dovecot/core-2.2: src/pop3-login/pop3-proxy.c annotate

annotate src/pop3-login/pop3-proxy.c @ 22325:e01bc3015b2f

lib-index: Check .log.2 rotation only when syncing Instead of also whenever appending transactions to .log file. This shouldn't change the behavior much, and it's needed for the following change to work correctly.

author	Timo Sirainen <timo.sirainen@dovecot.fi>
date	Tue, 11 Jul 2017 15:33:56 +0300
parents	9666b37cb252
children	cb108f786fb4

rev	line source
21390 2e2563132d5f Updated copyright notices to include the year 2017. Stephan Bosch <stephan.bosch@dovecot.fi> parents: 21389 diff changeset	1 /* Copyright (c) 2004-2017 Dovecot authors, see the included COPYING file */
2768 d344be0bb70f Added IMAP and POP3 proxying support. Timo Sirainen <tss@iki.fi> parents: diff changeset	2
10549 9ae939146ff7 login-common: Renamed common.h to login-common.h Timo Sirainen <tss@iki.fi> parents: 9756 diff changeset	3 #include "login-common.h"
2768 d344be0bb70f Added IMAP and POP3 proxying support. Timo Sirainen <tss@iki.fi> parents: diff changeset	4 #include "ioloop.h"
2773 e624a9ad6a30 More smart IMAP and POP3 proxies. Now if remote login fails, it just Timo Sirainen <tss@iki.fi> parents: 2768 diff changeset	5 #include "istream.h"
e624a9ad6a30 More smart IMAP and POP3 proxies. Now if remote login fails, it just Timo Sirainen <tss@iki.fi> parents: 2768 diff changeset	6 #include "ostream.h"
2768 d344be0bb70f Added IMAP and POP3 proxying support. Timo Sirainen <tss@iki.fi> parents: diff changeset	7 #include "base64.h"
2773 e624a9ad6a30 More smart IMAP and POP3 proxies. Now if remote login fails, it just Timo Sirainen <tss@iki.fi> parents: 2768 diff changeset	8 #include "safe-memset.h"
2768 d344be0bb70f Added IMAP and POP3 proxying support. Timo Sirainen <tss@iki.fi> parents: diff changeset	9 #include "str.h"
7117 769181a20483 Make sure all user input is sanitized before it's logged. Timo Sirainen <tss@iki.fi> parents: 7086 diff changeset	10 #include "str-sanitize.h"
21774 9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	11 #include "strescape.h"
16555 2dd27b0e7e49 lib-sasl: Use dsasl_ prefix so we don't conflict with Cyrus SASL library. Timo Sirainen <tss@iki.fi> parents: 16529 diff changeset	12 #include "dsasl-client.h"
2768 d344be0bb70f Added IMAP and POP3 proxying support. Timo Sirainen <tss@iki.fi> parents: diff changeset	13 #include "client.h"
d344be0bb70f Added IMAP and POP3 proxying support. Timo Sirainen <tss@iki.fi> parents: diff changeset	14 #include "pop3-proxy.h"
d344be0bb70f Added IMAP and POP3 proxying support. Timo Sirainen <tss@iki.fi> parents: diff changeset	15
21724 dce69a67f3b2 pop3-login: Log proxy state as human-readable string. Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21390 diff changeset	16 static const char *pop3_proxy_state_names[POP3_PROXY_STATE_COUNT] = {
dce69a67f3b2 pop3-login: Log proxy state as human-readable string. Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21390 diff changeset	17 "banner", "starttls", "xclient", "login1", "login2"
dce69a67f3b2 pop3-login: Log proxy state as human-readable string. Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21390 diff changeset	18 };
dce69a67f3b2 pop3-login: Log proxy state as human-readable string. Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21390 diff changeset	19
9756 e30495ae11de -login: Moved most of the common code to login-common. Timo Sirainen <tss@iki.fi>* parents: 9754 diff changeset	20 static void proxy_free_password(struct client *client)
8583 2ff2cac3578b imap/pop3-login: Cleaned up proxying code. Don't disconnect client on proxy failures. Timo Sirainen <tss@iki.fi> parents: 8546 diff changeset	21 {
2ff2cac3578b imap/pop3-login: Cleaned up proxying code. Don't disconnect client on proxy failures. Timo Sirainen <tss@iki.fi> parents: 8546 diff changeset	22 if (client->proxy_password == NULL)
2ff2cac3578b imap/pop3-login: Cleaned up proxying code. Don't disconnect client on proxy failures. Timo Sirainen <tss@iki.fi> parents: 8546 diff changeset	23 return;
2ff2cac3578b imap/pop3-login: Cleaned up proxying code. Don't disconnect client on proxy failures. Timo Sirainen <tss@iki.fi> parents: 8546 diff changeset	24
2ff2cac3578b imap/pop3-login: Cleaned up proxying code. Don't disconnect client on proxy failures. Timo Sirainen <tss@iki.fi> parents: 8546 diff changeset	25 safe_memset(client->proxy_password, 0, strlen(client->proxy_password));
2ff2cac3578b imap/pop3-login: Cleaned up proxying code. Don't disconnect client on proxy failures. Timo Sirainen <tss@iki.fi> parents: 8546 diff changeset	26 i_free_and_null(client->proxy_password);
2ff2cac3578b imap/pop3-login: Cleaned up proxying code. Don't disconnect client on proxy failures. Timo Sirainen <tss@iki.fi> parents: 8546 diff changeset	27 }
2ff2cac3578b imap/pop3-login: Cleaned up proxying code. Don't disconnect client on proxy failures. Timo Sirainen <tss@iki.fi> parents: 8546 diff changeset	28
16487 266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	29 static int proxy_send_login(struct pop3_client client, struct ostream output)
8546 50f49805b13b imap/pop3 proxy: Support master user logins. Timo Sirainen <tss@iki.fi> parents: 8123 diff changeset	30 {
16555 2dd27b0e7e49 lib-sasl: Use dsasl_ prefix so we don't conflict with Cyrus SASL library. Timo Sirainen <tss@iki.fi> parents: 16529 diff changeset	31 struct dsasl_client_settings sasl_set;
