 struct auth_request *auth_request;
3089083e1d47 Handle USER requests from master connections. Timo Sirainen <tss@iki.fi> parents: 3183 diff changeset	48 pool_t pool;
3089083e1d47 Handle USER requests from master connections. Timo Sirainen <tss@iki.fi> parents: 3183 diff changeset	49
3695 4f8598b0ca62 Use a bit larger initial pool sizes Timo Sirainen <tss@iki.fi> parents: 3687 diff changeset	50 pool = pool_alloconly_create("auth_request", 1024);
3185 3089083e1d47 Handle USER requests from master connections. Timo Sirainen <tss@iki.fi> parents: 3183 diff changeset	51 auth_request = p_new(pool, struct auth_request, 1);
3089083e1d47 Handle USER requests from master connections. Timo Sirainen <tss@iki.fi> parents: 3183 diff changeset	52 auth_request->pool = pool;
3089083e1d47 Handle USER requests from master connections. Timo Sirainen <tss@iki.fi> parents: 3183 diff changeset	53
3089083e1d47 Handle USER requests from master connections. Timo Sirainen <tss@iki.fi> parents: 3183 diff changeset	54 auth_request->refcount = 1;
3089083e1d47 Handle USER requests from master connections. Timo Sirainen <tss@iki.fi> parents: 3183 diff changeset	55 auth_request->created = ioloop_time;
3089083e1d47 Handle USER requests from master connections. Timo Sirainen <tss@iki.fi> parents: 3183 diff changeset	56 auth_request->auth = auth;
3089083e1d47 Handle USER requests from master connections. Timo Sirainen <tss@iki.fi> parents: 3183 diff changeset	57 auth_request->passdb = auth->passdbs;
3089083e1d47 Handle USER requests from master connections. Timo Sirainen <tss@iki.fi> parents: 3183 diff changeset	58 auth_request->userdb = auth->userdbs;
3655 62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	59 auth_request->credentials = -1;
3185 3089083e1d47 Handle USER requests from master connections. Timo Sirainen <tss@iki.fi> parents: 3183 diff changeset	60
3089083e1d47 Handle USER requests from master connections. Timo Sirainen <tss@iki.fi> parents: 3183 diff changeset	61 return auth_request;
3089083e1d47 Handle USER requests from master connections. Timo Sirainen <tss@iki.fi> parents: 3183 diff changeset	62 }
3089083e1d47 Handle USER requests from master connections. Timo Sirainen <tss@iki.fi> parents: 3183 diff changeset	63
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	64 void auth_request_success(struct auth_request *request,
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	65 const void *data, size_t data_size)
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	66 {
3171 8a3b57385eca Added state variable for auth_request and several assertions to make sure Timo Sirainen <tss@iki.fi> parents: 3167 diff changeset	67 i_assert(request->state == AUTH_REQUEST_STATE_MECH_CONTINUE);
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	68
4078 265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	69 if (request->passdb_failure) {
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	70 /* password was valid, but some other check failed. */
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	71 auth_request_fail(request);
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	72 return;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	73 }
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	74
3171 8a3b57385eca Added state variable for auth_request and several assertions to make sure Timo Sirainen <tss@iki.fi> parents: 3167 diff changeset	75 request->state = AUTH_REQUEST_STATE_FINISHED;
3074 3feb38ff17f5 Moving code around. Timo Sirainen <tss@iki.fi> parents: 3072 diff changeset	76 request->successful = TRUE;
3feb38ff17f5 Moving code around. Timo Sirainen <tss@iki.fi> parents: 3072 diff changeset	77 request->callback(request, AUTH_CLIENT_RESULT_SUCCESS,
3feb38ff17f5 Moving code around. Timo Sirainen <tss@iki.fi> parents: 3072 diff changeset	78 data, data_size);
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	79 }
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	80
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	81 void auth_request_fail(struct auth_request *request)
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	82 {
3171 8a3b57385eca Added state variable for auth_request and several assertions to make sure Timo Sirainen <tss@iki.fi> parents: 3167 diff changeset	83 i_assert(request->state == AUTH_REQUEST_STATE_MECH_CONTINUE);
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	84
3171 8a3b57385eca Added state variable for auth_request and several assertions to make sure Timo Sirainen <tss@iki.fi> parents: 3167 diff changeset	85 request->state = AUTH_REQUEST_STATE_FINISHED;
3074 3feb38ff17f5 Moving code around. Timo Sirainen <tss@iki.fi> parents: 3072 diff changeset	86 request->callback(request, AUTH_CLIENT_RESULT_FAILURE, NULL, 0);
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	87 }
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	88
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	89 void auth_request_internal_failure(struct auth_request *request)
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	90 {
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	91 request->internal_failure = TRUE;
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	92 auth_request_fail(request);
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	93 }
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	94
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	95 void auth_request_ref(struct auth_request *request)
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	96 {
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	97 request->refcount++;
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	98 }
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	99
3879 928229f8b3e6 deinit, unref, destroy, close, free, etc. functions now take a pointer to Timo Sirainen <tss@iki.fi> parents: 3863 diff changeset	100 void auth_request_unref(struct auth_request **_request)
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	101 {
3879 928229f8b3e6 deinit, unref, destroy, close, free, etc. functions now take a pointer to Timo Sirainen <tss@iki.fi> parents: 3863 diff changeset	102 struct auth_request request = _request;
928229f8b3e6 deinit, unref, destroy, close, free, etc. functions now take a pointer to Timo Sirainen <tss@iki.fi> parents: 3863 diff changeset	103
928229f8b3e6 deinit, unref, destroy, close, free, etc. functions now take a pointer to Timo Sirainen <tss@iki.fi> parents: 3863 diff changeset	104 *_request = NULL;
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	105 i_assert(request->refcount > 0);
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	106 if (--request->refcount > 0)
3879 928229f8b3e6 deinit, unref, destroy, close, free, etc. functions now take a pointer to Timo Sirainen <tss@iki.fi> parents: 3863 diff changeset	107 return;
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	108
3386 e4b84d82c685 Master connection's USER command was leaking memory (with deliver binary). Timo Sirainen <tss@iki.fi> parents: 3338 diff changeset	109 if (request->mech != NULL)
e4b84d82c685 Master connection's USER command was leaking memory (with deliver binary). Timo Sirainen <tss@iki.fi> parents: 3338 diff changeset	110 request->mech->auth_free(request);
e4b84d82c685 Master connection's USER command was leaking memory (with deliver binary). Timo Sirainen <tss@iki.fi> parents: 3338 diff changeset	111 else
e4b84d82c685 Master connection's USER command was leaking memory (with deliver binary). Timo Sirainen <tss@iki.fi> parents: 3338 diff changeset	112 pool_unref(request->pool);
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	113 }
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	114
3166 e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	115 void auth_request_export(struct auth_request request, string_t str)
e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	116 {
e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	117 str_append(str, "user=");
e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	118 str_append(str, request->user);
e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	119 str_append(str, "\tservice=");
e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	120 str_append(str, request->service);
3338 e5ce49c8524a USER auth command requires now service parameter and supports also others Timo Sirainen <tss@iki.fi> parents: 3318 diff changeset	121
4030 faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	122 if (request->master_user != NULL) {
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	123 str_append(str, "master_user=");
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	124 str_append(str, request->master_user);
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	125 }
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	126
3338 e5ce49c8524a USER auth command requires now service parameter and supports also others Timo Sirainen <tss@iki.fi> parents: 3318 diff changeset	127 if (request->local_ip.family != 0) {
e5ce49c8524a USER auth command requires now service parameter and supports also others Timo Sirainen <tss@iki.fi> parents: 3318 diff changeset	128 str_append(str, "\tlip=");
e5ce49c8524a USER auth command requires now service parameter and supports also others Timo Sirainen <tss@iki.fi> parents: 3318 diff changeset	129 str_append(str, net_ip2addr(&request->local_ip));
e5ce49c8524a USER auth command requires now service parameter and supports also others Timo Sirainen <tss@iki.fi> parents: 3318 diff changeset	130 }
e5ce49c8524a USER auth command requires now service parameter and supports also others Timo Sirainen <tss@iki.fi> parents: 3318 diff changeset	131 if (request->remote_ip.family != 0) {
e5ce49c8524a USER auth command requires now service parameter and supports also others Timo Sirainen <tss@iki.fi> parents: 3318 diff changeset	132 str_append(str, "\trip=");
e5ce49c8524a USER auth command requires now service parameter and supports also others Timo Sirainen <tss@iki.fi> parents: 3318 diff changeset	133 str_append(str, net_ip2addr(&request->remote_ip));
e5ce49c8524a USER auth command requires now service parameter and supports also others Timo Sirainen <tss@iki.fi> parents: 3318 diff changeset	134 }
e5ce49c8524a USER auth command requires now service parameter and supports also others Timo Sirainen <tss@iki.fi> parents: 3318 diff changeset	135 }
e5ce49c8524a USER auth command requires now service parameter and supports also others Timo Sirainen <tss@iki.fi> parents: 3318 diff changeset	136
3863 55df57c028d4 Added "bool" type and changed all ints that were used as booleans to bool. Timo Sirainen <tss@iki.fi> parents: 3771 diff changeset	137 bool auth_request_import(struct auth_request *request,
55df57c028d4 Added "bool" type and changed all ints that were used as booleans to bool. Timo Sirainen <tss@iki.fi> parents: 3771 diff changeset	138 const char key, const char value)
