Marco Giunta
2015-Sep-29 08:36 UTC
BUG: service(auth) crash when quota-status lookup an address with local-part starting with auth_master_user_separator
Hi,
I'm using dovecot 2.2.15 (configuration attached below), and I 've
enabled quota-status; when I try to look up the quota status of an
address with the local-part starting with the same character as
'auth_master_user_separator', dovecot/auth crash:
My 'auth_master_user_separator' is '*'
# telnet localhost 25001
Trying 127.0.0.1...
Connected to localhost.localdomain (127.0.0.1).
Escape character is '^]'.
request=smtpd_access_policy
sender=johndoe at example.com
recipient=*@example.com
size=100000000
action=DEFER_IF_PERMIT Internal error occurred. Refer to server log for
more information.
request=smtpd_access_policy
sender=johndoe at example.com
recipient=*janedoe at example.com
size=100000000
action=DEFER_IF_PERMIT Internal error occurred. Refer to server log for
more information.
request=smtpd_access_policy
sender=johndoe at example.com
recipient=;@example.com
size=100000000
action=DUNNO
request=smtpd_access_policy
sender=johndoe at example.com
recipient=;janedoe at example.com
size=100000000
and in server log:
Sep 29 08:51:05 my_server dovecot: master: Dovecot v2.2.15 starting up
for imap, pop3, lmtp, sieve (core dumps disabled)
Sep 29 08:51:05 my_server dovecot: master: Warning: /mnt is no longer
mounted. See http://wiki2.dovecot.org/Mountpoints
Sep 29 08:51:41 my_server dovecot: auth: Panic: file auth-request.c:
line 1252 (auth_request_set_login_username): assertion failed:
(*username != '\0')
Sep 29 08:51:41 my_server dovecot: auth: Error: Raw backtrace:
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a7126a] ->
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a712d6] ->
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a70cac] -> dovecot/auth
[0x4131eb] -> dovecot/auth(auth_request_set_username+0x94) [0x413284] ->
dovecot/auth [0x40dc4c] -> dovecot/auth [0x40e60b] ->
/usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x49) [0x3d70a82699]
-> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xd5)
[0x3d70a83a55] ->
/usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x9)
[0x3d70a82739] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38)
[0x3d70a829b8] ->
/usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13)
[0x3d70a29233] -> dovecot/auth(main+0x383) [0x41cfc3] ->
/lib64/libc.so.6(__libc_start_main+0xf4) [0x3302e1d9f4] -> dovecot/auth
[0x40b5f9]
Sep 29 08:51:41 my_server dovecot: quota-status: Error: userdb
lookup(*@example.com): Disconnected unexpectedly
Sep 29 08:51:41 my_server dovecot: auth: Fatal: master: service(auth):
child 2147 killed with signal 6 (core dumps disabled)
Sep 29 10:02:02 my_server dovecot: auth: Fatal: master: service(auth):
child 12592 killed with signal 6 (core dumps disabled)
Sep 29 10:03:52 my_server dovecot: auth: Panic: file auth-request.c:
line 1252 (auth_request_set_login_username): assertion failed:
(*username != '\0')
Sep 29 10:03:52 my_server dovecot: auth: Error: Raw backtrace:
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a7126a] ->
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a712d6] ->
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a70cac] -> dovecot/auth
[0x4131eb] -> dovecot/auth(auth_request_set_username+0x94) [0x413284] ->
dovecot/auth [0x40dc4c] -> dovecot/auth [0x40e60b] ->
/usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x49) [0x3d70a82699]
-> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xd5)
[0x3d70a83a55] ->
/usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x9)
[0x3d70a82739] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38)
[0x3d70a829b8] ->
/usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13)
[0x3d70a29233] -> dovecot/auth(main+0x383) [0x41cfc3] ->
/lib64/libc.so.6(__libc_start_main+0xf4) [0x3302e1d9f4] -> dovecot/auth
[0x40b5f9]
Sep 29 10:03:52 my_server dovecot: quota-status: Error: userdb
lookup(*janedoe at example.com): Disconnected unexpectedly
Sep 29 10:03:52 my_server dovecot: auth: Fatal: master: service(auth):
child 9945 killed with signal 6 (core dumps disabled)
Sep 29 10:16:10 my_server dovecot: auth: userdb(?): Username character
disallowed by auth_username_chars: 0x3b (username: ;@example.com)
Sep 29 10:16:43 my_server dovecot: auth: userdb(?): Username character
disallowed by auth_username_chars: 0x3b (username: ;janedoe at example.com)
If I change my 'auth_master_user_separator' to an other character, for
example ';' :
# telnet localhost 25001
Trying 127.0.0.1...
