1 /* $Cambridge: exim/src/src/auths/dovecot.c,v 1.7 2007/03/01 14:06:56 ph10 Exp $ */
4 * Copyright (c) 2004 Andrey Panin <pazke@donpac.ru>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published
8 * by the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
12 /* A number of modifications have been made to the original code. Originally I
13 commented them specially, but now they are getting quite extensive, so I have
14 ceased doing that. The biggest change is to use unbuffered I/O on the socket
15 because using C buffered I/O gives problems on some operating systems. PH */
20 #define VERSION_MAJOR 1
21 #define VERSION_MINOR 0
23 /* Options specific to the authentication mechanism. */
24 optionlist auth_dovecot_options[] = {
28 (void *)(offsetof(auth_dovecot_options_block, server_socket))
32 /* Size of the options list. An extern variable has to be used so that its
33 address can appear in the tables drtables.c. */
35 int auth_dovecot_options_count =
36 sizeof(auth_dovecot_options) / sizeof(optionlist);
38 /* Default private options block for the authentication method. */
40 auth_dovecot_options_block auth_dovecot_option_defaults = {
41 NULL, /* server_socket */
45 /* Static variables for reading from the socket */
47 static uschar sbuffer[256];
52 /*************************************************
53 * Initialization entry point *
54 *************************************************/
56 /* Called for each instance, after its options have been read, to
57 enable consistency checks to be done, or anything else that needs
60 void auth_dovecot_init(auth_instance *ablock)
62 auth_dovecot_options_block *ob =
63 (auth_dovecot_options_block *)(ablock->options_block);
65 if (ablock->public_name == NULL)
66 ablock->public_name = ablock->name;
67 if (ob->server_socket != NULL)
68 ablock->server = TRUE;
69 ablock->client = FALSE;
72 static int strcut(uschar *str, uschar **ptrs, int nptrs)
77 for (n = 0; n < nptrs; n++)
99 #define CHECK_COMMAND(str, arg_min, arg_max) do { \
100 if (strcmpic(US(str), args[0]) != 0) \
102 if (nargs - 1 < (arg_min)) \
104 if (nargs - 1 > (arg_max)) \
108 #define OUT(msg) do { \
109 auth_defer_msg = (US msg); \
115 /*************************************************
116 * "fgets" to read directly from socket *
117 *************************************************/
119 /* Added by PH after a suggestion by Steve Usher because the previous use of
120 C-style buffered I/O gave trouble. */
123 dc_gets(uschar *s, int n, int fd)
132 sbp = read(fd, sbuffer, sizeof(sbuffer));
133 if (sbp == 0) { if (count == 0) return NULL; else break; }
138 if (count >= n - 1) break;
139 s[count++] = sbuffer[p];
140 if (sbuffer[p++] == '\n') break;
143 memmove(sbuffer, sbuffer + p, sbp - p);
146 if (s[count-1] == '\n' || count >= n - 1) break;
156 /*************************************************
157 * Server entry point *
158 *************************************************/
160 int auth_dovecot_server(auth_instance *ablock, uschar *data)
162 auth_dovecot_options_block *ob =
163 (auth_dovecot_options_block *)(ablock->options_block);
164 struct sockaddr_un sa;
167 uschar *auth_command;
168 uschar *auth_extra_data = US"";
170 int cuid = 0, cont = 1, found = 0, fd, ret = DEFER;
172 HDEBUG(D_auth) debug_printf("dovecot authentication\n");
174 memset(&sa, 0, sizeof(sa));
175 sa.sun_family = AF_UNIX;
177 /* This was the original code here: it is nonsense because strncpy()
178 does not return an integer. I have converted this to use the function
179 that formats and checks length. PH */
182 if (strncpy(sa.sun_path, ob->server_socket, sizeof(sa.sun_path)) < 0) {
185 if (!string_format(US sa.sun_path, sizeof(sa.sun_path), "%s",
186 ob->server_socket)) {
187 auth_defer_msg = US"authentication socket path too long";
191 auth_defer_msg = US"authentication socket connection error";
193 fd = socket(PF_UNIX, SOCK_STREAM, 0);
197 if (connect(fd, (struct sockaddr *) &sa, sizeof(sa)) < 0)
200 auth_defer_msg = US"authentication socket protocol error";