16487 266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	32 const unsigned char *sasl_output;
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	33 unsigned int len;
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	34 const char mech_name, error;
21774 9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	35 string_t *str = t_str_new(128);
2773 e624a9ad6a30 More smart IMAP and POP3 proxies. Now if remote login fails, it just Timo Sirainen <tss@iki.fi> parents: 2768 diff changeset	36
15887 48c1c58948f5 proxying cleanup: Send TTL=1 (instead of TTL=0) as "no more proxying". Timo Sirainen <tss@iki.fi> parents: 15715 diff changeset	37 i_assert(client->common.proxy_ttl > 1);
21018 645375ff262c imap/pop3 proxy: If passdb returns proxy_not_trusted, don't send ID/XCLIENT Timo Sirainen <timo.sirainen@dovecot.fi> parents: 19552 diff changeset	38 if (client->proxy_xclient &&
645375ff262c imap/pop3 proxy: If passdb returns proxy_not_trusted, don't send ID/XCLIENT Timo Sirainen <timo.sirainen@dovecot.fi> parents: 19552 diff changeset	39 !client->common.proxy_not_trusted) {
21774 9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	40 string_t *fwd = t_str_new(128);
9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	41 for(const char const ptr = client->common.auth_passdb_args;*ptr != NULL; ptr++) {
9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	42 if (strncasecmp(*ptr, "forward_", 8) == 0) {
9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	43 if (str_len(fwd) > 0)
9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	44 str_append_c(fwd, '\t');
9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	45 str_append_tabescaped(fwd, (*ptr)+8);
9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	46 }
9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	47 }
9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	48
9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	49 str_printfa(str, "XCLIENT ADDR=%s PORT=%u SESSION=%s TTL=%u",
9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	50 net_ip2addr(&client->common.ip),
9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	51 client->common.remote_port,
9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	52 client_get_session_id(&client->common),
9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	53 client->common.proxy_ttl - 1);
9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	54 if (str_len(fwd) > 0) {
9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	55 str_append(str, " FORWARD=");
9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	56 base64_encode(str_data(fwd), str_len(fwd), str);
9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	57 }
9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	58 str_append(str, "\r\n");
14209 35ed77dd500e pop3-login: Implemented XCLIENT command for forwarding client ip/port from proxy. Timo Sirainen <tss@iki.fi> parents: 14133 diff changeset	59 /* remote supports XCLIENT, send it */
21774 9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	60 o_stream_nsend(output, str_data(str), str_len(str));
21725 685240c1a19b pop3-login: Remove usage of client.common.proxy_state Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21724 diff changeset	61 client->proxy_state = POP3_PROXY_XCLIENT;
14213 ef7518f0bdbc pop3 proxy: Fixed handling XCLIENT reply. Timo Sirainen <tss@iki.fi> parents: 14209 diff changeset	62 } else {
21725 685240c1a19b pop3-login: Remove usage of client.common.proxy_state Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21724 diff changeset	63 client->proxy_state = POP3_PROXY_LOGIN1;
14209 35ed77dd500e pop3-login: Implemented XCLIENT command for forwarding client ip/port from proxy. Timo Sirainen <tss@iki.fi> parents: 14133 diff changeset	64 }
35ed77dd500e pop3-login: Implemented XCLIENT command for forwarding client ip/port from proxy. Timo Sirainen <tss@iki.fi> parents: 14133 diff changeset	65
21774 9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	66 str_truncate(str, 0);
9666b37cb252 pop3-login: Pass forward_ passdb args using XCLIENT command Aki Tuomi <aki.tuomi@dovecot.fi> parents: 21725 diff changeset	67
16487 266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	68 if (client->common.proxy_mech == NULL) {
9165 96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	69 /* send USER command */
96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	70 str_append(str, "USER ");
9756 e30495ae11de -login: Moved most of the common code to login-common. Timo Sirainen <tss@iki.fi>* parents: 9754 diff changeset	71 str_append(str, client->common.proxy_user);
9165 96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	72 str_append(str, "\r\n");
16487 266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	73 o_stream_nsend(output, str_data(str), str_len(str));
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	74 return 0;
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	75 }
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	76
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	77 i_assert(client->common.proxy_sasl_client == NULL);
21389 59437f8764c6 global: Replaced all instances of memset(p, 0, sizeof(p)) with the new i_zero() macro. Stephan Bosch <stephan.bosch@dovecot.fi>* parents: 21018 diff changeset	78 i_zero(&sasl_set);
16529 ba720ff91a75 imap/pop3 proxy: Master user logins were broken by lib-sasl change. Timo Sirainen <tss@iki.fi> parents: 16526 diff changeset	79 sasl_set.authid = client->common.proxy_master_user != NULL ?