Connected to localhost.localdomain (127.0.0.1).
Escape character is '^]'.
request=smtpd_access_policy
sender=johndoe at example.com
recipient=*@example.com
size=100000000
action=DUNNO
request=smtpd_access_policy
sender=johndoe at example.com
recipient=*janedoe at example.com
size=100000000
action=DUNNO
request=smtpd_access_policy
sender=johndoe at example.com
recipient=;@example.com
size=100000000
action=DEFER_IF_PERMIT Internal error occurred. Refer to server log for
more information.
request=smtpd_access_policy
sender=johndoe at example.com
recipient=;janedoe at example.com
size=100000000
action=DEFER_IF_PERMIT Internal error occurred. Refer to server log for
more information.
and server log:
Sep 29 10:20:00 my_server dovecot: auth: userdb(?): Username character
disallowed by auth_username_chars: 0x2a (username: *@example.com)
Sep 29 10:20:31 my_server dovecot: auth: userdb(?): Username character
disallowed by auth_username_chars: 0x2a (username: *janedoe at example.com)
Sep 29 10:20:54 my_server dovecot: auth: Panic: file auth-request.c:
line 1252 (auth_request_set_login_username): assertion failed:
(*username != '\0')
Sep 29 10:20:54 my_server dovecot: auth: Error: Raw backtrace:
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a7126a] ->
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a712d6] ->
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a70cac] -> dovecot/auth
[0x4131eb] -> dovecot/auth(auth_request_set_username+0x94) [0x413284] ->
dovecot/auth [0x40dc4c] -> dovecot/auth [0x40e60b] ->
/usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x49) [0x3d70a82699]
-> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xd5)
[0x3d70a83a55] ->
/usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x9)
[0x3d70a82739] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38)
[0x3d70a829b8] ->
/usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13)
[0x3d70a29233] -> dovecot/auth(main+0x383) [0x41cfc3] ->
/lib64/libc.so.6(__libc_start_main+0xf4) [0x3302e1d9f4] -> dovecot/auth
[0x40b5f9]
Sep 29 10:20:54 my_server dovecot: quota-status: Error: userdb
lookup(;@example.com): Disconnected unexpectedly
Sep 29 10:20:54 my_server dovecot: auth: Fatal: master: service(auth):
child 19941 killed with signal 6 (core dumps disabled)
Sep 29 10:21:15 my_server dovecot: auth: Panic: file auth-request.c:
line 1252 (auth_request_set_login_username): assertion failed:
(*username != '\0')
Sep 29 10:21:15 my_server dovecot: auth: Error: Raw backtrace:
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a7126a] ->
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a712d6] ->
/usr/lib64/dovecot/libdovecot.so.0 [0x3d70a70cac] -> dovecot/auth
[0x4131eb] -> dovecot/auth(auth_request_set_username+0x94) [0x413284] ->
dovecot/auth [0x40dc4c] -> dovecot/auth [0x40e60b] ->
/usr/lib64/dovecot/libdovecot.so.0(io_loop_call_io+0x49) [0x3d70a82699]
-> /usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run_internal+0xd5)
[0x3d70a83a55] ->
/usr/lib64/dovecot/libdovecot.so.0(io_loop_handler_run+0x9)
[0x3d70a82739] -> /usr/lib64/dovecot/libdovecot.so.0(io_loop_run+0x38)
[0x3d70a829b8] ->
/usr/lib64/dovecot/libdovecot.so.0(master_service_run+0x13)
[0x3d70a29233] -> dovecot/auth(main+0x383) [0x41cfc3] ->
/lib64/libc.so.6(__libc_start_main+0xf4) [0x3302e1d9f4] -> dovecot/auth
[0x40b5f9]
Sep 29 10:21:15 my_server dovecot: quota-status: Error: userdb
lookup(;janedoe at example.com): Disconnected unexpectedly
Sep 29 10:21:15 my_server dovecot: auth: Fatal: master: service(auth):
child 20758 killed with signal 6 (core dumps disabled)
of course, I don't have any address '*@example.com' or
'*janedoe at example.com', but some bot in internet try to send emails
to
these addresses, and my Postfix ask my dovecot server for the quota of
'*' or '*janedoe' user.
