[Dovecot] passing remote ip to pam

dean gaudet dean-list-dovecot at arctic.org
Fri Jul 9 04:55:22 EEST 2004


to improve forensic log info i want to set the PAM_RHOST value to the
remote ip (which pam logs as rhost=foo in failure messages).  i didn't
look to see if anything has been done in this way on CVS because i'm still
on 0.99.10.6.

below is a bit of a hack.  in some sense the remote_ip might make more
sense in the AUTH_LOGIN_REQUEST_NEW packet rather than the continue
packet... but that looked like i'd have to change more code :)

btw -- is there anything which stops mech_plain_auth_continue from doing a
somewhat unbounded pstrdup if you send "a\0b" for the auth string?

-dean

diff -rpu dovecot-0.99.10.6.deborig/debian/changelog dovecot-0.99.10.6/debian/changelog
--- dovecot-0.99.10.6.deborig/debian/changelog	2004-07-08 18:11:55.000000000 -0700
+++ dovecot-0.99.10.6/debian/changelog	2004-07-08 18:34:40.000000000 -0700
@@ -1,3 +1,9 @@
+dovecot (0.99.10.6-3.dg1) unstable; urgency=low
+
+  * hack a solution to pass PAM_RHOST the remote ip
+
+ -- dean gaudet <dean at arctic.org>  Thu,  8 Jul 2004 18:34:26 -0700
+
 dovecot (0.99.10.6-3) unstable; urgency=low

   * Patched so dovecot follows symlinks to directories again.
diff -rpu dovecot-0.99.10.6.deborig/src/auth/auth-login-interface.h dovecot-0.99.10.6/src/auth/auth-login-interface.h
--- dovecot-0.99.10.6.deborig/src/auth/auth-login-interface.h	2003-05-18 05:26:28.000000000 -0700
+++ dovecot-0.99.10.6/src/auth/auth-login-interface.h	2004-07-08 18:32:22.000000000 -0700
@@ -1,6 +1,8 @@
 #ifndef __AUTH_LOGIN_INTERFACE_H
 #define __AUTH_LOGIN_INTERFACE_H

+#include "network.h"
+
 /* max. size for auth_login_request_continue.data[] */
 #define AUTH_LOGIN_MAX_REQUEST_DATA_SIZE 4096

@@ -57,6 +59,8 @@ struct auth_login_request_continue {
 	enum auth_login_request_type type; /* AUTH_LOGIN_REQUEST_CONTINUE */
 	unsigned int id;

+	struct ip_addr remote_ip;
+
 	size_t data_size;
 	/* unsigned char data[]; */
 };
diff -rpu dovecot-0.99.10.6.deborig/src/auth/mech-plain.c dovecot-0.99.10.6/src/auth/mech-plain.c
--- dovecot-0.99.10.6.deborig/src/auth/mech-plain.c	2003-05-18 05:26:28.000000000 -0700
+++ dovecot-0.99.10.6/src/auth/mech-plain.c	2004-07-08 18:25:14.000000000 -0700
@@ -21,6 +21,7 @@ mech_plain_auth_continue(struct auth_req
 	size_t i, count, len;

 	auth_request->callback = callback;
+	auth_request->remote_ip = request->remote_ip;

 	/* authorization ID \0 authentication ID \0 pass.
 	   we'll ignore authorization ID for now. */
diff -rpu dovecot-0.99.10.6.deborig/src/auth/mech.h dovecot-0.99.10.6/src/auth/mech.h
--- dovecot-0.99.10.6.deborig/src/auth/mech.h	2003-05-18 05:26:28.000000000 -0700
+++ dovecot-0.99.10.6/src/auth/mech.h	2004-07-08 18:31:42.000000000 -0700
@@ -1,6 +1,7 @@
 #ifndef __MECH_H
 #define __MECH_H

+#include "network.h"
 #include "auth-login-interface.h"

 struct login_connection;
@@ -11,6 +12,7 @@ typedef void mech_callback_t(struct auth
 struct auth_request {
 	pool_t pool;
 	char *user;
+	struct ip_addr remote_ip;

 	struct login_connection *conn;
 	unsigned int id;
diff -rpu dovecot-0.99.10.6.deborig/src/auth/passdb-pam.c dovecot-0.99.10.6/src/auth/passdb-pam.c
--- dovecot-0.99.10.6.deborig/src/auth/passdb-pam.c	2003-11-08 06:17:51.000000000 -0800
+++ dovecot-0.99.10.6/src/auth/passdb-pam.c	2004-07-08 18:32:52.000000000 -0700
@@ -166,13 +166,23 @@ static int pam_userpass_conv(int num_msg
 	return PAM_SUCCESS;
 }

-static int pam_auth(pam_handle_t *pamh, const char *user, const char **error)
+static int pam_auth(pam_handle_t *pamh, const char *user,
+		const struct ip_addr *remote_ip, const char **error)
 {
 	void *item;
 	int status;
+	const char *addr;

 	*error = NULL;