ba720ff91a75 imap/pop3 proxy: Master user logins were broken by lib-sasl change. Timo Sirainen <tss@iki.fi> parents: 16526 diff changeset	80 client->common.proxy_master_user : client->common.proxy_user;
ba720ff91a75 imap/pop3 proxy: Master user logins were broken by lib-sasl change. Timo Sirainen <tss@iki.fi> parents: 16526 diff changeset	81 sasl_set.authzid = client->common.proxy_user;
16487 266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	82 sasl_set.password = client->common.proxy_password;
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	83 client->common.proxy_sasl_client =
16555 2dd27b0e7e49 lib-sasl: Use dsasl_ prefix so we don't conflict with Cyrus SASL library. Timo Sirainen <tss@iki.fi> parents: 16529 diff changeset	84 dsasl_client_new(client->common.proxy_mech, &sasl_set);
2dd27b0e7e49 lib-sasl: Use dsasl_ prefix so we don't conflict with Cyrus SASL library. Timo Sirainen <tss@iki.fi> parents: 16529 diff changeset	85 mech_name = dsasl_client_mech_get_name(client->common.proxy_mech);
16487 266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	86
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	87 str_printfa(str, "AUTH %s ", mech_name);
16555 2dd27b0e7e49 lib-sasl: Use dsasl_ prefix so we don't conflict with Cyrus SASL library. Timo Sirainen <tss@iki.fi> parents: 16529 diff changeset	88 if (dsasl_client_output(client->common.proxy_sasl_client,
2dd27b0e7e49 lib-sasl: Use dsasl_ prefix so we don't conflict with Cyrus SASL library. Timo Sirainen <tss@iki.fi> parents: 16529 diff changeset	89 &sasl_output, &len, &error) < 0) {
16487 266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	90 client_log_err(&client->common, t_strdup_printf(
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	91 "proxy: SASL mechanism %s init failed: %s",
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	92 mech_name, error));
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	93 return -1;
9165 96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	94 }
16487 266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	95 if (len == 0)
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	96 str_append_c(str, '=');
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	97 else
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	98 base64_encode(sasl_output, len, str);
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	99 str_append(str, "\r\n");
14681 ca37d1577291 Added o_stream_nsend() and related functions to make delayed error handling safer. Timo Sirainen <tss@iki.fi>* parents: 14576 diff changeset	100 o_stream_nsend(output, str_data(str), str_len(str));
16487 266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	101
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	102 proxy_free_password(&client->common);
21725 685240c1a19b pop3-login: Remove usage of client.common.proxy_state Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21724 diff changeset	103 if (client->proxy_state != POP3_PROXY_XCLIENT)
685240c1a19b pop3-login: Remove usage of client.common.proxy_state Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21724 diff changeset	104 client->proxy_state = POP3_PROXY_LOGIN2;
16487 266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	105 return 0;
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	106 }
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	107
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	108 static int
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	109 pop3_proxy_continue_sasl_auth(struct client client, struct ostream output,
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	110 const char *line)
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	111 {
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	112 string_t *str;
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	113 const unsigned char *data;
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	114 unsigned int data_len;
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	115 const char *error;
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	116 int ret;
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	117
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	118 str = t_str_new(128);
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	119 if (base64_decode(line, strlen(line), NULL, str) < 0) {
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	120 client_log_err(client, "proxy: Server sent invalid base64 data in AUTH response");
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	121 return -1;
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	122 }
16555 2dd27b0e7e49 lib-sasl: Use dsasl_ prefix so we don't conflict with Cyrus SASL library. Timo Sirainen <tss@iki.fi> parents: 16529 diff changeset	123 ret = dsasl_client_input(client->proxy_sasl_client,
2dd27b0e7e49 lib-sasl: Use dsasl_ prefix so we don't conflict with Cyrus SASL library. Timo Sirainen <tss@iki.fi> parents: 16529 diff changeset	124 str_data(str), str_len(str), &error);
