- dovecot - dovecot.org

Re: [Dovecot] PATCH: mysql authentication
by Matthew Reimer 03 Oct '03

03 Oct '03

Here's another patch. This one isn't much different from the last patch, except it tries a little harder to make sure that the required fields are returned by the query (like the pgsql module does). One question about how t_strdup works. How and who should memory returned by t_strdup be freed? My patch has a function my_get_str() which returns the value of t_strdup, and then I do this: user.uid = atoi(my_get_str(res, row, "uid")); /* XXX leak */ user.gid = atoi(my_get_str(res, row, "gid")); /* XXX leak */ Will this result in a memory leak? Matt diff -u -r --new-file work/dovecot-0.99.10/doc/dovecot-mysql.conf work.patched/dovecot-0.99.10/doc/dovecot-mysql.conf --- work/dovecot-0.99.10/doc/dovecot-mysql.conf Wed Dec 31 16:00:00 1969 +++ work.patched/dovecot-0.99.10/doc/dovecot-mysql.conf Tue Sep 30 12:24:00 2003 @@ -0,0 +1,70 @@ +# For the mysql passdb module, you'll need a database with a table that +# contains fields for at least the userid and password. If you want to +# use the user@domain syntax, you might want to have a separate domain +# field as well. +# +# If your users all have the same uig/gid, and have predictable home +# directories, you can use the static userdb module to generate the home +# dir based on the userid and domain. In this case, you won't need fields +# for home, uid, or gid in the database. +# +# If you prefer to use the mysql userdb module, you'll want to add fields +# for home, uid, and gid. Here is an example table: +# +# CREATE TABLE users ( +# userid VARCHAR(128) NOT NULL, +# password VARCHAR(64) NOT NULL, +# home VARCHAR(256) NOT NULL, +# uid INTEGER NOT NULL, +# gid INTEGER NOT NULL, +# active CHAR(1) DEFAULT 'Y' NOT NULL +# ); + +db_host = localhost +db_port = 3306 +#db_unix_socket = /var/tmp/mysql.sock +db = users +db_user = dovecot-db +db_passwd = opensesame +db_client_flags = 0 + +# Default password scheme. +# +# Currently supported schemes include PLAIN, PLAIN-MD5, DIGEST-MD5, and CRYPT. +# +#default_pass_scheme = PLAIN-MD5 + +# Query to retrieve the password. +# +# The query should return one row, one column. If more than one row or column +# is returned, authentication will automatically fail. +# +# Available substitutions: +# %u = entire userid +# %n = user part of user@domain +# %d = domain part of user@domain +# +# Example: +# password_query = SELECT password FROM users WHERE userid = '%n' AND domain = '%d' +# password_query = SELECT password FROM users WHERE userid = '%u' AND active = 'Y' +# +#password_query = SELECT password FROM users WHERE userid = '%u' + +# Query to retrieve the user information. +# +# The query must return only one row. The columns to return are: +# home - Home directory +# mail - MAIL environment +# system_user - System user name (for initgroups()) +# uid - System UID +# gid - System GID +# +# Either home or mail is required. uid and gid are required. If more than one +# row is returned or there's missing fields, login will automatically fail. +# +# Examples +# user_query = SELECT home, uid, gid FROM users WHERE userid = '%n' AND domain = '%d' +# user_query = SELECT dir AS home, user AS uid, group AS gid FROM users where userid = '%u' +# user_query = SELECT home, 501 AS uid, 501 AS gid FROM users WHERE userid = '%u' +# +#user_query = SELECT home, uid, gid FROM users WHERE userid = '%u' diff -u -r --new-file work/dovecot-0.99.10/src/auth/Makefile.in work.patched/dovecot-0.99.10/src/auth/Makefile.in --- work/dovecot-0.99.10/src/auth/Makefile.in Thu Jun 26 09:15:11 2003 +++ work.patched/dovecot-0.99.10/src/auth/Makefile.in Tue Sep 30 12:24:00 2003 @@ -99,10 +99,10 @@ dovecot_auth_LDADD = ../lib-settings/libsettings.a ../lib/liblib.a $(AUTH_LIBS) $(RAND_LIBS) $(MODULE_LIBS) -dovecot_auth_SOURCES = auth-module.c db-ldap.c db-pgsql.c db-passwd-file.c login-connection.c main.c master-connection.c md5crypt.c mech.c mech-anonymous.c mech-cyrus-sasl2.c mech-plain.c mech-digest-md5.c mycrypt.c passdb.c passdb-ldap.c passdb-passwd.c passdb-passwd-file.c passdb-pam.c passdb-shadow.c passdb-vpopmail.c passdb-pgsql.c password-scheme.c userdb.c userdb-ldap.c userdb-passwd.c userdb-passwd-file.c userdb-static.c userdb-vpopmail.c userdb-pgsql.c +dovecot_auth_SOURCES = auth-module.c