Logging changes. Make sure we don't write control characters to log and also

log IP address.

--HG--
branch : HEAD

diff --git a/src/auth/db-passwd-file.c b/src/auth/db-passwd-file.c
index 73356b6adb226feaf1cbceed45571f3e1ad7d34b..8c46bf7710726ca432e49be8f7800a65c0e164b6 100644 (file)
--- a/src/auth/db-passwd-file.c
+++ b/src/auth/db-passwd-file.c
@@ -215,16 +215,18 @@ void db_passwd_file_unref(struct passwd_file *pw)
 }
 
 struct passwd_user *
-db_passwd_file_lookup(struct passwd_file *pw, const char *user)
+db_passwd_file_lookup(struct passwd_file *pw, struct auth_request *request)
 {
        struct passwd_user *pu;
 
        passwd_file_sync(pw);
 
-       pu = hash_lookup(pw->users, user);
+       pu = hash_lookup(pw->users, request->user);
        if (pu == NULL) {
-               if (verbose)
-                       i_info("passwd-file(%s): unknown user", user);
+               if (verbose) {
+                       i_info("passwd-file(%s): unknown user",
+                              get_log_prefix(request));
+               }
        }
 
        return pu;

diff --git a/src/auth/db-passwd-file.h b/src/auth/db-passwd-file.h
index 1ba31e1394658403f3a85ad4b85b54be142a4984..c4abd29e274bb527a09308dac0c650c3a509476a 100644 (file)
--- a/src/auth/db-passwd-file.h
+++ b/src/auth/db-passwd-file.h
@@ -30,7 +30,7 @@ extern struct passwd_file *userdb_pwf;
 extern struct passwd_file *passdb_pwf;
 
 struct passwd_user *
-db_passwd_file_lookup(struct passwd_file *pw, const char *user);
+db_passwd_file_lookup(struct passwd_file *pw, struct auth_request *request);
 
 struct passwd_file *db_passwd_file_parse(const char *path, int userdb);
 void db_passwd_file_unref(struct passwd_file *pw);

diff --git a/src/auth/mech-anonymous.c b/src/auth/mech-anonymous.c
index 8c9d4f1f8daccf4508edf5d0affaf4c67fb5fcd9..13cf612228a0153a212ea1252f248edc4a9468a6 100644 (file)
--- a/src/auth/mech-anonymous.c
+++ b/src/auth/mech-anonymous.c
@@ -11,12 +11,15 @@ mech_anonymous_auth_continue(struct auth_request *auth_request,
        i_assert(anonymous_username != NULL);
 
        if (verbose) {
-               i_info("mech-anonymous: login by %s",
-                      t_strndup(data, data_size));
+               auth_request->user =
+                       p_strndup(pool_datastack_create(), data, data_size);
+               i_info("anonymous(%s): login",
+                      get_log_prefix(auth_request));
        }
 
        auth_request->callback = callback;
        auth_request->user = p_strdup(auth_request->pool, anonymous_username);
+
        mech_auth_finish(auth_request, NULL, 0, TRUE);
        return TRUE;
 }

diff --git a/src/auth/mech-cram-md5.c b/src/auth/mech-cram-md5.c
index a447347592fd2bb8cc0121b33dd1697d4edfa3f3..c22a201e3215b56474cdbe56ad728a05544e6d74 100644 (file)
--- a/src/auth/mech-cram-md5.c
+++ b/src/auth/mech-cram-md5.c
@@ -94,7 +94,7 @@ static int verify_credentials(struct cram_auth_request *auth,
        if (memcmp(response_hex, auth->response, 32) != 0) {
                if (verbose) {
                        i_info("cram-md5(%s): password mismatch",
-                              auth->username);
+                              get_log_prefix(&auth->auth_request));
                }
                return FALSE;
        }
@@ -135,13 +135,13 @@ static void credentials_callback(const char *result,
        if (verify_credentials(auth, result)) {
                if (verbose) {
                        i_info("cram-md5(%s): authenticated",
-                              auth->username == NULL ? "" : auth->username);
+                              get_log_prefix(&auth->auth_request));
                }
                mech_auth_finish(request, NULL, 0, TRUE);
        } else {
                if (verbose) {
                        i_info("cram-md5(%s): authentication failed",
-                              auth->username == NULL ? "" : auth->username);
+                              get_log_prefix(&auth->auth_request));
                }
                mech_auth_finish(request, NULL, 0, FALSE);
        }
@@ -177,7 +177,7 @@ mech_cram_md5_auth_continue(struct auth_request *auth_request,
 
        if (verbose) {
                i_info("cram-md5(%s): %s",
-                      auth->username == NULL ? "" : auth->username, error);
+                       get_log_prefix(&auth->auth_request), error);
        }
 