16487 266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	125 if (ret == 0) {
16555 2dd27b0e7e49 lib-sasl: Use dsasl_ prefix so we don't conflict with Cyrus SASL library. Timo Sirainen <tss@iki.fi> parents: 16529 diff changeset	126 ret = dsasl_client_output(client->proxy_sasl_client,
2dd27b0e7e49 lib-sasl: Use dsasl_ prefix so we don't conflict with Cyrus SASL library. Timo Sirainen <tss@iki.fi> parents: 16529 diff changeset	127 &data, &data_len, &error);
16487 266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	128 }
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	129 if (ret < 0) {
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	130 client_log_err(client, t_strdup_printf(
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	131 "proxy: Server sent invalid authentication data: %s",
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	132 error));
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	133 return -1;
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	134 }
16526 178fe5bf943b Make static analyzer happier. Timo Sirainen <tss@iki.fi> parents: 16487 diff changeset	135 i_assert(ret == 0);
16487 266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	136
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	137 str_truncate(str, 0);
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	138 base64_encode(data, data_len, str);
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	139 str_append(str, "\r\n");
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	140
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	141 o_stream_nsend(output, str_data(str), str_len(str));
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	142 return 0;
9165 96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	143 }
96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	144
9756 e30495ae11de -login: Moved most of the common code to login-common. Timo Sirainen <tss@iki.fi>* parents: 9754 diff changeset	145 int pop3_proxy_parse_line(struct client client, const char line)
9165 96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	146 {
9756 e30495ae11de -login: Moved most of the common code to login-common. Timo Sirainen <tss@iki.fi>* parents: 9754 diff changeset	147 struct pop3_client pop3_client = (struct pop3_client )client;
9165 96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	148 struct ostream *output;
96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	149 enum login_proxy_ssl_flags ssl_flags;
96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	150
5138 20302f49eda3 Don't crash if the remote server disconnects before we're logged in. Timo Sirainen <tss@iki.fi> parents: 5046 diff changeset	151 i_assert(!client->destroyed);
20302f49eda3 Don't crash if the remote server disconnects before we're logged in. Timo Sirainen <tss@iki.fi> parents: 5046 diff changeset	152
9756 e30495ae11de -login: Moved most of the common code to login-common. Timo Sirainen <tss@iki.fi>* parents: 9754 diff changeset	153 output = login_proxy_get_ostream(client->login_proxy);
21725 685240c1a19b pop3-login: Remove usage of client.common.proxy_state Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21724 diff changeset	154 switch (pop3_client->proxy_state) {
9165 96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	155 case POP3_PROXY_BANNER:
2773 e624a9ad6a30 More smart IMAP and POP3 proxies. Now if remote login fails, it just Timo Sirainen <tss@iki.fi> parents: 2768 diff changeset	156 /* this is a banner */
2785 fc4b1ec1b3ef Use USER/PASS instad for AUTH PLAIN. Also don't require "+OK" to have Timo Sirainen <tss@iki.fi> parents: 2783 diff changeset	157 if (strncmp(line, "+OK", 3) != 0) {
9756 e30495ae11de -login: Moved most of the common code to login-common. Timo Sirainen <tss@iki.fi>* parents: 9754 diff changeset	158 client_log_err(client, t_strdup_printf(
7117 769181a20483 Make sure all user input is sanitized before it's logged. Timo Sirainen <tss@iki.fi> parents: 7086 diff changeset	159 "proxy: Remote returned invalid banner: %s",
769181a20483 Make sure all user input is sanitized before it's logged. Timo Sirainen <tss@iki.fi> parents: 7086 diff changeset	160 str_sanitize(line, 160)));
9756 e30495ae11de -login: Moved most of the common code to login-common. Timo Sirainen <tss@iki.fi>* parents: 9754 diff changeset	161 client_proxy_failed(client, TRUE);
8583 2ff2cac3578b imap/pop3-login: Cleaned up proxying code. Don't disconnect client on proxy failures. Timo Sirainen <tss@iki.fi> parents: 8546 diff changeset	162 return -1;
2773 e624a9ad6a30 More smart IMAP and POP3 proxies. Now if remote login fails, it just Timo Sirainen <tss@iki.fi> parents: 2768 diff changeset	163 }
14209 35ed77dd500e pop3-login: Implemented XCLIENT command for forwarding client ip/port from proxy. Timo Sirainen <tss@iki.fi> parents: 14133 diff changeset	164 pop3_client->proxy_xclient =
35ed77dd500e pop3-login: Implemented XCLIENT command for forwarding client ip/port from proxy. Timo Sirainen <tss@iki.fi> parents: 14133 diff changeset	165 strncmp(line+3, " [XCLIENT]", 10) == 0;