db-ldap.c db-pgsql.c db-mysql.c db-passwd-file.c login-connection.c main.c master-connection.c md5crypt.c mech.c mech-anonymous.c mech-cyrus-sasl2.c mech-plain.c mech-digest-md5.c mycrypt.c passdb.c passdb-ldap.c passdb-passwd.c passdb-passwd-file.c passdb-pam.c passdb-shadow.c passdb-vpopmail.c passdb-pgsql.c passdb-mysql.c password-scheme.c userdb.c userdb-ldap.c userdb-passwd.c userdb-passwd-file.c userdb-static.c userdb-vpopmail.c userdb-pgsql.c userdb-mysql.c -noinst_HEADERS = auth-login-interface.h auth-master-interface.h auth-mech-desc.h auth-module.h db-ldap.h db-pgsql.h db-passwd-file.h common.h login-connection.h master-connection.h md5crypt.h mech.h mycrypt.h passdb.h password-scheme.h userdb.h userdb-vpopmail.h +noinst_HEADERS = auth-login-interface.h auth-master-interface.h auth-mech-desc.h auth-module.h db-ldap.h db-pgsql.h db-mysql.h db-passwd-file.h common.h login-connection.h master-connection.h md5crypt.h mech.h mycrypt.h passdb.h password-scheme.h userdb.h userdb-vpopmail.h mkinstalldirs = $(SHELL) $(top_srcdir)/mkinstalldirs CONFIG_HEADER = ../../config.h @@ -116,17 +116,17 @@ LDFLAGS = @LDFLAGS@ LIBS = @LIBS@ dovecot_auth_OBJECTS = auth-module.$(OBJEXT) db-ldap.$(OBJEXT) \ -db-pgsql.$(OBJEXT) db-passwd-file.$(OBJEXT) login-connection.$(OBJEXT) \ +db-pgsql.$(OBJEXT) db-mysql.$(OBJEXT) db-passwd-file.$(OBJEXT) login-connection.$(OBJEXT) \ main.$(OBJEXT) master-connection.$(OBJEXT) md5crypt.$(OBJEXT) \ mech.$(OBJEXT) mech-anonymous.$(OBJEXT) mech-cyrus-sasl2.$(OBJEXT) \ mech-plain.$(OBJEXT) mech-digest-md5.$(OBJEXT) mycrypt.$(OBJEXT) \ passdb.$(OBJEXT) passdb-ldap.$(OBJEXT) passdb-passwd.$(OBJEXT) \ passdb-passwd-file.$(OBJEXT) passdb-pam.$(OBJEXT) \ passdb-shadow.$(OBJEXT) passdb-vpopmail.$(OBJEXT) \ -passdb-pgsql.$(OBJEXT) password-scheme.$(OBJEXT) userdb.$(OBJEXT) \ +passdb-pgsql.$(OBJEXT) passdb-mysql.$(OBJEXT) password-scheme.$(OBJEXT) userdb.$(OBJEXT) \ userdb-ldap.$(OBJEXT) userdb-passwd.$(OBJEXT) \ userdb-passwd-file.$(OBJEXT) userdb-static.$(OBJEXT) \ -userdb-vpopmail.$(OBJEXT) userdb-pgsql.$(OBJEXT) +userdb-vpopmail.$(OBJEXT) userdb-pgsql.$(OBJEXT) userdb-mysql.$(OBJEXT) dovecot_auth_DEPENDENCIES = ../lib-settings/libsettings.a \ ../lib/liblib.a dovecot_auth_LDFLAGS = @@ -295,6 +295,13 @@ ../../src/lib/strfuncs.h ../../src/lib/network.h \ ../../src/lib/str.h ../../src/lib-settings/settings.h \ db-pgsql.h +db-mysql.o: db-mysql.c ../../config.h common.h ../../src/lib/lib.h \ + ../../src/lib/compat.h ../../src/lib/macros.h \ + ../../src/lib/failures.h ../../src/lib/data-stack.h \ + ../../src/lib/mempool.h ../../src/lib/imem.h \ + ../../src/lib/strfuncs.h ../../src/lib/network.h \ + ../../src/lib/str.h ../../src/lib-settings/settings.h \ + db-mysql.h login-connection.o: login-connection.c common.h ../../src/lib/lib.h \ ../../config.h ../../src/lib/compat.h ../../src/lib/macros.h \ ../../src/lib/failures.h ../../src/lib/data-stack.h \ @@ -388,6 +395,14 @@ ../../src/lib/str.h ../../src/lib/strescape.h \ ../../src/lib/var-expand.h password-scheme.h db-pgsql.h \ passdb.h mech.h auth-login-interface.h +passdb-mysql.o: passdb-mysql.c ../../config.h common.h \ + ../../src/lib/lib.h ../../src/lib/compat.h \ + ../../src/lib/macros.h ../../src/lib/failures.h \ + ../../src/lib/data-stack.h ../../src/lib/mempool.h \ + ../../src/lib/imem.h ../../src/lib/strfuncs.h \ + ../../src/lib/str.h ../../src/lib/strescape.h \ + ../../src/lib/var-expand.h password-scheme.h db-mysql.h \ + passdb.h mech.h auth-login-interface.h passdb-shadow.o: passdb-shadow.c ../../config.h common.h \ ../../src/lib/lib.h ../../src/lib/compat.h \ ../../src/lib/macros.h ../../src/lib/failures.h \ @@ -428,6 +443,13 @@ ../../src/lib/imem.h ../../src/lib/strfuncs.h \ ../../src/lib/str.h ../../src/lib/strescape.h \ ../../src/lib/var-expand.h db-pgsql.h userdb.h +userdb-mysql.o: userdb-mysql.c ../../config.h common.h \ + ../../src/lib/lib.h ../../src/lib/compat.h \ + ../../src/lib/macros.h ../../src/lib/failures.h \ + ../../src/lib/data-stack.h ../../src/lib/mempool.h \ + ../../src/lib/imem.h ../../src/lib/strfuncs.h \ + ../../src/lib/str.h ../../src/lib/strescape.h \ + ../../src/lib/var-expand.h db-mysql.h userdb.h userdb-static.o: userdb-static.c ../../config.h common.h \ ../../src/lib/lib.h ../../src/lib/compat.h \ ../../src/lib/macros.h ../../src/lib/failures.h \ diff -u -r --new-file work/dovecot-0.99.10/src/auth/db-mysql.c work.patched/dovecot-0.99.10/src/auth/db-mysql.c --- work/dovecot-0.99.10/src/auth/db-mysql.c Wed Dec 31 16:00:00 1969 +++ work.patched/dovecot-0.99.10/src/auth/db-mysql.c Tue Sep 30 12:24:00 2003 @@ -0,0 +1,181 @@ +/* Copyright (C) 2003 Alex Howansky, Timo Sirainen */ + +#include "config.h" +#undef HAVE_CONFIG_H + +#if defined(PASSDB_MYSQL) || defined(USERDB_MYSQL) + +#include "common.h" +#include "network.h" +#include "str.h" +#include "settings.h" +#include "db-mysql.h" + +#include <limits.h> +#include <stddef.h> +#include <stdlib.h> + +#define DEF(type, name) { type, #name, offsetof(struct mysql_settings, name) } + +static struct setting_def setting_defs[] = { + DEF(SET_STR, db_host), + DEF(SET_STR, db_port), + DEF(SET_STR, db_unix_socket), + DEF(SET_STR, db), + DEF(SET_STR, db_user), + DEF(SET_STR, db_passwd), + DEF(SET_STR, db_client_flags), + DEF(SET_STR, password_query), + DEF(SET_STR, user_query), + DEF(SET_STR, default_pass_scheme) +}; + +struct mysql_settings default_mysql_settings = { + MEMBER(db_host) "localhost", + MEMBER(db_port) "0", + MEMBER(db_unix_socket) "/var/tmp/mysql.sock", + MEMBER(db) "email_accounts", + MEMBER(db_user) "dovecot", + MEMBER(db_passwd) "changeme", + MEMBER(db_client_flags) "0", + MEMBER(password_query) "SELECT password FROM users WHERE userid = '%u'", + MEMBER(user_query) "SELECT home, uid, gid FROM users WHERE userid = '%u'", + MEMBER(default_pass_scheme) "PLAIN-MD5" +}; + +static struct mysql_connection *mysql_connections = NULL; + +static int mysql_conn_open(struct mysql_connection *conn); +static void mysql_conn_close(struct mysql_connection *conn); + +void db_mysql_query(struct mysql_connection *conn, const char *query, + struct mysql_request *request) +{ + MYSQL_RES *res; + int failed; + + if (!conn->connected) { + if (!mysql_conn_open(conn)) { + request->callback(conn, request, NULL); + return; + } + } + + if (verbose_debug) + i_info("MYSQL: Performing query: %s", query); + + if (mysql_query(conn->mysql, query)) + i_info("MYSQL: Error executing query \"%s\": %s", query, + mysql_error(conn->mysql)); + + if ((res = mysql_store_result(conn->mysql))) + failed = FALSE; + else { + i_info("MYSQL: Error retrieving results: %s", + mysql_error(conn->mysql)); + failed = TRUE; + } + + request->callback(conn, request, failed ? NULL : res); + mysql_free_result(res); + i_free(request); +} + +static int mysql_conn_open(struct mysql_connection *conn) +{ + if (conn->connected) + return TRUE; + + if (conn->mysql == NULL) { + conn->mysql = mysql_init(NULL); + if (conn->mysql == NULL) { + i_error("MYSQL: mysql_init failed"); + return FALSE; + } + + if (!mysql_real_connect(conn->mysql, conn->set.db_host, + conn->set.db_user, conn->set.db_passwd, + conn->set.db, + atoi(conn->set.db_port), + conn->set.db_unix_socket, + strtoul(conn->set.db_client_flags, + NULL, 10))) { + i_error("MYSQL: Can't connect to database %s: %s", + conn->set.db, mysql_error(conn->mysql)); + return FALSE; + } + } + + conn->connected = TRUE; + return TRUE; +} + +static void mysql_conn_close(struct mysql_connection *conn) +{ + conn->connected = FALSE; + + if (conn->mysql != NULL) { + mysql_close(conn->mysql); + conn->mysql = NULL; + } +} + +static struct mysql_connection *mysql_conn_find(const char *config_path) +{ + struct mysql_connection *conn; + + for (conn = mysql_connections; conn != NULL; conn = conn->next) { + if (strcmp(conn->config_path, config_path) == 0) + return conn; + } + + return NULL; +} + +static const char *parse_setting(const char *key, const char *value, + void *context) +{ + struct mysql_connection *conn = context; + + return parse_setting_from_defs(conn->pool, setting_defs, + &conn->set, key, value); +} + +struct mysql_connection *db_mysql_init(const char *config_path) +{ + struct mysql_connection *conn; + pool_t pool; + + conn = mysql_conn_find(config_path); + if (conn != NULL) { + conn->refcount++; + return conn; + } + + pool = pool_alloconly_create("mysql_connection", 1024); + conn = p_new(pool, struct mysql_connection, 1); + conn->pool = pool; + + conn->refcount = 1; + + conn->config_path = p_strdup(pool, config_path); + conn->set = default_mysql_settings; + settings_read(config_path, parse_setting, conn); + + (void)mysql_conn_open(conn); + + conn->next = mysql_connections; + mysql_connections = conn; + return conn; +} + +void db_mysql_unref(struct mysql_connection *conn) +{ + if (--conn->refcount > 0) + return; + + mysql_conn_close(conn); + pool_unref(conn->pool); +} + +#endif diff -u -r --new-file work/dovecot-0.99.10/src/auth/db-mysql.h work.patched/dovecot-0.99.10/src/auth/db-mysql.h --- work/dovecot-0.99.10/src/auth/db-mysql.h Wed Dec 31 16:00:00 1969 +++ work.patched/dovecot-0.99.10/src/auth/db-mysql.h Tue Sep 30 12:24:00 2003 @@ -0,0 +1,51 @@ +#ifndef __DB_MYSQL_H +#define __DB_MYSQL_H + +#include <mysql.h> + +struct mysql_connection; +struct mysql_request; + +typedef void mysql_query_callback_t(struct mysql_connection *conn, + struct mysql_request *request, + MYSQL_RES *res); + +struct mysql_settings { + const char *db_host; + const char *db_port; + const char *db_unix_socket; + const char *db; + const char *db_user; + const char *db_passwd; + const char *db_client_flags; + const char *password_query; + const char *user_query; + const char *default_pass_scheme; +}; + +struct mysql_connection { + struct mysql_connection *next; + + pool_t pool; + int refcount; + + char *config_path; + struct mysql_settings set; + + MYSQL *mysql; + + unsigned int connected:1; +}; + +struct mysql_request { + mysql_query_callback_t *callback; + void *context; +}; + +void db_mysql_query(struct mysql_connection *conn, const char *query, + struct mysql_request *request); + +struct mysql_connection *db_mysql_init(const char *config_path); +void db_mysql_unref(struct mysql_connection *conn); + +#endif diff -u -r --new-file work/dovecot-0.99.10/src/auth/master-connection.c work.patched/dovecot-0.99.10/src/auth/master-connection.c --- work/dovecot-0.99.10/src/auth/master-connection.c Mon May 26 08:27:13 2003 +++ work.patched/dovecot-0.99.10/src/auth/master-connection.c Tue Sep 30 12:24:00 2003 @@ -55,7 +55,7 @@ reply.virtual_user_idx = reply_add(buf, user->virtual_user); reply.mail_idx = reply_add(buf, user->mail); - p = strstr(user->home, "/./"); + p = user->home ? strstr(user->home, "/./") : NULL; if (p == NULL) { reply.home_idx = reply_add(buf, user->home); reply.chroot_idx = reply_add(buf, NULL); diff -u -r --new-file work/dovecot-0.99.10/src/auth/passdb-mysql.c work.patched/dovecot-0.99.10/src/auth/passdb-mysql.c --- work/dovecot-0.99.10/src/auth/passdb-mysql.c Wed Dec 31 16:00:00 1969 +++ work.patched/dovecot-0.99.10/src/auth/passdb-mysql.c Tue Sep 30 12:24:00 2003 @@ -0,0 +1,171 @@ +/* Copyright (C) 2003 Alex Howansky, Timo Sirainen */ + +#include "config.h" +#undef HAVE_CONFIG_H + +#ifdef PASSDB_MYSQL + +#include "common.h" +#include "str.h" +#include "strescape.h" +#include "var-expand.h" +#include "password-scheme.h" +#include "db-mysql.h" +#include "passdb.h" + +#include <mysql.h> +#include <stdlib.h> +#include <string.h> + +struct passdb_mysql_connection { + struct mysql_connection *conn; +}; + +struct passdb_mysql_request { + struct mysql_request request; + + enum passdb_credentials credentials; + union { + verify_plain_callback_t *verify_plain; + lookup_credentials_callback_t *lookup_credentials; + } callback; + + char password[1]; +}; + +static struct passdb_mysql_connection *passdb_mysql_conn; + +static void mysql_handle_request(struct mysql_connection *conn, + struct mysql_request *request, MYSQL_RES *res) +{ + struct passdb_mysql_request *mysql_request = + (struct passdb_mysql_request *) request; + struct auth_request *auth_request = request->context; + const char *user, *password, *scheme; + int ret = 0; + + user = auth_request->user; + password = NULL; + + if (res != NULL) { + if (mysql_num_rows(res) == 0) { + if (verbose) + i_info("mysql(%s): Unknown user", user); + } else if (mysql_num_rows(res) > 1) { + i_error("mysql(%s): Multiple matches for user", user); + } else if (mysql_num_fields(res) != 1) { + i_error("mysql(%s): Password query returned " + "more than one field", user); + } else { + MYSQL_ROW row; + + row = mysql_fetch_row(res); + if (row) + password = t_strdup(row[0]); + } + } + + scheme = password_get_scheme(&password); + if (scheme == NULL) { + scheme = conn->set.default_pass_scheme; + i_assert(scheme != NULL); + } + + if (mysql_request->credentials != -1) { + passdb_handle_credentials(mysql_request->credentials, + user, password, scheme, + mysql_request->callback.lookup_credentials, + auth_request); + return; + } + + /* verify