        /* failed */

diff --git a/src/auth/mech-digest-md5.c b/src/auth/mech-digest-md5.c
index 48307459b07f722787e47d4c53772a0eda01c7da..0acdbd51353f2bda1491110557aa39d4eb32952d 100644 (file)
--- a/src/auth/mech-digest-md5.c
+++ b/src/auth/mech-digest-md5.c
@@ -198,9 +198,11 @@ static int verify_credentials(struct digest_auth_request *auth,
                        /* verify response */
                        if (memcmp(response_hex, auth->response, 32) != 0) {
                                if (verbose) {
+                                       struct auth_request *auth_request =
+                                               &auth->auth_request;
                                        i_info("digest-md5(%s): "
                                               "password mismatch",
-                                              auth->username);
+                                              get_log_prefix(auth_request));
                                }
                                return FALSE;
                        }
@@ -571,7 +573,7 @@ mech_digest_md5_auth_continue(struct auth_request *auth_request,
                 error = "Authentication failed";
        else if (verbose) {
                i_info("digest-md5(%s): %s",
-                      auth->username == NULL ? "" : auth->username, error);
+                      get_log_prefix(auth_request), error);
        }
 
        /* failed */

diff --git a/src/auth/mech-plain.c b/src/auth/mech-plain.c
index 12fc0a010c5247abf39cc665fb3801c7ab61ad03..d530bee74e78e758afe62f083877f98374dc35dc 100644 (file)
--- a/src/auth/mech-plain.c
+++ b/src/auth/mech-plain.c
@@ -44,8 +44,10 @@ mech_plain_auth_continue(struct auth_request *auth_request,
 
        if (authenid == NULL) {
                /* invalid input */
-               if (verbose)
-                       i_info("mech-plain: no username given");
+               if (verbose) {
+                       i_info("plain(%s): no username given",
+                              get_log_prefix(auth_request));
+               }
                mech_auth_finish(auth_request, NULL, 0, FALSE);
        } else {
                /* split and save user/realm */
@@ -61,8 +63,8 @@ mech_plain_auth_continue(struct auth_request *auth_request,
                if (!mech_is_valid_username(auth_request->user)) {
                        /* invalid username */
                        if (verbose) {
-                               i_info("mech-plain(%s): invalid username",
-                                      auth_request->user);
+                               i_info("plain(%s): invalid username",
+                                      get_log_prefix(auth_request));
                        }
                        mech_auth_finish(auth_request, NULL, 0, FALSE);
                } else {

diff --git a/src/auth/mech.c b/src/auth/mech.c
index ca408b0cdb942801a832ee222bac687a966f5640..278442a09fc084ef2c18572149a0aced61eaff01 100644 (file)
--- a/src/auth/mech.c
+++ b/src/auth/mech.c
@@ -110,16 +110,6 @@ void mech_request_new(struct auth_client_connection *conn,
                return;
        }
 
-       if (ssl_require_client_cert &&
-           (request->flags & AUTH_CLIENT_FLAG_SSL_VALID_CLIENT_CERT) == 0) {
-               /* we fail without valid certificate */
-               if (verbose)
-                       i_info("Client didn't present valid SSL certificate");
-               failure_reply.id = request->id;
-               callback(&failure_reply, NULL, conn);
-               return;
-       }
-
 #ifdef USE_CYRUS_SASL2
        if (set_use_cyrus_sasl)
                auth_request = mech_cyrus_sasl_new(conn, request, callback);
@@ -127,31 +117,44 @@ void mech_request_new(struct auth_client_connection *conn,
 #endif
                auth_request = mech->auth_new();
 
-       if (auth_request != NULL) {
-               auth_request->created = ioloop_time;
-               auth_request->conn = conn;
-               auth_request->id = request->id;
-               auth_request->protocol =
-                       p_strdup(auth_request->pool,
-                                (const char *)data + request->protocol_idx);
-
-               if (request->ip_family != 0) {
-                       auth_request->local_ip.family = request->ip_family;
-                       auth_request->remote_ip.family = request->ip_family;
-                               
-
-                       memcpy(&auth_request->local_ip, data, ip_size);
-                       memcpy(&auth_request->remote_ip, data + ip_size,
-                              ip_size);
-               }
+       if (auth_request == NULL)
+               return;
 
-               hash_insert(conn->auth_requests, POINTER_CAST(request->id),
-                           auth_request);
+       auth_request->created = ioloop_time;
+       auth_request->conn = conn;
+       auth_request->id = request->id;
+       auth_request->protocol =
+               p_strdup(auth_request->pool,
+                        (const char *)data + request->protocol_idx);
 
