imap/pop3 proxy: If passdb returns proxy_not_trusted, don't send ID/XCLIENT

This allows using Dovecot proxying feature towards less trusted servers.

diff --git a/src/imap-login/imap-proxy.c b/src/imap-login/imap-proxy.c
index 4f49fd9248ecd1cb8b237bbb8a2d8f88f27c687f..1cdce494ff93dcb882b9f7969898364373830fda 100644 (file)
--- a/src/imap-login/imap-proxy.c
+++ b/src/imap-login/imap-proxy.c
@@ -168,7 +168,8 @@ static int proxy_input_banner(struct imap_client *client,
                i_free(client->proxy_backend_capability);
                client->proxy_backend_capability =
                        i_strdup(t_strcut(line + 5 + 12, ']'));
-               if (str_array_icase_find(capabilities, "ID")) {
+               if (str_array_icase_find(capabilities, "ID") &&
+                   !client->common.proxy_not_trusted) {
                        proxy_write_id(client, str);
                        if (client->common.proxy_nopipelining) {
                                /* write login or starttls after I OK */

diff --git a/src/login-common/client-common-auth.c b/src/login-common/client-common-auth.c
index 0a4d30b530e0cc84ef66a1e86ff121f11ded24f0..9e6b04fb283496b821a3149b506aebebe77fb842 100644 (file)
--- a/src/login-common/client-common-auth.c
+++ b/src/login-common/client-common-auth.c
@@ -154,6 +154,8 @@ static void client_auth_parse_args(struct client *client, bool success,
                        reply_r->proxy_mech = value;
                else if (strcmp(key, "proxy_nopipelining") == 0)
                        reply_r->proxy_nopipelining = TRUE;
+               else if (strcmp(key, "proxy_not_trusted") == 0)
+                       reply_r->proxy_not_trusted = TRUE;
                else if (strcmp(key, "master") == 0)
                        reply_r->master_user = value;
                else if (strcmp(key, "ssl") == 0) {
@@ -415,6 +417,7 @@ static int proxy_start(struct client *client,
        client->proxy_master_user = i_strdup(reply->master_user);
        client->proxy_password = i_strdup(reply->password);
        client->proxy_nopipelining = reply->proxy_nopipelining;
+       client->proxy_not_trusted = reply->proxy_not_trusted;
 
        /* disable input until authentication is finished */
        if (client->io != NULL)

diff --git a/src/login-common/client-common.h b/src/login-common/client-common.h
index d37ca917c130455864677a43191272f759991ec6..64c8856fa9171b8d2955045859d8e083f48089ec 100644 (file)
--- a/src/login-common/client-common.h
+++ b/src/login-common/client-common.h
@@ -70,6 +70,7 @@ struct client_auth_reply {
 
        unsigned int proxy:1;
        unsigned int proxy_nopipelining:1;
+       unsigned int proxy_not_trusted:1;
        unsigned int temp:1;
        unsigned int nologin:1;
        unsigned int authz_failure:1;
@@ -176,6 +177,7 @@ struct client {
        unsigned int auth_process_comm_fail:1;
        unsigned int proxy_auth_failed:1;
        unsigned int proxy_nopipelining:1;
+       unsigned int proxy_not_trusted:1;
        unsigned int auth_waiting:1;
        unsigned int auth_user_disabled:1;
        unsigned int auth_pass_expired:1;

diff --git a/src/pop3-login/pop3-proxy.c b/src/pop3-login/pop3-proxy.c
index dd4d0b49b129d3d3a10c574318ce9f56c2b33546..e1cceb087ca5bdce9a8c312430bba7374f913e20 100644 (file)
--- a/src/pop3-login/pop3-proxy.c
+++ b/src/pop3-login/pop3-proxy.c
@@ -30,7 +30,8 @@ static int proxy_send_login(struct pop3_client *client, struct ostream *output)
        string_t *str;
 
        i_assert(client->common.proxy_ttl > 1);
-       if (client->proxy_xclient) {
+       if (client->proxy_xclient &&
+           !client->common.proxy_not_trusted) {
                /* remote supports XCLIENT, send it */
                o_stream_nsend_str(output, t_strdup_printf(
                        "XCLIENT ADDR=%s PORT=%u SESSION=%s TTL=%u\r\n",