I've solved the problem adding a REJECT rule to Postfix to discard the
mail to '*@example.com' before the quota check, but this problem should
be solved in Dovecot.
thank you,
Marco
My configuration:
# 2.2.15: /etc/dovecot/dovecot.conf
# Pigeonhole version 0.4.6 (3e924b1b6c5c+)
# OS: Linux 2.6.18-406.el5 x86_64 Red Hat Enterprise Linux Server
release 5.11 (Tikanga) ext3
auth_master_user_separator = *
auth_mechanisms = plain login
auth_verbose = yes
auth_verbose_passwords = sha1
disable_plaintext_auth = no
doveadm_password = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
doveadm_port = 12345
first_valid_uid = 200
hostname = myserver.example.com
imap_client_workarounds = delay-newmail
lda_mailbox_autocreate = yes
lda_mailbox_autosubscribe = yes
lda_original_recipient_header = X-Original-To
listen = *
login_log_format_elements = user=<%u> PID=%p method=%m rip=%r lip=%l %c
login_trusted_networks = XXX.XXX.XXX.XXX
mail_gid = mail
mail_home = /var/spool/mail/%1n/%n
mail_location =
maildir:/var/spool/mail/%1n/%n:INDEX=/var/shared/indexes/%1n/%n
mail_plugins = acl mailbox_alias quota
mail_shared_explicit_inbox = yes
mail_uid = vmail
maildir_very_dirty_syncs = yes
managesieve_notify_capability = mailto
managesieve_sieve_capability = fileinto reject envelope
encoded-character vacation subaddress comparator-i;ascii-numeric
relational regex imap4flags copy include variables body enotify
environment mailbox date ihave duplicate vacation-seconds imapflags notify
mbox_write_locks = fcntl
mmap_disable = yes
namespace archives {
hidden = no
inbox = no
list = children
location =
maildir:/var/spool/archives/%1n/%n:INDEX=/var/shared/indexes/%1n/%n/archives
mailbox 2015 {
auto = subscribe
special_use = \Archive
}
prefix = Archives.
separator = .
subscriptions = no
type = private
}
namespace inbox {
inbox = yes
location mailbox Drafts {
auto = subscribe
special_use = \Drafts
}
mailbox Junk {
auto = subscribe
special_use = \Junk
}
mailbox Sent {
auto = subscribe
special_use = \Sent
}
mailbox Trash {
auto = subscribe
special_use = \Trash
}
prefix separator = .
}
namespace others {
list = children
location =
maildir:/var/spool/mail/%%1n/%%n:INDEXPVT=/var/shared/indexes/%1n/%n/shared/%%n
prefix = Other Users.%%n.
separator = .
subscriptions = no
type = shared
}
namespace others_archives {
list = children
location =
maildir:/var/spool/archives/%%1n/%%n:INDEXPVT=/var/shared/indexes/%1n/%n/shared/%%n/archives
prefix = Other Users Archives.%%n.
separator = .
subscriptions = no
type = shared
}
passdb {
args = /etc/dovecot/passwd.masterusers
driver = passwd-file
master = yes
pass = yes
}
passdb {
args = /etc/dovecot/dovecot-ldap.conf.ext
driver = ldap
}
plugin {
acl = vfile:/etc/dovecot/global-acls:cache_secs=300
acl_shared_dict = file:/var/shared/dovecot/shared-mailboxes.dict
fts = solr
fts_autoindex = yes
fts_autoindex_max_recent_msgs = 20
fts_solr = url=http://solr.localdomain:8080/solr/
mailbox_alias_new = INBOX_spam
mailbox_alias_old = Junk
quota = maildir:User quota:ns quota2 = maildir:Archive quota:ns=Archives.