-               if (!auth_request->auth_initial(auth_request, request, data,
-                                               callback))
-                       mech_request_free(auth_request, request->id);
+       if (request->ip_family != 0) {
+               auth_request->local_ip.family = request->ip_family;
+               auth_request->remote_ip.family = request->ip_family;
+
+               memcpy(&auth_request->local_ip.ip, data, ip_size);
+               memcpy(&auth_request->remote_ip.ip, data + ip_size, ip_size);
        }
+
+       if (ssl_require_client_cert &&
+           (request->flags & AUTH_CLIENT_FLAG_SSL_VALID_CLIENT_CERT) == 0) {
+               /* we fail without valid certificate */
+               if (verbose) {
+                       i_info("ssl-cert-check(%s): "
+                              "Client didn't present valid SSL certificate",
+                              get_log_prefix(auth_request));
+               }
+               auth_request_unref(auth_request);
+
+               failure_reply.id = request->id;
+               callback(&failure_reply, NULL, conn);
+               return;
+       }
+
+       hash_insert(conn->auth_requests, POINTER_CAST(request->id),
+                   auth_request);
+
+       if (!auth_request->auth_initial(auth_request, request, data, callback))
+               mech_request_free(auth_request, request->id);
 }
 
 void mech_request_continue(struct auth_client_connection *conn,
@@ -312,6 +315,46 @@ auth_request_get_var_expand_table(const struct auth_request *auth_request,
        return tab;
 }
 
+const char *get_log_prefix(const struct auth_request *auth_request)
+{
+#define MAX_LOG_USERNAME_LEN 64
+       const char *p, *ip;
+       string_t *str;
+
+       str = t_str_new(64);
+
+       if (auth_request->user == NULL)
+               str_append(str, "?");
+       else {
+               /* any control characters in username will be replaced by '?' */
+               for (p = auth_request->user; *p != '\0'; p++) {
+                       if ((unsigned char)*p < 32)
+                               break;
+               }
+
+               str_append_n(str, auth_request->user,
+                            (size_t)(p - auth_request->user));
+               for (; *p != '\0'; p++) {
+                       if ((unsigned char)*p < 32)
+                               str_append_c(str, '?');
+                       else
+                               str_append_c(str, *p);
+               }
+
+               if (str_len(str) > MAX_LOG_USERNAME_LEN) {
+                       str_truncate(str, MAX_LOG_USERNAME_LEN);
+                       str_append(str, "...");
+               }
+       }
+
+       ip = net_ip2addr(&auth_request->remote_ip);
+       if (ip != NULL) {
+               str_append_c(str, ',');
+               str_append(str, ip);
+       }
+       return str_c(str);
+}
+
 extern struct mech_module mech_plain;
 extern struct mech_module mech_cram_md5;
 extern struct mech_module mech_digest_md5;

diff --git a/src/auth/mech.h b/src/auth/mech.h
index 451ceb004c3b828f58aa69537c9d47d93f79f388..a64288deb3b961e3da205d20e6b61895c20639e3 100644 (file)
--- a/src/auth/mech.h
+++ b/src/auth/mech.h
@@ -97,6 +97,8 @@ const struct var_expand_table *
 auth_request_get_var_expand_table(const struct auth_request *auth_request,
                                  const char *(*escape_func)(const char *));
 
+const char *get_log_prefix(const struct auth_request *auth_request);
+
 void mech_init(void);
 void mech_deinit(void);
 

diff --git a/src/auth/passdb-bsdauth.c b/src/auth/passdb-bsdauth.c
index 037c968eeb2bf56974752bf6ef64772ed398f81c..796d9404dfec941e8224e8be364903b74573bb02 100644 (file)
--- a/src/auth/passdb-bsdauth.c
+++ b/src/auth/passdb-bsdauth.c
@@ -23,8 +23,10 @@ bsdauth_verify_plain(struct auth_request *request, const char *password,
 
        pw = getpwnam(request->user);
        if (pw == NULL) {
-               if (verbose)
-                       i_info("passwd(%s): unknown user", request->user);
+               if (verbose) {
+                       i_info("passwd(%s): unknown user",
+                              get_log_prefix(request));
+               }
                callback(PASSDB_RESULT_USER_UNKNOWN, request);
                return;
        }
@@ -32,7 +34,7 @@ bsdauth_verify_plain(struct auth_request *request, const char *password,
        if (!IS_VALID_PASSWD(pw->pw_passwd)) {
                if (verbose) {
                        i_info("passwd(%s): invalid password field '%s'",
-                              request->user, pw->pw_passwd);
+                              get_log_prefix(request), pw->pw_passwd);
                }
                callback(PASSDB_RESULT_USER_DISABLED, request);
                return;
@@ -45,8 +47,10 @@ bsdauth_verify_plain(struct auth_request *request, const char *password,
        safe_memset(pw->pw_passwd, 0, strlen(pw->pw_passwd));
 
