doveadm: Added doveadm_allowed_commands setting, which is used by doveadm server.

diff --git a/src/doveadm/client-connection.c b/src/doveadm/client-connection.c
index ae7574913b00e4d998e68a2b5168b44c0369b7a1..a169255e6edb374abafb8e320d56a98a41d4c9f8 100644 (file)
--- a/src/doveadm/client-connection.c
+++ b/src/doveadm/client-connection.c
@@ -111,6 +111,27 @@ doveadm_mail_cmd_server(const char *cmd_name,
        return ret;
 }
 
+static bool client_is_allowed_command(const struct doveadm_settings *set,
+                                     const char *cmd_name)
+{
+       bool ret = FALSE;
+
+       if (*set->doveadm_allowed_commands == '\0')
+               return TRUE;
+
+       T_BEGIN {
+               const char *const *cmds =
+                       t_strsplit(set->doveadm_allowed_commands, ",");
+               for (; *cmds != NULL; cmds++) {
+                       if (strcmp(*cmds, cmd_name) == 0) {
+                               ret = TRUE;
+                               break;
+                       }
+               }
+       } T_END;
+       return ret;
+}
+
 static bool client_handle_command(struct client_connection *conn, char **args)
 {
        struct mail_storage_service_input input;
@@ -152,6 +173,12 @@ static bool client_handle_command(struct client_connection *conn, char **args)
                }
        }
 
+       if (!client_is_allowed_command(conn->set, cmd_name)) {
+               i_error("doveadm client isn't allowed to use command: %s",
+                       cmd_name);
+               return FALSE;
+       }
+
        o_stream_cork(conn->output);
        ret = doveadm_mail_cmd_server(cmd_name, conn->set, &input, argc, args);
        if (ret)

diff --git a/src/doveadm/doveadm-settings.c b/src/doveadm/doveadm-settings.c
index ce844c12efd3298f802cc668e5578fe0c8ca38d4..ed3f48040c058f3375d5015048b32a7862a3357f 100644 (file)
--- a/src/doveadm/doveadm-settings.c
+++ b/src/doveadm/doveadm-settings.c
@@ -59,6 +59,7 @@ static const struct setting_define doveadm_setting_defines[] = {
        DEF(SET_UINT, doveadm_worker_count),
        DEF(SET_UINT, doveadm_proxy_port),
        DEF(SET_STR, doveadm_password),
+       DEF(SET_STR, doveadm_allowed_commands),
 
        { SET_STRLIST, "plugin", offsetof(struct doveadm_settings, plugin_envs), NULL },
 
@@ -73,6 +74,7 @@ const struct doveadm_settings doveadm_default_settings = {
        .doveadm_worker_count = 0,
        .doveadm_proxy_port = 0,
        .doveadm_password = "",
+       .doveadm_allowed_commands = "",
 
        .plugin_envs = ARRAY_INIT
 };

diff --git a/src/doveadm/doveadm-settings.h b/src/doveadm/doveadm-settings.h
index 567d47834ceb70b419fad6a3ba3c9d4e107cb728..bc9ef9033da869f5afc076efdde1923eb1451e11 100644 (file)
--- a/src/doveadm/doveadm-settings.h
+++ b/src/doveadm/doveadm-settings.h
@@ -9,6 +9,7 @@ struct doveadm_settings {
        unsigned int doveadm_worker_count;
        unsigned int doveadm_proxy_port;
        const char *doveadm_password;
+       const char *doveadm_allowed_commands;
 
        ARRAY_DEFINE(plugin_envs, const char *);
 };