3338 e5ce49c8524a USER auth command requires now service parameter and supports also others Timo Sirainen <tss@iki.fi> parents: 3318 diff changeset	139 {
e5ce49c8524a USER auth command requires now service parameter and supports also others Timo Sirainen <tss@iki.fi> parents: 3318 diff changeset	140 if (strcmp(key, "user") == 0)
e5ce49c8524a USER auth command requires now service parameter and supports also others Timo Sirainen <tss@iki.fi> parents: 3318 diff changeset	141 request->user = p_strdup(request->pool, value);
4030 faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	142 else if (strcmp(key, "master_user") == 0)
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	143 request->master_user = p_strdup(request->pool, value);
3635 c12df370e1b2 Added ssl_username_from_cert setting. Not actually tested yet.. Timo Sirainen <tss@iki.fi> parents: 3609 diff changeset	144 else if (strcmp(key, "cert_username") == 0) {
c12df370e1b2 Added ssl_username_from_cert setting. Not actually tested yet.. Timo Sirainen <tss@iki.fi> parents: 3609 diff changeset	145 if (request->auth->ssl_username_from_cert) {
c12df370e1b2 Added ssl_username_from_cert setting. Not actually tested yet.. Timo Sirainen <tss@iki.fi> parents: 3609 diff changeset	146 /* get username from SSL certificate. it overrides
c12df370e1b2 Added ssl_username_from_cert setting. Not actually tested yet.. Timo Sirainen <tss@iki.fi> parents: 3609 diff changeset	147 the username given by the auth mechanism. */
c12df370e1b2 Added ssl_username_from_cert setting. Not actually tested yet.. Timo Sirainen <tss@iki.fi> parents: 3609 diff changeset	148 request->user = p_strdup(request->pool, value);
c12df370e1b2 Added ssl_username_from_cert setting. Not actually tested yet.. Timo Sirainen <tss@iki.fi> parents: 3609 diff changeset	149 request->cert_username = TRUE;
c12df370e1b2 Added ssl_username_from_cert setting. Not actually tested yet.. Timo Sirainen <tss@iki.fi> parents: 3609 diff changeset	150 }
c12df370e1b2 Added ssl_username_from_cert setting. Not actually tested yet.. Timo Sirainen <tss@iki.fi> parents: 3609 diff changeset	151 } else if (strcmp(key, "service") == 0)
3338 e5ce49c8524a USER auth command requires now service parameter and supports also others Timo Sirainen <tss@iki.fi> parents: 3318 diff changeset	152 request->service = p_strdup(request->pool, value);
e5ce49c8524a USER auth command requires now service parameter and supports also others Timo Sirainen <tss@iki.fi> parents: 3318 diff changeset	153 else if (strcmp(key, "lip") == 0)
e5ce49c8524a USER auth command requires now service parameter and supports also others Timo Sirainen <tss@iki.fi> parents: 3318 diff changeset	154 net_addr2ip(value, &request->local_ip);
e5ce49c8524a USER auth command requires now service parameter and supports also others Timo Sirainen <tss@iki.fi> parents: 3318 diff changeset	155 else if (strcmp(key, "rip") == 0)
e5ce49c8524a USER auth command requires now service parameter and supports also others Timo Sirainen <tss@iki.fi> parents: 3318 diff changeset	156 net_addr2ip(value, &request->remote_ip);
e5ce49c8524a USER auth command requires now service parameter and supports also others Timo Sirainen <tss@iki.fi> parents: 3318 diff changeset	157 else
e5ce49c8524a USER auth command requires now service parameter and supports also others Timo Sirainen <tss@iki.fi> parents: 3318 diff changeset	158 return FALSE;
e5ce49c8524a USER auth command requires now service parameter and supports also others Timo Sirainen <tss@iki.fi> parents: 3318 diff changeset	159
e5ce49c8524a USER auth command requires now service parameter and supports also others Timo Sirainen <tss@iki.fi> parents: 3318 diff changeset	160 return TRUE;
3166 e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	161 }
e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	162
3068 b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	163 void auth_request_initial(struct auth_request *request,
3071 c7db6b291daa API cleanup Timo Sirainen <tss@iki.fi> parents: 3069 diff changeset	164 const unsigned char *data, size_t data_size)
3068 b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	165 {
3171 8a3b57385eca Added state variable for auth_request and several assertions to make sure Timo Sirainen <tss@iki.fi> parents: 3167 diff changeset	166 i_assert(request->state == AUTH_REQUEST_STATE_NEW);
8a3b57385eca Added state variable for auth_request and several assertions to make sure Timo Sirainen <tss@iki.fi> parents: 3167 diff changeset	167
8a3b57385eca Added state variable for auth_request and several assertions to make sure Timo Sirainen <tss@iki.fi> parents: 3167 diff changeset	168 request->state = AUTH_REQUEST_STATE_MECH_CONTINUE;
3071 c7db6b291daa API cleanup Timo Sirainen <tss@iki.fi> parents: 3069 diff changeset	169 request->mech->auth_initial(request, data, data_size);
3068 b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	170 }
b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	171
b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	172 void auth_request_continue(struct auth_request *request,
3071 c7db6b291daa API cleanup Timo Sirainen <tss@iki.fi> parents: 3069 diff changeset	173 const unsigned char *data, size_t data_size)
3068 b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	174 {
3171 8a3b57385eca Added state variable for auth_request and several assertions to make sure Timo Sirainen <tss@iki.fi> parents: 3167 diff changeset	175 i_assert(request->state == AUTH_REQUEST_STATE_MECH_CONTINUE);
8a3b57385eca Added state variable for auth_request and several assertions to make sure Timo Sirainen <tss@iki.fi> parents: 3167 diff changeset	176
3071 c7db6b291daa API cleanup Timo Sirainen <tss@iki.fi> parents: 3069 diff changeset	177 request->mech->auth_continue(request, data, data_size);
3068 b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	178 }
b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	179
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	180 static void auth_request_save_cache(struct auth_request *request,
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	181 enum passdb_result result)
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	182 {
3183 16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	183 struct passdb_module *passdb = request->passdb->passdb;
3520 e2fe8222449d s/occured/occurred/ Timo Sirainen <tss@iki.fi> parents: 3432 diff changeset	184 const char *extra_fields;
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	185 string_t *str;
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	186
3655 62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	187 switch (result) {
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	188 case PASSDB_RESULT_USER_UNKNOWN:
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	189 case PASSDB_RESULT_PASSWORD_MISMATCH:
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	190 case PASSDB_RESULT_OK:
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	191 case PASSDB_RESULT_SCHEME_NOT_AVAILABLE:
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	192 /* can be cached */
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	193 break;
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	194 case PASSDB_RESULT_USER_DISABLED:
4374 96fd7a3f9bfe If password is expired, give "Password expired" error. Currently works only Timo Sirainen <tss@iki.fi> parents: 4295 diff changeset	195 case PASSDB_RESULT_PASS_EXPIRED:
3655 62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	196 /* FIXME: we can't cache this now, or cache lookup would
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	197 return success. */
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	198 return;
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	199 case PASSDB_RESULT_INTERNAL_FAILURE:
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	200 i_unreached();
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	201 }
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	202
3520 e2fe8222449d s/occured/occurred/ Timo Sirainen <tss@iki.fi> parents: 3432 diff changeset	203 extra_fields = request->extra_fields == NULL ? NULL :
e2fe8222449d s/occured/occurred/ Timo Sirainen <tss@iki.fi> parents: 3432 diff changeset	204 auth_stream_reply_export(request->extra_fields);
e2fe8222449d s/occured/occurred/ Timo Sirainen <tss@iki.fi> parents: 3432 diff changeset	205 i_assert(extra_fields == NULL \|\|
e2fe8222449d s/occured/occurred/ Timo Sirainen <tss@iki.fi> parents: 3432 diff changeset	206 (strstr(extra_fields, "\tpass=") == NULL &&
e2fe8222449d s/occured/occurred/ Timo Sirainen <tss@iki.fi> parents: 3432 diff changeset	207 strncmp(extra_fields, "pass=", 5) != 0));
3432 079ec5c2d665 Last change caused user-given passwords to be cached, and later the password Timo Sirainen <tss@iki.fi> parents: 3431 diff changeset	208
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	209 if (passdb_cache == NULL)
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	210 return;
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	211
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	212 if (passdb->cache_key == NULL)
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	213 return;
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	214
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	215 if (result < 0) {
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	216 /* lookup failed. */
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	217 if (result == PASSDB_RESULT_USER_UNKNOWN) {
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	218 auth_cache_insert(passdb_cache, request,
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	219 passdb->cache_key, "");
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	220 }
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	221 return;
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	222 }
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	223
3669 09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	224 if (!request->no_password && request->passdb_password == NULL) {
3656 fda241fa5d77 Make auth caching work with non-sql/ldap passdbs too. Timo Sirainen <tss@iki.fi> parents: 3655 diff changeset	225 /* passdb didn't provide the correct password */
fda241fa5d77 Make auth caching work with non-sql/ldap passdbs too. Timo Sirainen <tss@iki.fi> parents: 3655 diff changeset	226 if (result != PASSDB_RESULT_OK \|\|
fda241fa5d77 Make auth caching work with non-sql/ldap passdbs too. Timo Sirainen <tss@iki.fi> parents: 3655 diff changeset	227 request->mech_password == NULL)
fda241fa5d77 Make auth caching work with non-sql/ldap passdbs too. Timo Sirainen <tss@iki.fi> parents: 3655 diff changeset	228 return;
fda241fa5d77 Make auth caching work with non-sql/ldap passdbs too. Timo Sirainen <tss@iki.fi> parents: 3655 diff changeset	229
3669 09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	230 /* we can still cache valid password lookups though.
