mailcow/data/Dockerfiles/dovecot/auth-server-connection.c

/* Copyright (c) 2003-2017 Dovecot authors, see the included COPYING file */

#include "lib.h"
#include "array.h"
#include "hash.h"
#include "hostpid.h"
#include "ioloop.h"
#include "istream.h"
#include "ostream.h"
#include "net.h"
#include "strescape.h"
#include "eacces-error.h"
#include "auth-client-private.h"
#include "auth-client-request.h"
#include "auth-server-connection.h"

#include <unistd.h>

#define AUTH_SERVER_CONN_MAX_LINE_LENGTH AUTH_CLIENT_MAX_LINE_LENGTH
#define AUTH_HANDSHAKE_TIMEOUT (30*1000)
#define AUTH_SERVER_RECONNECT_TIMEOUT_SECS 5

static void
auth_server_connection_reconnect(struct auth_server_connection *conn,
         const char *disconnect_reason);

static int
auth_server_input_mech(struct auth_server_connection *conn,
           const char *const *args)
{
  struct auth_mech_desc mech_desc;

  if (conn->handshake_received) {
    i_error("BUG: Authentication server already sent handshake");
    return -1;
  }
  if (args[0] == NULL) {
    i_error("BUG: Authentication server sent broken MECH line");
    return -1;
  }

  i_zero(&mech_desc);
  mech_desc.name = p_strdup(conn->pool, args[0]);

  if (strcmp(mech_desc.name, "PLAIN") == 0)
    conn->has_plain_mech = TRUE;

  for (args++; *args != NULL; args++) {
    if (strcmp(*args, "private") == 0)
      mech_desc.flags |= MECH_SEC_PRIVATE;
    else if (strcmp(*args, "anonymous") == 0)
      mech_desc.flags |= MECH_SEC_ANONYMOUS;
    else if (strcmp(*args, "plaintext") == 0)
      mech_desc.flags |= MECH_SEC_PLAINTEXT;
    else if (strcmp(*args, "dictionary") == 0)
      mech_desc.flags |= MECH_SEC_DICTIONARY;
    else if (strcmp(*args, "active") == 0)
      mech_desc.flags |= MECH_SEC_ACTIVE;
    else if (strcmp(*args, "forward-secrecy") == 0)
      mech_desc.flags |= MECH_SEC_FORWARD_SECRECY;
    else if (strcmp(*args, "mutual-auth") == 0)
      mech_desc.flags |= MECH_SEC_MUTUAL_AUTH;
  }
  array_append(&conn->available_auth_mechs, &mech_desc, 1);
  return 0;
}

static int
auth_server_input_spid(struct auth_server_connection *conn,
           const char *const *args)
{
  if (conn->handshake_received) {
    i_error("BUG: Authentication server already sent handshake");
    return -1;
  }

  if (str_to_uint(args[0], &conn->server_pid) < 0) {
    i_error("BUG: Authentication server sent invalid PID");
    return -1;
  }
  return 0;
}

static int
auth_server_input_cuid(struct auth_server_connection *conn,
           const char *const *args)
{
  if (conn->handshake_received) {
    i_error("BUG: Authentication server already sent handshake");
    return -1;
  }
  if (args[0] == NULL ||
      str_to_uint(args[0], &conn->connect_uid) < 0) {
    i_error("BUG: Authentication server sent broken CUID line");
    return -1;
  }
  return 0;
}

static int
auth_server_input_cookie(struct auth_server_connection *conn,
       const char *const *args)
{
  if (conn->cookie != NULL) {
    i_error("BUG: Authentication server already sent cookie");
    return -1;
  }
  conn->cookie = p_strdup(conn->pool, args[0]);
  return 0;
}

static int auth_server_input_done(struct auth_server_connection *conn)
{
  if (array_count(&conn->available_auth_mechs) == 0) {
    i_error("BUG: Authentication server returned no mechanisms");
    return -1;
  }
  if (conn->cookie == NULL) {
    i_error("BUG: Authentication server didn't send a cookie");
    return -1;
  }

