login-proxy: Check for missing host IP address earlier

Also fail if "hostip" is returned by passdb but it's not a valid IP address.

diff --git a/src/login-common/client-common-auth.c b/src/login-common/client-common-auth.c
index 9c40a605831aa2c42572dd5f3fc789702ac1f708..4b6bd39c98d21eb933b38020c49d650f0beb2257 100644 (file)
--- a/src/login-common/client-common-auth.c
+++ b/src/login-common/client-common-auth.c
@@ -387,7 +387,8 @@ static void proxy_input(struct client *client)
 static bool
 proxy_check_start(struct client *client, struct event *event,
                  const struct client_auth_reply *reply,
-                 const struct dsasl_client_mech **sasl_mech_r)
+                 const struct dsasl_client_mech **sasl_mech_r,
+                 struct ip_addr *ip_r)
 {
        if (reply->password == NULL) {
                e_error(event, "password not given");
@@ -398,6 +399,18 @@ proxy_check_start(struct client *client, struct event *event,
                return FALSE;
        }
 
+       if (reply->hostip != NULL && reply->hostip[0] != '\0') {
+               if (net_addr2ip(reply->hostip, ip_r) < 0) {
+                       e_error(event, "Invalid hostip %s", reply->hostip);
+                       return FALSE;
+               }
+       } else if (net_addr2ip(reply->host, ip_r) < 0) {
+               e_error(event,
+                       "BUG: host %s is not an IP (auth should have changed it)",
+                       reply->host);
+               return FALSE;
+       }
+
        if (reply->proxy_mech != NULL) {
                *sasl_mech_r = dsasl_client_mech_find(reply->proxy_mech);
                if (*sasl_mech_r == NULL) {
@@ -423,6 +436,7 @@ static int proxy_start(struct client *client,
 {
        struct login_proxy_settings proxy_set;
        const struct dsasl_client_mech *sasl_mech = NULL;
+       struct ip_addr ip;
        struct event *event;
 
        i_assert(reply->destuser != NULL);
@@ -436,7 +450,7 @@ static int proxy_start(struct client *client,
        event_set_append_log_prefix(event, t_strdup_printf(
                "proxy(%s): ", client->virtual_user));
 
-       if (!proxy_check_start(client, event, reply, &sasl_mech)) {
+       if (!proxy_check_start(client, event, reply, &sasl_mech, &ip)) {
                client_proxy_error(client, PROXY_FAILURE_MSG);
                event_unref(&event);
                return -1;
@@ -444,9 +458,7 @@ static int proxy_start(struct client *client,
 
        i_zero(&proxy_set);
        proxy_set.host = reply->host;
-       if (reply->hostip != NULL &&
-           net_addr2ip(reply->hostip, &proxy_set.ip) < 0)
-               proxy_set.ip.family = 0;
+       proxy_set.ip = ip;
        if (reply->source_ip != NULL) {
                if (net_addr2ip(reply->source_ip, &proxy_set.source_ip) < 0)
                        proxy_set.source_ip.family = 0;

diff --git a/src/login-common/login-proxy.c b/src/login-common/login-proxy.c
index 5a93cceb8f0bd2e1c212488a49572127da7567b9..edff91321bc785fa3d2821bc97a67b3e8647e705 100644 (file)
--- a/src/login-common/login-proxy.c
+++ b/src/login-common/login-proxy.c
@@ -280,14 +280,6 @@ static int login_proxy_connect(struct login_proxy *proxy)
        proxy->num_waiting_connections_updated = FALSE;
        rec->num_waiting_connections++;
 
-       if (proxy->ip.family == 0 &&
-           net_addr2ip(proxy->host, &proxy->ip) < 0) {
-               e_error(proxy->event,
-                       "BUG: host %s is not an IP (auth should have changed it)",
-                       proxy->host);
-               return -1;
-       }
-
        if (rec->last_success.tv_sec == 0) {
                /* first connect to this IP. don't start immediately failing
                   the check below. */