09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	231 strdup() it so that mech_password doesn't get
09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	232 cleared too early. */
09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	233 request->passdb_password =
09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	234 p_strdup(request->pool, request->mech_password);
3645 81180ca12997 We were caching failed blocking requests wrong. Timo Sirainen <tss@iki.fi> parents: 3635 diff changeset	235 }
81180ca12997 We were caching failed blocking requests wrong. Timo Sirainen <tss@iki.fi> parents: 3635 diff changeset	236
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	237 /* save all except the currently given password in cache */
3520 e2fe8222449d s/occured/occurred/ Timo Sirainen <tss@iki.fi> parents: 3432 diff changeset	238 str = t_str_new(256);
3669 09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	239 if (request->passdb_password != NULL) {
09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	240 if (*request->passdb_password != '{') {
09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	241 /* cached passwords must have a known scheme */
09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	242 str_append_c(str, '{');
09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	243 str_append(str, passdb->default_pass_scheme);
09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	244 str_append_c(str, '}');
09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	245 }
09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	246 if (strchr(request->passdb_password, '\t') != NULL)
09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	247 i_panic("%s: Password contains TAB", request->user);
09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	248 if (strchr(request->passdb_password, '\n') != NULL)
09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	249 i_panic("%s: Password contains LF", request->user);
09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	250 str_append(str, request->passdb_password);
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	251 }
3166 e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	252
3520 e2fe8222449d s/occured/occurred/ Timo Sirainen <tss@iki.fi> parents: 3432 diff changeset	253 if (extra_fields != NULL) {
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	254 str_append_c(str, '\t');
3520 e2fe8222449d s/occured/occurred/ Timo Sirainen <tss@iki.fi> parents: 3432 diff changeset	255 str_append(str, extra_fields);
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	256 }
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	257 if (request->no_failure_delay) {
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	258 str_append_c(str, '\t');
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	259 str_append(str, "nodelay");
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	260 }
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	261 auth_cache_insert(passdb_cache, request, passdb->cache_key, str_c(str));
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	262 }
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	263
4030 faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	264 static bool auth_request_master_lookup_finish(struct auth_request *request)
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	265 {
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	266 /* master login successful. update user and master_user variables. */
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	267 auth_request_log_info(request, "passdb", "Master user logging in as %s",
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	268 request->requested_login_user);
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	269
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	270 request->master_user = request->user;
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	271 request->user = request->requested_login_user;
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	272 request->requested_login_user = NULL;
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	273
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	274 request->skip_password_check = TRUE;
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	275 request->passdb_password = NULL;
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	276
4104 77e10f1d2cb2 Removed master_no_passdb setting. Added pass setting which can be used to do Timo Sirainen <tss@iki.fi> parents: 4078 diff changeset	277 if (!request->passdb->pass) {
4030 faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	278 /* skip the passdb lookup, we're authenticated now. */
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	279 return TRUE;
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	280 }
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	281
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	282 /* the authentication continues with passdb lookup for the
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	283 requested_login_user. */
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	284 request->passdb = request->auth->passdbs;
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	285 return FALSE;
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	286 }
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	287
3863 55df57c028d4 Added "bool" type and changed all ints that were used as booleans to bool. Timo Sirainen <tss@iki.fi> parents: 3771 diff changeset	288 static bool
3655 62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	289 auth_request_handle_passdb_callback(enum passdb_result *result,
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	290 struct auth_request *request)
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	291 {
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	292 if (request->passdb_password != NULL) {
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	293 safe_memset(request->passdb_password, 0,
3167 97f53e0cce63 Fallback to using expired records from auth cache if database lookups fail. Timo Sirainen <tss@iki.fi> parents: 3166 diff changeset	294 strlen(request->passdb_password));
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	295 }
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	296
3655 62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	297 if (request->passdb->deny && *result != PASSDB_RESULT_USER_UNKNOWN) {
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	298 /* deny passdb. we can get through this step only if the
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	299 lookup returned that user doesn't exist in it. internal
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	300 errors are fatal here. */
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	301 if (*result != PASSDB_RESULT_INTERNAL_FAILURE) {
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	302 auth_request_log_info(request, "passdb",
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	303 "User found from deny passdb");
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	304 *result = PASSDB_RESULT_USER_DISABLED;
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	305 }
4030 faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	306 } else if (*result == PASSDB_RESULT_OK) {
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	307 /* success */
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	308 if (request->requested_login_user != NULL) {
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	309 /* this was a master user lookup. */
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	310 if (!auth_request_master_lookup_finish(request))
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	311 return FALSE;
4104 77e10f1d2cb2 Removed master_no_passdb setting. Added pass setting which can be used to do Timo Sirainen <tss@iki.fi> parents: 4078 diff changeset	312 } else {
77e10f1d2cb2 Removed master_no_passdb setting. Added pass setting which can be used to do Timo Sirainen <tss@iki.fi> parents: 4078 diff changeset	313 if (request->passdb->pass) {
77e10f1d2cb2 Removed master_no_passdb setting. Added pass setting which can be used to do Timo Sirainen <tss@iki.fi> parents: 4078 diff changeset	314 /* this wasn't the final passdb lookup,
77e10f1d2cb2 Removed master_no_passdb setting. Added pass setting which can be used to do Timo Sirainen <tss@iki.fi> parents: 4078 diff changeset	315 continue to next passdb */
77e10f1d2cb2 Removed master_no_passdb setting. Added pass setting which can be used to do Timo Sirainen <tss@iki.fi> parents: 4078 diff changeset	316 request->passdb = request->passdb->next;
4402 8846e6be0e02 If multiple passdbs were configured and we tried to authenticate as user Timo Sirainen <tss@iki.fi> parents: 4374 diff changeset	317 request->passdb_password = NULL;
4104 77e10f1d2cb2 Removed master_no_passdb setting. Added pass setting which can be used to do Timo Sirainen <tss@iki.fi> parents: 4078 diff changeset	318 return FALSE;
77e10f1d2cb2 Removed master_no_passdb setting. Added pass setting which can be used to do Timo Sirainen <tss@iki.fi> parents: 4078 diff changeset	319 }
4030 faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	320 }
4374 96fd7a3f9bfe If password is expired, give "Password expired" error. Currently works only Timo Sirainen <tss@iki.fi> parents: 4295 diff changeset	321 } else if (*result == PASSDB_RESULT_PASS_EXPIRED) {
96fd7a3f9bfe If password is expired, give "Password expired" error. Currently works only Timo Sirainen <tss@iki.fi> parents: 4295 diff changeset	322 if (request->extra_fields == NULL)
96fd7a3f9bfe If password is expired, give "Password expired" error. Currently works only Timo Sirainen <tss@iki.fi> parents: 4295 diff changeset	323 request->extra_fields = auth_stream_reply_init(request);
96fd7a3f9bfe If password is expired, give "Password expired" error. Currently works only Timo Sirainen <tss@iki.fi> parents: 4295 diff changeset	324 auth_stream_reply_add(request->extra_fields, "reason",
96fd7a3f9bfe If password is expired, give "Password expired" error. Currently works only Timo Sirainen <tss@iki.fi> parents: 4295 diff changeset	325 "Password expired");
4030 faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	326 } else if (request->passdb->next != NULL &&
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	327 *result != PASSDB_RESULT_USER_DISABLED) {
3183 16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	328 /* try next passdb. */
4030 faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	329 request->passdb = request->passdb->next;
4402 8846e6be0e02 If multiple passdbs were configured and we tried to authenticate as user Timo Sirainen <tss@iki.fi> parents: 4374 diff changeset	330 request->passdb_password = NULL;
4030 faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	331
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	332 if (*result == PASSDB_RESULT_INTERNAL_FAILURE) {
3655 62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	333 /* remember that we have had an internal failure. at
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	334 the end return internal failure if we couldn't
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	335 successfully login. */
3606 8a8352cda514 If passdb lookup fails with internal error, try other passdbs anyway before Timo Sirainen <tss@iki.fi> parents: 3520 diff changeset	336 request->passdb_internal_failure = TRUE;
3655 62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	337 }
3183 16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	338 if (request->extra_fields != NULL)
3520 e2fe8222449d s/occured/occurred/ Timo Sirainen <tss@iki.fi> parents: 3432 diff changeset	339 auth_stream_reply_reset(request->extra_fields);
3183 16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	340
3655 62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	341 return FALSE;
4030 faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	342 } else if (request->passdb_internal_failure) {
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	343 /* last passdb lookup returned internal failure. it may have
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	344 had the correct password, so return internal failure
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	345 instead of plain failure. */
3655 62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	346 *result = PASSDB_RESULT_INTERNAL_FAILURE;
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	347 }
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	348
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	349 return TRUE;
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	350 }