plain */ + if (password == NULL) { + mysql_request->callback.verify_plain(PASSDB_RESULT_USER_UNKNOWN, + auth_request); + return; + } + + ret = password_verify(mysql_request->password, password, + scheme, user); + if (ret < 0) + i_error("mysql(%s): Unknown password scheme %s", user, scheme); + else if (ret == 0) { + if (verbose) + i_info("mysql(%s): Password mismatch", user); + } + + mysql_request->callback.verify_plain(ret > 0 ? PASSDB_RESULT_OK : + PASSDB_RESULT_PASSWORD_MISMATCH, + auth_request); +} + +static void mysql_lookup_pass(struct auth_request *auth_request, + struct mysql_request *mysql_request) +{ + struct mysql_connection *conn = passdb_mysql_conn->conn; + const char *query; + string_t *str; + + str = t_str_new(512); + var_expand(str, conn->set.password_query, + str_escape(auth_request->user), NULL); + query = str_c(str); + + mysql_request->callback = mysql_handle_request; + mysql_request->context = auth_request; + + db_mysql_query(conn, query, mysql_request); +} + +static void +mysql_verify_plain(struct auth_request *request, const char *password, + verify_plain_callback_t *callback) +{ + struct passdb_mysql_request *mysql_request; + + mysql_request = i_malloc(sizeof(struct passdb_mysql_request) + + strlen(password)); + mysql_request->credentials = -1; + mysql_request->callback.verify_plain = callback; + strcpy(mysql_request->password, password); + + mysql_lookup_pass(request, &mysql_request->request); +} + +static void mysql_lookup_credentials(struct auth_request *request, + enum passdb_credentials credentials, + lookup_credentials_callback_t *callback) +{ + struct passdb_mysql_request *mysql_request; + + mysql_request = i_new(struct passdb_mysql_request, 1); + mysql_request->credentials = credentials; + mysql_request->callback.lookup_credentials = callback; + + mysql_lookup_pass(request, &mysql_request->request); +} + +static void passdb_mysql_init(const char *args) +{ + struct mysql_connection *conn; + + passdb_mysql_conn = i_new(struct passdb_mysql_connection, 1); + passdb_mysql_conn->conn = conn = db_mysql_init(args); +} + +static void passdb_mysql_deinit(void) +{ + db_mysql_unref(passdb_mysql_conn->conn); + i_free(passdb_mysql_conn); +} + +struct passdb_module passdb_mysql = { + passdb_mysql_init, + passdb_mysql_deinit, + + mysql_verify_plain, + mysql_lookup_credentials +}; + +#endif diff -u -r --new-file work/dovecot-0.99.10/src/auth/passdb.c work.patched/dovecot-0.99.10/src/auth/passdb.c --- work/dovecot-0.99.10/src/auth/passdb.c Sun May 18 05:26:28 2003 +++ work.patched/dovecot-0.99.10/src/auth/passdb.c Tue Sep 30 12:24:00 2003 @@ -110,6 +110,10 @@ if (strcasecmp(name, "pgsql") == 0) passdb = &passdb_pgsql; #endif +#ifdef PASSDB_MYSQL + if (strcasecmp(name, "mysql") == 0) + passdb = &passdb_mysql; +#endif #ifdef HAVE_MODULES passdb_module = passdb != NULL ? NULL : auth_module_open(name); if (passdb_module != NULL) { diff -u -r --new-file work/dovecot-0.99.10/src/auth/passdb.h work.patched/dovecot-0.99.10/src/auth/passdb.h --- work/dovecot-0.99.10/src/auth/passdb.h Thu Mar 20 07:46:33 2003 +++ work.patched/dovecot-0.99.10/src/auth/passdb.h Tue Sep 30 12:24:00 2003 @@ -58,6 +58,7 @@ extern struct passdb_module passdb_vpopmail; extern struct passdb_module passdb_ldap; extern struct passdb_module passdb_pgsql; +extern struct passdb_module passdb_mysql; void passdb_init(void); void passdb_deinit(void); diff -u -r --new-file work/dovecot-0.99.10/src/auth/userdb-mysql.c work.patched/dovecot-0.99.10/src/auth/userdb-mysql.c --- work/dovecot-0.99.10/src/auth/userdb-mysql.c Wed Dec 31 16:00:00 1969 +++ work.patched/dovecot-0.99.10/src/auth/userdb-mysql.c Tue Sep 30 12:24:00 2003 @@ -0,0 +1,160 @@ +/* Copyright (C) 2003 Alex Howansky, Timo Sirainen */ + +#include "config.h" +#undef HAVE_CONFIG_H + +#ifdef USERDB_MYSQL + +#include "common.h" +#include "str.h" +#include "strescape.h" +#include "var-expand.h" +#include "db-mysql.h" +#include "userdb.h" + +#include <mysql.h> +#include <stdlib.h> +#include <string.h> + +struct userdb_mysql_connection { + struct mysql_connection *conn; +}; + +struct userdb_mysql_request { + struct mysql_request request; + userdb_callback_t *userdb_callback; + + char username[1]; /* variable width */ +}; + +static struct