imap/pop3 proxy: Support master user logins.

--HG--
branch : HEAD

diff --git a/src/auth/auth-request-handler.c b/src/auth/auth-request-handler.c
index ca481f54e47c0f92d50b7b7bb866dae41d301e2e..47919fe884bd24e03fe7f7f491050925b13a1930 100644 (file)
--- a/src/auth/auth-request-handler.c
+++ b/src/auth/auth-request-handler.c
@@ -145,10 +145,19 @@ static void get_client_extra_fields(struct auth_request *request,
                }
        }
 
-       if (request->proxy && !seen_pass && request->mech_password != NULL) {
-               /* we're proxying - send back the password that was
-                  sent by user (not the password in passdb). */
-               auth_stream_reply_add(reply, "pass", request->mech_password);
+       if (request->proxy) {
+               /* we're proxying */
+               if (!seen_pass && request->mech_password != NULL) {
+                       /* send back the password that was sent by user
+                          (not the password in passdb). */
+                       auth_stream_reply_add(reply, "pass",
+                                             request->mech_password);
+               }
+               if (request->master_user != NULL) {
+                       /* the master username needs to be forwarded */
+                       auth_stream_reply_add(reply, "master",
+                                             request->master_user);
+               }
        }
 }
 

diff --git a/src/imap-login/client-authenticate.c b/src/imap-login/client-authenticate.c
index 31c58a2899e56aa8a3fbc41727771107a8834c0a..8006b0e465aadb44fe7737f529b2907c378bb76d 100644 (file)
--- a/src/imap-login/client-authenticate.c
+++ b/src/imap-login/client-authenticate.c
@@ -98,6 +98,7 @@ static bool client_handle_args(struct imap_client *client,
                               const char *const *args, bool success)
 {
        const char *reason = NULL, *host = NULL, *destuser = NULL, *pass = NULL;
+       const char *master_user = NULL;
        string_t *reply;
        unsigned int port = 143;
        bool proxy = FALSE, temp = FALSE, nologin = !success, proxy_self;
@@ -122,6 +123,8 @@ static bool client_handle_args(struct imap_client *client,
                        destuser = *args + 9;
                else if (strncmp(*args, "pass=", 5) == 0)
                        pass = *args + 5;
+               else if (strncmp(*args, "master=", 7) == 0)
+                       master_user = *args + 7;
                else if (strncmp(*args, "user=", 5) == 0) {
                        /* already handled in login-common */
                } else if (auth_debug) {
@@ -143,7 +146,8 @@ static bool client_handle_args(struct imap_client *client,
                   proxy host=.. [port=..] [destuser=..] pass=.. */
                if (!success)
                        return FALSE;
-               if (imap_proxy_new(client, host, port, destuser, pass) < 0)
+               if (imap_proxy_new(client, host, port, destuser, master_user,
+                                  pass) < 0)
                        client_destroy_internal_failure(client);
                return TRUE;
        }

diff --git a/src/imap-login/client.c b/src/imap-login/client.c
index d379722de66865519e2dfd118f77ea2b9ba5f489..0a554382cf8aaf7eeac432f55aaa206c513b4f87 100644 (file)
--- a/src/imap-login/client.c
+++ b/src/imap-login/client.c
@@ -585,8 +585,8 @@ void client_destroy(struct imap_client *client, const char *reason)
                client->proxy_password = NULL;
        }
 
-       i_free(client->proxy_user);
-       client->proxy_user = NULL;
+       i_free_and_null(client->proxy_user);
+       i_free_and_null(client->proxy_master_user);
 
        if (client->proxy != NULL) {
                login_proxy_free(client->proxy);

diff --git a/src/imap-login/client.h b/src/imap-login/client.h
index 76de7ff82f963116db1fef580863f315c83535a1..ad655a7e124acc6595b5e25aa6ea79a6342bfec7 100644 (file)
--- a/src/imap-login/client.h
+++ b/src/imap-login/client.h
@@ -17,7 +17,7 @@ struct imap_client {
        struct timeout *to_idle_disconnect, *to_auth_waiting;
 