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	351
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	352 void auth_request_verify_plain_callback(enum passdb_result result,
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	353 struct auth_request *request)
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	354 {
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	355 i_assert(request->state == AUTH_REQUEST_STATE_PASSDB);
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	356
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	357 request->state = AUTH_REQUEST_STATE_MECH_CONTINUE;
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	358
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	359 if (result != PASSDB_RESULT_INTERNAL_FAILURE)
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	360 auth_request_save_cache(request, result);
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	361 else {
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	362 /* lookup failed. if we're looking here only because the
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	363 request was expired in cache, fallback to using cached
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	364 expired record. */
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	365 const char *cache_key = request->passdb->passdb->cache_key;
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	366
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	367 if (passdb_cache_verify_plain(request, cache_key,
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	368 request->mech_password,
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	369 &result, TRUE)) {
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	370 auth_request_log_info(request, "passdb",
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	371 "Fallbacking to expired data from cache");
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	372 }
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	373 }
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	374
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	375 if (!auth_request_handle_passdb_callback(&result, request)) {
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	376 /* try next passdb */
3183 16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	377 auth_request_verify_plain(request, request->mech_password,
16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	378 request->private_callback.verify_plain);
3655 62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	379 } else {
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	380 auth_request_ref(request);
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	381 request->private_callback.verify_plain(result, request);
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	382 safe_memset(request->mech_password, 0,
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	383 strlen(request->mech_password));
3879 928229f8b3e6 deinit, unref, destroy, close, free, etc. functions now take a pointer to Timo Sirainen <tss@iki.fi> parents: 3863 diff changeset	384 auth_request_unref(&request);
3606 8a8352cda514 If passdb lookup fails with internal error, try other passdbs anyway before Timo Sirainen <tss@iki.fi> parents: 3520 diff changeset	385 }
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	386 }
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	387
3068 b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	388 void auth_request_verify_plain(struct auth_request *request,
b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	389 const char *password,
b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	390 verify_plain_callback_t *callback)
b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	391 {
4030 faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	392 struct passdb_module *passdb;
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	393 enum passdb_result result;
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	394 const char *cache_key;
3171 8a3b57385eca Added state variable for auth_request and several assertions to make sure Timo Sirainen <tss@iki.fi> parents: 3167 diff changeset	395
8a3b57385eca Added state variable for auth_request and several assertions to make sure Timo Sirainen <tss@iki.fi> parents: 3167 diff changeset	396 i_assert(request->state == AUTH_REQUEST_STATE_MECH_CONTINUE);
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	397
4030 faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	398 if (request->passdb == NULL) {
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	399 /* no masterdbs, master logins not supported */
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	400 i_assert(request->requested_login_user != NULL);
4139 68c2ad5e4f85 Master login attempts weren't logged if no master passdbs were defined. Timo Sirainen <tss@iki.fi> parents: 4136 diff changeset	401 auth_request_log_info(request, "passdb",
68c2ad5e4f85 Master login attempts weren't logged if no master passdbs were defined. Timo Sirainen <tss@iki.fi> parents: 4136 diff changeset	402 "Attempted master login with no master passdbs");
68c2ad5e4f85 Master login attempts weren't logged if no master passdbs were defined. Timo Sirainen <tss@iki.fi> parents: 4136 diff changeset	403 callback(PASSDB_RESULT_USER_UNKNOWN, request);
4030 faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	404 return;
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	405 }
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	406
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	407 passdb = request->passdb->passdb;
3183 16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	408 if (request->mech_password == NULL)
16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	409 request->mech_password = p_strdup(request->pool, password);
3656 fda241fa5d77 Make auth caching work with non-sql/ldap passdbs too. Timo Sirainen <tss@iki.fi> parents: 3655 diff changeset	410 else
fda241fa5d77 Make auth caching work with non-sql/ldap passdbs too. Timo Sirainen <tss@iki.fi> parents: 3655 diff changeset	411 i_assert(request->mech_password == password);
3166 e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	412 request->private_callback.verify_plain = callback;
3164 da9e4ffef09f Last changes broke proxying when user was in auth cache. Timo Sirainen <tss@iki.fi> parents: 3161 diff changeset	413
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	414 cache_key = passdb_cache == NULL ? NULL : passdb->cache_key;
3728 64ed35c97678 Don't crash if cache key isn't set but cache is enabled. Timo Sirainen <tss@iki.fi> parents: 3695 diff changeset	415 if (passdb_cache_verify_plain(request, cache_key, password,
64ed35c97678 Don't crash if cache key isn't set but cache is enabled. Timo Sirainen <tss@iki.fi> parents: 3695 diff changeset	416 &result, FALSE)) {
64ed35c97678 Don't crash if cache key isn't set but cache is enabled. Timo Sirainen <tss@iki.fi> parents: 3695 diff changeset	417 callback(result, request);
64ed35c97678 Don't crash if cache key isn't set but cache is enabled. Timo Sirainen <tss@iki.fi> parents: 3695 diff changeset	418 return;
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	419 }
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	420
3171 8a3b57385eca Added state variable for auth_request and several assertions to make sure Timo Sirainen <tss@iki.fi> parents: 3167 diff changeset	421 request->state = AUTH_REQUEST_STATE_PASSDB;
3655 62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	422 request->credentials = -1;
3171 8a3b57385eca Added state variable for auth_request and several assertions to make sure Timo Sirainen <tss@iki.fi> parents: 3167 diff changeset	423
3166 e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	424 if (passdb->blocking)
e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	425 passdb_blocking_verify_plain(request);
e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	426 else {
3771 4b6d962485b9 Added authentication bind support. Patch by J.M. Maurer. Timo Sirainen <tss@iki.fi> parents: 3728 diff changeset	427 passdb->iface.verify_plain(request, password,
4b6d962485b9 Added authentication bind support. Patch by J.M. Maurer. Timo Sirainen <tss@iki.fi> parents: 3728 diff changeset	428 auth_request_verify_plain_callback);
3166 e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	429 }
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	430 }
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	431
3166 e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	432 void auth_request_lookup_credentials_callback(enum passdb_result result,
3655 62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	433 const char *password,
3166 e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	434 struct auth_request *request)
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	435 {
3655 62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	436 const char *scheme;
3167 97f53e0cce63 Fallback to using expired records from auth cache if database lookups fail. Timo Sirainen <tss@iki.fi> parents: 3166 diff changeset	437
3171 8a3b57385eca Added state variable for auth_request and several assertions to make sure Timo Sirainen <tss@iki.fi> parents: 3167 diff changeset	438 i_assert(request->state == AUTH_REQUEST_STATE_PASSDB);
8a3b57385eca Added state variable for auth_request and several assertions to make sure Timo Sirainen <tss@iki.fi> parents: 3167 diff changeset	439
8a3b57385eca Added state variable for auth_request and several assertions to make sure Timo Sirainen <tss@iki.fi> parents: 3167 diff changeset	440 request->state = AUTH_REQUEST_STATE_MECH_CONTINUE;
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	441
3655 62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	442 if (result != PASSDB_RESULT_INTERNAL_FAILURE)
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	443 auth_request_save_cache(request, result);
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	444 else {
3167 97f53e0cce63 Fallback to using expired records from auth cache if database lookups fail. Timo Sirainen <tss@iki.fi> parents: 3166 diff changeset	445 /* lookup failed. if we're looking here only because the
97f53e0cce63 Fallback to using expired records from auth cache if database lookups fail. Timo Sirainen <tss@iki.fi> parents: 3166 diff changeset	446 request was expired in cache, fallback to using cached
97f53e0cce63 Fallback to using expired records from auth cache if database lookups fail. Timo Sirainen <tss@iki.fi> parents: 3166 diff changeset	447 expired record. */
3655 62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	448 const char *cache_key = request->passdb->passdb->cache_key;
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	449
3167 97f53e0cce63 Fallback to using expired records from auth cache if database lookups fail. Timo Sirainen <tss@iki.fi> parents: 3166 diff changeset	450 if (passdb_cache_lookup_credentials(request, cache_key,
3655 62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	451 &password, &scheme,
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	452 &result, TRUE)) {
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	453 auth_request_log_info(request, "passdb",
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	454 "Fallbacking to expired data from cache");
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	455 password = result != PASSDB_RESULT_OK ? NULL :
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	456 passdb_get_credentials(request, password,
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	457 scheme);
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	458 if (password == NULL && result == PASSDB_RESULT_OK)
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	459 result = PASSDB_RESULT_SCHEME_NOT_AVAILABLE;
3167 97f53e0cce63 Fallback to using expired records from auth cache if database lookups fail. Timo Sirainen <tss@iki.fi> parents: 3166 diff changeset	460 }
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	461 }
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	462
3655 62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	463 if (!auth_request_handle_passdb_callback(&result, request)) {
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	464 /* try next passdb */
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	465 auth_request_lookup_credentials(request, request->credentials,
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	466 request->private_callback.lookup_credentials);
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	467 } else {
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	468 request->private_callback.
