-- mod_net_dovecotauth.lua

--

-- Protocol spec:

-- http://dovecot.org/doc/auth-protocol.txt

--

-- Example postfix config:

-- sudo postconf smtpd_sasl_path=inet:127.0.0.1:28484

-- sudo postconf smtpd_sasl_type=dovecot

-- sudo postconf smtpd_sasl_auth_enable=yes

module:set_global();

-- Imports

local new_sasl = require "core.usermanager".get_sasl_handler;

local user_exists = require "core.usermanager".user_exists;

local base64 = require"util.encodings".base64;

local dump = require"util.serialization".serialize;

local pposix = require "util.pposix";

-- Config

local default_vhost = module:get_option_string("dovecotauth_host", (next(hosts))); -- TODO Is there a better solution?

local allow_master = module:get_option_boolean("dovecotauth_allow_master", false);

-- Active sessions

local sessions = {};

-- Session methods

local new_session;

do

local sess = { };

local sess_mt = { __index = sess };

function new_session(conn)

	local s = { type = "?", conn = conn, buf = "", sasl = {} }

	function s:log(l, m, ...)

		return module:log(l, self.type..tonumber(tostring(self):match("%x+$"), 16)..": "..m, ...);

	end

	return setmetatable(s, sess_mt);

end

function sess:send(...)

	local data = table.concat({...}, "\t") .. "\n"

	-- self:log("debug", "SEND: %s", dump(ret));

	return self.conn:write(data);

end

local mech_params = {

	ANONYMOUS = "anonymous";

	PLAIN = "plaintext";

	["DIGEST-MD5"] = "mutual-auth";

	["SCRAM-SHA-1"] = "mutual-auth";

	["SCRAM-SHA-1-PLUS"] = "mutual-auth";

}

function sess:handshake()

	self:send("VERSION", 1, 1);

	self:send("SPID", pposix.getpid());

	self:send("CUID", tonumber(tostring(self):match"%x+$", 16));

	for mech in pairs(self.g_sasl:mechanisms()) do

		self:send("MECH", mech, mech_params[mech]);

	end

	self:send("DONE");

end

function sess:feed(data)

	-- TODO break this up a bit

	-- module:log("debug", "sess = %s", dump(self));

	local buf = self.buf;

	buf = buf .. data;

	local line, eol = buf:match("(.-)\r?\n()")

	while line and line ~= "" do

		buf = buf:sub(eol);

		self.buf = buf;

		local part = line:gmatch("[^\t]+");

		local command = part();

		if command == "VERSION" then

			local major = tonumber(part());

			local minor = tonumber(part());

			if major ~= 1 then

				self:log("warn", "Wrong version, expected 1.1, got %s.%s", tostring(major), tostring(minor));

				self.conn:close();

				break;

			end

		elseif command == "CPID" then

			self.type = "C";

			self.pid = part();

		elseif command == "SPID" and allow_master then

			self.type = "M";

			self.pid = part();

		elseif command == "AUTH" and self.type ~= "?" then

			-- C: "AUTH" TAB <id> TAB <mechanism> TAB service=<service> [TAB <parameters>]

			local id = part() -- <id>

			local sasl = self.sasl[id];

			local mech = part();

			if not sasl then

				-- TODO Should maybe initialize SASL handler after parsing the line?

				sasl = self.g_sasl:clean_clone();

				self.sasl[id] = sasl;

				if not sasl:select(mech) then

					self:send("FAIL", id, "reason=invalid-mechanism");

					self.sasl[id] = nil;

					sasl = false

				end

			end

			if sasl then

				local params = {}; -- Not used for anything yet

				for p in part do

					local k,v = p:match("^([^=]*)=(.*)$");

					if k == "resp" then

						self:log("debug", "params = %s", dump(params));

						v = base64.decode(v);

						local status, ret, err = sasl:process(v);

						self:log("debug", status);

						if status == "challenge" then

							self:send("CONT", id, base64.encode(ret));

						elseif status == "failure" then

							self.sasl[id] = nil;

							self:send("FAIL", id, "reason="..tostring(err));

						elseif status == "success" then

							self.sasl[id] = nil;

							self:send("OK", id, "user="..sasl.username, ret and "resp="..base64.encode(ret));

						end

						break; -- resp MUST be the last param

					else

						params[k or p] = v or true;

					end

				end

			end

		elseif command == "USER" and self.type == "M" then

			-- FIXME Should this be on a separate listener?

			local id = part();

			local user = part();

			if user and user_exists(user, default_vhost) then

				self:send("USER", id);

			else

				self:send("NOTFOUND", id);

			end

		else

			self:log("warn", "Unhandled command %s", tostring(command));

			self.conn:close();

			break;

		end

		line, eol = buf:match("(.-)\r?\n()")

	end

end

end

local listener = {}

function listener.onconnect(conn)

	local s = new_session(conn);

	sessions[conn] = s;

	local g_sasl = new_sasl(default_vhost, s);

	s.g_sasl = g_sasl;

	s:handshake();

end

function listener.onincoming(conn, data)

	local s = sessions[conn];

	-- s:log("debug", "RECV %s", dump(data));

	return s:feed(data);

end

function listener.ondisconnect(conn)

	sessions[conn] = nil;

end

function module.unload()

	for c in pairs(sessions) do

		c:close();

	end

end

module:provides("net", {

	default_port = 28484;

	listener = listener;

});