+	if ((addr = net_ip2addr(remote_ip))
+		&& (status = pam_set_item(pamh, PAM_RHOST, addr))
+			!= PAM_SUCCESS) {
+		*error = t_strdup_printf("pam_set_item(PAM_RHOST, %s) failed: %s",
+					 addr, pam_strerror(pamh, status));
+		return status;
+	}
+
 	if ((status = pam_authenticate(pamh, 0)) != PAM_SUCCESS) {
 		*error = t_strdup_printf("pam_authenticate(%s) failed: %s",
 					 user, pam_strerror(pamh, status));
@@ -205,7 +215,8 @@ static int pam_auth(pam_handle_t *pamh,

 static void
 pam_verify_plain_child(const char *service, const char *user,
-		       const char *password, int fd)
+		       const char *password, const struct ip_addr *remote_ip,
+		       int fd)
 {
 	pam_handle_t *pamh;
 	struct pam_userpass userpass;
@@ -228,7 +239,7 @@ pam_verify_plain_child(const char *servi
 		str = t_strdup_printf("pam_start(%s) failed: %s",
 				      user, pam_strerror(pamh, status));
 	} else {
-		status = pam_auth(pamh, user, &str);
+		status = pam_auth(pamh, user, remote_ip, &str);
 		if ((status2 = pam_end(pamh, status)) == PAM_SUCCESS) {
 			/* FIXME: check for PASSDB_RESULT_UNKNOWN_USER
 			   somehow? */
@@ -353,7 +364,7 @@ pam_verify_plain(struct auth_request *re

 	if (pid == 0) {
 		(void)close(fd[0]);
-		pam_verify_plain_child(service, request->user, password, fd[1]);
+		pam_verify_plain_child(service, request->user, password, &request->remote_ip, fd[1]);
 		_exit(0);
 	}

diff -rpu dovecot-0.99.10.6.deborig/src/imap-login/client-authenticate.c dovecot-0.99.10.6/src/imap-login/client-authenticate.c
--- dovecot-0.99.10.6.deborig/src/imap-login/client-authenticate.c	2003-11-24 11:50:55.000000000 -0800
+++ dovecot-0.99.10.6/src/imap-login/client-authenticate.c	2004-07-08 18:21:19.000000000 -0700
@@ -140,7 +140,7 @@ static void login_callback(struct auth_r
 	case 0:
 		/* continue */
 		ptr = buffer_get_data(client->plain_login, &size);
-		auth_continue_request(request, ptr, size);
+		auth_continue_request(request, ptr, size, &client->common.ip);

 		buffer_set_used_size(client->plain_login, 0);
 		break;
@@ -270,7 +270,8 @@ static void client_auth_input(void *cont
 	} else {
 		auth_continue_request(client->common.auth_request,
 				      buffer_get_data(buf, NULL),
-				      buffer_get_used_size(buf));
+				      buffer_get_used_size(buf),
+				      &client->common.ip);
 	}

 	/* clear sensitive data */
diff -rpu dovecot-0.99.10.6.deborig/src/login-common/auth-connection.c dovecot-0.99.10.6/src/login-common/auth-connection.c
--- dovecot-0.99.10.6.deborig/src/login-common/auth-connection.c	2003-05-26 08:27:13.000000000 -0700
+++ dovecot-0.99.10.6/src/login-common/auth-connection.c	2004-07-08 18:33:38.000000000 -0700
@@ -335,13 +335,21 @@ int auth_init_request(enum auth_mech mec
 }

 void auth_continue_request(struct auth_request *request,
-			   const unsigned char *data, size_t data_size)
+			   const unsigned char *data, size_t data_size,
+			   const struct ip_addr *remote_ip)
 {
 	struct auth_login_request_continue auth_request;

 	/* send continued request to auth */
 	auth_request.type = AUTH_LOGIN_REQUEST_CONTINUE;
 	auth_request.id = request->id;
+	if (remote_ip) {
+		auth_request.remote_ip = *remote_ip;
+	}
+	else {
+		memset(&auth_request.remote_ip,
+			0, sizeof(auth_request.remote_ip));
+	}
 	auth_request.data_size = data_size;

 	if (o_stream_send(request->conn->output, &auth_request,
diff -rpu dovecot-0.99.10.6.deborig/src/login-common/auth-connection.h dovecot-0.99.10.6/src/login-common/auth-connection.h
--- dovecot-0.99.10.6.deborig/src/login-common/auth-connection.h	2003-02-09 23:56:23.000000000 -0800
+++ dovecot-0.99.10.6/src/login-common/auth-connection.h	2004-07-08 18:20:58.000000000 -0700
@@ -48,7 +48,8 @@ int auth_init_request(enum auth_mech mec
 		      const char **error);

 void auth_continue_request(struct auth_request *request,
-			   const unsigned char *data, size_t data_size);
+			   const unsigned char *data, size_t data_size,
+			   const struct ip_addr *remote_ip);

 void auth_abort_request(struct auth_request *request);

diff -rpu dovecot-0.99.10.6.deborig/src/pop3-login/client-authenticate.c dovecot-0.99.10.6/src/pop3-login/client-authenticate.c
--- dovecot-0.99.10.6.deborig/src/pop3-login/client-authenticate.c	2003-11-24 11:52:09.000000000 -0800
+++ dovecot-0.99.10.6/src/pop3-login/client-authenticate.c	2004-07-08 18:21:32.000000000 -0700
@@ -141,7 +141,7 @@ static void login_callback(struct auth_r

 	case 0:
 		ptr = buffer_get_data(client->plain_login, &size);
-		auth_continue_request(request, ptr, size);
+		auth_continue_request(request, ptr, size, &client->common.ip);

 		buffer_set_used_size(client->plain_login, 0);
 		break;
@@ -259,7 +259,8 @@ static void client_auth_input(void *cont
 	} else {
 		auth_continue_request(client->common.auth_request,
 				      buffer_get_data(buf, NULL),
-				      buffer_get_used_size(buf));
+				      buffer_get_used_size(buf),
+				      &client->common.ip);
 	}

 	/* clear sensitive data */



More information about the dovecot mailing list