  if (conn->to != NULL)
    timeout_remove(&conn->to);

  conn->handshake_received = TRUE;
  if (conn->client->connect_notify_callback != NULL) {
    conn->client->connect_notify_callback(conn->client, TRUE,
        conn->client->connect_notify_context);
  }
  return 0;
}

static int
auth_server_lookup_request(struct auth_server_connection *conn,
         const char *id_arg, bool remove,
         struct auth_client_request **request_r)
{
  struct auth_client_request *request;
  unsigned int id;

  if (id_arg == NULL || str_to_uint(id_arg, &id) < 0) {
    i_error("BUG: Authentication server input missing ID");
    return -1;
  }

  request = hash_table_lookup(conn->requests, POINTER_CAST(id));
  if (request == NULL) {
    i_error("BUG: Authentication server sent unknown id %u", id);
    return -1;
  }
  if (remove || auth_client_request_is_aborted(request))
    hash_table_remove(conn->requests, POINTER_CAST(id));

  *request_r = request;
  return 0;
}

static int
auth_server_input_ok(struct auth_server_connection *conn,
         const char *const *args)
{
  struct auth_client_request *request;

  if (auth_server_lookup_request(conn, args[0], TRUE, &request) < 0)
    return -1;
  auth_client_request_server_input(request, AUTH_REQUEST_STATUS_OK,
           args + 1);
  return 0;
}

static int auth_server_input_cont(struct auth_server_connection *conn,
          const char *const *args)
{
  struct auth_client_request *request;

  if (str_array_length(args) < 2) {
    i_error("BUG: Authentication server sent broken CONT line");
    return -1;
  }

  if (auth_server_lookup_request(conn, args[0], FALSE, &request) < 0)
    return -1;
  auth_client_request_server_input(request, AUTH_REQUEST_STATUS_CONTINUE,
           args + 1);
  return 0;
}

static int auth_server_input_fail(struct auth_server_connection *conn,
          const char *const *args)
{
  struct auth_client_request *request;

  if (auth_server_lookup_request(conn, args[0], TRUE, &request) < 0)
    return -1;
  auth_client_request_server_input(request, AUTH_REQUEST_STATUS_FAIL,
           args + 1);
  return 0;
}

static int
auth_server_connection_input_line(struct auth_server_connection *conn,
          const char *line)
{
  const char *const *args;

  if (conn->client->debug)
    i_debug("auth input: %s", line);

  args = t_strsplit_tabescaped(line);
  if (args[0] == NULL) {
    i_error("Auth server sent empty line");
    return -1;
  }
  if (strcmp(args[0], "OK") == 0)
    return auth_server_input_ok(conn, args + 1);
  else if (strcmp(args[0], "CONT") == 0)
    return auth_server_input_cont(conn, args + 1);
  else if (strcmp(args[0], "FAIL") == 0)
    return auth_server_input_fail(conn, args + 1);
  else if (strcmp(args[0], "MECH") == 0)
    return auth_server_input_mech(conn, args + 1);
  else if (strcmp(args[0], "SPID") == 0)
    return auth_server_input_spid(conn, args + 1);
  else if (strcmp(args[0], "CUID") == 0)
    return auth_server_input_cuid(conn, args + 1);
  else if (strcmp(args[0], "COOKIE") == 0)
    return auth_server_input_cookie(conn, args + 1);
  else if (strcmp(args[0], "DONE") == 0)
    return auth_server_input_done(conn);
  else {
    i_error("Auth server sent unknown command: %s", args[0]);
    return -1;
  }
}

static void auth_server_connection_input(struct auth_server_connection *conn)
{
  struct istream *input;
  const char *line, *error;
  int ret;

  switch (i_stream_read(conn->input)) {
  case 0:
    return;
  case -1:
    /* disconnected */
    error = conn->input->stream_errno != 0 ?
      strerror(conn->input->stream_errno) : "EOF";
    auth_server_connection_reconnect(conn, error);
    return;
  case -2:
    /* buffer full - can't happen unless auth is buggy */
    i_error("BUG: Auth server sent us more than %d bytes of data",
      AUTH_SERVER_CONN_MAX_LINE_LENGTH);
    auth_server_connection_disconnect(conn, "buffer full");
    return;
  }

  if (!conn->version_received) {
    line = i_stream_next_line(conn->input);
    if (line == NULL)
      return;

