$Id: drac_auth.patch,v 1.15 2002/08/14 20:50:59 ken3 Exp $

Patch to add support for Dynamic Relay Authorization Control

For more information about DRAC, see:
	http://mail.cc.umanitoba.ca/drac/index.html


Installation
------------

1.  Apply this patch in the toplevel directory using the following command:

	# patch -b -p0 < contrib/drac_auth.patch

2.  Cleanup any previous builds:

	# make distclean

3a. If you DO NOT have 'smake' and 'autoconf' installed on your system, goto
    step 3b.

    Perform the following to reconfigure your build:

	# rm aclocal.m4 configure config.h.in
	# sh SMakefile
	# ./configure ... --with-drac=<location of libdrac>

    NOTE: you can find your original configure command in config.status

    Proceed to step 4.

3b. Edit imap/Makefile and modify the following three variables:

	DEFS = ... -DDRAC_AUTH
	LIBS = ... -ldrac
	LDFLAGS = ... -L<location of libdrac>

4.  Build and install the software:

	# make
	# make install

5.  If dracd is not running on the same system as Cyrus (localhost),
    use the 'drachost' option in imapd.conf(5) to specify the hostname of
    the dracd server.

6.  Installation is complete!


Operation
---------

The behavior of DRAC is controlled by the value of the 'dracinterval' option
in imapd.conf(5).  If 'dracinterval' is 0 (zero), DRAC support is disabled.
Otherwise, DRAC support is enabled and has the following behavior:

pop3d: Whenever a client opens a user's INBOX, drac_auth() is called.

imapd: Once a client is logged in (via LOGIN or AUTHENTICATE),
       drac_send() will be called once every 'dracinterval' minutes.





Index: acconfig.h
===================================================================
RCS file: /afs/andrew/system/cvs/src/cyrus/acconfig.h,v
retrieving revision 1.36
diff -u -r1.36 acconfig.h
--- acconfig.h	2002/08/13 00:11:28	1.36
+++ acconfig.h	2002/08/14 20:37:45
@@ -101,6 +101,9 @@
 /* do we have SASL support for APOP? */
 #undef HAVE_APOP
 
+/* the Dynamic Relay Authorization Control package */
+#undef DRAC_AUTH
+
 /* do we have OpenSSL? */
 #undef HAVE_SSL
 
Index: configure.in
===================================================================
RCS file: /afs/andrew/system/cvs/src/cyrus/configure.in,v
retrieving revision 1.237
diff -u -r1.237 configure.in
--- configure.in	2002/07/22 16:16:02	1.237
+++ configure.in	2002/08/14 20:37:45
@@ -879,6 +879,19 @@
 SNMP_SUBDIRS=""
 AC_SUBST(SNMP_SUBDIRS)
 
+dnl
+dnl Test for DRAC
+dnl
+DRACLIBS=
+AC_ARG_WITH(drac, [  --with-drac=DIR         use DRAC library in <DIR> [no] ],
+	if test -d "$withval"; then
+		LDFLAGS="$LDFLAGS -L${withval}"
+		AC_CHECK_LIB(drac, dracauth,
+			AC_DEFINE(DRAC_AUTH)
+			DRACLIBS="-ldrac")
+	fi)
+AC_SUBST(DRACLIBS)
+
 CMU_SOCKETS
 CMU_LIBWRAP
 CMU_UCDSNMP
Index: imap/Makefile.in
===================================================================
RCS file: /afs/andrew/system/cvs/src/cyrus/imap/Makefile.in,v
retrieving revision 1.165
diff -u -r1.165 Makefile.in
--- imap/Makefile.in	2002/07/25 21:07:05	1.165
+++ imap/Makefile.in	2002/08/14 20:37:48
@@ -67,6 +67,7 @@
 SIEVE_LIBS = @SIEVE_LIBS@
 IMAP_COM_ERR_LIBS = @IMAP_COM_ERR_LIBS@
 LIB_WRAP = @LIB_WRAP@
+DRAC_LIBS = @DRACLIBS@
 LIBS = $(IMAP_LIBS) $(IMAP_COM_ERR_LIBS)
 DEPLIBS = ../acap/libacap.a ../lib/libcyrus.a @DEPLIBS@
 