userdb_mysql_connection *userdb_mysql_conn; + +static int is_result_valid(MYSQL_RES *res) +{ + int i, n_fields, found; + MYSQL_FIELD *fields; + + if (res == NULL) { + i_error("MYSQL: Query failed"); + return FALSE; + } + + if (mysql_num_rows(res) == 0) { + if (verbose) + i_error("MYSQL: Authenticated user not found"); + return FALSE; + } + + n_fields = mysql_num_fields(res); + fields = mysql_fetch_fields(res); + + /* Make sure the 'uid' field exists. */ + for (found = 0, i = 0; i < n_fields; i++) + if (strcmp("uid", fields[i].name) == 0) { + found = 1; + break; + } + + if (!found) { + i_error("MYSQL: User query did not return 'uid' field"); + return FALSE; + } + + /* Make sure the 'gid' field exists. */ + for (found = 0, i = 0; i < n_fields; i++) + if (strcmp("gid", fields[i].name) == 0) { + found = 1; + break; + } + + if (!found) { + i_error("MYSQL: User query did not return 'gid' field"); + return FALSE; + } + + return TRUE; +} + +static const char *my_get_str(MYSQL_RES *res, MYSQL_ROW row, const char *field) +{ + int i, n_fields; + unsigned long *lengths; + MYSQL_FIELD *fields; + + n_fields = mysql_num_fields(res); + lengths = mysql_fetch_lengths(res); + fields = mysql_fetch_fields(res); + for (i = 0; i < n_fields; i++) + if (strcmp(field, fields[i].name) == 0) + return (const char *) lengths[i] == 0 ? + NULL : t_strdup(row[i]); + + return NULL; +} + +static void mysql_handle_request(struct mysql_connection *conn __attr_unused__, + struct mysql_request *request, MYSQL_RES *res) +{ + struct userdb_mysql_request *urequest = + (struct userdb_mysql_request *) request; + struct user_data user; + MYSQL_ROW row; + + if (res != NULL && is_result_valid(res) && + (row = mysql_fetch_row(res))) { + memset(&user, 0, sizeof(user)); + user.virtual_user = urequest->username; + user.system_user = my_get_str(res, row, "system_user"); + user.home = my_get_str(res, row, "home"); + user.mail = my_get_str(res, row, "mail"); + user.uid = atoi(my_get_str(res, row, "uid")); /* XXX leak */ + user.gid = atoi(my_get_str(res, row, "gid")); /* XXX leak */ + urequest->userdb_callback(&user, request->context); + } else { + urequest->userdb_callback(NULL, request->context); + } +} + +static void userdb_mysql_lookup(const char *user, userdb_callback_t *callback, + void *context) +{ + struct mysql_connection *conn = userdb_mysql_conn->conn; + struct userdb_mysql_request *request; + const char *query; + string_t *str; + + str = t_str_new(512); + var_expand(str, conn->set.user_query, str_escape(user), NULL); + query = str_c(str); + + request = i_malloc(sizeof(struct userdb_mysql_request) + strlen(user)); + request->request.callback = mysql_handle_request; + request->request.context = context; + request->userdb_callback = callback; + strcpy(request->username, user); + + db_mysql_query(conn, query, &request->request); +} + +static void userdb_mysql_init(const char *args) +{ + struct mysql_connection *conn; + + userdb_mysql_conn = i_new(struct userdb_mysql_connection, 1); + userdb_mysql_conn->conn = conn = db_mysql_init(args); +} + +static void userdb_mysql_deinit(void) +{ + db_mysql_unref(userdb_mysql_conn->conn); + i_free(userdb_mysql_conn); +} + +struct userdb_module userdb_mysql = { + userdb_mysql_init, + userdb_mysql_deinit, + + userdb_mysql_lookup +}; + +#endif diff -u -r --new-file work/dovecot-0.99.10/src/auth/userdb.c work.patched/dovecot-0.99.10/src/auth/userdb.c --- work/dovecot-0.99.10/src/auth/userdb.c Sun May 18 05:26:28 2003 +++ work.patched/dovecot-0.99.10/src/auth/userdb.c Tue Sep 30 12:24:00 2003 @@ -49,6 +49,10 @@ if (strcasecmp(name, "pgsql") == 0) userdb = &userdb_pgsql; #endif +#ifdef USERDB_MYSQL + if (strcasecmp(name, "mysql") == 0) + userdb = &userdb_mysql; +#endif #ifdef HAVE_MODULES userdb_module = userdb != NULL ? NULL : auth_module_open(name); if (userdb_module != NULL) { diff -u -r --new-file work/dovecot-0.99.10/src/auth/userdb.h work.patched/dovecot-0.99.10/src/auth/userdb.h --- work/dovecot-0.99.10/src/auth/userdb.h Sun May 18 05:26:28 2003 +++ work.patched/dovecot-0.99.10/src/auth/userdb.h Tue Sep 30 12:24:00 2003 @@ -29,6 +29,7 @@ extern struct userdb_module userdb_vpopmail; extern struct userdb_module userdb_ldap; extern struct userdb_module userdb_pgsql; +extern struct userdb_module userdb_mysql; void userdb_init(void); void userdb_deinit(void);