    /* make sure the major version matches */
    if (strncmp(line, "VERSION\t", 8) != 0 ||
        !str_uint_equals(t_strcut(line + 8, '\t'),
             AUTH_CLIENT_PROTOCOL_MAJOR_VERSION)) {
      i_error("Authentication server not compatible with "
        "this client (mixed old and new binaries?)");
      auth_server_connection_disconnect(conn,
        "incompatible server");
      return;
    }
    conn->version_received = TRUE;
  }

  input = conn->input;
  i_stream_ref(input);
  while ((line = i_stream_next_line(input)) != NULL && !input->closed) {
    T_BEGIN {
      ret = auth_server_connection_input_line(conn, line);
    } T_END;

    if (ret < 0) {
      auth_server_connection_disconnect(conn, t_strdup_printf(
        "Received broken input: %s", line));
      break;
    }
  }
  i_stream_unref(&input);
}

struct auth_server_connection *
auth_server_connection_init(struct auth_client *client)
{
  struct auth_server_connection *conn;
  pool_t pool;

  pool = pool_alloconly_create("auth server connection", 1024);
  conn = p_new(pool, struct auth_server_connection, 1);
  conn->pool = pool;

  conn->client = client;
  conn->fd = -1;
  hash_table_create_direct(&conn->requests, pool, 100);
  i_array_init(&conn->available_auth_mechs, 8);
  return conn;
}

static void
auth_server_connection_remove_requests(struct auth_server_connection *conn,
               const char *disconnect_reason)
{
  static const char *const temp_failure_args[] = { "temp", NULL };
  struct hash_iterate_context *iter;
  void *key;
  struct auth_client_request *request;
  time_t created, oldest = 0;
  unsigned int request_count = 0;

  if (hash_table_count(conn->requests) == 0)
    return;

  iter = hash_table_iterate_init(conn->requests);
  while (hash_table_iterate(iter, conn->requests, &key, &request)) {
    if (!auth_client_request_is_aborted(request)) {
      request_count++;
      created = auth_client_request_get_create_time(request);
      if (oldest > created || oldest == 0)
        oldest = created;
    }

    auth_client_request_server_input(request,
      AUTH_REQUEST_STATUS_INTERNAL_FAIL,
      temp_failure_args);
  }
  hash_table_iterate_deinit(&iter);
  hash_table_clear(conn->requests, FALSE);

  if (request_count > 0) {
    i_warning("Auth connection closed with %u pending requests "
        "(max %u secs, pid=%s, %s)", request_count,
        (unsigned int)(ioloop_time - oldest),
        my_pid, disconnect_reason);
  }
}

void auth_server_connection_disconnect(struct auth_server_connection *conn,
               const char *reason)
{
  conn->handshake_received = FALSE;
  conn->version_received = FALSE;
  conn->has_plain_mech = FALSE;
  conn->server_pid = 0;
  conn->connect_uid = 0;
  conn->cookie = NULL;
  array_clear(&conn->available_auth_mechs);

  if (conn->to != NULL)
    timeout_remove(&conn->to);
  if (conn->io != NULL)
    io_remove(&conn->io);
  if (conn->fd != -1) {
    i_stream_destroy(&conn->input);
    o_stream_destroy(&conn->output);

    if (close(conn->fd) < 0)
      i_error("close(auth server connection) failed: %m");
    conn->fd = -1;
  }

  auth_server_connection_remove_requests(conn, reason);