@@ -213,15 +214,18 @@
 
 imapd: xversion $(IMAPDOBJS) libimap.a $(DEPLIBS) $(SERVICE)
 	$(CC) $(LDFLAGS) -o imapd \
-	 $(SERVICE) $(IMAPDOBJS) libimap.a $(DEPLIBS) $(LIBS) $(LIB_WRAP)
+	 $(SERVICE) $(IMAPDOBJS) libimap.a $(DEPLIBS) $(LIBS) $(LIB_WRAP) \
+	 $(DRAC_LIBS)
 
 imapd.pure: $(IMAPDOBJS) libimap.a $(DEPLIBS) $(SERVICE)
 	$(PURIFY) $(PUREOPT) $(CC) $(LDFLAGS) -o imapd.pure \
-	 $(SERVICE) $(IMAPDOBJS) libimap.a $(DEPLIBS) $(LIBS) $(LIB_WRAP)
+	 $(SERVICE) $(IMAPDOBJS) libimap.a $(DEPLIBS) $(LIBS) $(LIB_WRAP) \
+	 $(DRAC_LIBS)
 
 imapd.quant: $(IMAPDOBJS) libimap.a $(DEPLIBS) $(SERVICE)
 	$(QUANTIFY) $(QUANTOPT) $(CC) $(LDFLAGS) -o imapd.quant \
-	 $(SERVICE) $(IMAPDOBJS) libimap.a $(DEPLIBS) $(LIBS) $(LIB_WRAP)
+	 $(SERVICE) $(IMAPDOBJS) libimap.a $(DEPLIBS) $(LIBS) $(LIB_WRAP) \
+	 $(DRAC_LIBS)
 
 proxyd: $(PROXYDOBJS) libimap.a $(DEPLIBS) $(SERVICE)
 	$(CC) $(LDFLAGS) -o proxyd \
@@ -253,7 +257,7 @@
 
 pop3d: pop3d.o tls.o libimap.a $(DEPLIBS) $(SERVICE)
 	$(CC) $(LDFLAGS) -o pop3d pop3d.o tls.o $(SERVICE) \
-	 libimap.a $(DEPLIBS) $(LIBS) $(LIB_WRAP)
+	 libimap.a $(DEPLIBS) $(LIBS) $(LIB_WRAP) $(DRAC_LIBS)
 
 pop3proxyd: pop3proxyd.o tls.o libimap.a $(DEPLIBS) $(SERVICE)
 	$(CC) $(LDFLAGS) -o pop3proxyd pop3proxyd.o tls.o $(SERVICE) \
Index: imap/imapd.c
===================================================================
RCS file: /afs/andrew/system/cvs/src/cyrus/imap/imapd.c,v
retrieving revision 1.404
diff -u -r1.404 imapd.c
--- imap/imapd.c	2002/08/12 23:53:38	1.404
+++ imap/imapd.c	2002/08/14 20:37:48
@@ -120,6 +120,18 @@
 static SSL *tls_conn = NULL;
 #endif /* HAVE_SSL */
 
+#ifdef DRAC_AUTH
+static struct {
+    int interval;		/* dracd "ping" interval; 0 = disabled */
+    unsigned long clientaddr;
+    struct prot_waitevent *event;
+} drac;
+
+extern int dracconn(char *server, char **errmsg);
+extern int dracsend(unsigned long userip, char **errmsg);
+extern int dracdisc(char **errmsg);
+#endif /* DRAC_AUTH */
+
 /* current sub-user state */
 static struct mailbox mboxstruct;
 static struct mailbox *imapd_mailbox;
@@ -543,6 +555,23 @@
     /* setup for sending IMAP IDLE notifications */
     idle_enabled();
 