2773 e624a9ad6a30 More smart IMAP and POP3 proxies. Now if remote login fails, it just Timo Sirainen <tss@iki.fi> parents: 2768 diff changeset	166
9756 e30495ae11de -login: Moved most of the common code to login-common. Timo Sirainen <tss@iki.fi>* parents: 9754 diff changeset	167 ssl_flags = login_proxy_get_ssl_flags(client->login_proxy);
9165 96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	168 if ((ssl_flags & PROXY_SSL_FLAG_STARTTLS) == 0) {
16487 266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	169 if (proxy_send_login(pop3_client, output) < 0) {
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	170 client_proxy_failed(client, TRUE);
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	171 return -1;
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	172 }
8546 50f49805b13b imap/pop3 proxy: Support master user logins. Timo Sirainen <tss@iki.fi> parents: 8123 diff changeset	173 } else {
14681 ca37d1577291 Added o_stream_nsend() and related functions to make delayed error handling safer. Timo Sirainen <tss@iki.fi>* parents: 14576 diff changeset	174 o_stream_nsend_str(output, "STLS\r\n");
21725 685240c1a19b pop3-login: Remove usage of client.common.proxy_state Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21724 diff changeset	175 pop3_client->proxy_state = POP3_PROXY_STARTTLS;
8546 50f49805b13b imap/pop3 proxy: Support master user logins. Timo Sirainen <tss@iki.fi> parents: 8123 diff changeset	176 }
8583 2ff2cac3578b imap/pop3-login: Cleaned up proxying code. Don't disconnect client on proxy failures. Timo Sirainen <tss@iki.fi> parents: 8546 diff changeset	177 return 0;
9165 96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	178 case POP3_PROXY_STARTTLS:
96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	179 if (strncmp(line, "+OK", 3) != 0) {
9756 e30495ae11de -login: Moved most of the common code to login-common. Timo Sirainen <tss@iki.fi>* parents: 9754 diff changeset	180 client_log_err(client, t_strdup_printf(
9165 96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	181 "proxy: Remote STLS failed: %s",
96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	182 str_sanitize(line, 160)));
9756 e30495ae11de -login: Moved most of the common code to login-common. Timo Sirainen <tss@iki.fi>* parents: 9754 diff changeset	183 client_proxy_failed(client, TRUE);
9165 96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	184 return -1;
96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	185 }
9756 e30495ae11de -login: Moved most of the common code to login-common. Timo Sirainen <tss@iki.fi>* parents: 9754 diff changeset	186 if (login_proxy_starttls(client->login_proxy) < 0) {
e30495ae11de -login: Moved most of the common code to login-common. Timo Sirainen <tss@iki.fi>* parents: 9754 diff changeset	187 client_proxy_failed(client, TRUE);
9165 96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	188 return -1;
96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	189 }
96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	190 /* i/ostreams changed. */
9756 e30495ae11de -login: Moved most of the common code to login-common. Timo Sirainen <tss@iki.fi>* parents: 9754 diff changeset	191 output = login_proxy_get_ostream(client->login_proxy);
16487 266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	192 if (proxy_send_login(pop3_client, output) < 0) {
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	193 client_proxy_failed(client, TRUE);
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	194 return -1;
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	195 }
9165 96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	196 return 1;
14213 ef7518f0bdbc pop3 proxy: Fixed handling XCLIENT reply. Timo Sirainen <tss@iki.fi> parents: 14209 diff changeset	197 case POP3_PROXY_XCLIENT:
ef7518f0bdbc pop3 proxy: Fixed handling XCLIENT reply. Timo Sirainen <tss@iki.fi> parents: 14209 diff changeset	198 if (strncmp(line, "+OK", 3) != 0) {
ef7518f0bdbc pop3 proxy: Fixed handling XCLIENT reply. Timo Sirainen <tss@iki.fi> parents: 14209 diff changeset	199 client_log_err(client, t_strdup_printf(
ef7518f0bdbc pop3 proxy: Fixed handling XCLIENT reply. Timo Sirainen <tss@iki.fi> parents: 14209 diff changeset	200 "proxy: Remote XCLIENT failed: %s",
ef7518f0bdbc pop3 proxy: Fixed handling XCLIENT reply. Timo Sirainen <tss@iki.fi> parents: 14209 diff changeset	201 str_sanitize(line, 160)));
ef7518f0bdbc pop3 proxy: Fixed handling XCLIENT reply. Timo Sirainen <tss@iki.fi> parents: 14209 diff changeset	202 client_proxy_failed(client, TRUE);
ef7518f0bdbc pop3 proxy: Fixed handling XCLIENT reply. Timo Sirainen <tss@iki.fi> parents: 14209 diff changeset	203 return -1;
ef7518f0bdbc pop3 proxy: Fixed handling XCLIENT reply. Timo Sirainen <tss@iki.fi> parents: 14209 diff changeset	204 }
21725 685240c1a19b pop3-login: Remove usage of client.common.proxy_state Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21724 diff changeset	205 pop3_client->proxy_state = client->proxy_sasl_client == NULL ?