  if (conn->client->connect_notify_callback != NULL) {
    conn->client->connect_notify_callback(conn->client, FALSE,
        conn->client->connect_notify_context);
  }
}

static void auth_server_reconnect_timeout(struct auth_server_connection *conn)
{
  (void)auth_server_connection_connect(conn);
}

static void
auth_server_connection_reconnect(struct auth_server_connection *conn,
         const char *disconnect_reason)
{
  time_t next_connect;

  auth_server_connection_disconnect(conn, disconnect_reason);

  next_connect = conn->last_connect + AUTH_SERVER_RECONNECT_TIMEOUT_SECS;
  conn->to = timeout_add(ioloop_time >= next_connect ? 0 :
             (next_connect - ioloop_time) * 1000,
             auth_server_reconnect_timeout, conn);
}

void auth_server_connection_deinit(struct auth_server_connection **_conn)
{
        struct auth_server_connection *conn = *_conn;

  *_conn = NULL;

  auth_server_connection_disconnect(conn, "deinitializing");
  i_assert(hash_table_count(conn->requests) == 0);
  hash_table_destroy(&conn->requests);
  array_free(&conn->available_auth_mechs);
  pool_unref(&conn->pool);
}

static void auth_client_handshake_timeout(struct auth_server_connection *conn)
{
  i_error("Timeout waiting for handshake from auth server. "
    "my pid=%u, input bytes=%"PRIuUOFF_T,
    conn->client->client_pid, conn->input->v_offset);
  auth_server_connection_reconnect(conn, "auth server timeout");
}

int auth_server_connection_connect(struct auth_server_connection *conn)
{
  const char *handshake;
  int fd;

  i_assert(conn->fd == -1);

  conn->last_connect = ioloop_time;
  if (conn->to != NULL)
    timeout_remove(&conn->to);

  /* max. 1 second wait here. */
  fd = net_connect_unix_with_retries(conn->client->auth_socket_path,
             1000);
  if (fd == -1) {
    if (errno == EACCES) {
      i_error("auth: %s",
        eacces_error_get("connect",
          conn->client->auth_socket_path));
    } else {
      i_error("auth: connect(%s) failed: %m",
        conn->client->auth_socket_path);
    }
    return -1;
  }
  conn->fd = fd;
  conn->io = io_add(fd, IO_READ, auth_server_connection_input, conn);
  conn->input = i_stream_create_fd(fd, AUTH_SERVER_CONN_MAX_LINE_LENGTH,
           FALSE);
  conn->output = o_stream_create_fd(fd, (size_t)-1, FALSE);

  handshake = t_strdup_printf("VERSION\t%u\t%u\nCPID\t%u\n",
            AUTH_CLIENT_PROTOCOL_MAJOR_VERSION,
                                    AUTH_CLIENT_PROTOCOL_MINOR_VERSION,
            conn->client->client_pid);
  if (o_stream_send_str(conn->output, handshake) < 0) {
    i_warning("Error sending handshake to auth server: %s",
        o_stream_get_error(conn->output));
    auth_server_connection_disconnect(conn,
      o_stream_get_error(conn->output));
    return -1;
  }

  conn->to = timeout_add(AUTH_HANDSHAKE_TIMEOUT,
             auth_client_handshake_timeout, conn);
  return 0;
}

unsigned int
auth_server_connection_add_request(struct auth_server_connection *conn,
           struct auth_client_request *request)
{
  unsigned int id;

  id = ++conn->client->request_id_counter;
  if (id == 0) {
    /* wrapped - ID 0 not allowed */
    id = ++conn->client->request_id_counter;
  }
  i_assert(hash_table_lookup(conn->requests, POINTER_CAST(id)) == NULL);
  hash_table_insert(conn->requests, POINTER_CAST(id), request);
  return id;
}

void auth_server_connection_remove_request(struct auth_server_connection *conn, unsigned int id)
{
  i_assert(conn->handshake_received);
  hash_table_remove(conn->requests, POINTER_CAST(id));
}