+#ifdef DRAC_AUTH
+    /* setup for sending DRAC "pings" */
+    drac.event = NULL;
+    drac.interval = config_getint("dracinterval", 5);
+    if (drac.interval < 0) drac.interval = 0;
+    if (drac.interval) {
+	char *err;
+
+	if (dracconn((char*) config_getstring("drachost", "localhost"), &err) != 0) {
+	    /* disable DRAC */
+	    drac.interval = 0;
+	    syslog(LOG_ERR, "dracconn: %s", err);
+	    syslog(LOG_ERR, "DRAC notifications disabled");
+	}
+    }
+#endif /* DRAC_AUTH */
+
     /* create connection to the SNMP listener, if available. */
     snmp_connect(); /* ignore return code */
     snmp_set_str(SERVER_NAME_VERSION,CYRUS_VERSION);
@@ -627,6 +656,12 @@
 		  imapd_haveaddr = 1;
 	      }
 	}
+
+#ifdef DRAC_AUTH
+	drac.clientaddr = imapd_remoteaddr.sin_addr.s_addr;
+    } else {
+	drac.clientaddr = 0;
+#endif /* DRAC_AUTH */
     }
 
     /* create the SASL connection */
@@ -669,6 +704,11 @@
     prot_flush(imapd_out);
     snmp_increment(ACTIVE_CONNECTIONS, -1);
 
+#ifdef DRAC_AUTH
+    if (drac.event) prot_removewaitevent(imapd_in, drac.event);
+    drac.event = NULL;
+#endif /* DRAC_AUTH */
+
     /* cleanup */
     imapd_reset();
 
@@ -759,6 +799,10 @@
     tls_shutdown_serverengine();
 #endif
 
+#ifdef DRAC_AUTH
+    if (drac.interval) (void) dracdisc((char **)NULL);
+#endif /* DRAC_AUTH */
+
     exit(code);
 }
 
@@ -781,7 +825,36 @@
 
 }
 
+#ifdef DRAC_AUTH
 /*
+ * Ping dracd every 'drac.interval' minutes
+ * to let it know that we are still connected
+ */
+struct prot_waitevent *drac_ping(struct protstream *s,
+				 struct prot_waitevent *ev, void *rock)
+{
+    char *err;
+    static int nfailure = 0;
+
+    if (dracsend(drac.clientaddr, &err) != 0) {
+	syslog(LOG_ERR, "dracsend: %s", err);
+	if (++nfailure >= 3) {
+	    /* can't contact dracd for 3 consecutive tries - disable DRAC */
+	    prot_removewaitevent(s, ev);
+	    drac.event = NULL;
+	    syslog(LOG_ERR, "DRAC notifications disabled");
+	    return NULL;
+	}
+    }
+    else
+	nfailure = 0;
+
+    ev->mark = time(NULL) + (drac.interval * 60);
+    return ev;
+}
+#endif /* DRAC_AUTH */
+
+/*
  * Top-level command loop parsing
  */
 void cmdloop()
@@ -1802,6 +1875,11 @@
 
     prot_printf(imapd_out, "%s OK %s\r\n", tag, reply);
 
+#ifdef DRAC_AUTH
+    if (drac.interval && drac.clientaddr)
+	drac.event = prot_addwaitevent(imapd_in, 0 /* now */, drac_ping, NULL);
+#endif /* DRAC_AUTH */
+
     /* Create telemetry log */
     imapd_logfd = telemetry_log(imapd_userid, imapd_in, imapd_out);
 
@@ -1942,6 +2020,11 @@
 
     prot_setsasl(imapd_in,  imapd_saslconn);
     prot_setsasl(imapd_out, imapd_saslconn);
+
+#ifdef DRAC_AUTH
+    if (drac.interval && drac.clientaddr)
+	drac.event = prot_addwaitevent(imapd_in, 0 /* now */, drac_ping, NULL);
+#endif /* DRAC_AUTH */
 