        if (!result) {
-               if (verbose)
-                       i_info("passwd(%s): password mismatch", request->user);
+               if (verbose) {
+                       i_info("passwd(%s): password mismatch",
+                              get_log_prefix(request));
+               }
                callback(PASSDB_RESULT_PASSWORD_MISMATCH, request);
                return;
        }

diff --git a/src/auth/passdb-ldap.c b/src/auth/passdb-ldap.c
index 5ad50281a38d7661557f4c2f9e5a9b2e30290d72..5eb7a8922c3e8c73cc1caede393e94c37bfa9c50 100644 (file)
--- a/src/auth/passdb-ldap.c
+++ b/src/auth/passdb-ldap.c
@@ -65,15 +65,18 @@ static void handle_request(struct ldap_connection *conn,
                ret = ldap_result2error(conn->ld, res, 0);
                if (ret != LDAP_SUCCESS) {
                        i_error("ldap(%s): ldap_search() failed: %s",
-                               user, ldap_err2string(ret));
+                               get_log_prefix(auth_request),
+                               ldap_err2string(ret));
                        res = NULL;
                }
        }
 
        entry = res == NULL ? NULL : ldap_first_entry(conn->ld, res);
        if (entry == NULL) {
-               if (res != NULL)
-                       i_error("ldap(%s): unknown user", user);
+               if (res != NULL && verbose) {
+                       i_info("ldap(%s): unknown user",
+                              get_log_prefix(auth_request));
+               }
        } else {
                attr = ldap_first_attribute(conn->ld, entry, &ber);
                while (attr != NULL) {
@@ -90,10 +93,12 @@ static void handle_request(struct ldap_connection *conn,
                        attr = ldap_next_attribute(conn->ld, entry, ber);
                }
 
-               if (password == NULL)
-                       i_error("ldap(%s): No password in reply", user);
-               else if (ldap_next_entry(conn->ld, entry) != NULL) {
-                       i_error("ldap(%s): Multiple password replies", user);
+               if (password == NULL) {
+                       i_error("ldap(%s): No password in reply",
+                               get_log_prefix(auth_request));
+               } else if (ldap_next_entry(conn->ld, entry) != NULL) {
+                       i_error("ldap(%s): Multiple password replies",
+                               get_log_prefix(auth_request));
                        password = NULL;
                }
        }
@@ -125,11 +130,14 @@ static void handle_request(struct ldap_connection *conn,
        }
 
        ret = password_verify(ldap_request->password, password, scheme, user);
-       if (ret < 0)
-               i_error("ldap(%s): Unknown password scheme %s", user, scheme);
-       else if (ret == 0) {
-               if (verbose)
-                       i_info("ldap(%s): password mismatch", user);
+       if (ret < 0) {
+               i_error("ldap(%s): Unknown password scheme %s",
+                       get_log_prefix(auth_request), scheme);
+       } else if (ret == 0) {
+               if (verbose) {
+                       i_info("ldap(%s): password mismatch",
+                              get_log_prefix(auth_request));
+               }
        }
 
        ldap_request->callback.verify_plain(ret > 0 ? PASSDB_RESULT_OK :

diff --git a/src/auth/passdb-mysql.c b/src/auth/passdb-mysql.c
index 9e38523e484f3ca5e6d8137eaf008469571a46ad..ea0d0ea9d93b42511269f783ec3d8279ae0ed6a4 100644 (file)
--- a/src/auth/passdb-mysql.c
+++ b/src/auth/passdb-mysql.c
@@ -48,13 +48,17 @@ static void mysql_handle_request(struct mysql_connection *conn,
 
        if (res != NULL) {
                if (mysql_num_rows(res) == 0) {
-                       if (verbose)
-                               i_info("mysql(%s): Unknown user", user);
+                       if (verbose) {
+                               i_info("mysql(%s): Unknown user",
+                                      get_log_prefix(auth_request));
+                       }
                } else if (mysql_num_rows(res) > 1) {
-                       i_error("mysql(%s): Multiple matches for user", user);
+                       i_error("mysql(%s): Multiple matches for user",
+                               get_log_prefix(auth_request));
                } else if (mysql_num_fields(res) != 1) {
                        i_error("mysql(%s): Password query returned "
-                               "more than one field", user);
+                               "more than one field",
+                               get_log_prefix(auth_request));
                } else {
                        MYSQL_ROW row;
 