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	469 lookup_credentials(result, password, request);
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	470 }
3068 b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	471 }
b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	472
b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	473 void auth_request_lookup_credentials(struct auth_request *request,
b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	474 enum passdb_credentials credentials,
b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	475 lookup_credentials_callback_t *callback)
b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	476 {
3183 16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	477 struct passdb_module *passdb = request->passdb->passdb;
3655 62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	478 const char cache_key, password, *scheme;
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	479 enum passdb_result result;
3171 8a3b57385eca Added state variable for auth_request and several assertions to make sure Timo Sirainen <tss@iki.fi> parents: 3167 diff changeset	480
8a3b57385eca Added state variable for auth_request and several assertions to make sure Timo Sirainen <tss@iki.fi> parents: 3167 diff changeset	481 i_assert(request->state == AUTH_REQUEST_STATE_MECH_CONTINUE);
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	482
3682 0207808033ad Non-plaintext authentication and passdb cache didn't work together. Patch by Timo Sirainen <tss@iki.fi> parents: 3669 diff changeset	483 request->credentials = credentials;
0207808033ad Non-plaintext authentication and passdb cache didn't work together. Patch by Timo Sirainen <tss@iki.fi> parents: 3669 diff changeset	484
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	485 cache_key = passdb_cache == NULL ? NULL : passdb->cache_key;
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	486 if (cache_key != NULL) {
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	487 if (passdb_cache_lookup_credentials(request, cache_key,
3655 62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	488 &password, &scheme,
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	489 &result, FALSE)) {
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	490 passdb_handle_credentials(result, password, scheme,
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	491 callback, request);
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	492 return;
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	493 }
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	494 }
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	495
3171 8a3b57385eca Added state variable for auth_request and several assertions to make sure Timo Sirainen <tss@iki.fi> parents: 3167 diff changeset	496 request->state = AUTH_REQUEST_STATE_PASSDB;
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	497 request->private_callback.lookup_credentials = callback;
3166 e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	498
e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	499 if (passdb->blocking)
e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	500 passdb_blocking_lookup_credentials(request);
3771 4b6d962485b9 Added authentication bind support. Patch by J.M. Maurer. Timo Sirainen <tss@iki.fi> parents: 3728 diff changeset	501 else if (passdb->iface.lookup_credentials != NULL) {
4b6d962485b9 Added authentication bind support. Patch by J.M. Maurer. Timo Sirainen <tss@iki.fi> parents: 3728 diff changeset	502 passdb->iface.lookup_credentials(request,
3166 e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	503 auth_request_lookup_credentials_callback);
3655 62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	504 } else {
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	505 /* this passdb doesn't support credentials */
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	506 auth_request_lookup_credentials_callback(
62fc6883faeb Fixes and cleanups to credentials handling. Also fixed auth caching to work Timo Sirainen <tss@iki.fi> parents: 3645 diff changeset	507 PASSDB_RESULT_SCHEME_NOT_AVAILABLE, NULL, request);
3166 e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	508 }
3068 b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	509 }
b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	510
3520 e2fe8222449d s/occured/occurred/ Timo Sirainen <tss@iki.fi> parents: 3432 diff changeset	511 void auth_request_userdb_callback(struct auth_stream_reply *reply,
3183 16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	512 struct auth_request *request)
16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	513 {
3520 e2fe8222449d s/occured/occurred/ Timo Sirainen <tss@iki.fi> parents: 3432 diff changeset	514 if (reply == NULL && request->userdb->next != NULL) {
3183 16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	515 /* try next userdb. */
16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	516 request->userdb = request->userdb->next;
16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	517 auth_request_lookup_user(request,
16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	518 request->private_callback.userdb);
16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	519 return;
16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	520 }
16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	521
3520 e2fe8222449d s/occured/occurred/ Timo Sirainen <tss@iki.fi> parents: 3432 diff changeset	522 if (reply == NULL && request->client_pid != 0) {
3183 16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	523 /* this was actual login attempt */
16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	524 auth_request_log_error(request, "userdb",
16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	525 "user not found from userdb");
16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	526 }
16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	527
3520 e2fe8222449d s/occured/occurred/ Timo Sirainen <tss@iki.fi> parents: 3432 diff changeset	528 request->private_callback.userdb(reply, request);
3183 16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	529 }
16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	530
3068 b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	531 void auth_request_lookup_user(struct auth_request *request,
3166 e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	532 userdb_callback_t *callback)
3068 b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	533 {
3183 16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	534 struct userdb_module *userdb = request->userdb->userdb;
16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	535
16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	536 request->private_callback.userdb = callback;
3166 e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	537
e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	538 if (userdb->blocking)
3183 16ea551957ed Replaced userdb/passdb settings with blocks so it's possible to give Timo Sirainen <tss@iki.fi> parents: 3171 diff changeset	539 userdb_blocking_lookup(request);
3166 e6a487d80288 Restructuring of auth code. Balancer auth processes were a bad idea. Usually Timo Sirainen <tss@iki.fi> parents: 3164 diff changeset	540 else
3658 fc4622b1c1ef Separated userdb_module's interface and the actual data struct. Timo Sirainen <tss@iki.fi> parents: 3657 diff changeset	541 userdb->iface->lookup(request, auth_request_userdb_callback);
3068 b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	542 }
b01a8fa09f94 Cleanups. Timo Sirainen <tss@iki.fi> parents: 3065 diff changeset	543
4030 faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	544 static char *
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	545 auth_request_fix_username(struct auth_request request, const char username,
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	546 const char **error_r)
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	547 {
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	548 unsigned char *p;
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	549 char *user;
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	550
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	551 if (strchr(username, '@') == NULL &&
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	552 request->auth->default_realm != NULL) {
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	553 user = p_strconcat(request->pool, username, "@",
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	554 request->auth->default_realm, NULL);
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	555 } else {
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	556 user = p_strdup(request->pool, username);
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	557 }
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	558
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	559 for (p = (unsigned char )user; p != '\0'; p++) {
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	560 if (request->auth->username_translation[*p & 0xff] != 0)
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	561 p = request->auth->username_translation[p & 0xff];
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	562 if (request->auth->username_chars[*p & 0xff] == 0) {
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	563 *error_r = "Username contains disallowed characters";
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	564 return NULL;
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	565 }
4168 3f27bf7832a2 Added auth_username_format setting. Timo Sirainen <tss@iki.fi> parents: 4164 diff changeset	566 }
3f27bf7832a2 Added auth_username_format setting. Timo Sirainen <tss@iki.fi> parents: 4164 diff changeset	567
3f27bf7832a2 Added auth_username_format setting. Timo Sirainen <tss@iki.fi> parents: 4164 diff changeset	568 if (request->auth->username_format != NULL) {
3f27bf7832a2 Added auth_username_format setting. Timo Sirainen <tss@iki.fi> parents: 4164 diff changeset	569 /* username format given, put it through variable expansion.
3f27bf7832a2 Added auth_username_format setting. Timo Sirainen <tss@iki.fi> parents: 4164 diff changeset	570 we'll have to temporarily replace request->user to get
3f27bf7832a2 Added auth_username_format setting. Timo Sirainen <tss@iki.fi> parents: 4164 diff changeset	571 %u to be the wanted username */
3f27bf7832a2 Added auth_username_format setting. Timo Sirainen <tss@iki.fi> parents: 4164 diff changeset	572 const struct var_expand_table *table;
3f27bf7832a2 Added auth_username_format setting. Timo Sirainen <tss@iki.fi> parents: 4164 diff changeset	573 char *old_username;
3f27bf7832a2 Added auth_username_format setting. Timo Sirainen <tss@iki.fi> parents: 4164 diff changeset	574 string_t *dest;
3f27bf7832a2 Added auth_username_format setting. Timo Sirainen <tss@iki.fi> parents: 4164 diff changeset	575
3f27bf7832a2 Added auth_username_format setting. Timo Sirainen <tss@iki.fi> parents: 4164 diff changeset	576 old_username = request->user;
3f27bf7832a2 Added auth_username_format setting. Timo Sirainen <tss@iki.fi> parents: 4164 diff changeset	577 request->user = user;
3f27bf7832a2 Added auth_username_format setting. Timo Sirainen <tss@iki.fi> parents: 4164 diff changeset	578
3f27bf7832a2 Added auth_username_format setting. Timo Sirainen <tss@iki.fi> parents: 4164 diff changeset	579 t_push();
3f27bf7832a2 Added auth_username_format setting. Timo Sirainen <tss@iki.fi> parents: 4164 diff changeset	580 dest = t_str_new(256);
4295 4fc637010202 Escape SQL strings using sql_escape_string(). Fixes the problems with Timo Sirainen <tss@iki.fi> parents: 4168 diff changeset	581 table = auth_request_get_var_expand_table(request,
4fc637010202 Escape SQL strings using sql_escape_string(). Fixes the problems with Timo Sirainen <tss@iki.fi> parents: 4168 diff changeset	582 auth_request_str_escape);
4168 3f27bf7832a2 Added auth_username_format setting. Timo Sirainen <tss@iki.fi> parents: 4164 diff changeset	583 var_expand(dest, request->auth->username_format, table);
3f27bf7832a2 Added auth_username_format setting. Timo Sirainen <tss@iki.fi> parents: 4164 diff changeset	584 user = p_strdup(request->pool, str_c(dest));
3f27bf7832a2 Added auth_username_format setting. Timo Sirainen <tss@iki.fi> parents: 4164 diff changeset	585 t_pop();
3f27bf7832a2 Added auth_username_format setting. Timo Sirainen <tss@iki.fi> parents: 4164 diff changeset	586
3f27bf7832a2 Added auth_username_format setting. Timo Sirainen <tss@iki.fi> parents: 4164 diff changeset	587 request->user = old_username;
3f27bf7832a2 Added auth_username_format setting. Timo Sirainen <tss@iki.fi> parents: 4164 diff changeset	588 }
3f27bf7832a2 Added auth_username_format setting. Timo Sirainen <tss@iki.fi> parents: 4164 diff changeset	589
4030 faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	590 return user;
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	591 }
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	592
3863 55df57c028d4 Added "bool" type and changed all ints that were used as booleans to bool. Timo Sirainen <tss@iki.fi> parents: 3771 diff changeset	593 bool auth_request_set_username(struct auth_request *request,
55df57c028d4 Added "bool" type and changed all ints that were used as booleans to bool. Timo Sirainen <tss@iki.fi> parents: 3771 diff changeset	594 const char username, const char *error_r)
3065 29d83a8bb50d Reorganized the code to have less global/static variables. Timo Sirainen <tss@iki.fi> parents: 3064 diff changeset	595 {
4164 d38dd6312be1 Master login fixes, PLAIN authentication was still broken.. Timo Sirainen <tss@iki.fi> parents: 4146 diff changeset	596 const char p, login_username = NULL;
4108 e1774d677536 Added auth_master_user_separator setting which allows giving the master username inside the normal username. Timo Sirainen <timo.sirainen@movial.fi> parents: 4104 diff changeset	597