        struct login_proxy *proxy;
-       char *proxy_user, *proxy_password;
+       char *proxy_user, *proxy_master_user, *proxy_password;
 
        unsigned int bad_counter;
 

diff --git a/src/imap-login/imap-proxy.c b/src/imap-login/imap-proxy.c
index 2aa1d5a440c0980c4e4aa3e8f4d4f11249685b1e..e8330d68fd110e684c9e1f741da26ea24058991f 100644 (file)
--- a/src/imap-login/imap-proxy.c
+++ b/src/imap-login/imap-proxy.c
@@ -4,6 +4,7 @@
 #include "ioloop.h"
 #include "istream.h"
 #include "ostream.h"
+#include "base64.h"
 #include "str.h"
 #include "str-sanitize.h"
 #include "safe-memset.h"
@@ -46,6 +47,66 @@ static void proxy_write_id(struct imap_client *client, string_t *str)
                    client->common.local_port);
 }
 
+static void proxy_free_password(struct imap_client *client)
+{
+       safe_memset(client->proxy_password, 0, strlen(client->proxy_password));
+       i_free_and_null(client->proxy_password);
+}
+
+static void get_plain_auth(struct imap_client *client, string_t *dest)
+{
+       string_t *str;
+
+       str = t_str_new(128);
+       str_append(str, client->proxy_user);
+       str_append_c(str, '\0');
+       str_append(str, client->proxy_master_user);
+       str_append_c(str, '\0');
+       str_append(str, client->proxy_password);
+       base64_encode(str_data(str), str_len(str), dest);
+}
+
+static int proxy_input_banner(struct imap_client *client,
+                             struct ostream *output, const char *line)
+{
+       string_t *str;
+
+       if (strncmp(line, "* OK ", 5) != 0) {
+               client_syslog(&client->common, t_strdup_printf(
+                       "proxy: Remote returned invalid banner: %s",
+                       str_sanitize(line, 160)));
+               client_destroy_internal_failure(client);
+               return -1;
+       }
+
+       str = t_str_new(128);
+       if (imap_banner_has_capability(line + 5, "ID"))
+               proxy_write_id(client, str);
+
+       if (client->proxy_master_user == NULL) {
+               /* logging in normally - use LOGIN command */
+               str_append(str, "L LOGIN ");
+               imap_quote_append_string(str, client->proxy_user, FALSE);
+               str_append_c(str, ' ');
+               imap_quote_append_string(str, client->proxy_password, FALSE);
+
+               proxy_free_password(client);
+       } else if (imap_banner_has_capability(line + 5, "SASL-IR")) {
+               /* master user login with SASL initial response support */
+               str_append(str, "L AUTHENTICATE PLAIN ");
+               get_plain_auth(client, str);
+               proxy_free_password(client);
+       } else {
+               /* master user login without SASL initial response */
+               str_append(str, "L AUTHENTICATE PLAIN");
+       }
+
+       str_append(str, "\r\n");
+       (void)o_stream_send(output, str_data(str), str_len(str));
+       client->proxy_login_sent = TRUE;
+       return 0;
+}
+
 static int proxy_input_line(struct imap_client *client,
                            struct ostream *output, const char *line)
 {
@@ -55,33 +116,17 @@ static int proxy_input_line(struct imap_client *client,
 
        if (!client->proxy_login_sent) {
                /* this is a banner */
-               if (strncmp(line, "* OK ", 5) != 0) {
-                       client_syslog(&client->common, t_strdup_printf(
-                               "proxy: Remote returned invalid banner: %s",
-                               str_sanitize(line, 160)));
-                       client_destroy_internal_failure(client);
-                       return -1;
-               }
-
+               return proxy_input_banner(client, output, line);
+       } else if (*line == '+') {
+               /* AUTHENTICATE started. finish it. */
                str = t_str_new(128);
-               if (imap_banner_has_capability(line + 5, "ID"))
-                       proxy_write_id(client, str);
-
-               /* send LOGIN command */
-               str_append(str, "P LOGIN ");
-               imap_quote_append_string(str, client->proxy_user, FALSE);
-               str_append_c(str, ' ');
-               imap_quote_append_string(str, client->proxy_password, FALSE);
+               get_plain_auth(client, str);
                str_append(str, "\r\n");
-               (void)o_stream_send(output, str_data(str), str_len(str));
+               proxy_free_password(client);
 