16487 266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	206 POP3_PROXY_LOGIN1 : POP3_PROXY_LOGIN2;
14214 cf713cf9b7c0 pop3 proxy: Fixed previous change not to hang. Timo Sirainen <tss@iki.fi> parents: 14213 diff changeset	207 return 0;
9165 96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	208 case POP3_PROXY_LOGIN1:
16487 266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	209 i_assert(client->proxy_sasl_client == NULL);
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	210 if (strncmp(line, "+OK", 3) != 0)
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	211 break;
2835 39c315e7697d Keep proxy_user stored until proxy is destroyed. Timo Sirainen <tss@iki.fi> parents: 2786 diff changeset	212
16487 266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	213 /* USER successful, send PASS */
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	214 o_stream_nsend_str(output, t_strdup_printf(
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	215 "PASS %s\r\n", client->proxy_password));
8583 2ff2cac3578b imap/pop3-login: Cleaned up proxying code. Don't disconnect client on proxy failures. Timo Sirainen <tss@iki.fi> parents: 8546 diff changeset	216 proxy_free_password(client);
21725 685240c1a19b pop3-login: Remove usage of client.common.proxy_state Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21724 diff changeset	217 pop3_client->proxy_state = POP3_PROXY_LOGIN2;
8583 2ff2cac3578b imap/pop3-login: Cleaned up proxying code. Don't disconnect client on proxy failures. Timo Sirainen <tss@iki.fi> parents: 8546 diff changeset	218 return 0;
9165 96678e83eab6 imap/pop3 proxy: Support SSL/TLS connections to remote servers. Timo Sirainen <tss@iki.fi> parents: 9159 diff changeset	219 case POP3_PROXY_LOGIN2:
16487 266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	220 if (strncmp(line, "+ ", 2) == 0 &&
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	221 client->proxy_sasl_client != NULL) {
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	222 /* continue SASL authentication */
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	223 if (pop3_proxy_continue_sasl_auth(client, output,
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	224 line+2) < 0) {
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	225 client_proxy_failed(client, TRUE);
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	226 return -1;
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	227 }
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	228 return 0;
266101990d63 imap/pop3-login: Use libsasl for authenticating to remote IMAP/POP3 server. Timo Sirainen <tss@iki.fi> parents: 15887 diff changeset	229 }
2850 4e5b1a1494c5 Check that PASS replies with OK. Timo Sirainen <tss@iki.fi> parents: 2835 diff changeset	230 if (strncmp(line, "+OK", 3) != 0)
4e5b1a1494c5 Check that PASS replies with OK. Timo Sirainen <tss@iki.fi> parents: 2835 diff changeset	231 break;
4e5b1a1494c5 Check that PASS replies with OK. Timo Sirainen <tss@iki.fi> parents: 2835 diff changeset	232
2835 39c315e7697d Keep proxy_user stored until proxy is destroyed. Timo Sirainen <tss@iki.fi> parents: 2786 diff changeset	233 /* Login successful. Send this line to client. */
7454 053ec63146cb Send the success reply in one write. Based on patch by Onno Molenkamp. Timo Sirainen <tss@iki.fi> parents: 7438 diff changeset	234 line = t_strconcat(line, "\r\n", NULL);
14681 ca37d1577291 Added o_stream_nsend() and related functions to make delayed error handling safer. Timo Sirainen <tss@iki.fi>* parents: 14576 diff changeset	235 o_stream_nsend_str(client->output, line);
2835 39c315e7697d Keep proxy_user stored until proxy is destroyed. Timo Sirainen <tss@iki.fi> parents: 2786 diff changeset	236
9756 e30495ae11de -login: Moved most of the common code to login-common. Timo Sirainen <tss@iki.fi>* parents: 9754 diff changeset	237 client_proxy_finish_destroy_client(client);
8775 98e1115cd8f0 pop3-login: Don't crash after successful login. Timo Sirainen <tss@iki.fi> parents: 8590 diff changeset	238 return 1;
21724 dce69a67f3b2 pop3-login: Log proxy state as human-readable string. Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21390 diff changeset	239 case POP3_PROXY_STATE_COUNT:
dce69a67f3b2 pop3-login: Log proxy state as human-readable string. Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21390 diff changeset	240 i_unreached();
2835 39c315e7697d Keep proxy_user stored until proxy is destroyed. Timo Sirainen <tss@iki.fi> parents: 2786 diff changeset	241 }
39c315e7697d Keep proxy_user stored until proxy is destroyed. Timo Sirainen <tss@iki.fi> parents: 2786 diff changeset	242
9038 72045e108c8b imap-login: Use [resp-codes] to figure out when to replace remote's auth failed message with ours. Timo Sirainen <tss@iki.fi> parents: 9015 diff changeset	243 /* Login failed. Pass through the error message to client.