4054 f83d7d14b999 Digest-MD5 logins didn't work if passdb changed username. Timo Sirainen <tss@iki.fi> parents: 4042 diff changeset	598 if (request->original_username == NULL) {
f83d7d14b999 Digest-MD5 logins didn't work if passdb changed username. Timo Sirainen <tss@iki.fi> parents: 4042 diff changeset	599 /* the username may change later, but we need to use this
f83d7d14b999 Digest-MD5 logins didn't work if passdb changed username. Timo Sirainen <tss@iki.fi> parents: 4042 diff changeset	600 username when verifying at least DIGEST-MD5 password */
f83d7d14b999 Digest-MD5 logins didn't work if passdb changed username. Timo Sirainen <tss@iki.fi> parents: 4042 diff changeset	601 request->original_username = p_strdup(request->pool, username);
f83d7d14b999 Digest-MD5 logins didn't work if passdb changed username. Timo Sirainen <tss@iki.fi> parents: 4042 diff changeset	602 }
3635 c12df370e1b2 Added ssl_username_from_cert setting. Not actually tested yet.. Timo Sirainen <tss@iki.fi> parents: 3609 diff changeset	603 if (request->cert_username) {
c12df370e1b2 Added ssl_username_from_cert setting. Not actually tested yet.. Timo Sirainen <tss@iki.fi> parents: 3609 diff changeset	604 /* cert_username overrides the username given by
c12df370e1b2 Added ssl_username_from_cert setting. Not actually tested yet.. Timo Sirainen <tss@iki.fi> parents: 3609 diff changeset	605 authentication mechanism. */
c12df370e1b2 Added ssl_username_from_cert setting. Not actually tested yet.. Timo Sirainen <tss@iki.fi> parents: 3609 diff changeset	606 return TRUE;
c12df370e1b2 Added ssl_username_from_cert setting. Not actually tested yet.. Timo Sirainen <tss@iki.fi> parents: 3609 diff changeset	607 }
c12df370e1b2 Added ssl_username_from_cert setting. Not actually tested yet.. Timo Sirainen <tss@iki.fi> parents: 3609 diff changeset	608
4108 e1774d677536 Added auth_master_user_separator setting which allows giving the master username inside the normal username. Timo Sirainen <timo.sirainen@movial.fi> parents: 4104 diff changeset	609 if (request->auth->master_user_separator != '\0') {
e1774d677536 Added auth_master_user_separator setting which allows giving the master username inside the normal username. Timo Sirainen <timo.sirainen@movial.fi> parents: 4104 diff changeset	610 /* check if the username contains a master user */
e1774d677536 Added auth_master_user_separator setting which allows giving the master username inside the normal username. Timo Sirainen <timo.sirainen@movial.fi> parents: 4104 diff changeset	611 p = strchr(username, request->auth->master_user_separator);
e1774d677536 Added auth_master_user_separator setting which allows giving the master username inside the normal username. Timo Sirainen <timo.sirainen@movial.fi> parents: 4104 diff changeset	612 if (p != NULL) {
e1774d677536 Added auth_master_user_separator setting which allows giving the master username inside the normal username. Timo Sirainen <timo.sirainen@movial.fi> parents: 4104 diff changeset	613 /* it does, set it. */
4140 52a2e6f35acf The login and master usernames were reversed when using Timo Sirainen <tss@iki.fi> parents: 4139 diff changeset	614 login_username = t_strdup_until(username, p);
52a2e6f35acf The login and master usernames were reversed when using Timo Sirainen <tss@iki.fi> parents: 4139 diff changeset	615
52a2e6f35acf The login and master usernames were reversed when using Timo Sirainen <tss@iki.fi> parents: 4139 diff changeset	616 /* username is the master user */
52a2e6f35acf The login and master usernames were reversed when using Timo Sirainen <tss@iki.fi> parents: 4139 diff changeset	617 username = p + 1;
4108 e1774d677536 Added auth_master_user_separator setting which allows giving the master username inside the normal username. Timo Sirainen <timo.sirainen@movial.fi> parents: 4104 diff changeset	618 }
e1774d677536 Added auth_master_user_separator setting which allows giving the master username inside the normal username. Timo Sirainen <timo.sirainen@movial.fi> parents: 4104 diff changeset	619 }
e1774d677536 Added auth_master_user_separator setting which allows giving the master username inside the normal username. Timo Sirainen <timo.sirainen@movial.fi> parents: 4104 diff changeset	620
3065 29d83a8bb50d Reorganized the code to have less global/static variables. Timo Sirainen <tss@iki.fi> parents: 3064 diff changeset	621 if (*username == '\0') {
29d83a8bb50d Reorganized the code to have less global/static variables. Timo Sirainen <tss@iki.fi> parents: 3064 diff changeset	622 /* Some PAM plugins go nuts with empty usernames */
29d83a8bb50d Reorganized the code to have less global/static variables. Timo Sirainen <tss@iki.fi> parents: 3064 diff changeset	623 *error_r = "Empty username";
29d83a8bb50d Reorganized the code to have less global/static variables. Timo Sirainen <tss@iki.fi> parents: 3064 diff changeset	624 return FALSE;
29d83a8bb50d Reorganized the code to have less global/static variables. Timo Sirainen <tss@iki.fi> parents: 3064 diff changeset	625 }
29d83a8bb50d Reorganized the code to have less global/static variables. Timo Sirainen <tss@iki.fi> parents: 3064 diff changeset	626
4030 faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	627 request->user = auth_request_fix_username(request, username, error_r);
4164 d38dd6312be1 Master login fixes, PLAIN authentication was still broken.. Timo Sirainen <tss@iki.fi> parents: 4146 diff changeset	628 if (request->user == NULL)
d38dd6312be1 Master login fixes, PLAIN authentication was still broken.. Timo Sirainen <tss@iki.fi> parents: 4146 diff changeset	629 return FALSE;
d38dd6312be1 Master login fixes, PLAIN authentication was still broken.. Timo Sirainen <tss@iki.fi> parents: 4146 diff changeset	630
d38dd6312be1 Master login fixes, PLAIN authentication was still broken.. Timo Sirainen <tss@iki.fi> parents: 4146 diff changeset	631 if (login_username != NULL) {
d38dd6312be1 Master login fixes, PLAIN authentication was still broken.. Timo Sirainen <tss@iki.fi> parents: 4146 diff changeset	632 if (!auth_request_set_login_username(request,
d38dd6312be1 Master login fixes, PLAIN authentication was still broken.. Timo Sirainen <tss@iki.fi> parents: 4146 diff changeset	633 login_username,
d38dd6312be1 Master login fixes, PLAIN authentication was still broken.. Timo Sirainen <tss@iki.fi> parents: 4146 diff changeset	634 error_r))
d38dd6312be1 Master login fixes, PLAIN authentication was still broken.. Timo Sirainen <tss@iki.fi> parents: 4146 diff changeset	635 return FALSE;
d38dd6312be1 Master login fixes, PLAIN authentication was still broken.. Timo Sirainen <tss@iki.fi> parents: 4146 diff changeset	636 }
d38dd6312be1 Master login fixes, PLAIN authentication was still broken.. Timo Sirainen <tss@iki.fi> parents: 4146 diff changeset	637 return TRUE;
4030 faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	638 }
3065 29d83a8bb50d Reorganized the code to have less global/static variables. Timo Sirainen <tss@iki.fi> parents: 3064 diff changeset	639
4030 faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	640 bool auth_request_set_login_username(struct auth_request *request,
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	641 const char *username,
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	642 const char **error_r)
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	643 {
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	644 i_assert(*username != '\0');
3065 29d83a8bb50d Reorganized the code to have less global/static variables. Timo Sirainen <tss@iki.fi> parents: 3064 diff changeset	645
4164 d38dd6312be1 Master login fixes, PLAIN authentication was still broken.. Timo Sirainen <tss@iki.fi> parents: 4146 diff changeset	646 if (strcmp(username, request->user) == 0) {
d38dd6312be1 Master login fixes, PLAIN authentication was still broken.. Timo Sirainen <tss@iki.fi> parents: 4146 diff changeset	647 /* The usernames are the same, we don't really wish to log
d38dd6312be1 Master login fixes, PLAIN authentication was still broken.. Timo Sirainen <tss@iki.fi> parents: 4146 diff changeset	648 in as someone else */
d38dd6312be1 Master login fixes, PLAIN authentication was still broken.. Timo Sirainen <tss@iki.fi> parents: 4146 diff changeset	649 return TRUE;
d38dd6312be1 Master login fixes, PLAIN authentication was still broken.. Timo Sirainen <tss@iki.fi> parents: 4146 diff changeset	650 }
d38dd6312be1 Master login fixes, PLAIN authentication was still broken.. Timo Sirainen <tss@iki.fi> parents: 4146 diff changeset	651
4030 faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	652 /* lookup request->user from masterdb first */
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	653 request->passdb = request->auth->masterdbs;
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	654
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	655 request->requested_login_user =
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	656 auth_request_fix_username(request, username, error_r);
4136 f7731e6eec7e If master login username is the same as the normal username, we don't want Timo Sirainen <tss@iki.fi> parents: 4108 diff changeset	657 return request->requested_login_user != NULL;
3065 29d83a8bb50d Reorganized the code to have less global/static variables. Timo Sirainen <tss@iki.fi> parents: 3064 diff changeset	658 }
29d83a8bb50d Reorganized the code to have less global/static variables. Timo Sirainen <tss@iki.fi> parents: 3064 diff changeset	659
4078 265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	660 static int is_ip_in_network(const char network, const struct ip_addr ip)
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	661 {
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	662 const uint32_t ip1, ip2;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	663 struct ip_addr net_ip;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	664 const char *p;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	665 unsigned int max_bits, bits, pos, i;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	666 uint32_t mask;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	667
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	668 max_bits = IPADDR_IS_V4(ip) ? 32 : 128;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	669 p = strchr(network, '/');
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	670 if (p == NULL) {
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	671 /* full IP address must match */
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	672 bits = max_bits;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	673 } else {
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	674 /* get the network mask */
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	675 network = t_strdup_until(network, p);
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	676 bits = strtoul(p+1, NULL, 10);
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	677 if (bits > max_bits)
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	678 bits = max_bits;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	679 }
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	680
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	681 if (net_addr2ip(network, &net_ip) < 0)
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	682 return -1;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	683
4533 92199dcb4018 If we logged in with IPv6 address and allow_nets contained IPv4 address, we Timo Sirainen <tss@iki.fi> parents: 4420 diff changeset	684 if (IPADDR_IS_V4(ip) != IPADDR_IS_V4(&net_ip)) {
4078 265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	685 /* one is IPv6 and one is IPv4 */
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	686 return 0;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	687 }
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	688 i_assert(IPADDR_IS_V6(ip) == IPADDR_IS_V6(&net_ip));
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	689
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	690 ip1 = (const uint32_t *)&ip->ip;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	691 ip2 = (const uint32_t *)&net_ip.ip;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	692
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	693 /* check first the full 32bit ints */
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	694 for (pos = 0, i = 0; pos + 32 <= bits; pos += 32, i++) {
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	695 if (ip1[i] != ip2[i])
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	696 return 0;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	697 }
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	698
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	699 /* check the last full bytes */
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	700 for (mask = 0xff; pos + 8 <= bits; pos += 8, mask <<= 8) {
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	701 if ((ip1[i] & mask) != (ip2[i] & mask))
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	702 return 0;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	703 }
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	704
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	705 /* check the last bits, they're reversed in bytes */
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	706 bits -= pos;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	707 for (mask = 0x80 << (pos % 32); bits > 0; bits--, mask >>= 1) {
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	708 if ((ip1[i] & mask) != (ip2[i] & mask))
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	709 return 0;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	710 }
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	711 return 1;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	712 }
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	713
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	714 static void auth_request_validate_networks(struct auth_request *request,