2 1

Re: [Dovecot] PATCH: mysql authentication
by Matthew Reimer 03 Oct '03

03 Oct '03

Timo Sirainen wrote: > > On Saturday, Aug 30, 2003, at 02:16 Europe/Helsinki, Matthew Reimer > wrote: > >> Here's a patch that implements mysql authentication. I started with >> the pgsql files and tweaked them to use mysql instead. It works for >> me, but there might be a couple of memory leaks. I'm welcome to >> suggestions on how to clean it up so it can be committed. > > Thank you. I'll look at it more closely later, but it looked fine with > a quick look. > > It would be nice to be able to use asynchronous database lookups. I'm > not sure how easy that is with MySQL, of if it's possible at all. With > PostgreSQL it looked annoyingly difficult so I haven't done it yet. > > Synchronous calls anyway mean that there's only one SQL statement > executing at a time and that may slow down the authentication if > there's a _lot_ of users logging in constantly. If that's a problem, > growing auth_count should help at least some. It specifies the number > of auth processes that respond to the authentication queries. > > And some day I'll probably move the sql stuff into separate lib-sql > and have only a single sql authenticator.. I'm not sure what you mean by asynchronous database lookups. Do you mean you'd like to be able to fire off a db lookup and then come back later to get the results? Like blocking vs non-blocking? I've pasted what may be relevant mysql documentation below in case it might help answer the question. N db handles could be allocated, giving us N simultaneous lookups. Matt --- From http://www.mysql.com/doc/en/C_API_function_overview.html: There are two ways for a client to process result sets. One way is to retrieve the entire result set all at once by calling mysql_store_result(). This function acquires from the server all the rows returned by the query and stores them in the client. The second way is for the client to initiate a row-by-row result set retrieval by calling mysql_use_result(). This function initialises the retrieval, but does not actually get any rows from the server. In both cases, you access rows by calling mysql_fetch_row(). With mysql_store_result(), mysql_fetch_row() accesses rows that have already been fetched from the server. With mysql_use_result(), mysql_fetch_row() actually retrieves the row from the server. Information about the size of the data in each row is available by calling mysql_fetch_lengths(). After you are done with a result set, call mysql_free_result() to free the memory used for it. The two retrieval mechanisms are complementary. Client programs should choose the approach that is most appropriate for their requirements. In practice, clients tend to use mysql_store_result() more commonly. An advantage of mysql_store_result() is that because the rows have all been fetched to the client, you not only can access rows sequentially, you can move back and forth in the result set using mysql_data_seek() or mysql_row_seek() to change the current row position within the result set. You can also find out how many rows there are by calling mysql_num_rows(). On the other hand, the memory requirements for mysql_store_result() may be very high for large result sets and you are more likely to encounter out-of-memory conditions. An advantage of mysql_use_result() is that the client requires less memory for the result set because it maintains only one row at a time (and because there is less allocation overhead, mysql_use_result() can be faster). Disadvantages are that you must process each row quickly to avoid tying up the server, you don't have random access to rows within the result set (you can only access rows sequentially), and you don't know how many rows are in the result set until you have retrieved them all. Furthermore, you must retrieve all the rows even if you determine in mid-retrieval that you've found the information you were looking for. --- end

1 0

[Dovecot] can't read attachments using javamail with dovecot
by Jonas Bosson 03 Oct '03

03 Oct '03

Dear folks, this might be a java-bug, but it seems to occur only when connecting to dovecot-IMAP. UW and Cyrus-ditto works, while when I try to read attachments (base64), I get slapped in the face with this: java.lang.NullPointerException at com.sun.mail.iap.Response.parse(Response.java:99) at com.sun.mail.iap.Response.<init>(Response.java:68) at com.sun.mail.imap.protocol.IMAPResponse.<init>(IMAPResponse.java:31) at com.sun.mail.imap.protocol.IMAPResponse.readResponse(IMAPResponse.java:105) at com.sun.mail.imap.protocol.IMAPProtocol.readResponse(IMAPProtocol.java:153) at com.sun.mail.iap.Protocol.command(Protocol.java:215) at com.sun.mail.imap.protocol.IMAPProtocol.fetch(IMAPProtocol.java:882) at com.sun.mail.imap.protocol.IMAPProtocol.fetch(IMAPProtocol.java:874) at com.sun.mail.imap.protocol.IMAPProtocol.fetchBody(IMAPProtocol.java:677) at com.sun.mail.imap.IMAPInputStream.fill(IMAPInputStream.java:74) at com.sun.mail.imap.IMAPInputStream.read(IMAPInputStream.java:105) at com.sun.mail.util.BASE64DecoderStream.decode(BASE64DecoderStream.java:143) at com.sun.mail.util.BASE64DecoderStream.read(BASE64DecoderStream.java:54) at se.illuminet.httpd.mail.MailXMLService.serviceXml(MailXMLService.java:361) This occurs in booth javamail 1.2 and 1.3(.1) using dovecot. Of course this unfriendly/unhandled response is a problem with javamail while biting the dust. Further analysis points to that the reading works OK up until 2^16 bytes, so it fails either in reading the tail of the attachment or resuming after the first buffered data is consumed. I tried the BODYSTRCUTURE-patch (booth #1 and then #2), but it didn't help. Now I am fresh out of ideas. The java-bug has a three week delay to surface on "bug-parade". But I still have to explain why it works in UW/Cyrus and not with dovecot. Next step would be to add trace-lines in dovecot. Any ideas? /Jonas

2 6

[Dovecot] pop3s in Outlook
by Antonin Karasek 03 Oct '03

03 Oct '03

Hi, I'm using Dovecot for pop3-ssl. Unofortunatelly, most of my users are using MS Outlook. I want them to be able to remove standard mesage: "The certificat is not signed by...", but I don't know how :-( In the dialog isn't a button "Trust this certificate forever"... Is there anybody, who know, how to solve this? Many thanks.

2 1

[Dovecot] Handling of X-Status flags
by Bernard Blackham 29 Sep '03

29 Sep '03

Hi all, I've done a bit of searching and haven't seen anybody else coming across this problem yet: I noticed that Dovecot uses the opposite flags for marking messages as deleted and draft to most other MUAs I've seen or used: With PINE, mutt and uw-imapd at least, messages are marked with X-Status 'D' for Deleted, and 'T' for drafT. Dovecot reverses this behaviour, using 'D' for Draft, and 'T' for Trashed. Was there any reason behind this? Or have I gone loopy? At our site, we have users reading mail with a mix of PINE locally, and through dovecot via WebMail and there seems to arise a bit of confusion between the two flags. Attached is a patch that reverses this behaviour (prepared against 0.99.10 but applies with a little fuzz to cvs). I'd like to hear people's comments on the issue... is it just me? :) Thanks, Bernard. -- Bernard Blackham bernard at blackham dot com dot au