72045e108c8b imap-login: Use [resp-codes] to figure out when to replace remote's auth failed message with ours. Timo Sirainen <tss@iki.fi> parents: 9015 diff changeset	244
72045e108c8b imap-login: Use [resp-codes] to figure out when to replace remote's auth failed message with ours. Timo Sirainen <tss@iki.fi> parents: 9015 diff changeset	245 If the backend server isn't Dovecot, the error message may
72045e108c8b imap-login: Use [resp-codes] to figure out when to replace remote's auth failed message with ours. Timo Sirainen <tss@iki.fi> parents: 9015 diff changeset	246 be different from Dovecot's "user doesn't exist" error. This
72045e108c8b imap-login: Use [resp-codes] to figure out when to replace remote's auth failed message with ours. Timo Sirainen <tss@iki.fi> parents: 9015 diff changeset	247 would allow an attacker to find out what users exist in the
72045e108c8b imap-login: Use [resp-codes] to figure out when to replace remote's auth failed message with ours. Timo Sirainen <tss@iki.fi> parents: 9015 diff changeset	248 system.
72045e108c8b imap-login: Use [resp-codes] to figure out when to replace remote's auth failed message with ours. Timo Sirainen <tss@iki.fi> parents: 9015 diff changeset	249
72045e108c8b imap-login: Use [resp-codes] to figure out when to replace remote's auth failed message with ours. Timo Sirainen <tss@iki.fi> parents: 9015 diff changeset	250 The optimal way to handle this would be to replace the
72045e108c8b imap-login: Use [resp-codes] to figure out when to replace remote's auth failed message with ours. Timo Sirainen <tss@iki.fi> parents: 9015 diff changeset	251 backend's "password failed" error message with Dovecot's
72045e108c8b imap-login: Use [resp-codes] to figure out when to replace remote's auth failed message with ours. Timo Sirainen <tss@iki.fi> parents: 9015 diff changeset	252 AUTH_FAILED_MSG, but this would require a new setting and
72045e108c8b imap-login: Use [resp-codes] to figure out when to replace remote's auth failed message with ours. Timo Sirainen <tss@iki.fi> parents: 9015 diff changeset	253 the sysadmin to actually bother setting it properly.
72045e108c8b imap-login: Use [resp-codes] to figure out when to replace remote's auth failed message with ours. Timo Sirainen <tss@iki.fi> parents: 9015 diff changeset	254
72045e108c8b imap-login: Use [resp-codes] to figure out when to replace remote's auth failed message with ours. Timo Sirainen <tss@iki.fi> parents: 9015 diff changeset	255 So for now we'll just forward the error message. This
72045e108c8b imap-login: Use [resp-codes] to figure out when to replace remote's auth failed message with ours. Timo Sirainen <tss@iki.fi> parents: 9015 diff changeset	256 shouldn't be a real problem since of course everyone will
72045e108c8b imap-login: Use [resp-codes] to figure out when to replace remote's auth failed message with ours. Timo Sirainen <tss@iki.fi> parents: 9015 diff changeset	257 be using only Dovecot as their backend :) */
9756 e30495ae11de -login: Moved most of the common code to login-common. Timo Sirainen <tss@iki.fi>* parents: 9754 diff changeset	258 if (strncmp(line, "-ERR ", 5) != 0) {
14146 e456e1bce47f login-common API made more extensible for different kinds of protocols. Timo Sirainen <tss@iki.fi> parents: 14133 diff changeset	259 client_send_reply(client, POP3_CMD_REPLY_ERROR,
e456e1bce47f login-common API made more extensible for different kinds of protocols. Timo Sirainen <tss@iki.fi> parents: 14133 diff changeset	260 AUTH_FAILED_MSG);
9756 e30495ae11de -login: Moved most of the common code to login-common. Timo Sirainen <tss@iki.fi>* parents: 9754 diff changeset	261 } else {
9754 b9ad5b841f7e -login: Use a common client_send_line() API. Timo Sirainen <tss@iki.fi>* parents: 9283 diff changeset	262 client_send_raw(client, t_strconcat(line, "\r\n", NULL));
b9ad5b841f7e -login: Use a common client_send_line() API. Timo Sirainen <tss@iki.fi>* parents: 9283 diff changeset	263 }
2785 fc4b1ec1b3ef Use USER/PASS instad for AUTH PLAIN. Also don't require "+OK" to have Timo Sirainen <tss@iki.fi> parents: 2783 diff changeset	264
14006 d88f58c6fd21 login: More verbose_auth -> auth_verbose changes. Timo Sirainen <tss@iki.fi> parents: 12782 diff changeset	265 if (client->set->auth_verbose) {
8123 26b67708b365 imap/pop3-proxy: If auth_verbose=yes, log proxy login failures. Timo Sirainen <tss@iki.fi> parents: 8097 diff changeset	266 if (strncmp(line, "-ERR ", 5) == 0)