quota2_rule = *:storage=20GB
quota2_warning = storage=95%% quota2-warning 95 %u
quota2_warning2 = storage=90%% quota2-warning 90 %u
quota2_warning3 = storage=80%% quota2-warning 80 %u
quota_rule = *:storage=5GB
quota_rule2 = Trash:storage=+20%%
quota_status_nouser = DUNNO
quota_status_overquota = 552 5.2.2 Quota exceeded (mailbox for user
is full)
quota_status_success = DUNNO
quota_warning = storage=100%% quota-warning 100 %u
quota_warning2 = storage=95%% quota-warning 95 %u
quota_warning3 = storage=90%% quota-warning 90 %u
quota_warning4 = storage=80%% quota-warning 80 %u
sieve = file:~/sieve;active=~/sieve/.dovecot.sieve
sieve_default = /etc/dovecot/sieve/dovecot.sieve
sieve_extensions = +notify +imapflags +vacation-seconds
sieve_max_redirects = 16
sieve_vacation_min_period = 0s
}
pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
postmaster_address = postmaster at example.com
protocols = imap pop3 lmtp sieve
rejection_reason = Your message to <%t> was automatically rejected for
the following reason - il tuo messaggio a <%t> ? stato rifiutato per il
seguente motivo:%n%n%r
rejection_subject = Rejected - Messaggio rifiutato: %s
service auth {
inet_listener {
port = 49494
}
unix_listener auth-userdb {
user = vmail
}
}
service dict {
unix_listener dict {
user = vmail
}
}
service doveadm {
inet_listener {
port = 26001
}
}
service imap-login {
process_min_avail = 16
service_count = 0
}
service imap {
process_limit = 2048
}
service lmtp {
inet_listener lmtp {
port = 24
}
process_min_avail = 5
}
service managesieve-login {
inet_listener sieve {
port = 4190
}
inet_listener sieve_deprecated {
port = 2000
}
process_min_avail = 16
service_count = 0
vsz_limit = 256 M
}
service quota-status {
client_limit = 1
executable = /usr/libexec/dovecot/quota-status -p postfix
inet_listener {
port = 25001
}
}
service quota-warning {
executable = script /usr/local/bin/dovecot-quota-warning.sh
unix_listener quota-warning {
user = vmail
}
user = vmail
}
service quota2-warning {
executable = script /usr/local/bin/dovecot-quota2-warning.sh
unix_listener quota2-warning {
user = vmail
}
user = vmail
}
ssl_cert = </etc/pki/dovecot/certs/myserver-crt.pem
ssl_key = </etc/pki/dovecot/private/myserver-key.pem
ssl_protocols = !SSLv2 !SSLv3
submission_host = smtp.example.com:25
syslog_facility = local2
userdb {
driver = prefetch
}
userdb {
args = /etc/dovecot/dovecot-ldap.conf.ext
driver = ldap
}
protocol lmtp {
mail_plugins = acl mailbox_alias quota sieve
postmaster_address = postmaster at example.com
}
protocol lda {
info_log_path log_path mail_plugins = acl mailbox_alias quota sieve
syslog_facility = local2
}
protocol imap {
mail_max_userip_connections = 50
mail_plugins = acl mailbox_alias quota imap_quota imap_acl
}
protocol sieve {
mail_max_userip_connections = 50
}
protocol pop3 {
mail_max_userip_connections = 50
}
--
-----------------------------------
|Marco Giunta - SISSA Computer Staff|
|Via Bonomea, 265 |
|34136 - Trieste, Italy |
|Tel: +39-40-3787-503 |
|Fax: +39-040-3787-244 |
|e-mail: giunta at sissa.it |
-----------------------------------
Timo Sirainen
2015-Sep-29 09:06 UTC
BUG: service(auth) crash when quota-status lookup an address with local-part starting with auth_master_user_separator
On 29 Sep 2015, at 11:36, Marco Giunta <giunta at sissa.it> wrote:> > Hi, > I'm using dovecot 2.2.15 (configuration attached below), and I 've enabled quota-status; when I try to look up the quota status of an address with the local-part starting with the same character as 'auth_master_user_separator', dovecot/auth crash: > > My 'auth_master_user_separator' is '*' > > Sep 29 08:51:41 my_server dovecot: auth: Panic: file auth-request.c: line 1252 (auth_request_set_login_username): assertion failed: (*username != '\0')v2.2.17 fixes this crash, but a better fix would be to disale the separator for these lookups. I think something like this would work: auth_master_user_separator = * protocol quota-status { # disable auth_master_user_separator = } or alternatively enable master user separator only for imap: auth_master_user_separator = protocol imap { auth_master_user_separator = * }
Marco Giunta
2015-Sep-29 09:41 UTC
BUG: service(auth) crash when quota-status lookup an address with local-part starting with auth_master_user_separator
On 2015-09-29 11:06, Timo Sirainen wrote:> On 29 Sep 2015, at 11:36, Marco Giunta <giunta at sissa.it> wrote:>> but a better fix would be to disale the separator for these lookups. I think something like this would work: > > auth_master_user_separator = * > protocol quota-status { > # disable > auth_master_user_separator > } >Thank you Timo, this works like a charms on 2.2.16; I'm waiting 2.2.19 to update my servers. Marco -- ----------------------------------- |Marco Giunta - SISSA Computer Staff| |Via Bonomea, 265 | |34136 - Trieste, Italy | |Tel: +39-40-3787-503 | |Fax: +39-040-3787-244 | |e-mail: giunta at sissa.it | -----------------------------------
Apparently Analagous Threads
- BUG: service(auth) crash when quota-status lookup an address with local-part starting with auth_master_user_separator
- bug in acl_defaults_from_inbox option
- sharing INBOX with ACL -> share all folders
- sharing INBOX with ACL -> share all folders
- sharing INBOX with ACL -> share all folders