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	715 const char *networks)
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	716 {
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	717 const char const net;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	718 bool found = FALSE;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	719
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	720 if (request->remote_ip.family == 0) {
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	721 /* IP not known */
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	722 auth_request_log_info(request, "passdb",
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	723 "allow_nets check failed: Remote IP not known");
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	724 request->passdb_failure = TRUE;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	725 return;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	726 }
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	727
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	728 t_push();
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	729 for (net = t_strsplit_spaces(networks, ", "); *net != NULL; net++) {
4420 1174e508593d auth_debug: If allow_nets is given, print debug messages when matching Timo Sirainen <tss@iki.fi> parents: 4402 diff changeset	730 auth_request_log_debug(request, "auth",
1174e508593d auth_debug: If allow_nets is given, print debug messages when matching Timo Sirainen <tss@iki.fi> parents: 4402 diff changeset	731 "allow_nets: Matching for network %s", *net);
4078 265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	732 switch (is_ip_in_network(*net, &request->remote_ip)) {
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	733 case 1:
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	734 found = TRUE;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	735 break;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	736 case -1:
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	737 auth_request_log_info(request, "passdb",
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	738 "allow_nets: Invalid network '%s'", *net);
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	739 break;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	740 default:
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	741 break;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	742 }
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	743 }
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	744 t_pop();
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	745
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	746 if (!found) {
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	747 auth_request_log_info(request, "passdb",
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	748 "allow_nets check failed: IP not in allowed networks");
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	749 }
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	750 request->passdb_failure = !found;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	751 }
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	752
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	753 void auth_request_set_field(struct auth_request *request,
3272 36db3285f4a7 Try to keep scheme always included in auth_request->passdb_password. Timo Sirainen <tss@iki.fi> parents: 3257 diff changeset	754 const char name, const char value,
36db3285f4a7 Try to keep scheme always included in auth_request->passdb_password. Timo Sirainen <tss@iki.fi> parents: 3257 diff changeset	755 const char *default_scheme)
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	756 {
4017 e2d267e6f930 Check that we don't pass around key=value pairs with empty keys. Timo Sirainen <tss@iki.fi> parents: 3918 diff changeset	757 i_assert(*name != '\0');
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	758 i_assert(value != NULL);
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	759
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	760 if (strcmp(name, "password") == 0) {
3272 36db3285f4a7 Try to keep scheme always included in auth_request->passdb_password. Timo Sirainen <tss@iki.fi> parents: 3257 diff changeset	761 if (request->passdb_password != NULL) {
4042 dabe100f3c38 Multiple password database error prints now the passdb name that caused it. Timo Sirainen <timo.sirainen@movial.fi> parents: 4030 diff changeset	762 auth_request_log_error(request,
dabe100f3c38 Multiple password database error prints now the passdb name that caused it. Timo Sirainen <timo.sirainen@movial.fi> parents: 4030 diff changeset	763 request->passdb->passdb->iface.name,
3272 36db3285f4a7 Try to keep scheme always included in auth_request->passdb_password. Timo Sirainen <tss@iki.fi> parents: 3257 diff changeset	764 "Multiple password values not supported");
36db3285f4a7 Try to keep scheme always included in auth_request->passdb_password. Timo Sirainen <tss@iki.fi> parents: 3257 diff changeset	765 return;
36db3285f4a7 Try to keep scheme always included in auth_request->passdb_password. Timo Sirainen <tss@iki.fi> parents: 3257 diff changeset	766 }
36db3285f4a7 Try to keep scheme always included in auth_request->passdb_password. Timo Sirainen <tss@iki.fi> parents: 3257 diff changeset	767
36db3285f4a7 Try to keep scheme always included in auth_request->passdb_password. Timo Sirainen <tss@iki.fi> parents: 3257 diff changeset	768 if (*value == '{') {
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	769 request->passdb_password =
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	770 p_strdup(request->pool, value);
6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	771 } else {
3274 859c4ffd514e Don't crash if cache is enabled and we're caching more than just Timo Sirainen <tss@iki.fi> parents: 3272 diff changeset	772 i_assert(default_scheme != NULL);
3272 36db3285f4a7 Try to keep scheme always included in auth_request->passdb_password. Timo Sirainen <tss@iki.fi> parents: 3257 diff changeset	773 request->passdb_password =
36db3285f4a7 Try to keep scheme always included in auth_request->passdb_password. Timo Sirainen <tss@iki.fi> parents: 3257 diff changeset	774 p_strdup_printf(request->pool, "{%s}%s",
36db3285f4a7 Try to keep scheme always included in auth_request->passdb_password. Timo Sirainen <tss@iki.fi> parents: 3257 diff changeset	775 default_scheme, value);
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	776 }
3397 2db396230881 auth_request_set_field() shouldn't save password to extra_fields. Fixes a Timo Sirainen <tss@iki.fi> parents: 3386 diff changeset	777 return;
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	778 }
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	779
3257 92c16e82b806 passdb can now change the username that was used to log in. This is mostly Timo Sirainen <tss@iki.fi> parents: 3192 diff changeset	780 if (strcmp(name, "user") == 0) {
92c16e82b806 passdb can now change the username that was used to log in. This is mostly Timo Sirainen <tss@iki.fi> parents: 3192 diff changeset	781 /* update username to be exactly as it's in database */
3427 3f7575e43202 If username changes, log the change if debugging is enabled. Timo Sirainen <tss@iki.fi> parents: 3397 diff changeset	782 if (strcmp(request->user, value) != 0) {
3f7575e43202 If username changes, log the change if debugging is enabled. Timo Sirainen <tss@iki.fi> parents: 3397 diff changeset	783 auth_request_log_debug(request, "auth",
3f7575e43202 If username changes, log the change if debugging is enabled. Timo Sirainen <tss@iki.fi> parents: 3397 diff changeset	784 "username changed %s -> %s",
3f7575e43202 If username changes, log the change if debugging is enabled. Timo Sirainen <tss@iki.fi> parents: 3397 diff changeset	785 request->user, value);
3f7575e43202 If username changes, log the change if debugging is enabled. Timo Sirainen <tss@iki.fi> parents: 3397 diff changeset	786 request->user = p_strdup(request->pool, value);
3f7575e43202 If username changes, log the change if debugging is enabled. Timo Sirainen <tss@iki.fi> parents: 3397 diff changeset	787 }
3257 92c16e82b806 passdb can now change the username that was used to log in. This is mostly Timo Sirainen <tss@iki.fi> parents: 3192 diff changeset	788 return;
92c16e82b806 passdb can now change the username that was used to log in. This is mostly Timo Sirainen <tss@iki.fi> parents: 3192 diff changeset	789 }
92c16e82b806 passdb can now change the username that was used to log in. This is mostly Timo Sirainen <tss@iki.fi> parents: 3192 diff changeset	790
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	791 if (strcmp(name, "nodelay") == 0) {
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	792 /* don't delay replying to client of the failure */
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	793 request->no_failure_delay = TRUE;
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	794 return;
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	795 }
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	796
3669 09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	797 if (strcmp(name, "nopassword") == 0) {
09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	798 /* NULL password - anything goes */
09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	799 i_assert(request->passdb_password == NULL);
09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	800 request->no_password = TRUE;
09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	801 return;
09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	802 }
09b5e002ad8a If passdb returned NULL password (ie. no password needed), it wasn't cached Timo Sirainen <tss@iki.fi> parents: 3668 diff changeset	803
4078 265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	804 if (strcmp(name, "allow_nets") == 0) {
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	805 auth_request_validate_networks(request, value);
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	806 return;
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	807 }
265655f270df Added "allow_nets" extra field. If set, the user can log in only from Timo Sirainen <timo.sirainen@movial.fi> parents: 4054 diff changeset	808
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	809 if (strcmp(name, "nologin") == 0) {
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	810 /* user can't actually login - don't keep this
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	811 reply for master */
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	812 request->no_login = TRUE;
3668 c9f1bd1e1ec2 nologin/proxy are now always in boolean format, ie. without any "=Y". Timo Sirainen <tss@iki.fi> parents: 3658 diff changeset	813 value = NULL;
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	814 } else if (strcmp(name, "proxy") == 0) {
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	815 /* we're proxying authentication for this user. send
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	816 password back if using plaintext authentication. */
3161 6a3254e3c3de Moved cache handling from sql/ldap-specific code to generic auth-request Timo Sirainen <tss@iki.fi> parents: 3158 diff changeset	817 request->proxy = TRUE;
3668 c9f1bd1e1ec2 nologin/proxy are now always in boolean format, ie. without any "=Y". Timo Sirainen <tss@iki.fi> parents: 3658 diff changeset	818 value = NULL;
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	819 }
3520 e2fe8222449d s/occured/occurred/ Timo Sirainen <tss@iki.fi> parents: 3432 diff changeset	820
e2fe8222449d s/occured/occurred/ Timo Sirainen <tss@iki.fi> parents: 3432 diff changeset	821 if (request->extra_fields == NULL)
e2fe8222449d s/occured/occurred/ Timo Sirainen <tss@iki.fi> parents: 3432 diff changeset	822 request->extra_fields = auth_stream_reply_init(request);
e2fe8222449d s/occured/occurred/ Timo Sirainen <tss@iki.fi> parents: 3432 diff changeset	823 auth_stream_reply_add(request->extra_fields, name, value);
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	824 }
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	825
3918 40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	826 int auth_request_password_verify(struct auth_request *request,
40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	827 const char *plain_password,
40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	828 const char *crypted_password,
40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	829 const char scheme, const char subsystem)
40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	830 {
40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	831 int ret;
40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	832
4030 faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	833 if (request->skip_password_check) {
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	834 /* currently this can happen only with master logins */
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	835 i_assert(request->master_user != NULL);
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	836 return 1;
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	837 }
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	838
3918 40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	839 ret = password_verify(plain_password, crypted_password, scheme,
4054 f83d7d14b999 Digest-MD5 logins didn't work if passdb changed username. Timo Sirainen <tss@iki.fi> parents: 4042 diff changeset	840 request->original_username);
3918 40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	841 if (ret < 0) {
40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	842 auth_request_log_error(request, subsystem,
40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	843 "Unknown password scheme %s", scheme);
40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	844 } else if (ret == 0) {
40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	845 auth_request_log_info(request, subsystem,