-               safe_memset(client->proxy_password, 0,
-                           strlen(client->proxy_password));
-               i_free(client->proxy_password);
-               client->proxy_password = NULL;
-               client->proxy_login_sent = TRUE;
+               (void)o_stream_send(output, str_data(str), str_len(str));
                return 0;
-       } else if (strncmp(line, "P OK ", 5) == 0) {
+       } else if (strncmp(line, "L OK ", 5) == 0) {
                /* Login successful. Send this line to client. */
                str = t_str_new(128);
                str_append(str, client->cmd_tag);
@@ -101,6 +146,10 @@ static int proxy_input_line(struct imap_client *client,
                        str_append_c(str, '/');
                        str_append(str, client->proxy_user);
                }
+               if (client->proxy_master_user != NULL) {
+                       str_printfa(str, " (master %s)",
+                                   client->proxy_master_user);
+               }
 
                (void)client_skip_line(client);
                login_proxy_detach(client->proxy, client->common.input,
@@ -112,7 +161,7 @@ static int proxy_input_line(struct imap_client *client,
                client->common.fd = -1;
                client_destroy_success(client, str_c(str));
                return -1;
-       } else if (strncmp(line, "P ", 2) == 0) {
+       } else if (strncmp(line, "L ", 2) == 0) {
                /* If the backend server isn't Dovecot, the error message may
                   be different from Dovecot's "user doesn't exist" error. This
                   would allow an attacker to find out what users exist in the
@@ -140,6 +189,10 @@ static int proxy_input_line(struct imap_client *client,
                                str_append_c(str, '/');
                                str_append(str, client->proxy_user);
                        }
+                       if (client->proxy_master_user != NULL) {
+                               str_printfa(str, " (master %s)",
+                                           client->proxy_master_user);
+                       }
                        str_append(str, ": ");
                        if (strncasecmp(line + 2, "NO ", 3) == 0)
                                str_append(str, line + 2 + 3);
@@ -156,8 +209,8 @@ static int proxy_input_line(struct imap_client *client,
                login_proxy_free(client->proxy);
                client->proxy = NULL;
 
-               i_free(client->proxy_user);
-               client->proxy_user = NULL;
+               i_free_and_null(client->proxy_user);
+               i_free_and_null(client->proxy_master_user);
                return -1;
        } else {
                /* probably some untagged reply */
@@ -210,7 +263,8 @@ static void proxy_input(struct istream *input, struct ostream *output,
 }
 
 int imap_proxy_new(struct imap_client *client, const char *host,
-                  unsigned int port, const char *user, const char *password)
+                  unsigned int port, const char *user, const char *master_user,
+                  const char *password)
 {
        i_assert(user != NULL);
        i_assert(!client->destroyed);
@@ -236,6 +290,7 @@ int imap_proxy_new(struct imap_client *client, const char *host,
 
        client->proxy_login_sent = FALSE;
        client->proxy_user = i_strdup(user);
+       client->proxy_master_user = i_strdup(master_user);
        client->proxy_password = i_strdup(password);
 
        /* disable input until authentication is finished */

diff --git a/src/imap-login/imap-proxy.h b/src/imap-login/imap-proxy.h
index a3427e2cbdeed30461f8cee0f51dfc5941320cb4..f9617dd5a515e280b2d4da60c2cde49c4b1582bb 100644 (file)
--- a/src/imap-login/imap-proxy.h
+++ b/src/imap-login/imap-proxy.h
@@ -4,6 +4,7 @@
 #include "login-proxy.h"
 
 int imap_proxy_new(struct imap_client *client, const char *host,
-                  unsigned int port, const char *user, const char *password);
+                  unsigned int port, const char *user, const char *master_user,
+                  const char *password);
 