2 2

[Dovecot] UIDPLUS?
by Keith Edmunds 29 Sep '03

29 Sep '03

Any plans to implement UIDPLUS in Dovecot? Keith

2 1

[Dovecot] Odd problem with dovecot segfaulting
by Tim Miller 29 Sep '03

29 Sep '03

Hi All, I installed dovecot on one of my servers the other day, and I want to use it in a vhosting environment. To this end, I have set it up to use password file authentication with a passwd file specified by me. This file will contain both system users and virtual accounts. To test it, I set up two accounts in the dovecot passwd file. One is a system user, I give his home dir in the correct field, along with the MD5 hash of his password in its field, and everything seems to work OK (he can login, read mail out of /var/spool/mail/user etc.). The seconmd account is a vhosted account, and I set the uid and gid to that under which the vhosting account exists. I did not set a home dir, but I set a mail dir in /var/spool/vmail/imap/vhost/user, and made this dir group writeable by dovecot. The user can login, but immediately upon authentication, dovecot segfaults (the log reports an "Internal login failure" and the authentication process is killed with signal 11, i.e. a segfault). Has anyone encountered this before? Is this even the right way to set up vhosting (I don't want to go with LDAP or SQL authentication right at the moment, but I may move to that later on)? Are there any things I should look for (this is probably due to something I've done wrong) or make dovecot be a bit more verbose in reporting errors to its log? Thanks in advance for any help. From what I've seen so far, dovecot looks like an excellent product. Best, Tim Miller

2 1

[Dovecot] pine and mozilla at the same time
by Gasha 26 Sep '03

26 Sep '03

Hi all, what is the best way to read e-mail from server using "pine" ?? I would like to use graphical IMAP client, mozilla for example. And sometimes run pine from shell. mbox or Maildir? Or maybe setup pine to use IMAP server on "localhost" ?? Gasha

2 1

[Dovecot] can't read attachments using javamail with dovecot
by Jonas Bosson 25 Sep '03

25 Sep '03

Dear folks, this might be a javamail-bug, but it seems to occur only when connecting to dovecot-IMAP. UW and Cyrus-ditto works, while when I try to read attachments (base64), I get slapped in the face with this: java.lang.NullPointerException at com.sun.mail.iap.Response.parse(Response.java:99) at com.sun.mail.iap.Response.<init>(Response.java:68) at com.sun.mail.imap.protocol.IMAPResponse.<init>(IMAPResponse.java:31) at com.sun.mail.imap.protocol.IMAPResponse.readResponse(IMAPResponse.java:105) at com.sun.mail.imap.protocol.IMAPProtocol.readResponse(IMAPProtocol.java:153) at com.sun.mail.iap.Protocol.command(Protocol.java:215) at com.sun.mail.imap.protocol.IMAPProtocol.fetch(IMAPProtocol.java:882) at com.sun.mail.imap.protocol.IMAPProtocol.fetch(IMAPProtocol.java:874) at com.sun.mail.imap.protocol.IMAPProtocol.fetchBody(IMAPProtocol.java:677) at com.sun.mail.imap.IMAPInputStream.fill(IMAPInputStream.java:74) at com.sun.mail.imap.IMAPInputStream.read(IMAPInputStream.java:105) at com.sun.mail.util.BASE64DecoderStream.decode(BASE64DecoderStream.java:143) at com.sun.mail.util.BASE64DecoderStream.read(BASE64DecoderStream.java:54) at se.illuminet.httpd.mail.MailXMLService.serviceXml(MailXMLService.java:361) This occurs in booth javamail 1.2 and 1.3(.1) using dovecot. Of course this unfriendly/unhandled response is a problem with javamail while it bites the dust. Further analysis points to that the reading works OK up until 2^16 bytes, so it fails either in reading the tail of the attachment or resuming after the first buffered data is consumed. I tried the BODYSTRCUTURE-patch (booth #1 and then #2), but it didn't help. Now I am fresh out of ideas. The java-bug has a three week delay to surface on "bug-parade". But I still have to explain why it works in UW/Cyrus and not with dovecot. Next step would be to add trace-lines in dovecot. Any ideas? /Jonas

1 0

[Dovecot] Multiple instances of .customflags staying open
by Ron 25 Sep '03

25 Sep '03

# cat /proc/version Linux version 2.4.20-18.9 (bhcompile(a)daffy.perf.redhat.com) (gcc version 3.2.2 20030222 (Red Hat Linux 3.2.2-5)) #1 Thu May 29 07:09:43 EDT 2003 # dovecot --version 0.99.10 I've just recently noticed a serious problem with my system. After about an hour or so I get errors in /var/log/maillog such as this; Sep 21 06:40:16 the-system imap(ray): opendir() failed with file \ \/home/ray/Maildir//new: Too many open files I investigated with 'lsof' and found that many copies of '.customflags' were open for each and every folder. ie; Each folder's '.customflags' file was open 15 times! I suspect that postfix is not able to store newly collected email while this is occuring, therefore I am likely losing messages. I've tried with multiple mail clients (Sylpheed & Evolution) and multiple users, always with the same result. Further investigation indicates that each time the client scans for new mail another instance of each and every '.customflags' is opened. As I have the client set for checking at five minute intervals then it was probably 75 minutes until the client barfed. Less, if I manualy scan for new mail a few times. If I shutdown the client and restart it then everything is fine for about an hour. Running 'lsof /home/ray/Maildir/.customflags' on the server I can see the list of files increasing each time the client checks for new mail. Any help would be appreciated!

4 14