40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	846 "Password mismatch");
40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	847 if (request->auth->verbose_debug_passwords) {
40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	848 auth_request_log_debug(request, subsystem,
40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	849 "%s(%s) != '%s'", scheme,
40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	850 plain_password,
40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	851 crypted_password);
40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	852 }
40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	853 }
40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	854 return ret;
40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	855 }
40a461d554e6 Added auth_debug_passwords setting. If it's not enabled, hide all password Timo Sirainen <tss@iki.fi> parents: 3879 diff changeset	856
4295 4fc637010202 Escape SQL strings using sql_escape_string(). Fixes the problems with Timo Sirainen <tss@iki.fi> parents: 4168 diff changeset	857 static const char *
4fc637010202 Escape SQL strings using sql_escape_string(). Fixes the problems with Timo Sirainen <tss@iki.fi> parents: 4168 diff changeset	858 escape_none(const char *string,
4fc637010202 Escape SQL strings using sql_escape_string(). Fixes the problems with Timo Sirainen <tss@iki.fi> parents: 4168 diff changeset	859 const struct auth_request *request __attr_unused__)
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	860 {
4295 4fc637010202 Escape SQL strings using sql_escape_string(). Fixes the problems with Timo Sirainen <tss@iki.fi> parents: 4168 diff changeset	861 return string;
4fc637010202 Escape SQL strings using sql_escape_string(). Fixes the problems with Timo Sirainen <tss@iki.fi> parents: 4168 diff changeset	862 }
4fc637010202 Escape SQL strings using sql_escape_string(). Fixes the problems with Timo Sirainen <tss@iki.fi> parents: 4168 diff changeset	863
4fc637010202 Escape SQL strings using sql_escape_string(). Fixes the problems with Timo Sirainen <tss@iki.fi> parents: 4168 diff changeset	864 const char *
4fc637010202 Escape SQL strings using sql_escape_string(). Fixes the problems with Timo Sirainen <tss@iki.fi> parents: 4168 diff changeset	865 auth_request_str_escape(const char *string,
4fc637010202 Escape SQL strings using sql_escape_string(). Fixes the problems with Timo Sirainen <tss@iki.fi> parents: 4168 diff changeset	866 const struct auth_request *request __attr_unused__)
4fc637010202 Escape SQL strings using sql_escape_string(). Fixes the problems with Timo Sirainen <tss@iki.fi> parents: 4168 diff changeset	867 {
4fc637010202 Escape SQL strings using sql_escape_string(). Fixes the problems with Timo Sirainen <tss@iki.fi> parents: 4168 diff changeset	868 return str_escape(string);
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	869 }
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	870
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	871 const struct var_expand_table *
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	872 auth_request_get_var_expand_table(const struct auth_request *auth_request,
4295 4fc637010202 Escape SQL strings using sql_escape_string(). Fixes the problems with Timo Sirainen <tss@iki.fi> parents: 4168 diff changeset	873 auth_request_escape_func_t *escape_func)
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	874 {
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	875 static struct var_expand_table static_tab[] = {
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	876 { 'u', NULL },
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	877 { 'n', NULL },
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	878 { 'd', NULL },
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	879 { 's', NULL },
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	880 { 'h', NULL },
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	881 { 'l', NULL },
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	882 { 'r', NULL },
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	883 { 'p', NULL },
3687 629ffe1a3874 %w contains now password Timo Sirainen <tss@iki.fi> parents: 3682 diff changeset	884 { 'w', NULL },
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	885 { '\0', NULL }
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	886 };
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	887 struct var_expand_table *tab;
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	888
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	889 if (escape_func == NULL)
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	890 escape_func = escape_none;
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	891
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	892 tab = t_malloc(sizeof(static_tab));
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	893 memcpy(tab, static_tab, sizeof(static_tab));
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	894
4295 4fc637010202 Escape SQL strings using sql_escape_string(). Fixes the problems with Timo Sirainen <tss@iki.fi> parents: 4168 diff changeset	895 tab[0].value = escape_func(auth_request->user, auth_request);
4fc637010202 Escape SQL strings using sql_escape_string(). Fixes the problems with Timo Sirainen <tss@iki.fi> parents: 4168 diff changeset	896 tab[1].value = escape_func(t_strcut(auth_request->user, '@'),
4fc637010202 Escape SQL strings using sql_escape_string(). Fixes the problems with Timo Sirainen <tss@iki.fi> parents: 4168 diff changeset	897 auth_request);
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	898 tab[2].value = strchr(auth_request->user, '@');
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	899 if (tab[2].value != NULL)
4295 4fc637010202 Escape SQL strings using sql_escape_string(). Fixes the problems with Timo Sirainen <tss@iki.fi> parents: 4168 diff changeset	900 tab[2].value = escape_func(tab[2].value+1, auth_request);
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	901 tab[3].value = auth_request->service;
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	902 /* tab[4] = we have no home dir */
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	903 if (auth_request->local_ip.family != 0)
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	904 tab[5].value = net_ip2addr(&auth_request->local_ip);
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	905 if (auth_request->remote_ip.family != 0)
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	906 tab[6].value = net_ip2addr(&auth_request->remote_ip);
3074 3feb38ff17f5 Moving code around. Timo Sirainen <tss@iki.fi> parents: 3072 diff changeset	907 tab[7].value = dec2str(auth_request->client_pid);
4295 4fc637010202 Escape SQL strings using sql_escape_string(). Fixes the problems with Timo Sirainen <tss@iki.fi> parents: 4168 diff changeset	908 if (auth_request->mech_password != NULL) {
4fc637010202 Escape SQL strings using sql_escape_string(). Fixes the problems with Timo Sirainen <tss@iki.fi> parents: 4168 diff changeset	909 tab[8].value = escape_func(auth_request->mech_password,
4fc637010202 Escape SQL strings using sql_escape_string(). Fixes the problems with Timo Sirainen <tss@iki.fi> parents: 4168 diff changeset	910 auth_request);
4fc637010202 Escape SQL strings using sql_escape_string(). Fixes the problems with Timo Sirainen <tss@iki.fi> parents: 4168 diff changeset	911 }
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	912 return tab;
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	913 }
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	914
3069 131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	915 static const char *
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	916 get_log_str(struct auth_request auth_request, const char subsystem,
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	917 const char *format, va_list va)
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	918 {
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	919 #define MAX_LOG_USERNAME_LEN 64
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	920 const char *ip;
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	921 string_t *str;
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	922
3069 131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	923 str = t_str_new(128);
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	924 str_append(str, subsystem);
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	925 str_append_c(str, '(');
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	926
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	927 if (auth_request->user == NULL)
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	928 str_append(str, "?");
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	929 else {
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	930 str_sanitize_append(str, auth_request->user,
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	931 MAX_LOG_USERNAME_LEN);
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	932 }
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	933
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	934 ip = net_ip2addr(&auth_request->remote_ip);
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	935 if (ip != NULL) {
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	936 str_append_c(str, ',');
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	937 str_append(str, ip);
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	938 }
4030 faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	939 if (auth_request->requested_login_user != NULL)
faf83f3e19b5 Added support for "master users" who can log in as other people. Currently works only with SASL PLAIN authentication by giving it authorization ID string. Timo Sirainen <timo.sirainen@movial.fi> parents: 4017 diff changeset	940 str_append(str, ",master");
3069 131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	941 str_append(str, "): ");
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	942 str_vprintfa(str, format, va);
3064 2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	943 return str_c(str);
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	944 }
2d33734b16d5 Split auth_request* functions from mech.c to auth-request.c Timo Sirainen <tss@iki.fi> parents: diff changeset	945
3069 131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	946 void auth_request_log_debug(struct auth_request *auth_request,
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	947 const char *subsystem,
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	948 const char *format, ...)
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	949 {
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	950 va_list va;
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	951
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	952 if (!auth_request->auth->verbose_debug)
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	953 return;
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	954
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	955 va_start(va, format);
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	956 t_push();
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	957 i_info("%s", get_log_str(auth_request, subsystem, format, va));
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	958 t_pop();
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	959 va_end(va);
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	960 }
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	961
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	962 void auth_request_log_info(struct auth_request *auth_request,
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	963 const char *subsystem,
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	964 const char *format, ...)
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	965 {
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	966 va_list va;
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	967
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	968 if (!auth_request->auth->verbose)
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	969 return;
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	970
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	971 va_start(va, format);
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	972 t_push();
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	973 i_info("%s", get_log_str(auth_request, subsystem, format, va));
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	974 t_pop();
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	975 va_end(va);
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	976 }
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	977
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	978 void auth_request_log_error(struct auth_request *auth_request,
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	979 const char *subsystem,
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	980 const char *format, ...)
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	981 {
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	982 va_list va;
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	983
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	984 va_start(va, format);
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	985 t_push();
3158 8849f2e380d1 userdb can now return extra parameters to master. Removed special handling Timo Sirainen <tss@iki.fi> parents: 3074 diff changeset	986 i_error("%s", get_log_str(auth_request, subsystem, format, va));
3069 131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	987 t_pop();
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	988 va_end(va);
131151e25e4b Added auth_request_log_(). Timo Sirainen <tss@iki.fi>* parents: 3068 diff changeset	989 }

Mercurial > dovecot > core-2.2

annotate src/auth/auth-request.c @ 4533:92199dcb4018 HEAD