 #endif

diff --git a/src/pop3-login/client-authenticate.c b/src/pop3-login/client-authenticate.c
index 6862721f1fc86a6d9d903ee2efca942d6a955ba4..0eab44185ff33b317fa387d3beadc276cca7ea1f 100644 (file)
--- a/src/pop3-login/client-authenticate.c
+++ b/src/pop3-login/client-authenticate.c
@@ -86,6 +86,7 @@ static bool client_handle_args(struct pop3_client *client,
                               const char *const *args, bool success)
 {
        const char *reason = NULL, *host = NULL, *destuser = NULL, *pass = NULL;
+       const char *master_user = NULL;
        string_t *reply;
        unsigned int port = 110;
        bool proxy = FALSE, temp = FALSE, nologin = !success;
@@ -107,6 +108,8 @@ static bool client_handle_args(struct pop3_client *client,
                        destuser = *args + 9;
                else if (strncmp(*args, "pass=", 5) == 0)
                        pass = *args + 5;
+               else if (strncmp(*args, "master=", 7) == 0)
+                       master_user = *args + 7;
                else if (strncmp(*args, "user=", 5) == 0) {
                        /* already handled in login-common */
                } else if (auth_debug) {
@@ -127,7 +130,8 @@ static bool client_handle_args(struct pop3_client *client,
                   proxy host=.. [port=..] [destuser=..] pass=.. */
                if (!success)
                        return FALSE;
-               if (pop3_proxy_new(client, host, port, destuser, pass) < 0)
+               if (pop3_proxy_new(client, host, port, destuser, master_user,
+                                  pass) < 0)
                        client_destroy_internal_failure(client);
                return TRUE;
        }

diff --git a/src/pop3-login/client.h b/src/pop3-login/client.h
index 6e76d24d9bdc608388b2d0eae338054249d351c1..f4da65e7225fbf13ded7e9f2723088bedfa4ca4d 100644 (file)
--- a/src/pop3-login/client.h
+++ b/src/pop3-login/client.h
@@ -17,7 +17,7 @@ struct pop3_client {
        struct timeout *to_idle_disconnect;
 
        struct login_proxy *proxy;
-       char *proxy_user, *proxy_password;
+       char *proxy_user, *proxy_master_user, *proxy_password;
        int proxy_state;
 
        unsigned int bad_counter;

diff --git a/src/pop3-login/pop3-proxy.c b/src/pop3-login/pop3-proxy.c
index 6a9d7309897a4acc20d8b0509caf5bbfdafdd521..40a55f96067e0eb1c36e902747cff7e0b7f15b81 100644 (file)
--- a/src/pop3-login/pop3-proxy.c
+++ b/src/pop3-login/pop3-proxy.c
@@ -11,6 +11,19 @@
 #include "client.h"
 #include "pop3-proxy.h"
 
+static void get_plain_auth(struct pop3_client *client, string_t *dest)
+{
+       string_t *str;
+
+       str = t_str_new(128);
+       str_append(str, client->proxy_user);
+       str_append_c(str, '\0');
+       str_append(str, client->proxy_master_user);
+       str_append_c(str, '\0');
+       str_append(str, client->proxy_password);
+       base64_encode(str_data(str), str_len(str), dest);
+}
+
 static void proxy_input(struct istream *input, struct ostream *output,
                        struct pop3_client *client)
 {
@@ -66,31 +79,43 @@ static void proxy_input(struct istream *input, struct ostream *output,
                        return;
                }
 
