anvil: Allow anvil-auth-penalty socket to use only PENALTY-* commands

diff --git a/src/anvil/anvil-connection.c b/src/anvil/anvil-connection.c
index e16e2da7a02af3c35b8190f0bab17e5af529eb3b..2439a6a54802cfdc5926cb425c9a457ff1206797 100644 (file)
--- a/src/anvil/anvil-connection.c
+++ b/src/anvil/anvil-connection.c
@@ -392,6 +392,12 @@ anvil_connection_request(struct anvil_connection *conn,
        time_t stamp;
        pid_t pid;
 
+       if (conn->conn_type == ANVIL_CONNECTION_TYPE_AUTH_PENALTY &&
+           !str_begins_with(cmd, "PENALTY-")) {
+               *error_r = "Only PENALTY-* commands allowed";
+               return -1;
+       }
+
        anvil_global_cmd_counter++;
        anvil_refresh_proctitle_delayed();
 

diff --git a/src/anvil/anvil-connection.h b/src/anvil/anvil-connection.h
index 096eb485407922beb822c7d32998c8c270271134..95334e0d0615574c536cb98b14f1a35bb45f5ce5 100644 (file)
--- a/src/anvil/anvil-connection.h
+++ b/src/anvil/anvil-connection.h
@@ -4,6 +4,7 @@
 enum anvil_connection_type {
        ANVIL_CONNECTION_TYPE_DEFAULT,
        ANVIL_CONNECTION_TYPE_MASTER,
+       ANVIL_CONNECTION_TYPE_AUTH_PENALTY,
 };
 
 /* Error is set and reply=NULL on internal errors. */

diff --git a/src/anvil/anvil-settings.c b/src/anvil/anvil-settings.c
index 15cd03957a1cb61d2c86a72cbb7b3535c4be67e1..805828574051f724b2278a2959bce087e1ec9009 100644 (file)
--- a/src/anvil/anvil-settings.c
+++ b/src/anvil/anvil-settings.c
@@ -37,6 +37,7 @@ const struct setting_keyvalue anvil_service_settings_defaults[] = {
        { "unix_listener/anvil/group", "$SET:default_internal_group" },
 
        { "unix_listener/anvil-auth-penalty/path", "anvil-auth-penalty" },
+       { "unix_listener/anvil-auth-penalty/type", "penalty" },
 #ifdef DOVECOT_PRO_EDITION
        /* Should use OX Abuse Shield instead */
        { "unix_listener/anvil-auth-penalty/mode", "0" },

diff --git a/src/anvil/main.c b/src/anvil/main.c
index 9f5b956f2e9f8f7b836959ade8afebcd93dbe848..5c08f39c475d23a22bc15b4b2ff8ce2e5e707234 100644 (file)
--- a/src/anvil/main.c
+++ b/src/anvil/main.c
@@ -99,8 +99,14 @@ static void client_connected(struct master_service_connection *conn)
 
        if (conn->listen_fd == MASTER_LISTEN_FD_FIRST)
                type = ANVIL_CONNECTION_TYPE_MASTER;
-       else
-               type = ANVIL_CONNECTION_TYPE_DEFAULT;
+       else {
+               const char *type_str = master_service_connection_get_type(conn);
+
+               if (strcmp(type_str, "penalty") == 0)
+                       type = ANVIL_CONNECTION_TYPE_AUTH_PENALTY;
+               else
+                       type = ANVIL_CONNECTION_TYPE_DEFAULT;
+       }
 
        master_service_client_connection_accept(conn);
        anvil_connection_create(conn->fd, type, conn->fifo);