     /* Create telemetry log */
     imapd_logfd = telemetry_log(imapd_userid, imapd_in, imapd_out);
Index: imap/pop3d.c
===================================================================
RCS file: /afs/andrew/system/cvs/src/cyrus/imap/pop3d.c,v
retrieving revision 1.124
diff -u -r1.124 pop3d.c
--- imap/pop3d.c	2002/07/24 19:30:37	1.124
+++ imap/pop3d.c	2002/08/14 20:37:48
@@ -101,6 +101,10 @@
 
 extern int errno;
 
+#ifdef DRAC_AUTH
+static int drac_enabled;
+extern int dracauth(char *server, unsigned long userip, char **errmsg);
+#endif /* DRAC_AUTH */
 
 
 #ifdef HAVE_SSL
@@ -440,6 +444,10 @@
     prot_settimeout(popd_in, timeout*60);
     prot_setflushonread(popd_in, popd_out);
 
+#ifdef DRAC_AUTH
+    drac_enabled = (config_getint("dracinterval", 5) > 0);
+#endif /* DRAC_AUTH */
+
     if (kflag) kpop();
 
     /* we were connected on pop3s port so we should do 
@@ -1429,6 +1437,20 @@
     }
     popd_mailbox = &mboxstruct;
     proc_register("pop3d", popd_clienthost, popd_userid, popd_mailbox->name);
+
+#ifdef DRAC_AUTH
+    if (drac_enabled) {
+	char *err;
+
+	if (dracauth((char*) config_getstring("drachost", "localhost"),
+		     popd_remoteaddr.sin_addr.s_addr, &err) != 0) {
+	    /* disable DRAC */
+	    drac_enabled = 0;
+	    syslog(LOG_ERR, "dracauth: %s", err);
+	    syslog(LOG_ERR, "DRAC notifications disabled");
+	}
+    }
+#endif /* DRAC_AUTH */
 
     /* Create telemetry log */
     telemetry_log(popd_userid, popd_in, popd_out);
Index: imap/version.c
===================================================================
RCS file: /afs/andrew/system/cvs/src/cyrus/imap/version.c,v
retrieving revision 1.9
diff -u -r1.9 version.c
--- imap/version.c	2002/07/09 18:50:24	1.9
+++ imap/version.c	2002/08/14 20:37:48
@@ -132,6 +132,10 @@
     snprintf(env_buf + strlen(env_buf), MAXIDVALUELEN - strlen(env_buf),
 	     "; %s", SIEVE_VERSION);
 #endif
+#ifdef DRAC_AUTH
+    snprintf(env_buf + strlen(env_buf), MAXIDVALUELEN - strlen(env_buf),
+	     "; DRAC");
+#endif
 #ifdef HAVE_LIBWRAP
     snprintf(env_buf + strlen(env_buf), MAXIDVALUELEN - strlen(env_buf),
 	     "; TCP Wrappers");
Index: man/imapd.conf.5
===================================================================
RCS file: /afs/andrew/system/cvs/src/cyrus/man/imapd.conf.5,v
retrieving revision 1.65
diff -u -r1.65 imapd.conf.5
--- man/imapd.conf.5	2002/06/12 17:38:58	1.65
+++ man/imapd.conf.5	2002/08/14 20:37:49
@@ -355,8 +355,14 @@
 The SASL password (if needed) to use when authenticating to the mupdate server.
 .IP "\fBmupdate_retry_delay:\fR 20" 5
 The time to wait between connection retries to the mupdate server.
+.IP "\fBdracinterval:\fR 5" 5
+If nonzero, enables the use of DRAC (Dynamic Relay Authorization Control)
+by the pop3d and imapd daemons.  Also sets the interval (in minutes) between 
+re-authorization requests made by imapd.
+.IP "\fBdrachost:\fR localhost" 5
+Hostname of the RPC dracd server.
 .SH SEE ALSO
 .PP
 \fBimapd(8)\fR, \fBpop3d(8)\fR, \fBlmtpd(8)\fR, \fBtimsieved(8)\fR,
 \fBidled(8)\fR, \fBnotifyd(8)\fR, \fBdeliver(8)\fR, \fBmaster(8)\fR, 
-\fBciphers(1)\fR
+\fBrpc.dracd(1m)\fR, \fBciphers(1)\fR