-               /* send USER command */
                str = t_str_new(128);
-               str_append(str, "USER ");
-               str_append(str, client->proxy_user);
-               str_append(str, "\r\n");
+               if (client->proxy_master_user == NULL) {
+                       /* send USER command */
+                       str_append(str, "USER ");
+                       str_append(str, client->proxy_user);
+                       str_append(str, "\r\n");
+               } else {
+                       /* master user login - use AUTH PLAIN. */
+                       str_append(str, "AUTH PLAIN\r\n");
+               }
                (void)o_stream_send(output, str_data(str), str_len(str));
 
                client->proxy_state++;
                return;
        case 1:
-               if (strncmp(line, "+OK", 3) != 0)
-                       break;
-
-               /* USER successful, send PASS */
                str = t_str_new(128);
-               str_append(str, "PASS ");
-               str_append(str, client->proxy_password);
-               str_append(str, "\r\n");
+               if (client->proxy_master_user == NULL) {
+                       if (strncmp(line, "+OK", 3) != 0)
+                               break;
+
+                       /* USER successful, send PASS */
+                       str_append(str, "PASS ");
+                       str_append(str, client->proxy_password);
+                       str_append(str, "\r\n");
+               } else {
+                       if (*line != '+')
+                               break;
+                       /* AUTH successful, send the authentication data */
+                       get_plain_auth(client, str);
+                       str_append(str, "\r\n");
+               }
                (void)o_stream_send(output, str_data(str),
                                    str_len(str));
 
                safe_memset(client->proxy_password, 0,
                            strlen(client->proxy_password));
-               i_free(client->proxy_password);
-               client->proxy_password = NULL;
+               i_free_and_null(client->proxy_password);
 
                client->proxy_state++;
                return;
@@ -113,6 +138,10 @@ static void proxy_input(struct istream *input, struct ostream *output,
                        str_append_c(str, '/');
                        str_append(str, client->proxy_user);
                }
+               if (client->proxy_master_user != NULL) {
+                       str_printfa(str, " (master %s)",
+                                   client->proxy_master_user);
+               }
 
                login_proxy_detach(client->proxy, client->common.input,
                                   client->output);
@@ -144,6 +173,10 @@ static void proxy_input(struct istream *input, struct ostream *output,
                        str_append_c(str, '/');
                        str_append(str, client->proxy_user);
                }
+               if (client->proxy_master_user != NULL) {
+                       str_printfa(str, " (master %s)",
+                                   client->proxy_master_user);
+               }
                str_append(str, ": ");
                if (strncmp(line, "-ERR ", 5) == 0)
                        str_append(str, line + 5);
@@ -163,16 +196,16 @@ static void proxy_input(struct istream *input, struct ostream *output,
        if (client->proxy_password != NULL) {
                safe_memset(client->proxy_password, 0,
                            strlen(client->proxy_password));
-               i_free(client->proxy_password);
-               client->proxy_password = NULL;
+               i_free_and_null(client->proxy_password);
        }
 
-       i_free(client->proxy_user);
-       client->proxy_user = NULL;
+       i_free_and_null(client->proxy_user);
+       i_free_and_null(client->proxy_master_user);
 }
 
 int pop3_proxy_new(struct pop3_client *client, const char *host,
-                  unsigned int port, const char *user, const char *password)
+                  unsigned int port, const char *user, const char *master_user,
+                  const char *password)
 {
        i_assert(user != NULL);
        i_assert(!client->destroyed);
@@ -198,6 +231,7 @@ int pop3_proxy_new(struct pop3_client *client, const char *host,
 
        client->proxy_state = 0;
        client->proxy_user = i_strdup(user);
+       client->proxy_master_user = i_strdup(master_user);
        client->proxy_password = i_strdup(password);
 
        /* disable input until authentication is finished */

diff --git a/src/pop3-login/pop3-proxy.h b/src/pop3-login/pop3-proxy.h
index da2ee680003ac7ffbb002dd393e2ffdb68b9bf40..11dcc05be134964d5ece03f9e537cc0914389cb9 100644 (file)
--- a/src/pop3-login/pop3-proxy.h
+++ b/src/pop3-login/pop3-proxy.h
@@ -4,6 +4,7 @@
 #include "login-proxy.h"
 
 int pop3_proxy_new(struct pop3_client *client, const char *host,
-                  unsigned int port, const char *user, const char *password);
+                  unsigned int port, const char *user, const char *master_user,
+                  const char *password);
 
 #endif