@@ -87,11 +91,14 @@ static void mysql_handle_request(struct mysql_connection *conn,
 
        ret = password_verify(mysql_request->password, password,
                              scheme, user);
-       if (ret < 0)
-               i_error("mysql(%s): Unknown password scheme %s", user, scheme);
-       else if (ret == 0) {
-               if (verbose)
-                       i_info("mysql(%s): Password mismatch", user);
+       if (ret < 0) {
+               i_error("mysql(%s): Unknown password scheme %s",
+                       get_log_prefix(auth_request), scheme);
+       } else if (ret == 0) {
+               if (verbose) {
+                       i_info("mysql(%s): Password mismatch",
+                              get_log_prefix(auth_request));
+               }
        }
 
        mysql_request->callback.verify_plain(ret > 0 ? PASSDB_RESULT_OK :

diff --git a/src/auth/passdb-pam.c b/src/auth/passdb-pam.c
index ee281ddc0909923a0645408af6fa5b892a4afd20..6fa465cc0cb9f84ef1a7d266e9d15823fb1194dc 100644 (file)
--- a/src/auth/passdb-pam.c
+++ b/src/auth/passdb-pam.c
@@ -166,7 +166,7 @@ static int pam_userpass_conv(int num_msg, linux_const struct pam_message **msg,
        return PAM_SUCCESS;
 }
 
-static int pam_auth(pam_handle_t *pamh, const char *user, const char **error)
+static int pam_auth(pam_handle_t *pamh, const char **error)
 {
        void *item;
        int status;
@@ -174,29 +174,29 @@ static int pam_auth(pam_handle_t *pamh, const char *user, const char **error)
        *error = NULL;
 
        if ((status = pam_authenticate(pamh, 0)) != PAM_SUCCESS) {
-               *error = t_strdup_printf("pam_authenticate(%s) failed: %s",
-                                        user, pam_strerror(pamh, status));
+               *error = t_strdup_printf("pam_authenticate() failed: %s",
+                                        pam_strerror(pamh, status));
                return status;
        }
 
 #ifdef HAVE_PAM_SETCRED
        if ((status = pam_setcred(pamh, PAM_ESTABLISH_CRED)) != PAM_SUCCESS) {
-               *error = t_strdup_printf("pam_setcred(%s) failed: %s",
-                                        user, pam_strerror(pamh, status));
+               *error = t_strdup_printf("pam_setcred() failed: %s",
+                                        pam_strerror(pamh, status));
                return status;
        }
 #endif
 
        if ((status = pam_acct_mgmt(pamh, 0)) != PAM_SUCCESS) {
-               *error = t_strdup_printf("pam_acct_mgmt(%s) failed: %s",
-                                        user, pam_strerror(pamh, status));
+               *error = t_strdup_printf("pam_acct_mgmt() failed: %s",
+                                        pam_strerror(pamh, status));
                return status;
        }
 
        status = pam_get_item(pamh, PAM_USER, (linux_const void **)&item);
        if (status != PAM_SUCCESS) {
-               *error = t_strdup_printf("pam_get_item(%s) failed: %s",
-                                        user, pam_strerror(pamh, status));
+               *error = t_strdup_printf("pam_get_item() failed: %s",
+                                        pam_strerror(pamh, status));
                return status;
        }
 
@@ -225,10 +225,10 @@ pam_verify_plain_child(const char *service, const char *user,
        status = pam_start(service, user, &conv, &pamh);
        if (status != PAM_SUCCESS) {
                result = PASSDB_RESULT_INTERNAL_FAILURE;
-               str = t_strdup_printf("pam_start(%s) failed: %s",
-                                     user, pam_strerror(pamh, status));
+               str = t_strdup_printf("pam_start() failed: %s",
+                                     pam_strerror(pamh, status));
        } else {
-               status = pam_auth(pamh, user, &str);
+               status = pam_auth(pamh, &str);
                if ((status2 = pam_end(pamh, status)) == PAM_SUCCESS) {
                        /* FIXME: check for PASSDB_RESULT_UNKNOWN_USER
                           somehow? */
@@ -238,7 +238,7 @@ pam_verify_plain_child(const char *service, const char *user,
                                PASSDB_RESULT_PASSWORD_MISMATCH;
                } else {
                        result = PASSDB_RESULT_INTERNAL_FAILURE;
-                       str = t_strdup_printf("pam_end(%s) failed: %s", user,
+                       str = t_strdup_printf("pam_end() failed: %s",
                                              pam_strerror(pamh, status2));
                }
        }
@@ -258,6 +258,7 @@ pam_verify_plain_child(const char *service, const char *user,
 static void pam_child_input(void *context)
 {
        struct pam_auth_request *request = context;
+       struct auth_request *auth_request = request->request;
        enum passdb_result result;
        char buf[513];
        ssize_t ret;
@@ -266,14 +267,17 @@ static void pam_child_input(void *context)
           We rely on that. */
        ret = read(request->fd, buf, sizeof(buf)-1);
        if (ret < 0) {
-               i_error("PAM: read() from child process failed: %m");
+               i_error("pam(%s): read() from child process failed: %m",
+                       get_log_prefix(auth_request));
                result = PASSDB_RESULT_INTERNAL_FAILURE;
        } else if (ret == 0) {
                /* it died */
-               i_error("PAM: Child process died");
+               i_error("pam(%s): Child process died",
+                       get_log_prefix(auth_request));
                result = PASSDB_RESULT_INTERNAL_FAILURE;
        } else if ((size_t)ret < sizeof(result)) {
-               i_error("PAM: Child process returned only %d bytes", ret);
+               i_error("pam(%s): Child process returned only %d bytes",
+                       get_log_prefix(auth_request), ret);
                result = PASSDB_RESULT_INTERNAL_FAILURE;
        } else {
                memcpy(&result, buf, sizeof(result));
@@ -282,18 +286,26 @@ static void pam_child_input(void *context)
                        /* error message included */
                        buf[ret] = '\0';
 
