From: Timo Sirainen <tss@iki.fi>
Date: Fri, 20 May 2011 11:21:51 +0000 (+0300)
Subject: doveadm: Added doveadm_allowed_commands setting, which is used by doveadm server.
X-Git-Tag: 2.0.14~76
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f07f57d644f640f7b3bda33594e65ea33ac33ac6;p=thirdparty%2Fdovecot%2Fcore.git

doveadm: Added doveadm_allowed_commands setting, which is used by doveadm server.
---

diff --git a/src/doveadm/client-connection.c b/src/doveadm/client-connection.c
index ae7574913b..a169255e6e 100644
--- a/src/doveadm/client-connection.c
+++ b/src/doveadm/client-connection.c
@@ -111,6 +111,27 @@ doveadm_mail_cmd_server(const char *cmd_name,
 	return ret;
 }
 
+static bool client_is_allowed_command(const struct doveadm_settings *set,
+				      const char *cmd_name)
+{
+	bool ret = FALSE;
+
+	if (*set->doveadm_allowed_commands == '\0')
+		return TRUE;
+
+	T_BEGIN {
+		const char *const *cmds =
+			t_strsplit(set->doveadm_allowed_commands, ",");
+		for (; *cmds != NULL; cmds++) {
+			if (strcmp(*cmds, cmd_name) == 0) {
+				ret = TRUE;
+				break;
+			}
+		}
+	} T_END;
+	return ret;
+}
+
 static bool client_handle_command(struct client_connection *conn, char **args)
 {
 	struct mail_storage_service_input input;
@@ -152,6 +173,12 @@ static bool client_handle_command(struct client_connection *conn, char **args)
 		}
 	}
 
+	if (!client_is_allowed_command(conn->set, cmd_name)) {
+		i_error("doveadm client isn't allowed to use command: %s",
+			cmd_name);
+		return FALSE;
+	}
+
 	o_stream_cork(conn->output);
 	ret = doveadm_mail_cmd_server(cmd_name, conn->set, &input, argc, args);
 	if (ret)
diff --git a/src/doveadm/doveadm-settings.c b/src/doveadm/doveadm-settings.c
index ce844c12ef..ed3f48040c 100644
--- a/src/doveadm/doveadm-settings.c
+++ b/src/doveadm/doveadm-settings.c
@@ -59,6 +59,7 @@ static const struct setting_define doveadm_setting_defines[] = {
 	DEF(SET_UINT, doveadm_worker_count),
 	DEF(SET_UINT, doveadm_proxy_port),
 	DEF(SET_STR, doveadm_password),
+	DEF(SET_STR, doveadm_allowed_commands),
 
 	{ SET_STRLIST, "plugin", offsetof(struct doveadm_settings, plugin_envs), NULL },
 
@@ -73,6 +74,7 @@ const struct doveadm_settings doveadm_default_settings = {
 	.doveadm_worker_count = 0,
 	.doveadm_proxy_port = 0,
 	.doveadm_password = "",
+	.doveadm_allowed_commands = "",
 
 	.plugin_envs = ARRAY_INIT
 };
diff --git a/src/doveadm/doveadm-settings.h b/src/doveadm/doveadm-settings.h
index 567d47834c..bc9ef9033d 100644
--- a/src/doveadm/doveadm-settings.h
+++ b/src/doveadm/doveadm-settings.h
@@ -9,6 +9,7 @@ struct doveadm_settings {
 	unsigned int doveadm_worker_count;
 	unsigned int doveadm_proxy_port;
 	const char *doveadm_password;
+	const char *doveadm_allowed_commands;
 
 	ARRAY_DEFINE(plugin_envs, const char *);
 };