login-common: Handle haproxy's TLS terminated connections same as if Dovecot did...

If haproxy is running on localhost, this is clearly the case. If haproxy
is not running on localhost, it's a bit more ambiguous. It is possible to
configure haproxy to do TLS termination and then use another TLS connection
towards Dovecot, but this is likely a not so common configuration. More
likely the intention is that if haproxy has done TLS termination, it should
be handle the same as if Dovecot had done it.

This commit doesn't actually change any behavior. It just makes the tls
variables work in a more consistent way.

diff --git a/src/login-common/client-common.c b/src/login-common/client-common.c
index a4c632f8c8270855b192b5a6adfda5a300bb7777..a586be1a0653bf7be1ffd62a3c17611da1a1cad1 100644 (file)
--- a/src/login-common/client-common.c
+++ b/src/login-common/client-common.c
@@ -220,6 +220,13 @@ client_alloc(int fd, pool_t pool,
                /* haproxy connections are always coming from
                   haproxy_trusted_networks, so we consider them secured. */
                client->connection_secured = TRUE;
+               /* Assume that the connection is also TLS secured if client
+                  terminated TLS connections on haproxy. If haproxy isn't
+                  running on localhost, the haproxy-Dovecot connection isn't
+                  TLS secured. However, that's most likely an intentional
+                  configuration and we should just consider the connection
+                  TLS secured anyway. */
+               client->connection_tls_secured = conn->haproxy.ssl;
                client->haproxy_terminated_tls = conn->haproxy.ssl;
                client->end_client_tls_secured = conn->haproxy.ssl;
                client->local_name = conn->haproxy.hostname;
@@ -638,7 +645,7 @@ static int client_output_starttls(struct client *client)
 
 void client_cmd_starttls(struct client *client)
 {
-       if (client->connection_tls_secured || client->haproxy_terminated_tls) {
+       if (client->connection_tls_secured) {
                client->v.notify_starttls(client, FALSE, "TLS is already active.");
                return;
        }
@@ -683,7 +690,7 @@ int client_get_plaintext_fd(struct client *client, int *fd_r, bool *close_fd_r)
 {
        int fds[2];
 
-       if (!client->connection_tls_secured) {
+       if (client->ssl_iostream == NULL) {
                /* Plaintext connection - We can send the fd directly to
                   the post-login process without any proxying. */
                *fd_r = client->fd;

diff --git a/src/login-common/client-common.h b/src/login-common/client-common.h
index 8c0bfa46b9ddac4ce7707d8625c7afe0e01ab7ba..d0c2b8391714f6744dec138f12ed73a91fdc81ae 100644 (file)
--- a/src/login-common/client-common.h
+++ b/src/login-common/client-common.h
@@ -228,8 +228,8 @@ struct client {
        bool input_blocked:1;
        bool login_success:1;
        bool no_extra_disconnect_reason:1;
-       /* Client/proxy connection is using TLS. Dovecot has terminated the
-          TLS connection (not haproxy). */
+       /* Client/proxy connection is using TLS. Either Dovecot or HAProxy
+          has terminated the TLS connection. */
        bool connection_tls_secured:1;
        /* connection_tls_secured=TRUE was started via STARTTLS command. */
        bool connection_used_starttls:1;

diff --git a/src/login-common/sasl-server.c b/src/login-common/sasl-server.c
index 978edd9d0b0c437dbc6d6d33ff7b561f881e73d7..fa5748b13a1ec9d027963803293fe6f8bac9ac0a 100644 (file)
--- a/src/login-common/sasl-server.c
+++ b/src/login-common/sasl-server.c
@@ -106,7 +106,7 @@ client_get_auth_flags(struct client *client)
        if (client->ssl_iostream != NULL &&
            ssl_iostream_has_valid_client_cert(client->ssl_iostream))
                auth_flags |= AUTH_REQUEST_FLAG_VALID_CLIENT_CERT;
-       if (client->connection_tls_secured || client->haproxy_terminated_tls)
+       if (client->connection_tls_secured)
                auth_flags |= AUTH_REQUEST_FLAG_CONN_SECURED_TLS;
        if (client->connection_secured)
                auth_flags |= AUTH_REQUEST_FLAG_CONN_SECURED;