-                       if (result == PASSDB_RESULT_INTERNAL_FAILURE)
-                               i_error("PAM: %s", buf + sizeof(result));
-                       else
-                               i_info("PAM: %s", buf + sizeof(result));
+                       if (result == PASSDB_RESULT_INTERNAL_FAILURE) {
+                               i_error("pam(%s): %s",
+                                       get_log_prefix(auth_request),
+                                       buf + sizeof(result));
+                       } else {
+                               i_info("pam(%s): %s",
+                                      get_log_prefix(auth_request),
+                                      buf + sizeof(result));
+                       }
                }
        }
 
-       if (auth_request_unref(request->request))
-               request->callback(result, request->request);
+       if (close(request->fd) < 0) {
+               i_error("pam(%s): close(child input) failed: %m",
+                       get_log_prefix(auth_request));
+       }
+
+       if (auth_request_unref(auth_request))
+               request->callback(result, auth_request);
 
-       if (close(request->fd) < 0)
-               i_error("PAM: close(child input) failed: %m");
        io_remove(request->io);
        i_free(request);
 }
@@ -332,14 +344,14 @@ pam_verify_plain(struct auth_request *request, const char *password,
 
        service = service_name != NULL ? service_name : request->protocol;
        if (pipe(fd) < 0) {
-               i_error("PAM: pipe() failed: %m");
+               i_error("pam(%s): pipe() failed: %m", get_log_prefix(request));
                callback(PASSDB_RESULT_INTERNAL_FAILURE, request);
                return;
        }
 
        pid = fork();
        if (pid == -1) {
-               i_error("PAM: fork() failed: %m");
+               i_error("pam(%s): fork() failed: %m", get_log_prefix(request));
                callback(PASSDB_RESULT_INTERNAL_FAILURE, request);
                (void)close(fd[0]);
                (void)close(fd[1]);
@@ -352,8 +364,10 @@ pam_verify_plain(struct auth_request *request, const char *password,
                _exit(0);
        }
 
-       if (close(fd[1]) < 0)
-               i_error("PAM: close(fd[1]) failed: %m");
+       if (close(fd[1]) < 0) {
+               i_error("pam(%s): close(fd[1]) failed: %m",
+                       get_log_prefix(request));
+       }
 
        auth_request_ref(request);
        pam_auth_request = i_new(struct pam_auth_request, 1);

diff --git a/src/auth/passdb-passwd-file.c b/src/auth/passdb-passwd-file.c
index 84b7496a6debc074ddda615908521241aff11e7e..04115d1bf19be79a46ae15987bb5444cb8e2f096 100644 (file)
--- a/src/auth/passdb-passwd-file.c
+++ b/src/auth/passdb-passwd-file.c
@@ -20,7 +20,7 @@ passwd_file_verify_plain(struct auth_request *request, const char *password,
        const char *scheme, *crypted_pass;
        int ret;
 
-       pu = db_passwd_file_lookup(passdb_pwf, request->user);
+       pu = db_passwd_file_lookup(passdb_pwf, request);
        if (pu == NULL) {
                callback(PASSDB_RESULT_USER_UNKNOWN, request);
                return;
@@ -37,10 +37,10 @@ passwd_file_verify_plain(struct auth_request *request, const char *password,
        else {
                if (ret < 0) {
                        i_error("passwd-file(%s): Unknown password scheme %s",
-                               pu->user_realm, scheme);
+                               get_log_prefix(request), scheme);
                } else if (verbose) {
                        i_info("passwd-file(%s): %s password mismatch",
-                              pu->user_realm, scheme);
+                              get_log_prefix(request), scheme);
                }
                callback(PASSDB_RESULT_PASSWORD_MISMATCH, request);
        }
@@ -54,7 +54,7 @@ passwd_file_lookup_credentials(struct auth_request *request,
        struct passwd_user *pu;
        const char *crypted_pass, *scheme;
 