9756 e30495ae11de -login: Moved most of the common code to login-common. Timo Sirainen <tss@iki.fi>* parents: 9754 diff changeset	267 line += 5;
e30495ae11de -login: Moved most of the common code to login-common. Timo Sirainen <tss@iki.fi>* parents: 9754 diff changeset	268 client_proxy_log_failure(client, line);
8123 26b67708b365 imap/pop3-proxy: If auth_verbose=yes, log proxy login failures. Timo Sirainen <tss@iki.fi> parents: 8097 diff changeset	269 }
14011 cb344eb79daa login proxy: If remote auth fails, say so in disconnect message instead of "internal failure". Timo Sirainen <tss@iki.fi> parents: 14006 diff changeset	270 client->proxy_auth_failed = TRUE;
9756 e30495ae11de -login: Moved most of the common code to login-common. Timo Sirainen <tss@iki.fi>* parents: 9754 diff changeset	271 client_proxy_failed(client, FALSE);
8583 2ff2cac3578b imap/pop3-login: Cleaned up proxying code. Don't disconnect client on proxy failures. Timo Sirainen <tss@iki.fi> parents: 8546 diff changeset	272 return -1;
2ff2cac3578b imap/pop3-login: Cleaned up proxying code. Don't disconnect client on proxy failures. Timo Sirainen <tss@iki.fi> parents: 8546 diff changeset	273 }
8123 26b67708b365 imap/pop3-proxy: If auth_verbose=yes, log proxy login failures. Timo Sirainen <tss@iki.fi> parents: 8097 diff changeset	274
9756 e30495ae11de -login: Moved most of the common code to login-common. Timo Sirainen <tss@iki.fi>* parents: 9754 diff changeset	275 void pop3_proxy_reset(struct client *client)
8583 2ff2cac3578b imap/pop3-login: Cleaned up proxying code. Don't disconnect client on proxy failures. Timo Sirainen <tss@iki.fi> parents: 8546 diff changeset	276 {
21725 685240c1a19b pop3-login: Remove usage of client.common.proxy_state Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21724 diff changeset	277 struct pop3_client pop3_client = (struct pop3_client )client;
685240c1a19b pop3-login: Remove usage of client.common.proxy_state Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21724 diff changeset	278
685240c1a19b pop3-login: Remove usage of client.common.proxy_state Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21724 diff changeset	279 pop3_client->proxy_state = POP3_PROXY_BANNER;
2768 d344be0bb70f Added IMAP and POP3 proxying support. Timo Sirainen <tss@iki.fi> parents: diff changeset	280 }
14146 e456e1bce47f login-common API made more extensible for different kinds of protocols. Timo Sirainen <tss@iki.fi> parents: 14133 diff changeset	281
e456e1bce47f login-common API made more extensible for different kinds of protocols. Timo Sirainen <tss@iki.fi> parents: 14133 diff changeset	282 void pop3_proxy_error(struct client client, const char text)
e456e1bce47f login-common API made more extensible for different kinds of protocols. Timo Sirainen <tss@iki.fi> parents: 14133 diff changeset	283 {
e456e1bce47f login-common API made more extensible for different kinds of protocols. Timo Sirainen <tss@iki.fi> parents: 14133 diff changeset	284 client_send_reply(client, POP3_CMD_REPLY_ERROR, text);
e456e1bce47f login-common API made more extensible for different kinds of protocols. Timo Sirainen <tss@iki.fi> parents: 14133 diff changeset	285 }
21724 dce69a67f3b2 pop3-login: Log proxy state as human-readable string. Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21390 diff changeset	286
dce69a67f3b2 pop3-login: Log proxy state as human-readable string. Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21390 diff changeset	287 const char pop3_proxy_get_state(struct client client)
dce69a67f3b2 pop3-login: Log proxy state as human-readable string. Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21390 diff changeset	288 {
21725 685240c1a19b pop3-login: Remove usage of client.common.proxy_state Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21724 diff changeset	289 struct pop3_client pop3_client = (struct pop3_client )client;
685240c1a19b pop3-login: Remove usage of client.common.proxy_state Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21724 diff changeset	290
685240c1a19b pop3-login: Remove usage of client.common.proxy_state Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21724 diff changeset	291 return pop3_proxy_state_names[pop3_client->proxy_state];
21724 dce69a67f3b2 pop3-login: Log proxy state as human-readable string. Timo Sirainen <timo.sirainen@dovecot.fi> parents: 21390 diff changeset	292 }

Mercurial > dovecot > core-2.2

annotate src/pop3-login/pop3-proxy.c @ 22325:e01bc3015b2f