login-common: Indicate TLS encryption if haproxy says it was

diff --git a/src/login-common/client-common.c b/src/login-common/client-common.c
index 8af187763cf10d64fd3f688c6da6053c0dc75765..1a6dbad708f2f8db7a7b822d074abc2be103885d 100644 (file)
--- a/src/login-common/client-common.c
+++ b/src/login-common/client-common.c
@@ -193,6 +193,7 @@ client_alloc(int fd, pool_t pool,
        client->trusted = client_is_trusted(client);
 
        if (conn->proxied) {
+               client->proxied_ssl = conn->proxy.ssl;
                client->secured = conn->proxy.ssl || client->trusted;
                client->ssl_secured = conn->proxy.ssl;
                client->local_name = conn->proxy.hostname;
@@ -762,6 +763,9 @@ get_var_expand_table(struct client *client)
        if (!client->tls) {
                tab[11].value = client->secured ? "secured" : NULL;
                tab[12].value = "";
+       } else if (client->proxied_ssl) {
+               tab[11].value = "TLS";
+               tab[12].value = "(proxied)";
        } else {
                const char *ssl_state =
                        ssl_iostream_is_handshaked(client->ssl_iostream) ?

diff --git a/src/login-common/client-common.h b/src/login-common/client-common.h
index 62ff639e7b70e640b5fbab77a0cdea04ab5223fe..b18a30a5e4fc1c2a320a34fec0071eaf63f6eef4 100644 (file)
--- a/src/login-common/client-common.h
+++ b/src/login-common/client-common.h
@@ -210,6 +210,7 @@ struct client {
        bool no_extra_disconnect_reason:1;
        bool starttls:1;
        bool tls:1;
+       bool proxied_ssl:1;
        bool secured:1;
        bool ssl_secured:1;
        bool trusted:1;

diff --git a/src/login-common/sasl-server.c b/src/login-common/sasl-server.c
index 9d8b418578b4ce9eb1ffb24f3746f55c00b98394..34d9091bfebaa1d5d52e10149ef1c63df76f8c2d 100644 (file)
--- a/src/login-common/sasl-server.c
+++ b/src/login-common/sasl-server.c
@@ -68,6 +68,8 @@ client_get_auth_flags(struct client *client)
        if (client->ssl_iostream != NULL &&
            ssl_iostream_has_valid_client_cert(client->ssl_iostream))
                auth_flags |= AUTH_REQUEST_FLAG_VALID_CLIENT_CERT;
+       if (client->tls)
+               auth_flags |= AUTH_REQUEST_FLAG_TRANSPORT_SECURITY_TLS;
        if (client->secured)
                auth_flags |= AUTH_REQUEST_FLAG_SECURED;
        if (login_binary->sasl_support_final_reply)