-       pu = db_passwd_file_lookup(passdb_pwf, request->user);
+       pu = db_passwd_file_lookup(passdb_pwf, request);
        if (pu == NULL) {
                callback(NULL, request);
                return;

diff --git a/src/auth/passdb-passwd.c b/src/auth/passdb-passwd.c
index 3d2b7bfd5d5ad7501017c1307dbf2e65d076d4d7..c577ba47fdc09650ad6a2b80b4033abafd0185fe 100644 (file)
--- a/src/auth/passdb-passwd.c
+++ b/src/auth/passdb-passwd.c
@@ -21,8 +21,10 @@ passwd_verify_plain(struct auth_request *request, const char *password,
 
        pw = getpwnam(request->user);
        if (pw == NULL) {
-               if (verbose)
-                       i_info("passwd(%s): unknown user", request->user);
+               if (verbose) {
+                       i_info("passwd(%s): unknown user",
+                              get_log_prefix(request));
+               }
                callback(PASSDB_RESULT_USER_UNKNOWN, request);
                return;
        }
@@ -30,7 +32,7 @@ passwd_verify_plain(struct auth_request *request, const char *password,
        if (!IS_VALID_PASSWD(pw->pw_passwd)) {
                if (verbose) {
                        i_info("passwd(%s): invalid password field '%s'",
-                              request->user, pw->pw_passwd);
+                              get_log_prefix(request), pw->pw_passwd);
                }
                callback(PASSDB_RESULT_USER_DISABLED, request);
                return;
@@ -43,8 +45,10 @@ passwd_verify_plain(struct auth_request *request, const char *password,
        safe_memset(pw->pw_passwd, 0, strlen(pw->pw_passwd));
 
        if (!result) {
-               if (verbose)
-                       i_info("passwd(%s): password mismatch", request->user);
+               if (verbose) {
+                       i_info("passwd(%s): password mismatch",
+                              get_log_prefix(request));
+               }
                callback(PASSDB_RESULT_PASSWORD_MISMATCH, request);
                return;
        }

diff --git a/src/auth/passdb-pgsql.c b/src/auth/passdb-pgsql.c
index c0459a306cc62c05bfd6a28be667158a7433b6f5..0bce98e3914757f15478bb5c49c6447d589bfa3f 100644 (file)
--- a/src/auth/passdb-pgsql.c
+++ b/src/auth/passdb-pgsql.c
@@ -49,13 +49,17 @@ static void pgsql_handle_request(struct pgsql_connection *conn,
 
        if (res != NULL) {
                if (PQntuples(res) == 0) {
-                       if (verbose)
-                               i_info("pgsql(%s): Unknown user", user);
+                       if (verbose) {
+                               i_info("pgsql(%s): Unknown user",
+                                      get_log_prefix(auth_request));
+                       }
                } else if (PQntuples(res) > 1) {
-                       i_error("pgsql(%s): Multiple matches for user", user);
+                       i_error("pgsql(%s): Multiple matches for user",
+                               get_log_prefix(auth_request));
                } else if (PQnfields(res) != 1) {
                        i_error("pgsql(%s): Password query returned "
-                               "more than one field", user);
+                               "more than one field",
+                               get_log_prefix(auth_request));
                } else {
                        password = t_strdup(PQgetvalue(res, 0, 0));
                }
@@ -84,11 +88,14 @@ static void pgsql_handle_request(struct pgsql_connection *conn,
 
        ret = password_verify(pgsql_request->password, password,
                              scheme, user);
-       if (ret < 0)
-               i_error("pgsql(%s): Unknown password scheme %s", user, scheme);
-       else if (ret == 0) {
-               if (verbose)
-                       i_info("pgsql(%s): Password mismatch", user);
+       if (ret < 0) {
+               i_error("pgsql(%s): Unknown password scheme %s",
+                       get_log_prefix(auth_request), scheme);
+       } else if (ret == 0) {
+               if (verbose) {
+                       i_info("pgsql(%s): Password mismatch",
+                              get_log_prefix(auth_request));
+               }
        }
 
        pgsql_request->callback.verify_plain(ret > 0 ? PASSDB_RESULT_OK :