202 sbp = 0; /* Socket buffer pointer */
204 if (dc_gets(buffer, sizeof(buffer), fd) == NULL)
205 OUT("authentication socket read error or premature eof");
207 buffer[Ustrlen(buffer) - 1] = 0;
208 HDEBUG(D_auth) debug_printf("received: %s\n", buffer);
209 nargs = strcut(buffer, args, sizeof(args) / sizeof(args[0]));
211 switch (toupper(*args[0])) {
213 CHECK_COMMAND("CUID", 1, 1);
214 cuid = Uatoi(args[1]);
218 CHECK_COMMAND("DONE", 0, 0);
223 CHECK_COMMAND("MECH", 1, INT_MAX);
224 if (strcmpic(US args[1], ablock->public_name) == 0)
229 CHECK_COMMAND("SPID", 1, 1);
233 CHECK_COMMAND("VERSION", 2, 2);
234 if (Uatoi(args[1]) != VERSION_MAJOR)
235 OUT("authentication socket protocol version mismatch");
246 /* Added by PH: data must not contain tab (as it is
247 b64 it shouldn't, but check for safety). */
249 if (Ustrchr(data, '\t') != NULL) {
254 /* Added by PH: extra fields when TLS is in use or if the TCP/IP
255 connection is local. */
257 if (tls_cipher != NULL)
258 auth_extra_data = string_sprintf("secured\t%s%s",
259 tls_certificate_verified? "valid-client-cert" : "",
260 tls_certificate_verified? "\t" : "");
261 else if (interface_address != NULL &&
262 Ustrcmp(sender_host_address, interface_address) == 0)
263 auth_extra_data = US"secured\t";
266 /****************************************************************************
267 The code below was the original code here. It didn't work. A reading of the
268 file auth-protocol.txt.gz that came with Dovecot 1.0_beta8 indicated that
269 this was not right. Maybe something changed. I changed it to move the
270 service indication into the AUTH command, and it seems to be better. PH
272 fprintf(f, "VERSION\t%d\t%d\r\nSERVICE\tSMTP\r\nCPID\t%d\r\n"
273 "AUTH\t%d\t%s\trip=%s\tlip=%s\tresp=%s\r\n",
274 VERSION_MAJOR, VERSION_MINOR, getpid(), cuid,
275 ablock->public_name, sender_host_address, interface_address,
276 data ? (char *) data : "");
278 Subsequently, the command was modified to add "secured" and "valid-client-
280 ****************************************************************************/
282 auth_command = string_sprintf("VERSION\t%d\t%d\nCPID\t%d\n"
283 "AUTH\t%d\t%s\tservice=smtp\t%srip=%s\tlip=%s\tresp=%s\n",
284 VERSION_MAJOR, VERSION_MINOR, getpid(), cuid,
285 ablock->public_name, auth_extra_data, sender_host_address,
286 interface_address, data ? (char *) data : "");
288 if (write(fd, auth_command, Ustrlen(auth_command)) < 0)
289 HDEBUG(D_auth) debug_printf("error sending auth_command: %s\n",
292 HDEBUG(D_auth) debug_printf("sent: %s", auth_command);
296 if (dc_gets(buffer, sizeof(buffer), fd) == NULL) {
297 auth_defer_msg = US"authentication socket read error or premature eof";
301 buffer[Ustrlen(buffer) - 1] = 0;
302 HDEBUG(D_auth) debug_printf("received: %s\n", buffer);
303 nargs = strcut(buffer, args, sizeof(args) / sizeof(args[0]));
305 if (Uatoi(args[1]) != cuid)
306 OUT("authentication socket connection id mismatch");
308 switch (toupper(*args[0])) {
310 CHECK_COMMAND("CONT", 1, 2);
312 tmp = auth_get_no64_data(&data, US args[2]);
318 /* Added by PH: data must not contain tab (as it is
319 b64 it shouldn't, but check for safety). */
321 if (Ustrchr(data, '\t') != NULL) {
326 temp = string_sprintf("CONT\t%d\t%s\r\n", cuid, data);
327 if (write(fd, temp, Ustrlen(temp)) < 0)
328 OUT("authentication socket write error");
332 CHECK_COMMAND("FAIL", 1, 2);
334 /* FIXME: add proper response handling */
336 uschar *p = Ustrchr(args[2], '=');
339 expand_nstring[1] = auth_vars[0] =
340 string_copy(p); /* PH */
341 expand_nlength[1] = Ustrlen(p);
350 CHECK_COMMAND("OK", 2, 2);
352 /* FIXME: add proper response handling */
353 uschar *p = Ustrchr(args[2], '=');
355 OUT("authentication socket protocol error, username missing");
358 expand_nstring[1] = auth_vars[0] =
359 string_copy(p); /* PH */
360 expand_nlength[1] = Ustrlen(p);
373 /* Expand server_condition as an authorization check */
374 return (ret == OK)? auth_check_serv_cond(ablock) : ret;