diff --git a/src/auth/passdb-shadow.c b/src/auth/passdb-shadow.c
index ee473f361a46c95d69a0a4b900e1555db4924ed4..4593738b722174cfd167b7bf5d0be423ab91a729 100644 (file)
--- a/src/auth/passdb-shadow.c
+++ b/src/auth/passdb-shadow.c
@@ -21,8 +21,10 @@ shadow_verify_plain(struct auth_request *request, const char *password,
 
        spw = getspnam(request->user);
        if (spw == NULL) {
-               if (verbose)
-                       i_info("shadow(%s): unknown user", request->user);
+               if (verbose) {
+                       i_info("shadow(%s): unknown user",
+                              get_log_prefix(request));
+               }
                callback(PASSDB_RESULT_USER_UNKNOWN, request);
                return;
        }
@@ -30,7 +32,7 @@ shadow_verify_plain(struct auth_request *request, const char *password,
        if (!IS_VALID_PASSWD(spw->sp_pwdp)) {
                if (verbose) {
                        i_info("shadow(%s): invalid password field '%s'",
-                              request->user, spw->sp_pwdp);
+                              get_log_prefix(request), spw->sp_pwdp);
                }
                callback(PASSDB_RESULT_USER_DISABLED, request);
                return;
@@ -43,8 +45,10 @@ shadow_verify_plain(struct auth_request *request, const char *password,
        safe_memset(spw->sp_pwdp, 0, strlen(spw->sp_pwdp));
 
        if (!result) {
-               if (verbose)
-                       i_info("shadow(%s): password mismatch", request->user);
+               if (verbose) {
+                       i_info("shadow(%s): password mismatch",
+                              get_log_prefix(request));
+               }
                callback(PASSDB_RESULT_PASSWORD_MISMATCH, request);
                return;
        }

diff --git a/src/auth/passdb-vpopmail.c b/src/auth/passdb-vpopmail.c
index f69a6cba52e35bd91f1316a8598552846827b63c..1cf77eb5588fe19055b8a32b4687c138953ec0a5 100644 (file)
--- a/src/auth/passdb-vpopmail.c
+++ b/src/auth/passdb-vpopmail.c
@@ -34,8 +34,8 @@ vpopmail_verify_plain(struct auth_request *request, const char *password,
            ((vpw->pw_gid & NO_POP) != 0 &&
             strcmp(request->protocol, "POP3") == 0)) {
                if (verbose) {
-                       i_info("vpopmail(%s@%s): %s disabled",
-                              vpop_user, vpop_domain, request->protocol);
+                       i_info("vpopmail(%s): %s disabled",
+                              get_log_prefix(request), request->protocol);
                }
                callback(PASSDB_RESULT_USER_DISABLED, request);
                return;
@@ -47,8 +47,8 @@ vpopmail_verify_plain(struct auth_request *request, const char *password,
 
        if (!result) {
                if (verbose) {
-                       i_info("vpopmail(%s@%s): password mismatch",
-                              vpop_user, vpop_domain);
+                       i_info("vpopmail(%s): password mismatch",
+                              get_log_prefix(request));
                }
 
                callback(PASSDB_RESULT_PASSWORD_MISMATCH, request);

diff --git a/src/auth/userdb-passwd-file.c b/src/auth/userdb-passwd-file.c
index f3359c424d07f36e293db58ce8468d74469ee6a5..3d67894b71422bfdbe8c93a0ac35109c15795f2e 100644 (file)
--- a/src/auth/userdb-passwd-file.c
+++ b/src/auth/userdb-passwd-file.c
@@ -17,7 +17,7 @@ static void passwd_file_lookup(struct auth_request *auth_request,
        struct user_data data;
        struct passwd_user *pu;
 
-       pu = db_passwd_file_lookup(userdb_pwf, auth_request->user);
+       pu = db_passwd_file_lookup(userdb_pwf, auth_request);
        if (pu == NULL) {
                callback(NULL, context);
                return;

diff --git a/src/auth/userdb-passwd.c b/src/auth/userdb-passwd.c
index 7d9c9c3341f6a5f8b245720f574c9a4470590c41..2bfa6a3daef6f0c83ddf7983b7bd55bc2705e9cb 100644 (file)
--- a/src/auth/userdb-passwd.c
+++ b/src/auth/userdb-passwd.c
@@ -18,8 +18,10 @@ static void passwd_lookup(struct auth_request *auth_request,
 
        pw = getpwnam(auth_request->user);
        if (pw == NULL) {
-               if (verbose)
-                       i_info("passwd(%s): unknown user", auth_request->user);
+               if (verbose) {
+                       i_info("passwd(%s): unknown user",
+                              get_log_prefix(auth_request));
+               }
                callback(NULL, context);
                return;
        }